Annex 11 vs Part 11: clause-by-clause mapping
Pick a topic, or a clause on either side, and see its counterpart: where 21 CFR Part 11 and EU GMP Annex 11 match, where Annex 11 asks for more and where Part 11 does, and the evidence that satisfies both. Mark each row for your lab and print the gap list. Already sure of the Part 11 side? Run the Part 11 compliance checklist first, then use this map for the Annex 11 extras.
The tool
Map a clause, mark your lab
Pick a topic or a clause on either side to see its counterpart. Pre-filled with a US contract QC lab taking on its first EU client; change any mark, or clear it to a blank sheet. Your entries stay in this browser only.
Gap list for a lab that must meet both
9 gaps
13 of 22 rows that apply are in place, 9 are gaps; 6 of the gaps sit in rows where Annex 11 asks more or stands alone.
Showing 25 of 25 rows.
Validate the system
Annex 11 asks moreValidation
21 CFR Part 11
§ 11.10(a)
“Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.”
EU GMP Annex 11 (2011)
Principle, § 4.1, § 4.3, § 4.4, § 4.6, § 4.7
“The application should be validated; IT infrastructure should be qualified.”
Annex 11 says what the validation pack holds: qualified IT infrastructure, an up-to-date inventory of systems (4.3), a system description for critical systems, user requirements traceable through the life cycle (4.4), and tests of parameter limits, data limits and error handling (4.7). Part 11 names one outcome Annex 11 does not: the ability to discern invalid or altered records.
Where they meet, and evidence for both
- Where they meet
- Both require the system to be validated before its records are relied on.
- Evidence that satisfies both
- Validation plan and report scoped by a written risk assessment; URS traced to test cases; infrastructure qualification record; system inventory; a test that shows the system flags an altered or invalid record.
Check data after a migration
Annex 11 onlyData migration
21 CFR Part 11
No counterpart (nearest § 11.10(a), § 11.10(c))
EU GMP Annex 11 (2011)
§ 4.8
“validation should include checks that data are not altered in value and/or meaning during this migration process”
Annex 11 makes migration checks part of validation: data moved to another format or system must keep its value and its meaning.
Where they meet, and evidence for both
- Where they meet
- Part 11 has no migration clause. A migration still sits under validation (§ 11.10(a)) and must leave every record retrievable (§ 11.10(c)).
- Evidence that satisfies both
- Migration plan and report: record counts before and after, a field-by-field comparison of a sample, and the audit trails carried across or archived with the old records.
Copies and printouts of records
Each adds somethingCopies and printouts
21 CFR Part 11
§ 11.10(b)
“accurate and complete copies of records in both human readable and electronic form”
EU GMP Annex 11 (2011)
§ 8.1, § 8.2
“it should be possible to generate printouts indicating if any of the data has been changed since the original entry”
Part 11 wants the copies in electronic form as well as human readable form, complete enough for FDA to inspect and copy. Annex 11 adds, for records supporting batch release, a printout that shows whether any data changed since the original entry.
Where they meet, and evidence for both
- Where they meet
- Both want readable copies of electronic records on demand (Annex 11 8.1: "clear printed copies").
- Evidence that satisfies both
- A tested export of one complete record (data, metadata and audit trail) as a readable report and as an electronic file; for release records, a report that flags every changed entry.
Protect stored records for the retention period
Annex 11 asks moreStorage, back-up and archiving
21 CFR Part 11
§ 11.10(c)
“Protection of records to enable their accurate and ready retrieval throughout the records retention period.”
EU GMP Annex 11 (2011)
§ 7.1
“Access to data should be ensured throughout the retention period.”
Annex 11 asks you to secure data by physical and electronic means and to check stored data for accessibility, readability and accuracy.
Where they meet, and evidence for both
- Where they meet
- Both protect records so they can be read for the whole retention period. Neither sets the length: Part 11 takes it from the predicate rule.
- Evidence that satisfies both
- A retention schedule per record type, the storage controls, and a logged periodic read-back of stored records.
Back up the data and prove it restores
Annex 11 onlyStorage, back-up and archiving
21 CFR Part 11
No counterpart (nearest § 11.10(c))
EU GMP Annex 11 (2011)
§ 7.2
“Regular back-ups of all relevant data should be done.”
Annex 11 wants the integrity of back-up data and the ability to restore it checked during validation and monitored periodically.
