What do EU GMP Annex 11 and ALCOA+ ask of a document automation system?
Updated October 2026 · By Scott Thompson, Founder
The short answer
Annex 11 is the EU GMP rule for computerised systems, and ALCOA+ is the data-integrity standard regulators apply under it: records must be attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available. A document system meets them with named actors on every action, a tamper-evident trail, kept originals, readable copies, retention, role-based access, and signatures where required. DynamoDocs provides those controls; validation, periodic review, and backups stay with you or your deployment.
ALCOA+, one letter at a time
Attributable: every ingest, edit, review decision, and export names the person who did it, never a shared account. Legible: any record prints as an inspection copy. Contemporaneous: each entry is time-stamped when the action happens. Original: the file as received is kept beside the data read from it. Accurate: validation checks every document and every edit keeps the before and after value. Complete: records are archived, never deleted, with their full history. Consistent: the history is hash-chained, so its order and content can be verified. Enduring: each record carries a retention date. Available: a copy can be produced at any time, for archived records too.
Annex 11, clause by clause
Audit trails (clause 9): append-only and hash-chained, with named actors, before/after values, and a reason for every change. Change and configuration management (10): every change to settings, rules, mappings and user access is kept in an attributed, tamper-evident change log. Printouts (8): inspection copies that carry their own integrity check. Security (12): four server-enforced roles, Microsoft 365 or Google sign-in, inactivity sign-out and account lockout. Audit-trail review (9): a built-in review flags edits after release, review overrides, re-posts and archives for a period, and records who reviewed it. Electronic signature (14): optional, re-authenticated at signing, with meaning and time, permanently linked to the record. Archiving (17): archive instead of delete, with retention dates. Accuracy checks (6): validation and matching on every document.
Reasons for change
Clause 9 asks for the reason when GMP-relevant data is changed or deleted. Every field edit in DynamoDocs records one. A reviewer can type it; if they do not, it is recorded as a correction of the AI reading, or of an earlier edit of the same field, and marked as recorded automatically. That default is accurate because edits are only possible before a document is posted. Archiving can be set to require a reason. Reasons appear in the history and on the inspection copy.
What stays with you
Validation (clause 4), periodic evaluation (11), incident management (13), and backups and business continuity (7, 16) belong to you and to how the system is deployed.
AI extraction under GMP
A revised draft of Annex 11 and a new draft Annex 22 on artificial intelligence were published for consultation in 2025. The Annex 22 draft takes a cautious line on generative AI in GMP-critical applications. Purchase orders and invoices are usually not GMP-critical records, but if yours are, DynamoDocs can be set so that no extracted value is released without a person reviewing it: straight-through posting off, the review gate on, and a signature on every release.
Related questions
Is Annex 11 the same as Part 11?
They overlap heavily (audit trails, access control, signatures, retention), but Annex 11 adds explicit expectations for a reason on changes, change management, periodic review, and business continuity. A system built for one is most of the way to the other.
Do you supply validation documents?
We provide the control-by-control description and the named automated tests behind each control, which your quality team can use in its validation. The validation itself, for your intended use, is yours.
Go deeper
See it on your documents
Bring a real invoice, PO, or RFQ and watch DynamoDocs take it from inbox to posted in your ERP in about 30 minutes.
More answers