EU GMP Annex 11
ActiveSpecialized framework
Best for: Pharmaceutical manufacturers, CMOs, and CROs operating computerized systems in EU GMP-regulated facilities. If you manufacture medicinal products for the EU market, or export finished products or APIs to EU member states, Annex 11 applies to every computerized system involved in manufacturing, quality control, and batch release. No company size or revenue threshold applies.
| Mandatory? | Mandatory for pharmaceutical manufacturers in/exporting to EU |
|---|---|
| Who validates? | EMA/national authority GMP inspection. No self-assessment. |
| Renewal | No fixed cycle; tied to GMP inspection schedule |
| Scope | Computerized systems in pharmaceutical manufacturing and QC |
| Governing body | European Commission, published within EudraLex Volume 4 (EU Guidelines for Good Manufacturing Practice). Enforcement is carried out by national competent authorities (e.g., MHRA in the UK pre-Brexit, BfArM/ZLG in Germany, ANSM in France) and coordinated through the European Medicines Agency (EMA)., EU GMP Annex 11 (2011). Official source |
Get started
Point the module source at the EU GMP Annex 11 endpoint and pin a version range you reviewed:
module "..." {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}eugmpannex11.compliance.tf lists every EU GMP Annex 11 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Audit Trail Completeness | CloudTrail controls verify regional coverage, read/write event capture, S3 object-level logging, and security trail configuration. Together they map directly to the system-generated audit trail requirements in Annex 11 Section 9. | Identify which S3 buckets contain GMP-relevant data. Write the audit trail review procedure, train QA staff on it, and document the scope rationale in your validation records. |
| Encryption at Rest | Checks encryption on API Gateway caches, backup recovery points, CloudTrail log files, CodeBuild artifacts, and CodeBuild S3 logs, with KMS customer-managed key usage validated where applicable. | Key management procedures, rotation schedules, IAM-based key access restrictions, and a documented encryption strategy tied to your system risk assessment per Annex 11 Section 1. |
| Encryption in Transit | Confirms that CloudFront distributions enforce encryption to custom origins and reject deprecated SSL protocols (SSLv3, TLSv1.0). | Application-layer communications, VPN tunnels, and data exchange interfaces with contract partners fall outside this benchmark. Document permitted cryptographic protocols in your system security policy. |
| Backup and Recovery | Confirms that backup plans meet 35-day minimum retention, recovery points are not prematurely expired, and manual deletion of recovery points is disabled. | Periodic restoration testing and documentation per Section 7.2. Confirm retention periods match your product-specific requirements, which may exceed 35 days for products with long shelf lives. Maintain a business continuity plan per Section 16. |
| Configuration Management | Validates that AWS Config is enabled in all regions and that the configuration recorder delivers logs without failure. | Build a formal change control procedure per Section 10 that integrates AWS Config data into your change assessment process. Document configuration baselines for validated systems and complete impact assessments before changes are approved. |
Controls by category
65 of 85 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 20 are Mapped only: EU GMP Annex 11 lists them, no compliance.tf module checks them.
Audit Trail (Section 9)
Incomplete audit trail coverage is the most common Annex 11 finding in cloud environments. Section 9 requires a system-generated record of all GMP-relevant changes and deletions, capturing who changed what, when, the old and new values, and why. Missing S3 object-level logging or gaps in multi-region trail coverage leaves no traceable history for GMP-critical data stores, which inspectors will flag as a direct deficiency.
| Control | Status |
|---|---|
| CloudTrail trails should have at least one enabled trail present in a region | Mapped |
Data Integrity and Encryption at Rest (Sections 7.1, 7.2)
When examining cloud-hosted validated systems, inspectors ask to see evidence that stored data is protected with customer-managed keys, not default service encryption. Sections 7.1 and 7.2 require controls that maintain data integrity throughout the retention period, which extends to backups and log archives. Build artifacts and cached API responses are frequently overlooked gaps that surface during inspection.
Data Storage and Business Continuity (Sections 7.2, 16)
Expect requests for backup retention policy documentation, restoration test records, and confirmation that backup data cannot be manually deleted or tampered with. Section 7.2 requires regular backups with integrity checks and restoration capability; Section 16 requires business continuity arrangements. A 35-day minimum retention aligns with typical batch review and release timelines, but validate this period against your own product lifecycle requirements.
| Control | Status |
|---|---|
| Backup plan rules should retain recovery points for at least 35 days | Mapped |
Monitoring and Incident Management (Section 13)
The first thing an assessor checks here is whether alarms actually do something. Section 13 requires incident reporting, assessment, and root cause identification. A CloudWatch alarm with no configured action is invisible to your incident management process and provides no defensible evidence during inspection.