Where they meet, and evidence for both
- Where they meet
- Part 11 has no back-up clause; § 11.10(c) is the nearest. For drug CGMP the predicate rule § 211.68(b) asks for "A backup file of data".
- Evidence that satisfies both
- A back-up procedure, a restore test in validation, and periodic restore tests with their results on file.
Archive data you can still retrieve
Annex 11 asks moreStorage, back-up and archiving
21 CFR Part 11
§ 11.10(c)
EU GMP Annex 11 (2011)
§ 17
“the ability to retrieve the data should be ensured and tested”
Annex 11 asks that archived data be checked for accessibility, readability and integrity, and that retrieval be tested when relevant changes are made to the system (equipment or programs).
Where they meet, and evidence for both
- Where they meet
- Both need archived records readable for the retention period. FDA's 2003 guidance accepts archives on paper or in standard electronic formats such as PDF when content and meaning are kept.
- Evidence that satisfies both
- An archive procedure, logged read-back checks, and a retrieval test before each upgrade or retirement of the system.
Limit access to authorised people
Each adds somethingSecurity and access
21 CFR Part 11
§ 11.10(d), § 11.10(g)
“Limiting system access to authorized individuals.”
EU GMP Annex 11 (2011)
§ 12.1, § 12.2, § 12.3
“Creation, change, and cancellation of access authorisations should be recorded.”
Part 11 asks for authority checks on each action: who may use the system, sign, alter a record or perform the operation. Annex 11 asks that granting, changing and removing access be recorded, and scales the controls to the system's criticality (12.2).
Where they meet, and evidence for both
- Where they meet
- Both restrict the system to authorised people.
- Evidence that satisfies both
- A role matrix with the rights of each role, a log of access granted, changed and removed with approvals, and a periodic access review.
Audit trail of changes and deletions
Each adds somethingAudit trail
21 CFR Part 11
§ 11.10(e)
“Record changes shall not obscure previously recorded information.”
EU GMP Annex 11 (2011)
§ 9, § 12.4
“For change or deletion of GMP-relevant data the reason should be documented.”
Part 11 makes the trail a control for every record in scope, creation included, and keeps it as long as the record. Annex 11 decides the trail by risk ("Consideration should be given") but adds two things Part 11 does not say: a documented reason for each GMP-relevant change or deletion, and regular review.
Where they meet, and evidence for both
- Where they meet
- Both want a system-generated record of who changed or deleted data and when; Annex 11 12.4 asks for the operator's identity with date and time.
- Evidence that satisfies both
- A trail on create, modify and delete with a forced reason on GMP fields, kept with the record; a scheduled audit trail review with a signed record of each one.
Enforce the order of steps
Part 11 onlyInput and sequence checks
21 CFR Part 11
§ 11.10(f)
“operational system checks to enforce permitted sequencing of steps and events”
EU GMP Annex 11 (2011)
No counterpart
Part 11 asks the system to enforce the permitted order of steps where order matters, such as review before approval.
Where they meet, and evidence for both
- Where they meet
- Annex 11 has no step-sequencing clause.
- Evidence that satisfies both
- Workflow configuration and an OQ test showing an out-of-order step is refused.
Check data coming into the system
Each adds somethingInput and sequence checks
21 CFR Part 11
§ 11.10(h)
“the validity of the source of data input or operational instruction”
EU GMP Annex 11 (2011)
§ 5, § 6
“For critical data entered manually, there should be an additional check on the accuracy of the data.”
Part 11 checks the source: whether this terminal or instrument may send this input. Annex 11 asks for built-in checks on data exchanged with other systems (5) and a second check, by a person or by validated electronic means, on critical data typed in by hand (6).
Where they meet, and evidence for both
- Where they meet
- Both want the system to guard what comes in.
- Evidence that satisfies both
- An interface specification with validated transfer checks, a list of permitted devices and instruments, and a second-person or system check on critical manual entries.
Qualified people with defined duties
Each adds somethingPeople and training
21 CFR Part 11
§ 11.10(i)
“have the education, training, and experience to perform their assigned tasks”
EU GMP Annex 11 (2011)
§ 2
“All personnel should have appropriate qualifications, level of access and defined responsibilities to carry out their assigned duties.”
Part 11 names those who develop, maintain or use the system. Annex 11 names the roles that must work together (Process Owner, System Owner, Qualified Persons and IT) and ties each person's level of access to their duties.
