Is your GMP documentation system ready for the tightened demands, introduced by draft revisions to Annex 11 (Computerised Systems), the newly proposed Annex 22 (Artificial Intelligence), and updated Chapter 4 (Documentation) of EudraLex Volume 4? Without rigorous control, gaps in oversight and inconsistent record-keeping threaten data integrity in pharma, exposing your organization to inspection findings and regulatory risk. This article will show you how to build best practices in documentation and governance so you can meet these new regulatory expectations with confidence.

How does the ALCOA++ principle enhance data integrity in pharma documentation?

The ALCOA++ principle (Attributable, Legible, Contemporaneous, Original, Accurate + Complete, Consistent, Enduring, Available) is central to ensuring reliable records under the recent draft changes to Chapter 4 and Annex 11 of the EU GMP guidelines. Regulators are now emphasising that evidence of ALCOA++ must extend beyond paper documents to cover digital, hybrid and AI-driven systems.

From experience, many audit observations arise because companies apply ALCOA++ rigorously to batch records, but neglect to apply the same discipline to supporting electronic data (e.g. equipment logs, LIMS entries). For companies aiming for compliance, strong documentation practices must reflect ALCOA++ across the entire data lifecycle: data generation, collection, processing, storage, retrieval, archival, and destruction. That means clear version control, unambiguous audit trails, authorised access, and ensuring that changes are traceable. The obligations in the revised Annex 11, explicitly require handling of data, identity & access management, audit trails, electronic signatures, and security, all tied to ensuring data integrity in pharma.

If you’re evaluating how to implement or update your documentation systems, you might consider engaging with experts. For example, GMP consultants (as part of our GMP Qualified Person / consulting services) can assist with gap analyses, validation of processes and systems, and embedding ALCOA++ principles in documentation frameworks that will satisfy both Chapter 4 and Annex 11 revisions.

Key areas to review under ALCOA++ include:

• Attributable, timestamped entries for all records.
• Using systems that maintain original data and prevent unauthorised deletion or alteration.
• Application of metadata and audit trails to all changes.
• Managing hybrid systems (paper + electronic) under uniform standards.
• Retention policies ensuring data availability throughout its lifecycle.

What are the key requirements for audit trails under the revised annex 11?

Audit trails are becoming one of the most scrutinised elements under the new draft of Annex 11. Regulatory expectations now explicitly demand that audit trails be secure, complete, immutable, and able to reconstruct who did what, when, where, and why — especially where data manipulation, system changes, or deviations occur.

According to the draft, audit trails must be part of any computerised system used in GMP operations. This includes not just tracking user actions but also system-generated events, change controls, electronic signatures, and the handling of outsourced or supplier-managed software. All of these must support maintaining data integrity in pharma by ensuring traceability.

Our company understands how critical this is: through Consulting for pharmaceutical companies we assist organisations to design and validate audit trail systems that are inspection ready. We help define acceptance criteria, map system requirements, ensure audit trail configuration meets all regulatory expectations, and support training so staff understand proper use and review of audit logs.

New requirements reinforce that audit trails must:

• Resist tampering and not be disabled or overwritten
• Be periodically reviewed for anomalies or suspicious patterns (OOS)
• Integrate into overall data governance and risk management (per Chapter 4)
• Remain validated and preserved through software, configuration changes or system updates

In practice, we have seen multiple systems that generated audit trails but lacked procedures for review. Validation of not only the system but also the review process is now expected.

How should pharmaceutical companies manage data integrity in hybrid systems?

As draft revision to Chapter 4 emphasises, many organisations operate with hybrid documentation: part electronic, part paper based. Ensuring data integrity in pharma within such mixed systems means harmonising controls so that documents, regardless of medium, meet the same ALCOA++ standards.

Critical steps include defining clear SOPs for when to use paper, when electronic, and how transitions happen (e.g. scanning, importing). Metadata, timestamps, user roles, and audit trails must accompany any record that moves between formats. The draft of Chapter 4 also requires that hybrid records remain legible, complete, and retrievable at any time.

Additionally, change control processes must cover both the digital and physical aspects: if a paper-recorded procedure is converted into an electronic system, validation of the process, migration (if any), and measures to prevent data loss or corruption are essential. Risk management must assess potential weaknesses (e.g. loss of metadata, authentication for paper records, scanning accuracy). But ultimately, without ensuring data integrity in pharma, such systems will fail under regulatory inspection.

Hybrid documentation systems – risk quantification and inspection findings

In recent years, regulatory bodies and industry reports have repeatedly flagged hybrid documentation systems—those combining electronic record creation with printed paper summaries—as significant weak-spots for ensuring data integrity in pharma. As outlined by LCGC (2019), hybrid systems are “the worst possible computerized system” from a compliance standpoint due to difficulties in maintaining traceability between paper printouts and their electronic originals, ensuring secure, unbroken audit trails, and protecting metadata.

Authorities have reported that reviewing records from hybrid systems can take up to 50 % more time compared to fully electronic systems. This is because inspectors must cross-check paper and electronic components, validate the integrity of paper scans or printouts, confirm that metadata (timestamps, authorship, version control) is preserved, and verify that the link between paper and electronic versions is secure and maintained.

These inefficiencies are not just about time; they translate into risk: when data transitions are not rigorously controlled, there’s higher chance of discrepancies, lost metadata, or inconsistencies that can undermine data integrity in pharma. Under the proposed revisions in Annex 11 and Chapter 4, companies are expected to have formal, validated procedures for such transitions, documented change control, and robust audit trails that span both paper and electronic elements throughout the retention period, to ensure that regulatory expectations are met, and integrity of data is demonstrable.

