GMP
Dr. Rachel Benett
October 4, 2026
When the European Commission and the Pharmaceutical Inspection Co-operation Scheme (PIC/S) published a draft revision of Annex 11 of the EU Good Manufacturing Practice (GMP) guidelines in July 2025, they changed the question inspectors will ask about computerized systems. For more than a decade, the central question has been whether a system was validated before first use. The draft asks a broader one: whether the system, its data, its users, and its suppliers have remained in a state of control since go-live. That shift makes Computer System Validation (CSV) a core professional competency rather than a background task.
I have seen how quickly that question surfaces in practice. During one inspection I supported as a validation lead, an inspector asked a single question about an audit trail and, within the hour, opened a finding that placed an entire batch record in doubt. When a system that manages electronic records cannot be shown to perform reliably, the data it produces becomes questionable. Questionable data can lead to rejected submissions, failed inspections and, in the worst case, a direct risk to patient safety.
Both the FDA and the EMA expect manufacturers to demonstrate continuing control over the computerized systems that affect product quality and data integrity. In the United States, Title 21 of the Code of Federal Regulations (CFR) Part 11 sets the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and generally equivalent to paper records and handwritten signatures. In the European Union, the current Annex 11 states that the application should be validated and the IT infrastructure qualified. Inspectors therefore look for documented evidence that a system was validated for its intended use and, increasingly, that it has stayed under control after go-live. With the Annex 11 revision now being finalized after public consultation, those expectations are about to rise again.
The current version of Annex 11 came into operation on 30 June 2011. For more than fourteen years, it has served as the European reference for computerized systems in regulated manufacturing. Over the same period, the technology it governs has moved to cloud platforms, software as a service, and interconnected data systems. On 7 July 2025, the European Commission and PIC/S published a draft revision of Annex 11, together with a new Annex 22 on artificial intelligence and a revised Chapter 4 on documentation. The public consultation closed on 7 October 2025, and the final text is expected in late 2026 or 2027. Until then, the 2011 Annex 11 remains in force.
The draft expands a short guideline into a considerably more detailed document. Its emphasis moves from proving that a system was validated before first use to demonstrating continuing control over the system, its data, its users, its suppliers, and its security. Expanded expectations for audit trails, supplier and service management, identity and access management, and periodic review all reflect that change. Professionals who already work within a lifecycle model will recognize the draft as an extension of established good practice. In my experience, the teams that find a revision like this difficult are rarely short of procedures. More often, their periodic reviews have quietly become a formality. In practical terms, inspectors will increasingly ask not only whether a system was validated, but whether it has remained in a state of control since go-live.
If Annex 11 and 21 CFR Part 11 define what regulators expect, GAMP 5 (Good Automated Manufacturing Practice) is the framework most of the industry uses to meet those expectations. The International Society for Pharmaceutical Engineering (ISPE) published GAMP 5 Second Edition in July 2022, updating the first edition to reflect the growing role of service providers, iterative software development, and automated tools. Its central principle is proportionality. Validation effort and documentation should be scaled to the risk a system poses to product quality, data integrity, and patient safety, rather than applied to the same exhaustive standard everywhere. The guide classifies software by category and gives explicit weight to critical thinking by experienced subject-matter experts over checklist completion.
The same reasoning appears in the United States. In September 2025, the FDA issued final guidance on Computer Software Assurance (CSA) for production and quality system software, updated in February 2026. The guidance was written for medical device manufacturers, but its logic, which focuses assurance effort on the intended use of each function and the risk it carries, mirrors the approach GAMP 5 recommends for pharmaceutical systems. A practitioner who understands both can apply the same reasoning consistently across European and U.S. expectations. The organizations that struggle are usually those that still treat validation as a documentation exercise rather than a judgment about where control matters.
One of the most visible changes in the Annex 11 draft is the treatment of security as a GMP requirement rather than an IT concern. Alongside expanded audit trail expectations and stricter identity and access management, the draft addresses the security of computerized systems directly. The underlying view is that a system whose security cannot be demonstrated cannot be relied upon to protect GMP data. Data integrity sits at the center of that view. The ALCOA+ principles hold that data must be attributable, legible, contemporaneous, original, and accurate, as well as complete, consistent, enduring, and available. These principles hold up only when the system generating the data enforces them by design.
Validation is the mechanism that connects a security control or an audit trail configuration to documented, inspectable evidence. A well-run validation lifecycle produces the records an inspector asks for when a data integrity question arises. Weak validation is how a single unexplained gap in an audit trail can grow into a warning letter and a lengthy remediation program. For most organizations, the risk is rarely the technology itself. The risk is being unable to show, on the day of the inspection, that the technology has been under control throughout its use.
For professionals who want to build these skills methodically, the Computer System Validation training course from GxP Training covers the full CSV lifecycle and the GAMP 5 risk-based approach in a single, structured program. It was built by a team of Regulatory Affairs Experts with qualifications from Northeastern University, Boston, and it translates the requirements of 21 CFR Part 11 and EU Annex 11 into a practical validation workflow that professionals can apply immediately in a regulated environment.
Course Details
Detailed Curriculum Overview
The need for Computer System Validation training is rarely confined to one job title. Quality assurance professionals own the evidence that a system is fit for use, so they need to understand exactly what a defensible validation package contains. Validation engineers and specialists design and execute that work. They benefit from a shared vocabulary with the IT and systems teams who configure platforms, manage audit trails, and control identity and access. Process owners and system owners, whose roles Annex 11 defines explicitly, need to understand what they are accountable for before an inspector asks. Regulatory affairs personnel, who translate inspector expectations into what the organization must show, rely on the same lifecycle understanding to defend a submission. When these roles share the same lifecycle vocabulary, a validation package can be defended by whichever person the inspector chooses to question.
A single data integrity or computerized systems observation can trigger a remediation program that is costly in consultant time, system rework, and re-validation. That is before counting any delay to a product launch or the reputational effect of a published warning letter. Trained professionals also work more efficiently, because they scope validation effort to risk instead of over-documenting low-risk systems or under-documenting critical ones. As the Annex 11 revision raises baseline expectations in the European Union and the FDA continues to support risk-based assurance in the United States, a workforce that already thinks in these terms is prepared for both. Organizations that pair this discipline with related knowledge, such as Computer Software Assurance and 21 CFR Part 11, build a validation function that can answer an inspector’s questions at any point, not only in the weeks before a scheduled visit.
GxP Training builds its courses with subject-matter experts drawn from regulated industry, so the material behind its Computer System Validation training reflects how validation is actually inspected rather than how it reads on paper. Every course concludes with a certificate that is unique, verifiable through an online checker, and CPD/CEU accredited, which makes it straightforward to share on LinkedIn and to file as audit-ready evidence of competence. Clients keep self-paced access for twelve months, so a busy validation professional can fit the material around project deadlines rather than the other way around. For teams, manager progress tracking and HR-friendly tools make it simple to assign the course, monitor completion, and demonstrate to an auditor that training was delivered and understood. Content is refreshed monthly to keep pace with moving guidance such as the Annex 11 revision, and SCORM compatibility means the courses drop cleanly into an existing corporate learning management system.
The Annex 11 revision is close to final. The consultation has closed, the final text is expected in late 2026 or 2027, and its direction is already clear. Regulators in Europe and the United States expect computerized systems to be validated, secured, and kept under control for their entire working life. Professionals and teams who prepare now will meet the new expectations on familiar ground. That preparation starts with structured, lifecycle-based Computer System Validation training, completed well before the final text takes effect.
