Compliance
2025 PIC/S–EU Draft Annex 11: Data Integrity and Access Changes
Compare the 2025 PIC/S–EU Annex 11 draft’s identity and access proposals with current EU Annex 11 and published PIC/S PE 009-18, with an Australian applicability note.
The 2025 joint PIC/S–European Commission consultation draft proposed a revised EU GMP Annex 11 with more explicit provisions on computerised-system lifecycle management, risk management, data integrity and related controls. One concrete example is the draft’s Identity and Access Management section: it spells out personal accounts, timely access changes, and authentication that identifies users with a high degree of certainty.
Australian context: This compares EU texts, not Australian-adopted requirements. The TGA’s adoption and applicability guidance identifies PIC/S PE 009-17 (25 August 2023) as applying from 1 September 2025, except for Annexes 4, 5 and 14, with phased compliance guidance. PIC/S’s newer PE 009-18 publication and the 2025 EU consultation draft do not by themselves change Australian adoption; check the TGA’s scope, exemptions and transition provisions for your activity.
These are proposals, not current requirements. The consultation closed on 7 October 2025. As checked on 12 November 2026, the Commission’s EudraLex Volume 4 page still lists Annex 11 as the January 2011 revision. Separately, PIC/S PE 009-18 (Annexes), dated 24 September 2026, contains Annex 11 section 12, “Security”; it is not the consultation draft’s new section 11 wording and does not by itself change the EU or Australian adoption status.
This article compares the current EU text with selected wording in the consultation draft, notes the separate published PIC/S text, then uses identity and access management as a practical example. It is not a full clause-by-clause legal analysis or a determination of applicability to a particular organisation.
What the consultation proposes
The PIC/S consultation notice and the European Commission’s consultation record describe a joint consultation on revised Chapter 4 and Annex 11. The Commission’s summary names system lifecycle management, risk management, data integrity, audit trails, electronic signatures and security among the proposed themes.
The draft text develops those themes in separate sections, including system requirements, supplier and service management, handling of data, identity and access management, audit trails and electronic signatures. The summary and draft describe proposals; neither makes them effective requirements. The Commission’s EudraLex Volume 4 index lists the current EU Annex 11 as the January 2011 revision. These pages were checked on 12 November 2026; recheck them before relying on this status in a later decision.
| Evidence | What it supports | What it does not establish |
|---|---|---|
| Current EudraLex Volume 4 index and Annex 11 | The index lists Annex 11 as the January 2011 revision; the current text includes security and access-authorisation provisions. | The complete legal position for every product, jurisdiction, or organisation. |
| 2025 consultation record and draft | The consultation closed on 7 October 2025; the draft describes proposed changes to computerised-system controls. | That draft text is currently effective, that a future text will be identical, or that a specific organisation must make a change. |
| PIC/S PE 009-18 (Annexes), dated 24 September 2026, Annex 11 section 12 | The published PIC/S text’s security and access-authorisation provisions. | That the 2025 draft wording was adopted unchanged by PIC/S, the EU or Australia. |
PIC/S PE 009-18 Annex 11 section 12, “Security,” calls for controls restricting access to authorised persons, security controls scaled to system criticality, records of access-authorisation creation, change and cancellation, and operator identity with date and time for data operations. This is distinct from the 2025 consultation draft’s section 11, “Identity and Access Management”: the draft’s unique-account, read-only shared-account exception, timely access-lifecycle and high-certainty authentication wording is not reproduced there. See the PIC/S PE 009-18 Annexes text, section 12 (PDF page 179; printed page 172).
Example: identity and access management
The contrast is visible in the current Annex 11 security provisions and the consultation draft’s newly titled Identity and Access Management section. The following comparison paraphrases the official texts; it is not legal advice or a complete comparison of the annexes.
| Topic | Current EU Annex 11 (2011) | 2025 consultation draft | What the draft makes more explicit |
|---|---|---|---|
| User identity | Section 12 calls for controls that restrict access to authorised persons and for relevant systems to record operator identity. | Section 11 says users should have unique personal accounts. Shared accounts are limited to read-only use where data and settings cannot be changed; other shared-account use is described in the draft as a data-integrity violation. | The draft directly addresses whether an account is personal and whether it permits changes, rather than relying only on general access control and operator-identity provisions. |
| Access changes | Creation, change and cancellation of access authorisations should be recorded. | Access and roles should be granted, modified and revoked in a timely way as people join, change or end their involvement in GMP activities. | The draft describes the timing and lifecycle of access changes, not only recording that authorisations changed. |
| Authentication | The current text lists examples of access-control methods and says the extent of controls depends on system criticality. | Authentication should identify users with a high degree of certainty; a token or smart card alone is not sufficient if another person could use it. | The draft focuses on confidence that the person authenticating is the identified user, including the risk of transferable credentials. |
These are differences between two documents, not a conclusion that existing systems fail current requirements. For example, a team could map how a shared account is configured today: can it only view, or can it change data or settings? It could then compare its current access-management records and controlled procedures with the draft’s proposed account, lifecycle and authentication wording. Any present-day compliance conclusion must still be based on applicable current sources; any change should follow the organisation’s established quality-system and change-control process.
Keep the evidence trail proportionate
For a proportionate internal comparison, record the current and draft provisions, what the account actually permits (read-only or change-capable), and who will revisit the decision if the draft changes. Treat the note as planning context, not a finding of current non-compliance or a reason by itself to change a controlled system.
For a corporate discussion about applying current, applicable expectations, the primary next step is QikSolve’s regulatory compliance pathway. For related context on oversight of systems and records, see data and system governance for quality teams. These pages provide related QikSolve context; this article does not make product-specific claims about their implementation.
Sources and status check
- PIC/S, Joint stakeholders’ consultation on Chapter 4 and Annex 11, consultation scope and coordination, checked 12 November 2026.
- European Commission, current Annex 11 – Computerised Systems, Annex 11 revision January 2011, especially section 12, checked 12 November 2026.
- PIC/S, PE 009-18 Guide to GMP for Medicinal Products, Annexes, dated 24 September 2026, Annex 11 section 12, checked 12 November 2026.
- TGA, Complying with the PIC/S Guide to GMP, adoption, applicability and transition guidance for Australian manufacturers, checked 12 November 2026.
- European Commission, 2025 consultation draft of Chapter 4 and Annex 11, especially section 11, checked 12 November 2026.
- European Commission, EudraLex Volume 4, Annex 11 listing, checked 12 November 2026.
- European Commission, Stakeholders’ consultation on Chapter 4 and Annex 11, status and page-level summary, checked 12 November 2026.
Recheck the official sources before release. If the Commission or PIC/S publishes revised text or a new status, verify their respective versions, adoption and applicability before updating this comparison. Do not silently substitute later material or treat the consultation draft as current requirements.