Where they meet, and evidence for both
- Where they meet
- Both require people qualified for their tasks.
- Evidence that satisfies both
- Training records against the system's SOPs, a named process owner and system owner, and job roles mapped to access roles.
Change control and system documents
Each adds somethingChange control and system documents
21 CFR Part 11
§ 11.10(k)
“Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation.”
EU GMP Annex 11 (2011)
§ 10, § 4.2
“Any changes to a computerised system including system configurations should only be made in a controlled manner in accordance with a defined procedure.”
Part 11's clause controls the system documentation: who gets it, who uses it, and a time-sequenced trail of its revisions. Annex 11 controls changes to the system itself, configuration included, and wants change control records in the validation documentation (4.2).
Where they meet, and evidence for both
- Where they meet
- Both put changes under a written procedure that leaves a record.
- Evidence that satisfies both
- A change control SOP that covers configuration, change records linked to the validation file, and controlled, versioned manuals and admin guides.
Extra controls for open systems
Part 11 onlySecurity and access
21 CFR Part 11
§ 11.30
“additional measures such as document encryption and use of appropriate digital signature standards”
EU GMP Annex 11 (2011)
No counterpart (nearest § 3.1, § 12.1)
Where the people responsible for the records do not control access, Part 11 adds measures such as encryption and digital signatures, from the record's creation to its receipt.
Where they meet, and evidence for both
- Where they meet
- Annex 11 draws no open or closed line. A hosted system falls under its supplier agreements (3.1) and access controls (12.1) instead.
- Evidence that satisfies both
- A written open or closed classification of the system; encryption in transit and at rest; the signature standard used for records sent outside your control.
What a signed record shows
Part 11 asks moreElectronic signatures
21 CFR Part 11
§ 11.50
“The printed name of the signer”
EU GMP Annex 11 (2011)
§ 14(c)
“include the time and date that they were applied”
Part 11 also requires the signer's printed name and the meaning of the signature (such as review, approval, responsibility or authorship) on every display and printout of the record. Annex 11 names only the time and date.
Where they meet, and evidence for both
- Where they meet
- Both show when the signature was applied.
- Evidence that satisfies both
- A signature block with printed name, date and time with its time zone, and meaning, on screen and on the printout.
Signature locked to its record
Part 11 asks moreElectronic signatures
21 CFR Part 11
§ 11.70
“cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means”
EU GMP Annex 11 (2011)
§ 14(b)
“be permanently linked to their respective record”
Part 11 also covers handwritten signatures executed to electronic records, and names the test: the signature cannot be cut, copied or moved by ordinary means.
Where they meet, and evidence for both
- Where they meet
- Both lock a signature to the record it signs.
- Evidence that satisfies both
- An OQ test that tries to copy or move a signature to another record, and the binding between each signature and the record version it signed.
An e-signature counts as a handwritten one
Part 11 asks moreElectronic signatures
21 CFR Part 11
§ 11.10(j), § 11.100(c)
“written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures”
EU GMP Annex 11 (2011)
§ 14(a)
“have the same impact as hand-written signatures within the boundaries of the company”
Part 11 asks for a written accountability policy and a hand-signed letter certifying to FDA that your e-signatures are the legally binding equivalent of handwritten signatures. The letter is a US step with no Annex 11 counterpart.
Where they meet, and evidence for both
- Where they meet
- Both make an electronic signature carry the weight of a handwritten one inside the company.
- Evidence that satisfies both
- An e-signature policy each signer acknowledges in writing, and the non-repudiation letter to FDA on file.
One signature per person, identity verified
Part 11 onlyElectronic signatures
21 CFR Part 11
§ 11.100(a), § 11.100(b)
“unique to one individual and shall not be reused by, or reassigned to, anyone else”
EU GMP Annex 11 (2011)
No counterpart (nearest § 12.3)
Part 11 makes each signature unique to one person, never reused or reassigned, and asks the organisation to verify the person's identity before issuing it.
Where they meet, and evidence for both
- Where they meet
- Annex 11 records who is given access (12.3) but says nothing about verifying identity before a signature is issued, or about reuse.
- Evidence that satisfies both
- An identity check on file before each account with signing rights is issued, and user IDs that are never reused.
Two components to sign
Part 11 asks moreElectronic signatures
21 CFR Part 11
§ 11.200
“Employ at least two distinct identification components such as an identification code and password.”
