Frameworks · Sector & GxP

EU GMP Annex 11 compliance, run as a living system

Annex 11 of the EU Good Manufacturing Practice guidelines sets expectations for computerised systems used in regulated manufacturing, covering validation, data integrity and supplier management.

Who it applies to

Pharmaceutical and life science manufacturers operating under EU GMP, and the suppliers of their computerised systems.

What it demands

Validation

Risk-based validation lifecycle with documented specifications and testing.

Data integrity

Audit trails, accuracy checks, secure storage and controlled changes.

Supplier governance

Assessment of suppliers and service providers of computerised systems.

How Compli-Once runs it

  • 1

    Validation documentation held as evidence with periodic review dates and owners.

  • 2

    Audit trail and data integrity requirements modelled as controls, not as a document folder.

  • 3

    Supplier assessments run through the vendor module beside the internal control set.

What you already satisfy

EU GMP Annex 11 overlaps with frameworks you may already run. The crosswalk quantifies existing coverage on day one, before you plan a single task.

Implement once, satisfy many

Access control
ISO 27001 A.5.15SOC 2 CC6.1SEBI CSCRF PR.AARBI CSF Access Mgmt
Incident response
ISO 27001 A.5.24SOC 2 CC7.3SEBI CSCRF 6-hour report
Change management
ISO 27001 A.8.32SOC 2 CC8.1PCI DSS v4 6.5

In a representative demonstration environment, 61% of a newly adopted regulatory framework was already satisfied by the existing ISO 27001 programme.

Illustrative, computed live per tenant in the platform.

Frequently asked questions

How does Annex 11 relate to 21 CFR Part 11?

They cover similar ground for different jurisdictions, and the crosswalk lets one validation programme evidence both.

Is periodic review handled?

Yes. Periodic review is scheduled per system, with the completed review retained as evidence.

You're done. We're not.

The audit ends. The readiness doesn't. See it on your own data.