[{"data":1,"prerenderedAt":317},["ShallowReactive",2],{"\u002Fblog\u002Fdraft-annex-11-data-integrity":3},{"id":4,"title":5,"author":6,"body":7,"category":298,"date":299,"description":300,"draft":301,"excerpt":302,"extension":303,"heroImage":304,"heroImageAlt":305,"meta":306,"navigation":307,"path":308,"seo":309,"seoTitle":302,"slug":302,"stem":310,"tags":311,"updated":302,"__hash__":316},"blog\u002Fblog\u002Fdraft-annex-11-data-integrity.md","2025 PIC\u002FS–EU Draft Annex 11: Data Integrity and Access Changes","QikSolve",{"type":8,"value":9,"toc":290},"minimark",[10,14,29,36,39,44,59,68,124,133,137,140,202,205,209,212,225,229,287],[11,12,13],"p",{},"The 2025 joint PIC\u002FS–European Commission consultation draft proposed a revised EU GMP Annex 11 with\nmore explicit provisions on computerised-system lifecycle management, risk management, data\nintegrity and related controls. One concrete example is the draft’s Identity and Access Management\nsection: it spells out personal accounts, timely access changes, and authentication that identifies\nusers with a high degree of certainty.",[11,15,16,20,21,28],{},[17,18,19],"strong",{},"Australian context:"," This compares EU texts, not Australian-adopted requirements. The\n",[22,23,27],"a",{"href":24,"rel":25},"https:\u002F\u002Fwww.tga.gov.au\u002Fproducts\u002Fmedicines\u002Fmanufacturing\u002Fmanufacture-medicine\u002Fgood-manufacturing-practice-gmp\u002Fcomplying-pics-guide-good-manufacturing-practice-medicinal-products",[26],"nofollow","TGA’s adoption and applicability guidance","\nidentifies PIC\u002FS PE 009-17 (25 August 2023) as applying from 1 September 2025, except for Annexes\n4, 5 and 14, with phased compliance guidance. PIC\u002FS’s newer PE 009-18 publication and the 2025 EU\nconsultation draft do not by themselves change Australian adoption; check the TGA’s scope,\nexemptions and transition provisions for your activity.",[11,30,31,32,35],{},"These are ",[17,33,34],{},"proposals, not current requirements",". The consultation closed on 7 October 2025. As\nchecked on 12 November 2026, the Commission’s EudraLex Volume 4 page still lists Annex 11 as the\nJanuary 2011 revision. Separately, PIC\u002FS PE 009-18 (Annexes), dated 24 September 2026, contains\nAnnex 11 section 12, “Security”; it is not the consultation draft’s new section 11 wording and does\nnot by itself change the EU or Australian adoption status.",[11,37,38],{},"This article compares the current EU text with selected wording in the consultation draft, notes the\nseparate published PIC\u002FS text, then uses identity and access management as a practical example. It\nis not a full clause-by-clause legal analysis or a determination of applicability to a particular\norganisation.",[40,41,43],"h2",{"id":42},"what-the-consultation-proposes","What the consultation proposes",[11,45,46,47,52,53,58],{},"The ",[22,48,51],{"href":49,"rel":50},"https:\u002F\u002Fpicscheme.org\u002Fen\u002Fnews\u002Fjoint-stakeholders-consultation-on-the-revision-of-chapter-4",[26],"PIC\u002FS consultation notice","\nand the European Commission’s ",[22,54,57],{"href":55,"rel":56},"https:\u002F\u002Fhealth.ec.europa.eu\u002Fconsultations\u002Fstakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en",[26],"consultation record","\ndescribe a joint consultation on revised Chapter 4 and Annex 11. The Commission’s summary names\nsystem lifecycle management, risk management, data integrity, audit trails, electronic signatures\nand security among the proposed themes.",[11,60,61,62,67],{},"The draft text develops those themes in separate sections, including system requirements, supplier\nand service management, handling of data, identity and access management, audit trails and\nelectronic signatures. The summary and draft describe proposals; neither makes them effective\nrequirements. The Commission’s ",[22,63,66],{"href":64,"rel":65},"https:\u002F\u002Fhealth.ec.europa.eu\u002Fmedicinal-products\u002Feudralex\u002Feudralex-volume-4_en",[26],"EudraLex Volume 4 index","\nlists the current EU Annex 11 as the January 2011 revision. These pages were checked on\n12 November 2026; recheck them before relying on this status in a later decision.",[69,70,71,87],"table",{},[72,73,74],"thead",{},[75,76,77,81,84],"tr",{},[78,79,80],"th",{},"Evidence",[78,82,83],{},"What it supports",[78,85,86],{},"What it does