EU GMP Annex 11 (2011)
§ 12.1
“personal codes with passwords, biometrics”
Part 11 rules the signing act itself: two components, all of them on the first signing in a continuous session and on every signing outside one, used only by their owner, so that misuse needs two or more people to collaborate.
Where they meet, and evidence for both
- Where they meet
- Annex 11 lists personal codes with passwords and biometrics among the ways to keep unauthorised people out of the system.
- Evidence that satisfies both
- A signing dialog that asks for ID and password again, and an OQ test of the first and later signings within one session.
Controls on IDs, passwords and tokens
Part 11 asks moreSecurity and access
21 CFR Part 11
§ 11.300
“no two individuals have the same combination of identification code and password”
EU GMP Annex 11 (2011)
§ 12.1, § 12.3
“Physical and/or logical controls should be in place to restrict access to computerised system to authorised persons.”
Part 11 lists the controls: unique ID and password pairs, periodic checks or aging, loss management for tokens and cards, urgent reporting of attempted misuse, and testing of tokens.
Where they meet, and evidence for both
- Where they meet
- Both expect controlled credentials; Annex 11 records each access authorisation created, changed or cancelled (12.3).
- Evidence that satisfies both
- A password policy (aging, lockout), a lost-token procedure, and alerts on repeated failed sign-ins sent to the security unit.
Risk management across the life cycle
Annex 11 onlyRisk management
21 CFR Part 11
No counterpart
EU GMP Annex 11 (2011)
§ 1
“decisions on the extent of validation and data integrity controls should be based on a justified and documented risk assessment”
Annex 11 makes risk management run through the whole life cycle, weighing patient safety, data integrity and product quality.
Where they meet, and evidence for both
- Where they meet
- Part 11 has no risk clause. FDA's 2003 guidance uses the same words for its own advice: base validation and audit trail decisions on "a justified and documented risk assessment".
- Evidence that satisfies both
- A system risk assessment that sets the validation scope and the data integrity controls, revisited at each change and periodic evaluation.
Agreements with suppliers and service providers
Annex 11 onlySuppliers and service providers
21 CFR Part 11
No counterpart (nearest § 11.10(a), § 11.10(i))
EU GMP Annex 11 (2011)
§ 3.1, § 3.2, § 3.3, § 3.4, § 4.5
“formal agreements must exist between the manufacturer and any third parties”
Annex 11 wants written agreements stating each third party's responsibilities, suppliers chosen on competence and reliability, an audit when risk calls for one, vendor documentation reviewed against user requirements, and supplier quality information available to inspectors.
Where they meet, and evidence for both
- Where they meet
- Part 11 has no supplier clause. A vendor's work reaches it only through your validation (§ 11.10(a)) and the training of people who develop the system (§ 11.10(i)).
- Evidence that satisfies both
- A quality agreement with each software vendor and host, a supplier assessment or audit report, and a documented review of the vendor's documentation against your URS.
Periodic evaluation of each system
Annex 11 onlyPeriodic review
21 CFR Part 11
No counterpart
EU GMP Annex 11 (2011)
§ 11
“periodically evaluated to confirm that they remain in a valid state and are compliant with GMP”
Annex 11 asks for periodic evaluation covering, where appropriate, functionality, deviations, incidents, problems, upgrade history, performance, reliability, security and validation status.
Where they meet, and evidence for both
- Where they meet
- Part 11 asks for validation but sets no review cycle after go-live.
- Evidence that satisfies both
- A periodic review report per system that reads those inputs and ends in a decision: still valid, or what must change.
Report and assess every incident
Annex 11 onlyIncidents and business continuity
21 CFR Part 11
No counterpart (nearest § 11.300(d))
EU GMP Annex 11 (2011)
§ 13
“All incidents, not only system failures and data errors, should be reported and assessed.”
Annex 11 asks for every incident to be reported and assessed, and for the root cause of a critical incident to drive corrective and preventive action.
Where they meet, and evidence for both
- Where they meet
- Part 11's nearest line is narrow: § 11.300(d) asks for urgent reporting of attempts to misuse passwords or ID codes.
- Evidence that satisfies both
- An incident procedure that logs system incidents, classifies them, and feeds critical ones into root cause analysis and CAPA.
