EU GMP Annex 11 and computerised systems
Annex 11 is the part of EU GMP that deals with software. It sets requirements for validation, data integrity, access control and audit trail.
What does Annex 11 require of a monitoring system?
Annex 11 applies to all computerised systems used in GMP-regulated activities. A monitoring system is one of them, because it produces data used to release or reject product.
The main requirements are that the system is validated for its purpose, that data cannot be changed without leaving a trace, that access is controlled and tied to named users, and that there is an audit trail of changes and actions.
Annex 11 also sets requirements for the supplier. There must be an assessment of the supplier, and the responsibilities between supplier and customer must be described. That is what a supplier agreement and a data processing agreement cover.
We supply the system, the documentation, the supplier information and the validation. You define the risk assessment and the scope.
What Annex 11 requires
Validated for its purpose
The system must be documented to do what you use it for. The scope follows from your risk assessment.
Audit trail
Changes and actions must be traceable to a named user with a timestamp, and the log must not be editable.
Controlled access
Users must be named and have the rights their role requires. On-premises supports LDAP.
Data can be presented
Data must be readable and printable throughout the retention period, even if the system is replaced.
Backup and restore
There must be a described procedure for backup, and restoring must have been tested.
Supplier assessment
There must be an assessment of the supplier and a description of how responsibilities are divided.
Cloud or on-premises, and what it means for Annex 11
If OCEAView runs in the cloud, operation and updates lie with the supplier, and this must be stated in the supplier agreement. If it runs on-premises on your own servers with LDAP, you control version updates yourselves, so a qualification is not invalidated by an update you have not approved. Both can meet Annex 11, but they place different demands on your own documentation.
Frequently asked questions
Is the system Annex 11 compliant?
A system can support the requirements, but compliance is achieved through the implementation and validation, which we handle. OCEAView has audit trail, access control and reporting that support Annex 11.
Who carries out the validation?
We do, on our own or together with your QA. You define the scope, and we carry out the validation and deliver the documentation.
What is the difference between Annex 11 and 21 CFR Part 11?
Annex 11 is European and covers computerised systems broadly. 21 CFR Part 11 is American and focuses on electronic records and signatures. The requirements overlap but are not identical.
Do we need to assess you as a supplier?
Yes, that is part of Annex 11. We provide the information you need for the assessment.
What if we change system later?
Data must be readable throughout the retention period. That is why readings and reports can be exported as PDF and CSV.
De bruger os allerede
Kom hurtigt i kontakt med den rette specialist.
Vi hjælper med alt fra nye monitoreringsløsninger til kalibrering, validering og teknisk support.
Generelle henvendelser
Nye projekter
IT & teknik
Administration
Besøg os
Måløv Byvej 229
2760 Måløv
Ring til os
+45 72 22 02 05
Man-fre, 08-16
Fortæl os, hvad du har brug for.
Vil du se, hvordan det ser ud hos jer?
Book en gennemgang. Vi kommer forbi, ser på udstyr og lokaler og rådgiver om, hvor følerne skal sidde. Derefter får du et skræddersyet forslag. Uden forpligtelser.
Book en gennemgang