During a Good Manufacturing Practice (GMP) inspection, Quality Control (QC) results are assessed together with the records behind them. Increasingly, those records are electronic, from chromatography data systems to Laboratory Information Management Systems (LIMS), and regulators expect their audit trails to be checked before results support batch release. As a result, data integrity in GMP laboratories is closely tied to how computerised systems are validated and controlled. EU GMP Annex 11 is the European reference on this topic, and it becomes especially relevant when testing is outsourced to a contract laboratory.
Data integrity obligations under EU GMP Annex 11: scope, computerised systems and validation requirements
EU GMP Annex 11, part of EudraLex Volume 4, applies to every computerised system used in GMP-regulated activities. The application must be validated and the IT infrastructure qualified. Risk management runs through the whole system lifecycle and covers patient safety, data integrity and product quality. The extent of validation and of data integrity controls must be justified by a documented risk assessment.
In practice, GMP computerised system validation under Annex 11 requires:
- User requirements that remain traceable throughout the lifecycle.
- An up-to-date inventory of systems and their GMP functions.
- Checks that data are not altered in value or meaning during migration.
- Periodic evaluation to confirm that each system remains in a validated state.
In routine operation, the annex adds accuracy checks for critical manual entries, secure storage with tested backups, access controls and electronic signatures.
The current version of Annex 11, in force since June 2011, remains applicable while a revision is being finalized. In July 2025, the European Commission published a substantially revised draft for consultation, prepared by the European Medicines Agency (EMA) GMDP Inspectors Working Group in cooperation with the Pharmaceutical Inspection Co-operation Scheme (PIC/S). The draft reinforces requirements for audit trails, electronic signatures and supplier oversight, and frames Annex 11 data integrity explicitly around ALCOA+ principles, described in the next section.
ALCOA+ in analytical laboratory practice: applying data integrity principles to routine GMP workflows
ALCOA is a data integrity standard acronym used across regulatory guidance to summarize the attributes that GMP data must meet. It stands for attributable, legible, contemporaneous, original, and accurate. ALCOA+ adds complete, consistent, enduring, and available; attributes later included to emphasize that data must remain reliable and accessible throughout their lifecycle.
ALCOA++ in pharma adds a tenth attribute, traceable: changes to data and metadata must remain traceable and must not obscure the original information. The term was formalized in EMA’s 2023 guideline for clinical trials. The draft revised EU GMP Chapter 4 now applies ALCOA++ to both paper and electronic records.
For laboratory data integrity, these principles translate into concrete controls:
- Attributable: every analyst uses an individual login, and the system records who entered, changed, or deleted data, with date and time.
- Contemporaneous: analysts cannot change date and time settings; practitioners recommend controlling these at the network level.
- Original: chromatographic records are dynamic. A printout does not preserve their full original format, so review should be based on the electronic data.
- Complete: metadata such as integration parameters, reprocessing details and aborted or incomplete injections are captured in the record.
- Enduring and available: backups are tested, and archived data remain readable throughout the retention period.
Applied consistently, ALCOA data integrity GMP controls make electronic records laboratory systems defensible during inspection.
Audit trail architecture in GMP contract laboratories: what QC managers should require from their CRO
The Food and Drug Administration (FDA) defines an audit trail as a secure, computer-generated, time-stamped record that allows the course of events around an electronic record to be reconstructed. The agency illustrates this with a high-performance liquid chromatography (HPLC) run, whose audit trail should include the user, the run date and time, the integration parameters, and any reprocessing with its justification.
Annex 11 asks for a risk-based audit trail of GMP-relevant changes and deletions, with the reason documented and the trail regularly reviewed. PIC/S adds that audit trails should be enabled and locked at all times. It also expects critical audit trails to be reviewed before batch release. An audit trail GMP laboratory assessment typically checks that:
- The audit trail cannot be deactivated or edited, and any change to its settings or to the system time is logged.
- Each entry captures who, what (including old and new values), when, and why.
- Reasons for change are specific enough to explain what was modified and why, which free-text fields usually capture better than predefined lists.
- Reviews follow a documented, risk-based procedure and are completed before results support a release decision.
- Electronic copies, including audit trail data, can be obtained in a readable form, and ideally searched and sorted.
The draft Annex 11 would raise this bar further. It calls for independent review by personnel not involved in the activity, and it states that flat, locked files are not acceptable as copies. For any audit trail pharmaceutical program, these provisions show where inspectors are heading.