Business continuity when the system is down
Annex 11 onlyIncidents and business continuity
21 CFR Part 11
No counterpart
EU GMP Annex 11 (2011)
§ 16
“provisions should be made to ensure continuity of support for those processes in the event of a system breakdown”
Annex 11 asks for a documented and tested fallback, such as a manual or alternative system, with the time to bring it into use set by risk.
Where they meet, and evidence for both
- Where they meet
- Part 11 has no continuity clause.
- Evidence that satisfies both
- A written fallback for each critical system, a recovery time set by risk, and a dated test of the fallback.
Batch release by a Qualified Person
Annex 11 onlyBatch release
21 CFR Part 11
No counterpart (nearest § 11.10(g))
EU GMP Annex 11 (2011)
§ 15
“the system should allow only Qualified Persons to certify the release of the batches”
Annex 11 asks the system to let only Qualified Persons certify release, to identify and record the person releasing, and to do it with an electronic signature.
Where they meet, and evidence for both
- Where they meet
- Part 11 has no Qualified Person. Its authority checks (§ 11.10(g)) are how a US system limits who may sign a release.
- Evidence that satisfies both
- A release role limited to named QPs, release signed electronically, and the certifying person recorded on the batch record.
Annex 11 vs Part 11 gap list: Contract QC lab: LIMS and chromatography data system
Our mapping of 21 CFR Part 11 against EU GMP Annex 11 (January 2011 text, the version in force). 9 gaps. 13 of 22 rows that apply are in place, 9 are gaps; 6 of the gaps sit in rows where Annex 11 asks more or stands alone.
| No. | Gap and clauses | What to close | Evidence for both |
|---|---|---|---|
| 1 | Validate the systemPart 11: § 11.10(a)Annex 11: Principle, § 4.1, § 4.3, § 4.4, § 4.6, § 4.7Annex 11 asks more | Annex 11 says what the validation pack holds: qualified IT infrastructure, an up-to-date inventory of systems (4.3), a system description for critical systems, user requirements traceable through the life cycle (4.4), and tests of parameter limits, data limits and error handling (4.7). Part 11 names one outcome Annex 11 does not: the ability to discern invalid or altered records.Note: Validation reports exist; no IT infrastructure qualification and no system inventory. | Validation plan and report scoped by a written risk assessment; URS traced to test cases; infrastructure qualification record; system inventory; a test that shows the system flags an altered or invalid record. |
| 2 | Copies and printouts of recordsPart 11: § 11.10(b)Annex 11: § 8.1, § 8.2Each adds something | Part 11 wants the copies in electronic form as well as human readable form, complete enough for FDA to inspect and copy. Annex 11 adds, for records supporting batch release, a printout that shows whether any data changed since the original entry.Note: No report that flags changed results on release data. | A tested export of one complete record (data, metadata and audit trail) as a readable report and as an electronic file; for release records, a report that flags every changed entry. |
| 3 | Back up the data and prove it restoresPart 11: No counterpart (nearest § 11.10(c))Annex 11: § 7.2Annex 11 only | Annex 11 wants the integrity of back-up data and the ability to restore it checked during validation and monitored periodically.Note: Restore tested once at OQ; no periodic restore test since. | A back-up procedure, a restore test in validation, and periodic restore tests with their results on file. |
| 4 | Limit access to authorised peoplePart 11: § 11.10(d), § 11.10(g)Annex 11: § 12.1, § 12.2, § 12.3Each adds something | Part 11 asks for authority checks on each action: who may use the system, sign, alter a record or perform the operation. Annex 11 asks that granting, changing and removing access be recorded, and scales the controls to the system's criticality (12.2).Note: Access changes made by IT ticket; not recorded in the system file. | A role matrix with the rights of each role, a log of access granted, changed and removed with approvals, and a periodic access review. |
| 5 | Audit trail of changes and deletionsPart 11: § 11.10(e)Annex 11: § 9, § 12.4Each adds something | Part 11 makes the trail a control for every record in scope, creation included, and keeps it as long as the record. Annex 11 decides the trail by risk ("Consideration should be given") but adds two things Part 11 does not say: a documented reason for each GMP-relevant change or deletion, and regular review.Note: Trail is on, but no reason is forced when a result is edited. | A trail on create, modify and delete with a forced reason on GMP fields, kept with the record; a scheduled audit trail review with a signed record of each one. |
