Raising the Bar in GxP Compliance – Part 24: Annex 11 Revisited – Mastering System Lifecycle & Supplier Oversight
Welcome to the twenty-fourth edition of Raising the Bar in GxP Compliance, Rephine’s expert-led blog series for QA, IT, and regulatory professionals. In this instalment, we explore the EMA’s 2025 draft revision of Annex 11, which places renewed emphasis on lifecycle management and supplier oversight for GxP computerised systems. As cloud-based platforms, SaaS solutions, and outsourced IT services become more common, regulators are calling for stronger, risk-based controls throughout the system lifecycle. Discover how Rephine helps clients stay ahead of compliance expectations by building robust, inspection-ready frameworks that ensure data integrity, quality, and operational resilience.
As digital systems take centre stage in GxP operations, compliance no longer stops at validation.
Regulators now expect end-to-end control—from system design to supplier oversight—throughout the entire lifecycle. Annex 11 isn’t just evolving. It’s raising the stakes.Â
As part of the EMA’s July 2025 draft revision of Annex 11, the role of lifecycle control and supplier oversight has become more central than ever in GxP-regulated computerised systems. The update reinforces the need for pharmaceutical and biotech companies to treat digital systems with the same rigour as traditional manufacturing equipment.
Annex 11 2025: Why System Lifecycle Management is Critical
Key Stages in the Computerised System Lifecycle
Computerised systems used in GxP operations must now follow a fully documented system lifecycle approach that includes:
- Clear definition of intended use
- System design and configuration records
- Validation planning and testing
- Change control and periodic review
- Decommissioning and data retention protocols
This approach ensures that systems remain fit for purpose throughout their operational life, with QRM principles applied at every step.
Strengthening Supplier Oversight in GxP Computerised Systems
One of the most notable additions in the new Annex 11 is the emphasis on external supplier control, especially for:
- Cloud-based solutions and SaaS platforms
- Outsourced IT services and infrastructure
- Custom-developed or validated systems
Companies must be able to demonstrate:
- Supplier qualification procedures
- Defined roles and responsibilities in technical agreements
- Oversight of system maintenance, incident management, and updates
This reflects growing regulatory scrutiny around data ownership, access control, and shared responsibility between regulated entities and their IT vendors.
Annex 11 Compliance Challenges for Pharma and Biotech
- Legacy systems with limited documentation or outdated validations
- Weak change control processes or missing periodic reviews
- Lack of formal supplier assessments or unclear SLAs
- Fragmentation between IT, QA and end-user departments
How Rephine Supports Annex 11 Readiness
Rephine supports clients in:
✅ Mapping full computerised system lifecycles and remediating gaps
✅ Updating validation and documentation packages
✅ Designing effective supplier qualification and oversight frameworks
✅ Facilitating collaboration between IT, QA and vendors
✅ Preparing for inspection readiness under the revised Annex 11
🧠This article is part of Rephine’s strategic content series on the 2025 EMA GMP guideline revisions.
Dr. Eduard Cayón
CSO (Chief Scientific Officer)
About the Author:
Dr. Eduard Cayón is the Chief Scientific Officer (CSO) at Rephine, a global leader in GxP compliance and quality assurance.
We don’t just deliver audits or consultancy services — we partner with clients at every stage of their quality journey, offering end-to-end solutions that empower confidence and compliance.
With over 25 years of experience, Rephine has built an enviable reputation as the gold standard in the industry operating from four primary locations: Stevenage in the UK, Barcelona in Spain, India, and Shanghai in China.
Dr. Cayón, who holds a Ph.D. in Organic Chemistry, is a deeply experienced pharmaceutical industry consultant and auditor.
He is dedicated to supporting pharmaceutical, biotech, and medical device companies in meeting the highest standards of manufacturing and supply chain integrity.
