For fifteen years, the EU’s rules for computerised systems in GMP manufacturing sat in a five-page document: Annex 11, last revised in 2011. That is changing. In July 2025, the European Commission and PIC/S published a draft revision that grows Annex 11 to 19 pages across 17 sections. Consultation closed on 7 October 2025, and the final text is expected after that, with the date it comes into force to be set when it is published.
If your plant exports to the EU or UK, or supplies customers who do, this matters for every automated system on your floor, including process skids. And for plants supplying the US, 21 CFR Part 11 has set the rules for electronic records and signatures for years. This article looks at what both mean for the automation you specify on new process equipment.
What is changing in Annex 11
The draft is not a light update. The areas that grew most are security, identity and access management, qualification and validation, audit trails, and supplier management. Cybersecurity is treated as a core GMP requirement for the first time.
For process equipment, three changes stand out:
- Audit trails capture more. Under the draft, audit trails must record when data is created, not only when it is changed or deleted.
- Access is tied to the individual. Users should be identified individually, with access limited to what their role needs.
- Supplier documentation is in scope. Where a manufacturer relies on a supplier’s qualification work, the draft sets expectations for how that reliance is justified and documented.
The revision was drafted together with PIC/S, which means its influence is likely to extend beyond the EU to the many regulators that follow PIC/S guidance.
Part 11 and Annex 11 side by side
The two are not the same regulation, but for a process skid they point in the same direction.
| Topic | 21 CFR Part 11 | EU GMP Annex 11 (draft revision) |
| Where it applies | FDA-regulated products for the US market | Medicinal products for the EU market |
| Core focus | Electronic records and electronic signatures | The whole lifecycle of computerised systems |
| Audit trail | Required for creation, modification and deletion of records | Expanded, including data creation events |
| Access control | Limited to authorised individuals | Individual identity and role-based access, with more detail on security |
| Suppliers | Not a main focus | Specific expectations for relying on supplier work |
What this means for process skid automation
A process skid’s automation creates GMP data every time it runs: temperatures, weights, times, alarms, operator actions. Under both frameworks, that data has to be attributable to a person, protected from change, and available for review. In practice, that means your URS should ask clear questions about four things:
- Who can do what. Individual user accounts, role-based permissions, and no shared logins.
- What gets recorded. An audit trail that captures creation, change and deletion, with the time and the user.
- How records are kept. Electronic batch records, backup, and a tested way to restore them.
- What the supplier hands over. Documents that show how the system was designed, tested and qualified.
What Esteril’s automation delivers
Esteril designs automation for process skids, vessels and CIP/SIP systems, working with Siemens, Schneider, Allen Bradley and Mitsubishi platforms. Systems are built to USFDA 21 CFR Part 11 and GAMP 5 guidelines. Key features include:
- PLC-SCADA open solution
- HMI or IPC for centralised control
- Electronic batch records (EBR)
- Audit trail
- Backup facility
Esteril’s electrical and automation team works with process specialists to design the automation sequences, so the control logic reflects how the process actually runs. More on our pharmaceutical automation and complex process skids.
Supplier documentation you can rely on
The draft Annex 11 gives more attention to how manufacturers rely on supplier work. That makes the supplier’s documentation package more important, not less. For every system, Esteril provides DQ, FAT, IQ, OQ and PQ protocols. FAT is carried out at Esteril’s dedicated testing facility before shipment. After OQ, Esteril hands over the final approved programmes and editable drawings, so your team is not dependent on the supplier to understand or maintain the system. Read our guide to FAT and SAT .
URS checklist for skid automation
| URS item | What to ask for |
| User access | Individual accounts, role-based permissions, password rules |
| Audit trail | Events captured, including creation, change and deletion, with user and time |
| Electronic signatures | Where signatures are needed and how they are applied |
| Batch records | EBR content and format |
| Backup and restore | Backup method, frequency and restore test |
| Platform | Preferred PLC and SCADA platform for your site |
| Validation documents | DQ, FAT, IQ, OQ, PQ scope, and FAT witness plan |
| Handover | Final programmes and editable drawings after OQ |
Frequently Asked Questions
Has the new Annex 11 come into force?
Not as of this article. The draft revision was published in July 2025 and consultation closed in October 2025. The date it comes into force will be set in the final text. Many manufacturers are using the draft as a checklist now rather than waiting.
Which PLC platforms does Esteril work with?
Siemens, Schneider, Allen Bradley and Mitsubishi.
Do we receive the programme after commissioning?
Yes. Esteril hands over the final approved programmes and editable drawings after OQ.
Talk to Esteril
Writing a URS for a new process skid? Send it to Esteril’s automation team for a review against 21 CFR Part 11 and GAMP 5. Contact our engineering team.