| 6 | Risk management across the life cyclePart 11: No counterpartAnnex 11: § 1Annex 11 only | Annex 11 makes risk management run through the whole life cycle, weighing patient safety, data integrity and product quality.Note: Validation scope set by habit; no written risk assessment. | A system risk assessment that sets the validation scope and the data integrity controls, revisited at each change and periodic evaluation. |
| 7 | Agreements with suppliers and service providersPart 11: No counterpart (nearest § 11.10(a), § 11.10(i))Annex 11: § 3.1, § 3.2, § 3.3, § 3.4, § 4.5Annex 11 only | Annex 11 wants written agreements stating each third party's responsibilities, suppliers chosen on competence and reliability, an audit when risk calls for one, vendor documentation reviewed against user requirements, and supplier quality information available to inspectors.Note: No quality agreement with the LIMS hosting vendor. | A quality agreement with each software vendor and host, a supplier assessment or audit report, and a documented review of the vendor's documentation against your URS. |
| 8 | Periodic evaluation of each systemPart 11: No counterpartAnnex 11: § 11Annex 11 only | Annex 11 asks for periodic evaluation covering, where appropriate, functionality, deviations, incidents, problems, upgrade history, performance, reliability, security and validation status.Note: No periodic review since go-live. | A periodic review report per system that reads those inputs and ends in a decision: still valid, or what must change. |
| 9 | Business continuity when the system is downPart 11: No counterpartAnnex 11: § 16Annex 11 only | Annex 11 asks for a documented and tested fallback, such as a manual or alternative system, with the time to bring it into use set by risk.Note: Fallback to paper worksheets not written down or tested. | A written fallback for each critical system, a recovery time set by risk, and a dated test of the fallback. |
Not for us: Check data after a migration; Extra controls for open systems; Batch release by a Qualified Person.
Prepared byReviewed by (QA)Date
What this map is
21 CFR Part 11 is a US regulation: FDA's rules for electronic records and electronic signatures, in force since August 20, 1997. EU GMP Annex 11 is European Commission guidance on computerised systems, published in EudraLex Volume 4 to interpret the EU's GMP principles. A lab that works under FDA rules and supplies an EU medicinal-product client is read against both, and the two are written in different shapes: Part 11 is a list of controls, Annex 11 a life cycle from risk assessment to archiving.
This tool sets them side by side in 25 rows. Each row names the clauses on both sides, quotes the words that matter, says how the two relate, and lists the evidence that satisfies both at once. For each Part 11 control on its own, read the Part 11 requirements section by section; for Annex 11 on its own, and when a US firm has to meet it, read EU Annex 11 for US labs and device makers.
Which Annex 11
The map uses the January 2011 revision of Annex 11 (“Deadline for coming into operation: 30 June 2011”), still the version listed in EudraLex Volume 4 when we read it on 2026-10-22. A revision was consulted on in 2025: a draft revised Annex 11, a revised Chapter 4 and a new Annex 22 on artificial intelligence were open for comment from 7 July to 7 October 2025. The 2011 text remains the one in force.
Our mapping
The pairing of clauses is our own reading of the two texts, not an official crosswalk. Where a clause has no true counterpart, the row says so and names the nearest section on the other side.
How to use this map
- Pick a way in: a topic, a Part 11 section, an Annex 11 clause, or a relation such as “Annex 11 only”. The picks combine.
- Read the row: the cites on each side, the words of each clause, and what one asks beyond the other. Open “Where they meet” for the evidence that satisfies both.
- Mark the row for your lab: In place, Gap or Not for us, with a note naming the document on file or what is missing.
- Copy or print the gap list. It carries each gap's clauses, what to close and the evidence for both, with lines for the preparer and QA to sign.
Six words describe how the two texts relate in a row:
- Both ask it
- The two clauses ask the same thing; one set of evidence covers both.
- Annex 11 asks more
- Both cover it, and Annex 11 asks for more detail or more evidence.
- Part 11 asks more
- Both cover it, and Part 11 asks for more.
- Each adds something
- They overlap, and each asks for something the other does not.
- Annex 11 only
- Only Annex 11 has the clause. The Part 11 side shows the nearest section, if any.
- Part 11 only
- Only Part 11 has the section. The Annex 11 side shows the nearest clause, if any.
