EU GMP Annex 11 Compliance

This document maps Cohera platform features to EU GMP Annex 11 requirements for computerized systems. Annex 11 applies to all forms of computerized systems used as part of GMP regulated activities.

Overview

EU GMP Annex 11 (revised 2011) provides guidance on computerized systems used in pharmaceutical manufacturing and quality management. It emphasizes risk management, data integrity, and proper validation throughout the system lifecycle.

Note

This document describes platform capabilities. Implementation of appropriate procedures and system validation remains the responsibility of the user organization.

General Requirements

1. Risk Management

Requirement	Cohera Implementation
Risk assessment throughout lifecycle	Cohera provides system documentation supporting risk assessment. Platform architecture designed to mitigate common risks.
Risk-based validation approach	Validation documentation supports risk-based approach per GAMP 5. System complexity documented for categorization.

2. Personnel

Requirement	Cohera Implementation
Defined responsibilities	Role-based access control supports defined responsibilities. Permissions documented per role.
Training documentation	Training acknowledgment workflows available. System access requires documented training completion.
IT and GMP cooperation	Platform documentation supports collaboration between IT and QA teams.

3. Suppliers and Service Providers

Requirement	Cohera Implementation
Supplier qualification	Cohera maintains ISO 27001 certification, SOC 2 Type II audit reports available.
Formal agreements	Service Level Agreement (SLA) documents responsibilities and service levels.
Audit rights	Customer audit rights documented in contract. Remote and on-site audits supported.

Operational Phase

4. Validation

Requirement	Cohera Implementation
Documented evidence	IQ/OQ/PQ protocols provided. Test scripts and expected results documented.
User requirements	URS template provided for customer requirements documentation.
Quality and functionality	Validation covers all quality-critical functions. Traceability matrix links requirements to tests.
Change control	All platform changes undergo documented change control process. Release notes document changes and validation impact.

5. Data

Requirement	Cohera Implementation
Built-in checks	Input validation, range checks, and format validation enforced.
Data integrity	ALCOA+ principles implemented throughout platform.
Manual entries	Manual data entry logged with user attribution.
Critical data verification	System supports second-person verification workflows.

6. Accuracy Checks

Requirement	Cohera Implementation
Input/output verification	Data validation on entry. Export verification checksums.
Critical processing	Critical calculations logged with audit trail.

7. Data Storage

Requirement	Cohera Implementation
Physical and logical security	Data encrypted at rest (AES-256) and in transit (TLS 1.3). Access controlled by authentication and authorization.
Backup verification	Automated backups with integrity verification. Recovery testing documented.
Accessibility throughout retention	Data remains accessible throughout configured retention period (up to 25 years).
Data migration testing	Data migration procedures documented and tested during upgrades.

8. Printouts

Requirement	Cohera Implementation
Clear copies	Data exportable in clear, readable formats (PDF, CSV, Excel).
Audit trail printout	Complete audit trails exportable with all required fields.
Data change indication	Printed records indicate current status and version.

9. Audit Trails

Requirement	Cohera Implementation
GMP relevant changes recorded	All changes to GMP data recorded with: timestamp, user ID, before value, after value.
Create, modify, delete operations	All CRUD operations logged. Deletions are soft-deletes with full audit trail.
Record linkage	Audit records linked to source records. Cannot be deleted independently.
Regular review	Audit trail review workflows available. Reports for trend analysis.

Tip

Cohera’s audit trail captures all changes automatically. No additional configuration is required for GMP-relevant data tracking.

10. Change and Configuration Management

Requirement	Cohera Implementation
Configuration documentation	System configuration documented and versioned.
Controlled changes	Platform changes follow documented SDLC. Customer configuration changes logged.
Validated state maintenance	Validation status tracked. Impact assessment provided with releases.

11. Periodic Evaluation

Requirement	Cohera Implementation
Performance review	System health dashboards and metrics available.
Functionality verification	Platform functionality verified with each release through automated testing.
Validation status assessment	Annual review support documentation provided.

12. Security

Requirement	Cohera Implementation
Physical and logical controls	Multi-layer security architecture. Data center security per ISO 27001.
Record protection	Records protected from unauthorized modification. Encryption at rest and in transit.
Authentication mechanisms	Username/password with configurable complexity. MFA available. SSO integration supported.
Authorization records	Permission changes logged in audit trail.
Access control management	Role-based access control. User provisioning/deprovisioning workflows.
Data management systems	Security controls apply to archived and backup data.

