Annex 11 compliant EDC: what to check, and what Capture covers

Annex 11 sits in Volume 4 of EudraLex, the EU guidelines for good manufacturing practice, and PIC/S carries an equivalent annex in its own GMP guide. It has a short principle and 17 clauses grouped into general requirements (risk management, personnel, suppliers and service providers), the project phase (validation) and the operational phase (data, accuracy checks, storage, printouts, audit trails, change management, periodic evaluation, security, incident management, electronic signatures, batch release, business continuity and archiving). The core idea is that replacing a manual process with a computerised one must not reduce product quality, process control or quality assurance.

Strictly, Annex 11 is a GMP text. An EDC that holds trial data is inspected under GCP, and the EMA's 2023 computerised systems guideline is the document EU GCP inspectors apply to eCRFs, ePRO, IRT and the cloud services behind them. Buyers still ask for an "Annex 11 compliant EDC" for good reasons: many QA teams come from GMP, PIC/S member inspectorates use Annex 11 vocabulary, and vendor questionnaires often use its clauses as the checklist. The two documents ask for similar evidence, so mapping an EDC against Annex 11 is a sensible exercise as long as you also read the GCP guideline. If you need the US side as well, see Annex 11 vs 21 CFR Part 11.

The audit trail is written by database triggers, one row per changed field, with the user, timestamp, old value, new value and reason for change. The database blocks updates and deletes on audit rows, and each row carries a SHA-256 hash chained to the previous row for that study, so a gap or an edit breaks the chain. The server records the IP address, and technical events go to a separate system log so the GCP trail holds only regulated actions. Clinical data is soft-deleted only; hard deletes are blocked. More detail is on the audit trail software page.

Staff signatures ask for the password again and store a meaning statement. On eConsent, the participant's signature is confirmed with an emailed one-time code, the investigator countersigns, and each signature is hashed to the exact document content at signing. Access follows study roles, with personal data segregated so researchers see coded IDs while site coordinators see names, enforced by row-level security in the database rather than only in the interface. Staff can turn on two-factor authentication with an authenticator app, and sessions end after inactivity with a countdown warning first. See role-based access control and electronic signatures.

Annex 11 speaks to the regulated user throughout. Clause 3 asks you to assess your supplier and put the arrangement in a formal agreement. Clause 4 asks for validation evidence that fits your intended use, which a vendor can support but not replace. Clause 11 asks you to come back and review the system periodically. The EMA clinical guideline makes the same point for trials: the sponsor and investigator stay responsible even when a service provider runs the system, and inspectors expect to see the documentation the sponsor relied on.

Treat the vendor's controls as inputs to your own file. A good starting point is the computer system validation guide, followed by the vendor security questionnaire for the supplier assessment.