개정판을 기다리는 동안,
지적은 2011년판으로 나왔습니다

While you wait for the revision, the citations arrive under the 2011 text.

The draft revisions of EU GMP Annex 11 (Computerised Systems), Annex 22 (Artificial Intelligence) and Chapter 4 (Documentation) were released on 7 July 2025, with comments closing on 7 October 2025. Checked on 16 October 2026, EudraLex Volume 4 still lists Annex 11 and Chapter 4 as the January 2011 versions, and there is no Annex 22. Meanwhile FDA kept issuing warning letters through 2026, citing current 21 CFR provisions only.

Statements with clause numbers (#) summarise the released draft documents, FDA warning letter texts, or PIC/S PI 041-1. Items marked i&CP view or i&CP suggestion are our interpretation, not a regulator's position. Company names are blanked as Firm A to Firm C. Draft clause numbers and wording may change in the final text.

Signal 1 · The draft's themes are already being cited

In the released draft, the weight of the Annex 11 revision sits on security, identity and access management, and audit trails. A warning letter issued in April 2026 to a finished-dosage site in France (Firm A) cites the same ground under 21 CFR 211.68: operators could change the system date, alarm limits and settings without restriction; network user authentication was not enforced; original printouts of Grade A action limit excursions could not be produced; and a vendor deleted all electronic data before a calibration, with no backup held. FDA asked for an independent assessment of every laboratory and production computer system, covering administrative rights, password controls and audit trail capability, plus policies on audit trails, prohibiting data deletion, and data retention and backup.

Signal 2 · The common citation is absence, not falsification

A warning letter issued in August 2026 to an active substance manufacturer in India (Firm B) cites 21 CFR 211.192 and 211.188: equipment printouts, laboratory notebooks, worksheets and analytical data supporting certificates of analysis could not be produced. Stability chambers were powered off and out of specification when powered on, and records supporting labelled expiry dates could not be provided. The response was found inadequate for lacking evidence of implemented corrective actions and a retrospective review and risk assessment. A voluntary recall and Import Alert 66-40 followed in the same month.

Signal 3 · Contract testing laboratories, the same principle again

A warning letter issued in August 2026 to a contract testing laboratory in India (Firm C) cites 21 CFR 211.194(a) and 211.22(d). Microbial sample sheets had blank entries, raw data sheets lacked complete plate counts while summary reports carried final numbers, and testing was not documented contemporaneously; the firm described this as a cultural gap affecting all products tested. OOS investigations showed testing into compliance, including a case where the instrument was changed after three failures and a passing result was reported without scientific justification. FDA asked for a CAPA plan assuring ALCOA records, a three-year retrospective review of all OOS results for US products, and notification of customers. The letter states that FDA considers contractors as extensions of the manufacturer's own facility.

Signal 4 · Audit trail review, the current expectation is already specific

No draft is needed to know what an audit trail review should look like. PIC/S PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (in force since 1 July 2021), was written as guidance for inspectorates (#3.1.1) and states that it is not mandatory or enforceable under law (#3.7). It is nonetheless a public PIC/S document, and it sets out when, who, what and how. Companies should select software with electronic audit trail functionality, and the functionality should be enabled and locked at all times, with any administrator deactivation recorded automatically (#9.6 Item 1, p.45). The GMP/GDP relevance of each audit trail should be assessed during qualification, so that the trails and entries to review, and the frequency, are defined (#9.6 Item 1, p.45). Critical audit trails should be independently reviewed with the other records of the operation and before the completion of that operation is reviewed, for example before batch release; non-critical ones at a pre-defined frequency during system reviews, by the originating department and, where necessary, verified by the quality unit (#9.6 Item 1, pp.45–46). The review of audit trails is part of the routine data review within the approval process, with frequency, roles and responsibilities based on a risk assessment, and an SOP describing in detail how to review, what to look for and how to search (#9.8 Item 1, p.49). The stated risk: failure to adequately review audit trails may allow manipulated or erroneous data to be accepted (#9.6 Item 1, p.46).

Overall message

The three letters cite different provisions but converge on one question: can the record be produced now. Firm A had no original printout of the failing result, Firm B had no raw data behind the certificate, Firm C had blank spaces where entries belonged. In all three, absence was cited before falsification.

The final text is still pending. The records are required today.