Main Reasons for the Update:
- Lack of structured lifecycle management for equipment and systems.
- Frequent violations of data integrity rules, posing major risks as the generation of large amounts of data becomes increasingly important.
- Better alignment with GDPR, 21 CFR Part 11, and other best international practices.
- Interfaces between systems and cloud solutions have become standard in the pharmaceutical industry.
Een praktische benadering van oorzaakanalyse
Productie- en kwaliteitsteams escaleren het probleem onmiddellijk. Leidinggevenden van de steriele productie komen bijeen om de situatie te beoordelen en er worden dringende beslissingen genomen. Vaak worden de ruimtes waar de APS werd uitgevoerd in quarantaine geplaatst. De commerciële steriele productie mag alleen doorgaan totdat de lopende batches zijn voltooid, maar er worden geen nieuwe batches gestart totdat de oorzaak van het positieve APS-resultaat is vastgesteld.
Meestal wordt er een speciale ‘war room’ ingericht en wordt er een team van materiedeskundigen (SME's) en kwaliteitsvertegenwoordigers samengesteld om het onderzoek te starten.
What are the Changes in Eudralex Volume 4 Annex 11:2026?
- Stricter requirements for Data Integrity and ALCOA+ principles: Data Integrity and ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available) are described in Annex 11. The importance of audit trails and their validation must be demonstrated, as well as the interfaces between systems. Archiving and backup of data must be proven.
- Access Management: Access control will become a key pillar. Companies must have access controls according to roles. Critical installations may only be accessed via multi-factor authentication. Access management must be periodically reviewed.
- Electronic Signature and Verification: Electronic signatures must be linked to the unique user, with traceability to the time and date of signing. Shared accounts or insufficient verification are not allowed.
- Mandatory Full Lifecycle Management: Companies must demonstrate full lifecycle management of systems. Systems must be validated before use, with periodic validation and maintenance to ensure the system remains in a validated state during use, changes, and maintenance. Decommissioning of systems is described, with emphasis on maintaining data integrity.
- Supplier Oversight: The client remains responsible for outsourced services. For example, with cloud applications, GMP responsibility remains with the client. Supplier audits must be performed and suppliers qualified. Contracts and Service Level Agreements (SLAs) must include requirements for data integrity, availability, and decommissioning.
- Archiving, Backup, and Data Retention: Data lifecycle management will become an important part of organizational policy. This includes demonstrating readability and integrity, ensuring cloud backups are secured and tested, and documenting these requirements in contracts.
- Periodic Evaluations and Change Control: Companies must conduct periodic evaluations, and demonstrate system performance, validation status, and security updates. Change control for software changes and configurations must be assessed and documented.
Impact on Your Organization
Due to the update of Eudralex Volume 4 Annex 11, your organization will need to perform a GAP analysis on current processes and systems. Procedures, contracts, and SLAs must be reviewed. Staff in QA, IT, and operations roles must be trained in the new requirements. QA and compliance teams are responsible for validation, audits, and ensuring quality.
Which Departments Will Be Impacted?
The GMP responsibility (direct) applies to pharmaceutical companies. In addition, manufacturers of medical devices and biotech companies must adapt their processes. Suppliers of cloud solutions and software will face stricter requirements from their clients.
As Nomec Advipro, we can assist you in performing a GAP analysis. Our Senior Consultants and GMP specialists are available to discuss the possibilities. In our GxP Academy, we also offer a CSV/CSA training that provides a good understanding of how computer system validation should be set up and what the requirements are.
Meet Normec Advipro Expert: Alain Deloof
Alain Deloof is the Operations Unit Director of Academy & Consultancy at Normec Advipro, bringing extensive expertise in cleanroom construction, GxP compliance, and quality systems within highly regulated industries.He has a proven track record of leading complex projects from concept to implementation, with strong experience in risk management, budget control, and the coordination of cross-functional teams. Alain is also an experienced auditor and strategic advisor, supporting organizations in achieving and maintaining regulatory compliance, including Good Manufacturing Practice (GMP), ISO 13485, and Computer System Validation (CSV).In his role as Operations Unit Director of the GxP Academy, Alain is responsible for the development and delivery of high-level training programs covering GMP, cleanroom operations, aseptic techniques, quality risk management, and CSV. Through these initiatives, he helps organizations strengthen internal expertise, enhance compliance, and improve inspection readiness.
Your Partner in Quality, Safety, and Compliance
The life sciences sector requires specialized knowledge and reliable guidance. Thanks to our extensive expertise, we help organizations comply with laws and regulations, ensure quality, and continue to innovate with confidence.