The whole map on one sheet
All 25 rows in reading order, Part 11 cites on the left and Annex 11 clauses on the right. The tool above holds the clause words and the evidence for each.
| Requirement | 21 CFR Part 11 | Annex 11 (2011) | How they relate |
|---|---|---|---|
| Validate the system | § 11.10(a) | Principle, § 4.1, § 4.3, § 4.4, § 4.6, § 4.7 | Annex 11 asks more |
| Check data after a migration | No counterpart (nearest § 11.10(a), § 11.10(c)) | § 4.8 | Annex 11 only |
| Copies and printouts of records | § 11.10(b) | § 8.1, § 8.2 | Each adds something |
| Protect stored records for the retention period | § 11.10(c) | § 7.1 | Annex 11 asks more |
| Back up the data and prove it restores | No counterpart (nearest § 11.10(c)) | § 7.2 | Annex 11 only |
| Archive data you can still retrieve | § 11.10(c) | § 17 | Annex 11 asks more |
| Limit access to authorised people | § 11.10(d), § 11.10(g) | § 12.1, § 12.2, § 12.3 | Each adds something |
| Audit trail of changes and deletions | § 11.10(e) | § 9, § 12.4 | Each adds something |
| Enforce the order of steps | § 11.10(f) | No counterpart | Part 11 only |
| Check data coming into the system | § 11.10(h) | § 5, § 6 | Each adds something |
| Qualified people with defined duties | § 11.10(i) | § 2 | Each adds something |
| Change control and system documents | § 11.10(k) | § 10, § 4.2 | Each adds something |
| Extra controls for open systems | § 11.30 | No counterpart (nearest § 3.1, § 12.1) | Part 11 only |
| What a signed record shows | § 11.50 | § 14(c) | Part 11 asks more |
| Signature locked to its record | § 11.70 | § 14(b) | Part 11 asks more |
| An e-signature counts as a handwritten one | § 11.10(j), § 11.100(c) | § 14(a) | Part 11 asks more |
| One signature per person, identity verified | § 11.100(a), § 11.100(b) | No counterpart (nearest § 12.3) | Part 11 only |
| Two components to sign | § 11.200 | § 12.1 | Part 11 asks more |
| Controls on IDs, passwords and tokens | § 11.300 | § 12.1, § 12.3 | Part 11 asks more |
| Risk management across the life cycle | No counterpart | § 1 | Annex 11 only |
| Agreements with suppliers and service providers | No counterpart (nearest § 11.10(a), § 11.10(i)) | § 3.1, § 3.2, § 3.3, § 3.4, § 4.5 | Annex 11 only |
| Periodic evaluation of each system | No counterpart | § 11 | Annex 11 only |
| Report and assess every incident | No counterpart (nearest § 11.300(d)) | § 13 | Annex 11 only |
| Business continuity when the system is down | No counterpart | § 16 | Annex 11 only |
| Batch release by a Qualified Person | No counterpart (nearest § 11.10(g)) | § 15 | Annex 11 only |
Both ask it: one set of evidence covers both. Asks more: both cover it, one asks for more. Each adds something: they overlap and each asks for something the other does not. Only: no counterpart; the nearest section is in brackets.
Worked example: a US contract lab and its first EU client
A 14-person US contract QC lab runs release and stability testing on a LIMS and a chromatography data system, both validated for Part 11. Its first EU client's quality agreement asks it to meet Annex 11 as well. The QA lead walks the 25 rows: 13 are in place, 3 do not apply (no migration planned, a closed system, and batch certification stays with the client's Qualified Person) and 9 are gaps.