| Control | Status |
|---|---|
| CloudWatch alarms should have an action configured | Enforced |
Additional controls (78)
AWS AppSync (2)
| Control | Status |
|---|---|
| AppSync GraphQL APIs should not use API key authentication | Enforced |
| AppSync API caches should have encryption at rest enabled | Enforced |
AWS Database Migration Service (1)
| Control | Status |
|---|---|
| DMS replication instances should not be publicly accessible | Enforced |
AWS Lambda (2)
| Control | Status |
|---|---|
| Lambda functions should be in a VPC | Enforced |
| Lambda functions should restrict public URL | Enforced |
AWS Secrets Manager (1)
| Control | Status |
|---|---|
| Secrets Manager secrets should be encrypted using CMK | Enforced |
AWS Step Functions (1)
| Control | Status |
|---|---|
| Step Functions state machines should have logging enabled | Enforced |
Amazon CloudWatch (1)
| Control | Status |
|---|---|
| CloudWatch log groups should have retention period of at least 365 days | Enforced |
Amazon CloudWatch Logs (1)
| Control | Status |
|---|---|
| Log groups should have encryption at rest enabled | Enforced |
Amazon DynamoDB (3)
Amazon DynamoDB Accelerator (1)
| Control | Status |
|---|---|
| DynamoDB Accelerator (DAX) clusters should be encrypted at rest | Mapped |
Amazon EBS (2)
| Control | Status |
|---|---|
| Attached EBS volumes should have encryption enabled | Enforced |
| EBS snapshots should be encrypted | Mapped |
Amazon EC2 (8)
Amazon EFS (2)
| Control | Status |
|---|---|
| EFS file systems should have encryption at rest enabled | Enforced |
| EFS file systems should be encrypted with CMK | Enforced |
Amazon EKS (1)
Amazon EMR (1)
| Control | Status |
|---|---|
| EMR cluster Kerberos should be enabled | Mapped |
Amazon ElastiCache (1)
Amazon Kinesis (1)
| Control | Status |
|---|---|
| Kinesis streams should have server side encryption enabled | Mapped |
Amazon MSK (2)
| Control | Status |
|---|---|
| MSK clusters should have public access disabled | Enforced |
| MSK clusters should disable unauthenticated access | Enforced |
Amazon OpenSearch Service (3)
Amazon RDS (12)
Amazon Redshift (4)
Amazon S3 (18)
Amazon SNS (1)
| Control | Status |
|---|---|
| SNS topics should be encrypted at rest | Enforced |
Amazon SQS (2)
| Control | Status |
|---|---|
| SQS queues should have encryption at rest enabled | Enforced |
| SQS queues should be encrypted with KMS CMK | Enforced |
Amazon SageMaker (2)
Amazon VPC (2)
Elastic Load Balancing (2)
Other (1)
| Control | Status |
|---|---|
| ES domain encryption at rest should be enabled | Mapped |
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST Cybersecurity Framework v1.1 | High 86% | |
| Title 21 CFR Part 11 | High 84% | |
| PCI DSS v4.0 | High 82% |
Frequently asked questions
Does Annex 11 apply to cloud-hosted systems, or only on-premise infrastructure?
Annex 11 applies to any computerized system used in GMP operations regardless of hosting model. Cloud-hosted systems (AWS, Azure, GCP) fall fully within scope. Section 3.4 explicitly addresses the use of service providers, requiring a formal agreement defining responsibilities and the ability for the regulated company to audit or inspect the provider. In practice, your cloud landing zone configuration, encryption settings, and logging are all subject to inspection.
How does Annex 11 enforcement differ from a certification audit like ISO 27001?
There is no Annex 11 certification. Compliance is assessed during routine GMP inspections by national competent authorities. Inspectors review your computerized system inventory, validation documentation, audit trail configurations, and data integrity controls as part of the broader GMP inspection. Non-compliance findings are recorded as GMP deficiencies (critical, major, or other) and can result in warning letters, restricted or suspended manufacturing licenses, or product recalls.
What is the relationship between Annex 11 and GAMP 5?
Annex 11 is the regulation. GAMP 5 (Good Automated Manufacturing Practice) is an industry guidance document published by ISPE that provides a risk-based approach to achieving compliance with Annex 11 and 21 CFR Part 11. It categorizes software into categories (1, 3, 4, 5) to scale validation effort proportionally. Regulators reference GAMP 5 frequently, but it carries no legal force on its own.
How do the AWS controls in this mapping relate to Annex 11 sections?
The controls map primarily to five Annex 11 sections. Section 9 (Audit Trails) is covered by CloudTrail controls. Sections 7.1 and 7.2 (Data Storage and Integrity) map to encryption-at-rest and backup controls. Section 12.1 (Security) maps to encryption-in-transit controls. Section 10 (Change and Configuration Management) maps to AWS Config controls. Section 13 (Incident Management) maps to CloudWatch alarm controls. These are infrastructure-level checks. Application-layer validation, SOPs, and user access management require separate assessment.
Is a 35-day backup retention period sufficient for Annex 11 compliance?
It depends on the data type and product lifecycle. Annex 11 Section 7.2 requires backups at regular intervals but does not prescribe a specific retention period. EU GMP Chapter 4 requires batch documentation to be retained for at least one year after expiry of the batch, which can mean 5 or more years for some products. The 35-day minimum in these controls is a baseline for operational recovery, not a substitute for long-term archival retention. Define retention periods based on your own risk assessment and product portfolio.