Computer system validation (CSV) demonstrates that a computerised system used in a GMP-regulated activity is fit for its intended purpose and works reliably. Under EU GMP Annex 11 this means any combination of software and hardware that together fulfil certain functions, from the laboratory information management system to the equipment control system to the electronic batch record. The Annex distinguishes two things: the application is validated, and the IT infrastructure it runs on is qualified.
What is validated
Every application used in a GMP-regulated activity. The IT infrastructure underneath is qualified.
What determines the scope
A justified and documented risk assessment with regard to patient safety, data integrity and product quality.
Who remains responsible
The regulated company. Formal agreements with clear responsibilities are required with suppliers and service providers.
How long it lasts
Over the entire life cycle, from the requirements to retirement of the system and archiving of the data.
One principle runs through all the regulations: if a system replaces a previously manual step, product quality, process control or quality assurance must not suffer, and the overall risk of the process must not increase. Closely related to this is data integrity, that is, whether data remain complete, consistent, accurate, trustworthy and reliable throughout their life cycle.
When you need this
The occasion is usually a new system. Anyone introducing a laboratory or quality management system, procuring production equipment with its own control system or moving records from paper to electronic records must demonstrate before productive use that the system meets the defined requirements. Changes, updates and data migrations are also included, because under Annex 11 a transfer to another format or system must be checked to ensure that data are not altered in value or meaning.
Companies often seek external support when their own quality assurance lacks the expertise for a particular system, when many systems are introduced at the same time, or when an inspection has revealed data integrity deficiencies that need to be addressed in an orderly way. For software obtained as a service over the internet, the obligation to validate also remains with the regulated company, and expertise is often needed precisely at this interface between provider and user.
Legal basis and rules
EU GMP Annex 11
The annex on computerised systems in the EU GMP Guide applies in its 2011 version, in effect since 30 June 2011. It covers risk management, suppliers, validation, audit trail, changes, periodic evaluation, access control, electronic signature, business continuity and archiving.
Revision in draft
A revised version of Annex 11, together with a new Chapter 4 on documentation and a new Annex 22 on artificial intelligence, was open for public consultation from 7 July to 7 October 2025. According to the EudraLex page, it has not yet been adopted.
AMWHV
The German Ordinance on the Manufacture of Medicinal Products and Active Substances (Arzneimittel- und Wirkstoffherstellungsverordnung, AMWHV) obliges manufacturers in Germany to follow Good Manufacturing Practice and refers to the EU GMP Guide for its interpretation, and therefore also to Annex 11.
PIC/S PI 041-1
The guidance on data management and integrity in GMP and GDP environments has applied since 1 July 2021. It is written mainly for inspectors but also shows companies what inspectors look for, and it describes the ALCOA+ principles.
GAMP 5, second edition
The ISPE industry guide to a risk-based approach to GxP systems was published in July 2022. It is not a legal standard but is regarded as a widely used benchmark and emphasises critical thinking, supplier involvement and also iterative development models.
What ALCOA+ means
PIC/S PI 041-1 summarises the principles of good documentation under the acronym ALCOA: data must be attributable, legible, contemporaneous, original and accurate. In addition, they must be complete, consistent, enduring and available, together referred to as ALCOA+. The guidance stresses that these principles apply equally to paper and electronic records.
How validation works
The process follows the life cycle of the system. You decide how deep each step goes based on the risk assessment, and Annex 11 explicitly requires that you can justify your standards, test plans and acceptance criteria on this basis.
01
System inventory and risk assessment
The starting point is an up-to-date list of all relevant systems with their GMP function. For critical systems, a description of the architecture, data flows, interfaces and security measures is added.
02
Defining requirements
The user requirements specification describes what the system must do. It is based on a documented risk assessment and remains traceable throughout the life cycle.
03
Assessing suppliers
The competence and reliability of the supplier are assessed, and the risk assessment decides whether an audit is needed. You check the documentation supplied with standard software against your requirements.
04
Testing
Evidence of appropriate test methods and test scenarios is provided, in particular for parameter limits, data limits and error handling. Deviations and changes during validation are documented.
05
Securing operation
Access rights, audit trail, data backup, business continuity and a procedure for changes and incidents are set up before the system goes live.
06
Periodic evaluation
During operation you check at regular intervals whether the system is still in a validated state and GMP-compliant, based among other things on deviations, incidents, updates and security.
Under Annex 11, an audit trail is to be provided based on a risk assessment, record all GMP-relevant changes and deletions, and document the reason for each such change. It must be available in an intelligible form and reviewed regularly. Within the company, electronic signatures should have the same effect as handwritten signatures, be permanently linked to the record and include the date and time.
What to look for when choosing a provider
A validation service provider should know the systems you use and at the same time speak the language of your quality assurance. The following questions help when comparing providers:
Questions to ask the provider
Does the provider have experience with your type of system, for example laboratory software, equipment control systems or quality management systems?
Does it work on a risk basis according to Annex 11 and GAMP 5, or does it deliver standard packages with the same test depth for every system?
How does it make use of the software manufacturer’s documentation and tests instead of testing everything again?
How does it handle data migration, audit trail and access rights?
Does it know the data integrity expectations of PIC/S PI 041-1?
How does it follow the revision of Annex 11, and how would it adapt your procedures to it?
Who prepares the documents, and how is it ensured that approval remains with you?
Frequently asked questions
Does every system in the company have to be validated?
+
Systems used in GMP-regulated activities are validated. The extent of validation depends on a justified and documented risk assessment. For a simple, low-criticality system the effort can therefore be much smaller than for a system that processes batch data.
Who is responsible if a service provider operates the system or provides it in the cloud?
+
The regulated company. Annex 11 requires formal agreements with clear responsibilities as soon as third parties provide, install, validate or maintain a system or process data. PIC/S PI 041-1 makes clear that responsibility remains with the regulated company even for outsourced systems.
Does the new version of Annex 11 already apply?
+
No. The 2011 version remains authoritative. The draft revision was consulted on in 2025 and has not yet been adopted. It can still be worth comparing your own procedures with the draft now, for example regarding service providers, audit trail and security.
Is GAMP 5 mandatory?
+
No. GAMP 5 is an ISPE industry guide. What is binding are the GMP rules, in Germany via the AMWHV and the EU GMP Guide. GAMP 5 is, however, frequently used as the basis for putting the requirements of Annex 11 into practice.
Sources
Every statement in this text was checked against these primary sources (as of 10.11.2026). Laws, guidelines and authority websites, no advertising.
Evidenze GmbH, based in Essen, is a contract research and consultancy company for clinical trials, with a focus on study management, data management, biostatistics, pharmacovigilance and quality assurance audits.
Essen
Evidenced
„Audits to computer systems GCP / GMP (GAMP 5 / FDA CFR 21 Part 11).“