Dutch authorities to focus on computerised systems during GMP inspections

Legal framework in the EU for GMP

Under Directive 2001/83/EC (Directive), the ‘Community code relating to medicinal products for human use’, the European Commission (EC) is empowered to adopt delegated acts to supplement the Directive by specifying the principles and guidelines of GMP for medicinal products¹. In the EU, Good Manufacturing Practices (GMP) guidelines are described in ”Eudralex”, in “ Volume 4”. It contains chapters focussing on basic requirements for medicinal products, including pharmaceutical quality systems; personnel; premise and equipment; documentation; production; quality control; outsourced activities; complaints and product recall; and self-inspection. These basic requirements are complemented by annexes focussing on specific areas within GMP, such as computerised systems (Annex 11)².

Guidelines for GMP-compliant use of CVS

Annex 11 (CVS) applies to all forms of CVS, used as part of GMP regulated activities. It concerns software as well as hardware components. Risks associated with the use of CVS must be managed throughout their lifecycle, considering patient safety, data integrity and product quality. To this end, decisions on the extent of validation and data integrity controls should be based on a justified and documented risk assessment of the computerised system. In anticipation of the announced series of pilot inspections, manufacturing authorizations holders may consider ensuring that:³

• an up-to-date listing of all relevant systems and their GMP functionality is available;⁴
• documentation is available on the (periodic) risk assessment of the CVS life cycle;⁵
• an audit trail is available, recording all GMP-relevant changes and deletions;⁶
• stored data is accessible, secured against damage (physically and electronically), readable and accurate, meaning that also back-ups of data should be regularly performed;⁷
• built-in checks are in place for the correct and secure entry and processing of data when CVS exchange data electronically with other systems;⁸
• measures are in place to prevent unauthorized access to CVS (e.g., use of keys, pass cards, personal codes with passwords, biometrics, restricted access to computer equipment and data storage areas);⁹ and
• formal agreements are in place with third parties (e.g. suppliers, service providers) for activities related to CVS, related services or data processing, including clear statements of the responsibilities of these third parties.¹⁰

Next steps

Based on the outcomes of the announced CVS pilot inspections in 2026, the IGJ will determine how to shape future supervision of CVS with GMP compliance. The IGJ aims to provide feedback on the findings of this pilot.

Our teams routinely advise on compliance with GMP requirements in the EU. Please contact the authors or the Hogan Lovells attorneys with whom you regularly work for additional information.

Authored by Hein van den Bos and Samantha van Dijk.