01
Risk management & system lifecycle
System inventory including SaaS and lab applications, periodic review, how you handle systems without vendor support.
Annex 11 revision · draft of 7 July 2025
Annex 11: where does your site stand today?
18 questions on the points that change most. Ten minutes, and you know where your site stands. Free of charge.
Why now
The requirements are out. What they mean for your site is written nowhere
Five pages become nineteen. Four chapters are entirely new and several others grow considerably. And legacy systems may no longer run on simply because they have been running for years. Each one has to be assessed, improved or replaced.
A project turns into a permanent state
Validation used to have an end date. In future you will have to show every year afresh that the system still does what it is supposed to.
Contracts need the longest run-up
Inspection support, audit rights, notification duties and an exit arrangement have to be in the supplier contract. Renegotiating takes months, not weeks.
IT evidence becomes GMP evidence
Patch management, network and malware protection, penetration tests. At most sites all of this exists, it is just documented in IT rather than in the quality system.
The self-check
Six areas, three questions each
Three gradations per line rather than yes and no. Everything you mark as „no / unclear" is a gap. The evaluation follows automatically at the end.
02
Suppliers & service providers
Mandatory contract elements, the split of responsibility for cloud and SaaS, approval of provider releases.
03
Data integrity & audit trail
Who, what, when and why including the old and new value. Review before batch release. Validated interfaces instead of manual transfers.
04
Validation & change control
End-to-end traceability, the validated state across changes, being able to evidence the status during an inspection.
05
Access & security
Personal accounts down to the terminals, multi-factor for remote maintenance, security evidence in a GMP-suitable form.
06
Backup & archiving
A real restore test, write-protected archiving with checksums, readability after the source system has been retired.
Start the self-check
A few contact details and you are straight into it. You will see your result on this site as soon as you are done.
This is based on the draft revision of Annex 11 to the EU GMP Guide, released for consultation on 7 July 2025 together with the new Annex 22 on artificial intelligence. The consultation closed on 7 October 2025; no date for it coming into force has been set. The self-check is an orientation and does not replace a regulatory assessment of your individual case.