13. Incident Management

Requirement	Cohera Implementation
Incident reporting	Security incident reporting procedures documented. Customer notification within 24 hours for critical incidents.
Root cause analysis	Incident investigation and remediation documented.
Corrective/preventive actions	CAPA process for significant incidents.

14. Electronic Signature

Requirement	Cohera Implementation
Binding and equivalence	Electronic signatures permanently linked to records. Legally binding per agreement.
Date and time inclusion	Signature timestamp recorded with each signature.
Authority verification	System validates signer has required authority for specific signature type.

15. Batch Release

Requirement	Cohera Implementation
QP release support	Batch release workflows support Qualified Person review and release.
Electronic record review	All batch-related records accessible for review prior to release.
Release signature	QP release signature captured with meaning and timestamp.

16. Business Continuity

Requirement	Cohera Implementation
Continuity measures	Redundant infrastructure across availability zones.
Documented procedures	Business continuity and disaster recovery procedures documented.
Manual operations	Manual backup procedures documented for critical failures.
Restoration testing	Disaster recovery testing performed and documented annually.

17. Archiving

Requirement	Cohera Implementation
Data archiving	Automated archiving based on retention policies.
Integrity and accessibility	Archived data integrity verified. Accessible throughout retention period.
Retrieval procedures	Data retrieval procedures documented. Export available in standard formats.

Implementation Guidance

Data Integrity Controls

Cohera implements ALCOA+ principles:

ALCOA+ Principle    Cohera Control
─────────────────   ──────────────────────────────────────
Attributable        User ID linked to every action
Legible            Clear data display, PDF export
Contemporaneous    Real-time timestamping (UTC)
Original           Original records preserved immutably
Accurate           Input validation, checksums
Complete           Audit trail with no gaps
Consistent         Standardized data entry, workflows
Enduring           Encrypted storage, redundancy
Available          24/7 access, export capability

Audit Trail Content

Every audit record includes:

Field	Description
timestamp	UTC timestamp of action
user_id	Unique identifier of acting user
user_name	Full name of acting user
action	Type of action (create, update, delete, etc.)
entity_type	Type of record affected
entity_id	Unique identifier of affected record
previous_value	Value before change (for updates)
new_value	Value after change (for updates)
reason	User-provided reason (when required)
signature_id	Associated electronic signature (if applicable)
client_info	IP address, user agent

Electronic Signature Implementation

{
  "signature_id": "sig_abc123def456",
  "record_type": "deviation",
  "record_id": "qe_deviation_789",
  "action": "approval",
  "meaning": "I have reviewed this deviation and approve its closure",
  "signer": {
    "user_id": "user_quality_manager",
    "name": "Dr. Maria Schmidt",
    "role": "Quality Manager",
    "email": "m.schmidt@pharma.com"
  },
  "timestamp": "2024-01-20T14:30:00Z",
  "record_hash": "sha256:abc123...",
  "verification_status": "valid"
}

Validation Support

Validation Documentation Package

Cohera provides:

Document	Purpose
System Overview	Architecture and design description
Functional Specification	Detailed feature documentation
User Requirements Template	Template for customer URS
IQ Protocol	Installation verification tests
OQ Protocol	Operational functionality tests
PQ Protocol	Performance verification tests
Traceability Matrix	Requirements to test mapping
SOPs	Operating procedures

Periodic Review Checklist

Annual validation review should verify:

• System remains in validated state
• All changes properly controlled
• Audit trail integrity maintained
• Security controls functioning
• User access appropriately managed
• Backup/restore tested
• Incidents properly managed
• Training records current

Compliance Reporting

Generate Annex 11 compliance reports:

curl -X POST "https://api.cohera.io/v1/audit-logs/reports/annex11" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "2024-01-01T00:00:00Z",
    "to": "2024-03-31T23:59:59Z",
    "include_sections": [
      "data_integrity",
      "audit_trail_review",
      "electronic_signatures",
      "access_control_review",
      "change_control"
    ]
  }'

Tip

Contact your Cohera account manager to request the complete EU GMP Annex 11 compliance documentation package, including detailed requirement mappings and validation support materials.