Over the past weeks, we collected your questions about Annex 11 and the upcoming 2026 revision. Many of you asked about similar challenges, so we grouped the most common themes and brought them to our experts for detailed, practical answers. Read them below.
What are the major changes expected in the 2026 revision of Annex 11?
The upcoming Annex 11 revision is expected to modernize the regulation to reflect today’s digital landscape, particularly around cloud-based systems, cybersecurity, and data integrity. Manufacturers should anticipate stricter expectations for managing electronic records across their entire lifecycle.
The revision is also expected to clarify responsibilities for cloud service providers, making it necessary for manufacturers to demonstrate strong oversight of their SaaS, PaaS, and IaaS vendors. Another significant area of evolution involves artificial intelligence and machine-learning systems, which will need structured validation, well-governed training data, and continuous performance monitoring. Additionally, the new Annex 11 is reinforcing a risk-based, quality-driven (QRM – Quality risk management) approach to computerized system compliance.
Why is Annex 11 relevant for device and software manufacturers who are not GMP companies?
Annex 11 applies to your customers, not you, but it governs how your customers must validate and operate your software. That means your software must behave in a predictable, transparent, and secure way, and you must be able to describe its functionality in a structured manner. GMP users cannot validate “black box” software; therefore, your product must offer documentation, testability, configuration control, auditability, and explainable behavior.
The better your development practices are aligned with Annex 11 principles, the easier it is for regulated companies to adopt your product.
Source: Unsplash
How should we, as device manufacturers, structure our development process to be Annex 11 ready?
You do not need a GMP-compliant SDLC, but you do need a controlled and documented SDLC that shows traceability between requirements, design, implementation, and testing. Annex 11-ready software development is characterized by:
- Documented requirements (functional + non-functional)
- Documented architecture and data-flow diagrams
- Documented testing (unit, integration, regression, system)
- Version control with history
- Repeatable build & deployment process
- A predictable release management process
Customers use this to build their validation package. Without it, validation becomes extremely costly and slow for them.
How do we provide an Annex 11-ready solution?
An Annex 11–ready software product must behave in a predictable, transparent, and secure way so GMP customers can validate it. The most critical feature is a comprehensive, immutable audit trail that records who performed what action, when, and why, including old and new values. Audit trails must be tamper-evident, always enabled, and easily exportable for review.
The software also needs strong identity and access management with unique user accounts, role-based permissions, and clear separation between administrative and operational roles. Security controls such as password policies, session timeouts, and optional multifactor authentication must be available; however, some can be accomplished by SOPs.
To support data integrity, the system must prevent silent overwrites, retain metadata, timestamp events reliably, and ensure traceability of all data lifecycle actions. Configuration options must be visible, documented, and tracked so customers can demonstrate that the system behaves as validated. Any changes to configuration or critical settings must be logged or included in an audit history. The release and update process must be controlled and transparent, with detailed release notes and versioning so customers can assess validation impact.
Together, these features allow GMP companies to demonstrate control over the system and confidently use it in regulated environments.
Source: Unsplash
How will the revision affect the use of cloud-based or SaaS systems like LIMS, QMS, or ERP platforms?
The revised Annex 11 is expected to explicitly acknowledge cloud-based systems and impose clearer expectations around their qualification and ongoing control. Manufacturers will likely be required to demonstrate that their cloud service providers meet GMP-relevant criteria, including reliable infrastructure, secure environments, and documented change management practices.
Instead of relying solely on vendor claims, manufacturers must show active oversight, which may include supplier audits, assessments of third-party certifications, and evaluation of contractual safeguards. Even when using SaaS systems, the customer remains fully responsible for data integrity, availability, and security. This shift means organizations must integrate cloud governance into their quality management system and treat external software services with the same rigor as internal systems.
Will Annex 11 require more rigorous supplier and vendor oversight?
Yes. The new revision is expected to significantly strengthen expectations around supplier qualification, especially for cloud / SaaS providers.
Customers must ensure suppliers understand GMP obligations, meet data integrity requirements, and can provide adequate support during audits or regulatory inspections. This may involve formal audits, quality agreements, and continuous performance monitoring.
Regulators want customers that work under GMP to remain accountable for outsourced services, meaning they must be able to demonstrate that third-party systems are reliable, secure, and validated appropriately.
How do we handle AI/ML if we want to be Annex 22-ready as well?
GMP customers must validate your AI model, so you must provide:
- Model version
- Training data description
- Intended use
- Known limitations
- Model update mechanism
- Drift detection strategy
- Explainability description
- Confidence outputs if possible
Without transparency, AI-based software is typically rejected for GMP use.
We help you meet Annex 11 and 21 CFR Part 11 requirements.
Our experts guide you from gap assessment to full compliance using proven SDLC practices, helping you become audit-ready and trusted by pharma partners. Learn more about our expertise.
