Raising the Bar in GxP Compliance – Part 25: Data Integrity & Audit Trails in Annex 11 – Securing Trust in Every Record.
Welcome to the twenty-fifth instalment of Raising the Bar in GxP Compliance, Rephine’s expert-led blog series for QA and regulatory professionals. In this edition, we unpack the EMA’s 2025 draft revision of Annex 11, which significantly strengthens expectations for data integrity, audit trails, and ALCOA+ compliance. With regulators worldwide intensifying scrutiny on how digital systems capture, protect, and trace GxP-critical data, organisations must ensure complete transparency of who did what, when, and why—underpinned by robust technical and procedural controls. Discover how Rephine helps companies close data integrity gaps, validate system audit trail functions, and embed compliance into every stage of the data lifecycle.
The EMA’s latest Annex 11 update raises the stakes for data integrity.
From system-generated, immutable audit trails to role-based access and ALCOA+ compliance, regulators are making it clear: every data point must be trustworthy, transparent, and inspection-ready. The question is—are your systems keeping up?
Audit Trails and Data Integrity: Strengthened Controls Under the New Annex 11
The EMA’s 2025 draft revision of Annex 11 – Computerised Systems significantly raises the bar for data integrity and audit trail controls. These updates reflect growing regulatory scrutiny of how digital systems record, manage, and protect GxP-relevant data throughout its lifecycle.
Why This Update Matters
Regulators have repeatedly flagged issues related to poor data practices, missing audit trails, and weak system security in inspections across the globe. The new Annex 11 positions data integrity as a cornerstone of digital compliance and makes clear what is expected:
- Full traceability of who did what, when, and why
- Immutable audit trails that are automatically generated, time-stamped, and reviewable
- Clear segregation of roles and access rights
- Application of ALCOA+ principles across all data records
- Technical controls to ensure data security, recovery and backup
Key Requirements Of The Revised Annex 11
- System-generated audit trails must be enabled for all critical GxP data entries and changes.
- Audit trails must be reviewed periodically and during investigations, with clear procedural ownership.
- Access control systems must prevent unauthorised modifications and protect original data.
- Data must remain accurate, legible, contemporaneous, original, attributable — as per ALCOA+.
- Backup and data recovery procedures must be validated and tested.
Common Gaps In Industry Practice
- Audit trail functions disabled or not validated
- No clear SOPs for routine audit trail review
- Shared user credentials or weak access security
- Lack of version control or metadata retention
- Backup systems not aligned with system criticality
How Rephine Can Help
Rephine helps clients strengthen their data integrity posture by:
✅ Performing data integrity audits and remediation planning
✅ Supporting audit trail gap assessments and testing
✅ Updating SOPs for audit trail review and access management
✅ Integrating ALCOA+ principles into IT system lifecycle protocols
✅ Preparing for inspection readiness with risk-based evidence
📅 Public consultation closes 7 October 2025. This article is part of Rephine’s ongoing series on the EMA 2025 GMP updates.
Dr. Eduard Cayón
CSO (Chief Scientific Officer)
About the Author:
Dr. Eduard Cayón is the Chief Scientific Officer (CSO) at Rephine, a global leader in GxP compliance and quality assurance.
We don’t just deliver audits or consultancy services — we partner with clients at every stage of their quality journey, offering end-to-end solutions that empower confidence and compliance.
With over 25 years of experience, Rephine has built an enviable reputation as the gold standard in the industry operating from four primary locations: Stevenage in the UK, Barcelona in Spain, India, and Shanghai in China.
Dr. Cayón, who holds a Ph.D. in Organic Chemistry, is a deeply experienced pharmaceutical industry consultant and auditor.
He is dedicated to supporting pharmaceutical, biotech, and medical device companies in meeting the highest standards of manufacturing and supply chain integrity.