not establish",[88,89,90,102,113],"tbody",{},[75,91,92,96,99],{},[93,94,95],"td",{},"Current EudraLex Volume 4 index and Annex 11",[93,97,98],{},"The index lists Annex 11 as the January 2011 revision; the current text includes security and access-authorisation provisions.",[93,100,101],{},"The complete legal position for every product, jurisdiction, or organisation.",[75,103,104,107,110],{},[93,105,106],{},"2025 consultation record and draft",[93,108,109],{},"The consultation closed on 7 October 2025; the draft describes proposed changes to computerised-system controls.",[93,111,112],{},"That draft text is currently effective, that a future text will be identical, or that a specific organisation must make a change.",[75,114,115,118,121],{},[93,116,117],{},"PIC\u002FS PE 009-18 (Annexes), dated 24 September 2026, Annex 11 section 12",[93,119,120],{},"The published PIC\u002FS text’s security and access-authorisation provisions.",[93,122,123],{},"That the 2025 draft wording was adopted unchanged by PIC\u002FS, the EU or Australia.",[11,125,126,127,132],{},"PIC\u002FS PE 009-18 Annex 11 section 12, “Security,” calls for controls restricting access to\nauthorised persons, security controls scaled to system criticality, records of access-authorisation\ncreation, change and cancellation, and operator identity with date and time for data operations.\nThis is distinct from the 2025 consultation draft’s section 11, “Identity and Access Management”:\nthe draft’s unique-account, read-only shared-account exception, timely access-lifecycle and\nhigh-certainty authentication wording is not reproduced there. See the ",[22,128,131],{"href":129,"rel":130},"https:\u002F\u002Fpicscheme.org\u002Fdocview\u002F11333",[26],"PIC\u002FS PE 009-18 Annexes\ntext",", section 12 (PDF page 179; printed page 172).",[40,134,136],{"id":135},"example-identity-and-access-management","Example: identity and access management",[11,138,139],{},"The contrast is visible in the current Annex 11 security provisions and the consultation draft’s\nnewly titled Identity and Access Management section. The following comparison paraphrases the\nofficial texts; it is not legal advice or a complete comparison of the annexes.",[69,141,142,158],{},[72,143,144],{},[75,145,146,149,152,155],{},[78,147,148],{},"Topic",[78,150,151],{},"Current EU Annex 11 (2011)",[78,153,154],{},"2025 consultation draft",[78,156,157],{},"What the draft makes more explicit",[88,159,160,174,188],{},[75,161,162,165,168,171],{},[93,163,164],{},"User identity",[93,166,167],{},"Section 12 calls for controls that restrict access to authorised persons and for relevant systems to record operator identity.",[93,169,170],{},"Section 11 says users should have unique personal accounts. Shared accounts are limited to read-only use where data and settings cannot be changed; other shared-account use is described in the draft as a data-integrity violation.",[93,172,173],{},"The draft directly addresses whether an account is personal and whether it permits changes, rather than relying only on general access control and operator-identity provisions.",[75,175,176,179,182,185],{},[93,177,178],{},"Access changes",[93,180,181],{},"Creation, change and cancellation of access authorisations should be recorded.",[93,183,184],{},"Access and roles should be granted, modified and revoked in a timely way as people join, change or end their involvement in GMP activities.",[93,186,187],{},"The draft describes the timing and lifecycle of access changes, not only recording that authorisations changed.",[75,189,190,193,196,199],{},[93,191,192],{},"Authentication",[93,194,195],{},"The current text lists examples of access-control methods and says the extent of controls depends on system criticality.",[93,197,198],{},"Authentication should identify users with a high degree of certainty; a token or smart card alone is not sufficient if another person could use it.",[93,200,201],{},"The draft focuses on confidence that the person authenticating is the identified user, including the risk of transferable credentials.",[11,203,204],{},"These are differences between two documents, not a conclusion that existing systems fail current\nrequirements. For example, a team could map how a shared account is configured today: can it only\nview, or can it change data or settings? It could then compare its