21 CFR Part 11 is the FDA regulation for electronic records and electronic signatures. EU GMP Annex 11 is the EU guideline for computerized systems used in GMP activities. Part 11 focuses on the trustworthiness of records and signatures; Annex 11 covers the whole system lifecycle, including risk management, supplier oversight, and periodic review.
Global pharmaceutical companies often achieve Part 11 compliance and assume that covers them for the EU as well. The two share a lot of ground, but the differences show up during inspections, and they matter even more now that Annex 11 is being rewritten.
At a Glance
Difference 1: Scope
Part 11 applies to electronic records created, modified, maintained, archived, retrieved, or transmitted under any FDA records requirement. Its scope is set by the underlying "predicate rule": if another FDA regulation requires the record, Part 11 applies to its electronic form. That reaches across FDA-regulated activities, including drug manufacturing, clinical and laboratory work, and medical devices. FDA's scope and application guidance explains how it applies in practice.
Annex 11 is part of the EU GMP guidelines and covers computerized systems used in GMP-regulated activities for medicines. Rather than starting from the record, it starts from the system and asks how critical it is to product quality, patient safety, and data integrity, then expects validation and controls proportionate to that risk.
The practical difference: validation documentation written for Part 11 often focuses on records and signatures, while an EU inspector will also expect to see a documented, risk-based view of the whole system.
Difference 2: Supplier and Service Provider Oversight
Annex 11 explicitly expects companies to assess the suppliers and service providers of their computerized systems, including through audits where the risk justifies it, and to have formal agreements setting out responsibilities.
Part 11 doesn't include an equivalent requirement. A company can validate a system to Part 11 without ever formally assessing the vendor's quality system, which satisfies the FDA rule but leaves a gap in the EU. This is one of the most common findings for companies relying on Part 11 documentation alone, and it's especially relevant for cloud and SaaS tools, where the vendor operates part of the system.
Difference 3: Periodic Review
Annex 11 requires computerized systems to be periodically evaluated, to confirm they remain validated and compliant. The frequency and depth should be risk-based, but the obligation is explicit.
Part 11 has no equivalent explicit periodic review requirement. FDA expects ongoing compliance through change control and lifecycle management, but it doesn't spell out a documented periodic review in the same way. Companies that rely on their Part 11 documentation often have no periodic review records, and that's frequently one of the first things an EU inspector asks for.
Where They Align
The frameworks agree on most fundamentals:
- Validation of systems used in regulated activities
- Audit trails that record changes to GMP-relevant data, with the user and time
- Access controls that limit system use to authorized people
- Electronic signatures that are attributable, linked to their records, and can't be reused or transferred
Part 11 is more detailed on electronic signatures and the controls around them, including specific requirements for open systems. We cover the most common misreadings in 21 CFR Part 11: The Compliance Assumptions Pharma Teams Make.
What the 2025 Draft Changes
Status as of November 2026: the 2011 version of Annex 11 remains in force. The revised text below is a draft and may change before it's finalized.
In July 2025, the European Commission and PIC/S published a draft revision of Annex 11 for consultation, alongside a revised Chapter 4 (Documentation) and a new Annex 22 on artificial intelligence. The consultation closed in October 2025, and the final version was expected during 2026.
The draft is a substantial rewrite rather than an update: roughly 19 pages instead of 5, organized into 17 sections with a glossary. The main changes:
- Broader audit trail expectations, extending to systems that control processes or capture, hold, or report data, and to actions such as changing settings, managing access, and applying electronic signatures
- Stricter access management, with more detailed controls
- Much more detail on electronic signatures, including clear expectations on authentication, what a signature shows, and the link between a signature and its record
- Stronger lifecycle expectations, covering risk management, supplier and service provider agreements, and periodic review
- Explicit coverage of modern realities, including cloud and outsourced services and cybersecurity
The effect is to bring Annex 11 closer to Part 11 on records and signatures, while keeping its broader lifecycle focus. The gap narrows, but the differences above remain.
Annex 22 and AI. The new Annex 22, published as a draft at the same time, addresses AI in GMP. It limits critical GMP applications to static, deterministic models, and keeps dynamic, continuously learning models and generative AI to non-critical uses with human oversight. We explore what that means for quality tools in How Pharma Teams Stay Compliant in an AI World.
What About Medical Devices?
Part 11 applies to medical device manufacturers' electronic records, alongside FDA's Quality Management System Regulation (QMSR), in effect since February 2, 2026. FDA's Computer Software Assurance guidance covers software used in device production and quality systems.
Annex 11 is an EU GMP guideline for medicines, so it doesn't apply to devices directly. In the EU, device manufacturers look instead to ISO 13485, which requires validation of software used in the quality management system.
What This Means for Labeling and Artwork Verification
Most comparisons of Part 11 and Annex 11 are written with lab systems and eQMS platforms in mind. The same rules apply to the tools used to verify labels and artwork, because those tools support a release decision.
The audit trail has to show what was compared, not just who logged in. A useful record shows which label version was compared against which approved master, what deviations were found, and how each was resolved, tied to specific document versions. The draft's broader audit trail scope makes this even more important. (Our Document Version Control guide covers why the version link matters.)
Label approvals need compliant electronic signatures. If artwork is approved electronically, the signature must be attributable to a named person, show what it means (reviewed or approved), and stay linked to the exact version signed.
The tool's vendor needs to be qualified. Under Annex 11, a comparison or proofreading tool's supplier falls within supplier oversight, particularly for cloud-based tools. Ask for the vendor's quality documentation, validation package, and hosting arrangements.
The tool needs periodic review. Include your comparison tool in the periodic review of computerized systems, not just at go-live. (See IQ, OQ, PQ: What Software Validation Means for Pharma QA.)
Deterministic comparison is easier to defend. A tool that produces the same traceable result from the same input fits both frameworks, and the direction set by Annex 22, far more easily than one whose output can vary.
A Practical Approach for Dual-Jurisdiction Teams
If you sell in both the US and EU, build one approach to the stricter requirement in each area:
- Use Part 11 as the baseline for records and signatures. It's the more detailed of the two.
- Add Annex 11's lifecycle elements: a risk assessment per system, supplier assessment and agreements, and documented periodic review.
- Plan for the draft now. The content is unlikely to change fundamentally, so gaps against it are worth closing early, especially on audit trails and e-signatures.
- Check your vendors. For every system supporting GMP decisions, including artwork verification, confirm what the vendor provides and what's your responsibility.
Frequently Asked Questions
What is the difference between Part 11 and Annex 11?Part 11 is an FDA regulation focused on electronic records and electronic signatures. Annex 11 is an EU GMP guideline covering the full lifecycle of computerized systems, with explicit expectations on risk management, supplier oversight, and periodic review.
What is 21 CFR Part 11 in simple words?It's the FDA rule that makes electronic records and electronic signatures as trustworthy as paper records and handwritten signatures, through validation, audit trails, access controls, and signature controls.
What are Annex 11 requirements?Validated computerized systems, risk management across the lifecycle, supplier and service provider oversight, audit trails, access and security controls, data integrity, electronic signatures, and periodic review.
Who does 21 CFR Part 11 apply to?Any organization keeping electronic records or using electronic signatures to meet FDA requirements, including drug and biologics manufacturers, device manufacturers, and organizations running FDA-regulated clinical and laboratory work.
Content Compare's audit trail and electronic signatures are built for both 21 CFR Part 11 and EU Annex 11, with every comparison tied to a specific document version, a validation package provided, and a deterministic comparison engine. See how it works on your own artwork.