What are the implications of Annex 22 for AI integration in GMP environments?

Annex 22 introduces for the first time a comprehensive regulatory framework for the use of AI/ML models in GMP environments. Key obligations include clear definition of intended use, rigorous validation plans, representative and high-quality training and test datasets, version control, human oversight, and continuous performance monitoring. All these are directed toward preserving data integrity in pharma in AI-driven subprocesses.

For instance, the draft requires that model training data must be demonstrably suitable (accurate, complete, not biased) and that test data reflect the operational environment. Also, change management is critical: any change to model parameters, data inputs, or algorithms must be tracked, validated, and documented. Explainability is another pillar; regulators expect that AI decisions affecting product quality or safety can be understood, traced, and where needed reviewed by humans.

Neglecting these requirements could lead to situations where AI outputs are not reproducible or cannot be audited, undermining trust and compliance. Ensuring that AI models do not introduce conflicts between automation and accountability is central to achieving and maintaining data integrity in pharma.

How can data governance frameworks support compliance with Annex 11 and Annex 22?

A robust data governance framework becomes not optional but foundational under the revised drafts. Such a framework must encompass policies, responsibilities, and technical controls covering data lifecycle, metadata, access, audit trails, validation, and oversight. These components all safeguard data integrity in pharma.

Key elements include defining data owners and stewards, specifying who is responsible for what at each stage (creation, processing, storage, archival, destruction). Integrating this with risk management, ensures that high-criticality data receive more rigorous governance. Governance must also address third-party services (per Annex 11) and the explainability of AI models (per Annex 22).

Technical controls under governance might include identity and access management, encryption, secure backups, software change controls, periodic review of system performance, and audit trail integrity. For AI under Annex 22, governance must additionally address explainability, model versioning, validation records, bias assessment, and transparent criteria for acceptance & revalidation. Without such a governance structure, organisations risk non-compliance and weak points that could compromise data integrity in pharma.

Governance framework effectiveness – measurable outcomes

Robust data governance frameworks are increasingly seen not just as regulatory checkboxes, but as measurable levers for improving data integrity in pharma through concrete outcomes. PIC/S guidance (“GXP Data Integrity Guidance Definitions,” PIC/S PI 041-1) emphasises that governance systems should be commensurate with risk and criticality of data, and that they must address both organisation-wide practices and technical controls across the full data lifecycle.

Empirical data supports this: organisations that have implemented formal data governance programmes report reductions in data errors and non-compliance findings. The APIC guide confirms that governance-driven risk management leads to earlier detection of inconsistencies and greater regulatory confidence. Such systems thereby contribute to stronger, more demonstrable data integrity in pharma, because every step of data handling, from generation to archival, is governed, measured, and reviewed.

What strategies ensure secure data archiving and retrieval in compliance with GMP?

Secure archiving and reliable retrieval are now emphasised in the revised Chapter 4 and Annex 11. To maintain data integrity in pharma, archived records—whether paper, digital, or hybrid—must remain legible, retrievable, and intact through the required retention period.

Good strategies include defining and validating backup and disaster recovery processes, ensuring encryption and physical security where appropriate, maintaining metadata so context isn’t lost, performing periodic checks of archived data for readability, bit-rot or format obsolescence. Also, migration plans are needed when format changes or system upgrades are envisaged. All these tasks must be documented.

Automated archival systems should generate their own audit trails to show when data was archived, by whom, where, and how access can be restored. Retrieval tests should be carried out that simulate an inspection scenario. By doing this, organisations show inspectors that archival systems are not a “dark corner” but fully controlled components that uphold data integrity in pharma.

How does the integration of quality risk management enhance data integrity in pharma?

Quality Risk Management (QRM) is now woven more deeply into every relevant part of the drafts: Documentation (Chapter 4), Computerised systems (Annex 11), and AI (AI/ML, models, new Annex 22). Applying risk-based thinking ensures that effort and controls are proportionate to the potential impact on product quality, patient safety, or data integrity in pharma.

In practice, this means categorising data types by criticality (e.g. sterility data, potency assays vs routine QC logs), identifying threats to data integrity (unauthorised access, system failure, digital corruption), assessing likelihood & consequences, and implementing controls accordingly. Under Annex 11, high-risk computerised systems or supplier services may demand stricter supplier oversight, tighter access control, more frequent validation or review. Under Annex 22, risk management guides selection of acceptable AI models, limits use of models with dynamic or probabilistic behaviour, demands rigorous monitoring.

In our experience, risk-based frameworks not only satisfy regulators but also improve internal confidence in data-driven decision-making, ensuring that the organisation strengthens its ability to protect, prove, and maintain data integrity in pharma throughout its operations.

Read also:

• Why are GMP guidelines and GMP requirements essential for compliance?
• GMP compliance meaning: 6 most common pitfalls – and how to prevent them
• Why is GMP training for employees essential – and what should it cover?

Sources: 1 – Chromatography Online. (2019, March 1). Data Integrity Focus, Part III: What Is the Problem with Hybrid Systems?, 2 – PIC/S (Pharmaceutical Inspection Co-operation Scheme). (2021, July 1). PIC/S PI 041-1: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments., 3 – EC. Stakeholders’ Consultation on EudraLex Volume 4 – Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and New Annex 22