Annex 11 versus 21 CFR Part 11: regulatory alignment for companies with global development programs
The Annex 11 vs 21 CFR Part 11 comparison starts with scope. Annex 11 applies to every computerised system used in GMP-regulated activities. 21 CFR Part 11, the US regulation on electronic records and signatures, applies when records required by other FDA regulations, known as predicate rules, are kept electronically or submitted to the FDA. For drug manufacturing, these include the current good manufacturing practice (cGMP) regulations in 21 CFR Part 211.
Since 2003, the FDA has applied Part 11 narrowly. For records still covered, it does not intend to enforce the specific requirements on validation, audit trails, record retention and record copying, but it continues to enforce access controls and electronic signature requirements. Predicate rules apply in full, so audit trails remain expected through cGMP: the FDA’s 2018 data integrity guidance clarifies that they should be reviewed as part of routine record review.
Annex 11 also covers the system lifecycle, including supplier oversight and periodic evaluation. Both frameworks treat electronic signatures as equivalent to handwritten ones, and Annex 11 requires them to be permanently linked to the record and to include the date and time of signing. For GMP electronic records supporting EU and US filings, a single set of controls that meets both frameworks avoids maintaining parallel systems.
Outsourcing and data integrity risk: vendor qualification, computerised system oversight and gap assessment
When testing is outsourced, the contract giver remains ultimately responsible for the integrity of the data it receives, as stated in the World Health Organization (WHO) guidance, and the draft Annex 11 also keeps the regulated user fully responsible for outsourced activities. PIC/S expects quality agreements to include data integrity provisions, and contract acceptors to notify any data integrity failure.
A practical gap assessment for outsourcing GMP data integrity should cover:
- Data governance: a data integrity policy and Standard Operating Procedure (SOPs) covering risk management, validation, change and deviation management, and access control. Reviewing these documents is the starting point for any data integrity SOP pharmaceutical evaluation.
- System oversight: the inventory and validation status of the systems that will generate your results.
- Source data verification: during audits, raw electronic data, metadata and audit trails, not only certificates of analysis. PIC/S recommends weighing the different data integrity risks of true copies and summary reports when qualifying contractors.
- Contract terms: prior approval of subcontracting, audit access, and data retention when the agreement ends.
For any data integrity CRO pharmaceutical relationship, these checks turn GMP data integrity requirements into evidence a sponsor can defend.
At AMSbiopharma, our GMP-certified laboratory, authorized by the Spanish Agency of Medicines and Medical Devices (AEMPS), generates analytical results within a quality system designed for inspection, from UPLC-MS/MS quality control testing to method validation and stability studies.
References
European Commission. EudraLex Volume 4: Annex 11: computerised systems. Draft for consultation [Internet]. Brussels: European Commission; 2025 Jul 7 [cited 2026 Oct 8]. Available from: https://health.ec.europa.eu/document/download/40231f18-e564-4043-94de-c031f813d38b_en
European Commission. EudraLex Volume 4: Chapter 4: documentation. Draft for consultation [Internet]. Brussels: European Commission; 2025 Jul 7 [cited 2026 Oct 8]. Available from: https://health.ec.europa.eu/document/download/fa336a6e-753b-46fc-b53b-9178bacd8878_en
European Commission. EudraLex Volume 4: EU guidelines for good manufacturing practice for medicinal products for human and veterinary use. Annex 11: computerised systems [Internet]. Brussels: European Commission; 2011 [cited 2026 Oct 8]. Available from: https://health.ec.europa.eu/system/files/2016-11/annex11_01-2011_en_0.pdf
Pharmaceutical Inspection Co-operation Scheme. Good practices for data management and integrity in regulated GMP/GDP environments. PI 041-1 [Internet]. Geneva: PIC/S; 2021 Jul 1 [cited 2026 Oct 8]. Available from: https://picscheme.org/docview/4234
U.S. Food and Drug Administration. Data integrity and compliance with drug CGMP: questions and answers. Guidance for industry [Internet]. Silver Spring (MD): FDA; 2018 Dec [cited 2026 Oct 8]. Available from: https://www.fda.gov/media/119570/download
U.S. Food and Drug Administration. Part 11, electronic records; electronic signatures — scope and application. Guidance for industry [Internet]. Rockville (MD): FDA; 2003 Aug [cited 2026 Oct 8]. Available from: https://www.fda.gov/media/75414/download
World Health Organization. Guideline on data integrity. In: WHO Expert Committee on Specifications for Pharmaceutical Preparations: fifty-fifth report. Annex 4. WHO Technical Report Series, No. 1033 [Internet]. Geneva: WHO; 2021 [cited 2026 Oct 8]. Available from: https://www.who.int/publications/m/item/annex-4-trs-1033