current access-management\nrecords and controlled procedures with the draft’s proposed account, lifecycle and authentication\nwording. Any present-day compliance conclusion must still be based on applicable current sources;\nany change should follow the organisation’s established quality-system and change-control process.",[40,206,208],{"id":207},"keep-the-evidence-trail-proportionate","Keep the evidence trail proportionate",[11,210,211],{},"For a proportionate internal comparison, record the current and draft provisions, what the account\nactually permits (read-only or change-capable), and who will revisit the decision if the draft\nchanges. Treat the note as planning context, not a finding of current non-compliance or a reason by\nitself to change a controlled system.",[11,213,214,215,219,220,224],{},"For a corporate discussion about applying current, applicable expectations, the primary next step\nis QikSolve’s ",[22,216,218],{"href":217},"\u002Fproduct\u002Fregulatory-compliance","regulatory compliance pathway",". For related context\non oversight of systems and records, see ",[22,221,223],{"href":222},"\u002Fproduct\u002Fdata-and-system-governance-for-quality-teams","data and system governance for quality teams",".\nThese pages provide related QikSolve context; this article does not make product-specific claims\nabout their implementation.",[40,226,228],{"id":227},"sources-and-status-check","Sources and status check",[230,231,232,241,250,257,265,273,280],"ul",{},[233,234,235,236,240],"li",{},"PIC\u002FS, ",[22,237,239],{"href":49,"rel":238},[26],"Joint stakeholders’ consultation on Chapter 4 and Annex 11",",\nconsultation scope and coordination, checked 12 November 2026.",[233,242,243,244,249],{},"European Commission, ",[22,245,248],{"href":246,"rel":247},"https:\u002F\u002Fhealth.ec.europa.eu\u002Fdocument\u002Fdownload\u002F8d305550-dd22-4dad-8463-2ddb4a1345f1_en?filename=annex11_01-2011_en.pdf",[26],"current Annex 11 – Computerised Systems",",\nAnnex 11 revision January 2011, especially section 12, checked 12 November 2026.",[233,251,235,252,256],{},[22,253,255],{"href":129,"rel":254},[26],"PE 009-18 Guide to GMP for Medicinal Products, Annexes",",\ndated 24 September 2026, Annex 11 section 12, checked 12 November 2026.",[233,258,259,260,264],{},"TGA, ",[22,261,263],{"href":24,"rel":262},[26],"Complying with the PIC\u002FS Guide to GMP",",\nadoption, applicability and transition guidance for Australian manufacturers, checked 12 November 2026.",[233,266,243,267,272],{},[22,268,271],{"href":269,"rel":270},"https:\u002F\u002Fhealth.ec.europa.eu\u002Fdocument\u002Fdownload\u002F40231f18-e564-4043-94de-c031f813d38b_en?filename=mp_vol4_chap4_annex11_consultation_guideline_en.pdf",[26],"2025 consultation draft of Chapter 4 and Annex 11",",\nespecially section 11, checked 12 November 2026.",[233,274,243,275,279],{},[22,276,278],{"href":64,"rel":277},[26],"EudraLex Volume 4",",\nAnnex 11 listing, checked 12 November 2026.",[233,281,243,282,286],{},[22,283,285],{"href":55,"rel":284},[26],"Stakeholders’ consultation on Chapter 4 and Annex 11",",\nstatus and page-level summary, checked 12 November 2026.",[11,288,289],{},"Recheck the official sources before release. If the Commission or PIC\u002FS publishes revised text or a\nnew status, verify their respective versions, adoption and applicability before updating this\ncomparison. Do not silently substitute later material or treat the consultation draft as current\nrequirements.",{"title":291,"searchDepth":292,"depth":292,"links":293},"",2,[294,295,296,297],{"id":42,"depth":292,"text":43},{"id":135,"depth":292,"text":136},{"id":207,"depth":292,"text":208},{"id":227,"depth":292,"text":228},"Compliance","2026-11-12","Compare the 2025 PIC\u002FS–EU Annex 11 draft’s identity and access proposals with current EU Annex 11 and published PIC\u002FS PE 009-18, with an Australian applicability note.",false,null,"md","\u002Fimages\u002Fblog\u002Fqiksolve-blog-annex-11-access-abstract-1200x900.webp","Abstract nested architectural frames with a prominent blue panel on a light background.",{},true,"\u002Fblog\u002Fdraft-annex-11-data-integrity",{"title":5,"description":300},"blog\u002Fdraft-annex-11-data-integrity",[312,313,314,315],"annex-11","gmp","data-integrity","consultation-proposal","X4IMLJG2WpVudbrp4ej6c2SeeXXIBFdKUYzJgur7J20",1794478285025]