| Gap | Clauses | What the lab found | Evidence to produce |
|---|---|---|---|
| Validate the systemAnnex 11 asks more | Part 11: § 11.10(a)Annex 11: Principle, § 4.1, § 4.3, § 4.4, § 4.6, § 4.7 | Validation reports exist; no IT infrastructure qualification and no system inventory. | Validation plan and report scoped by a written risk assessment; URS traced to test cases; infrastructure qualification record; system inventory; a test that shows the system flags an altered or invalid record. |
| Copies and printouts of recordsEach adds something | Part 11: § 11.10(b)Annex 11: § 8.1, § 8.2 | No report that flags changed results on release data. | A tested export of one complete record (data, metadata and audit trail) as a readable report and as an electronic file; for release records, a report that flags every changed entry. |
| Back up the data and prove it restoresAnnex 11 only | Part 11: No counterpart (nearest § 11.10(c))Annex 11: § 7.2 | Restore tested once at OQ; no periodic restore test since. | A back-up procedure, a restore test in validation, and periodic restore tests with their results on file. |
| Limit access to authorised peopleEach adds something | Part 11: § 11.10(d), § 11.10(g)Annex 11: § 12.1, § 12.2, § 12.3 | Access changes made by IT ticket; not recorded in the system file. | A role matrix with the rights of each role, a log of access granted, changed and removed with approvals, and a periodic access review. |
| Audit trail of changes and deletionsEach adds something | Part 11: § 11.10(e)Annex 11: § 9, § 12.4 | Trail is on, but no reason is forced when a result is edited. | A trail on create, modify and delete with a forced reason on GMP fields, kept with the record; a scheduled audit trail review with a signed record of each one. |
| Risk management across the life cycleAnnex 11 only | Part 11: No counterpartAnnex 11: § 1 | Validation scope set by habit; no written risk assessment. | A system risk assessment that sets the validation scope and the data integrity controls, revisited at each change and periodic evaluation. |
| Agreements with suppliers and service providersAnnex 11 only | Part 11: No counterpart (nearest § 11.10(a), § 11.10(i))Annex 11: § 3.1, § 3.2, § 3.3, § 3.4, § 4.5 | No quality agreement with the LIMS hosting vendor. | A quality agreement with each software vendor and host, a supplier assessment or audit report, and a documented review of the vendor's documentation against your URS. |
| Periodic evaluation of each systemAnnex 11 only | Part 11: No counterpartAnnex 11: § 11 | No periodic review since go-live. | A periodic review report per system that reads those inputs and ends in a decision: still valid, or what must change. |
| Business continuity when the system is downAnnex 11 only | Part 11: No counterpartAnnex 11: § 16 | Fallback to paper worksheets not written down or tested. | A written fallback for each critical system, a recovery time set by risk, and a dated test of the fallback. |
6 of the 9 gaps sit where Annex 11 asks more than Part 11 or stands alone: risk assessment, supplier agreements, periodic evaluation, back-up restores, business continuity and the validation pack. The other 3 are rows where each text adds something and the lab had only the Part 11 half: a trail without a forced reason, access changes with no record, copies with no changed-data flag. None of the gaps is a signature row: a system validated for Part 11 signatures already covers the three lines of Annex 11 § 14. The cheapest first step is the risk assessment, because Annex 11 sizes the validation, the audit trail and the review cycle from it. A validation pack sized for a small lab holds most of the rest.
Where the two differ in kind
- Regulation and guidance. Part 11 is codified US law and says “shall”. Annex 11 “provides guidance for the interpretation of the principles and guidelines of good manufacturing practice” and mostly says “should”.
- Scope. Part 11 reaches electronic records kept under an FDA records rule or submitted to FDA (§ 11.1(b)); check whether it applies to a record. Annex 11 applies to every computerised system used in GMP-regulated activities.
- Risk. Annex 11 opens with risk management (§ 1) and sizes validation by it. Part 11's text has no risk clause; FDA's 2003 guidance supplies one, asking for “a justified and documented risk assessment”, the same words Annex 11 uses.
- Signatures. Part 11 spends five sections on electronic signatures; Annex 11 gives them three lines in § 14. A system that passes the signature manifestation check already meets § 14(c).
- After go-live. Annex 11 keeps going where Part 11 stops: supplier agreements, periodic evaluation, incident management and business continuity. For hosted systems, see Part 11 for cloud and SaaS systems.
Common misreading
“Annex 11 requires an audit trail on every system.” The 2011 text says “Consideration should be given, based on a risk assessment”. And the reverse slip: “regularly reviewed” comes from Annex 11 § 9; § 11.10(e) requires the trail, not a review cadence. The audit trail review checklist builds a review that serves both.
Where the rule says so
The texts this map is built from, each read on the date shown.
- 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR), National Archives and FDAread 2026-10-22
- EudraLex Volume 4, Annex 11: Computerised Systems (January 2011), European Commissionread 2026-10-22
- EudraLex Volume 4, Good Manufacturing Practice guidelines (index), European Commissionread 2026-10-22
- Stakeholders' Consultation on EudraLex Volume 4: Chapter 4, Annex 11 and New Annex 22, European Commissionread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures: Scope and Application (guidance, 2003), FDAread 2026-10-22
- 21 CFR Part 211, CGMP for Finished Pharmaceuticals (eCFR), National Archives and FDAread 2026-10-22