Cybersecurity Requirements for GMP Systems (Annex 11 and New Annex 22)

What is changing and why it matters now

The European Commission is revising the EU GMP guidance to keep pace with advanced digital systems and AI adoption in regulated manufacturing. The consultation covers Chapter 4 (Documentation), a revised Annex 11 (Computerised Systems), and a new Annex 22 for Artificial Intelligence. The draft updates elevate risk management, data integrity, and lifecycle control of computerized and AI systems.

For official sources, see the EU stakeholder consultation page, Annex 11 draft, and Annex 22 draft.

Chapter 4 Documentation: data governance becomes central

The draft Chapter 4 revision emphasizes that documentation is not a clerical step. It is a controlled system tied to data governance. Records can be text, image, video, or audio, and must remain accurate, complete, legible, and available throughout their lifecycle. This expands expectations for electronic records, e-signatures, audit trails, and hybrid documentation models.

• Document lifecycle controls apply equally to paper, digital, and hybrid records.
• Risk management principles are required for documentation systems.
• Consistency with Annex 11 data integrity and system controls is expected.

Annex 11: computerized systems lifecycle and supplier oversight

The updated Annex 11 expands requirements for lifecycle management of computerized systems. Quality risk management must be applied throughout requirements, validation, operation, change control, and retirement. Suppliers and service providers are explicitly in scope, and data integrity controls are reinforced across audit trails, access management, and security.

• Defined and maintained system requirements with traceability.
• Validated systems with documented change control and periodic review.
• Supplier qualification, monitoring, and contractual controls.
• Data integrity by design, with security and auditability built in.

Annex 22: AI lifecycle controls for GMP use cases

Annex 22 introduces explicit requirements for AI and machine learning used in GMP processes. It expects clear intended use, model governance, quality of training data, validation and performance metrics, and ongoing monitoring with human oversight and change control. This affects AI used in process control, deviation detection, quality analytics, and predictive maintenance.

• Define intended use, model boundaries, and performance metrics.
• Training and test data must be controlled, traceable, and representative.
• Model changes require controlled updates and impact assessment.
• Human review is required for high-impact decisions.

Practical compliance roadmap for manufacturers

The drafts are not final, but regulators and inspectors will expect that organizations are already aligning their systems, governance, and evidence with the new direction. Use this roadmap to begin preparation.

1. Map all GMP-relevant computerized and AI systems to product impact.
2. Review documentation practices against data integrity and lifecycle rules.
3. Update validation and change control procedures for AI systems.
4. Assess supplier and cloud provider controls for Annex 11 expectations.
5. Implement monitoring, audit trails, and role-based access controls.
6. Prepare evidence packages and inspection-ready documentation.

How Hunto AI helps you get compliant

Hunto AI accelerates compliance readiness by mapping your systems to Annex 11 and Annex 22 requirements, generating validation evidence, and tracking readiness gaps across documentation, data integrity, and AI governance. We provide continuous control monitoring so your GMP systems stay inspection-ready as the drafts become enforceable guidance.