top of page
tamsinmarshall4
4 hours ago
6 min read

Editorial | Open Access | Published 29th September 2026| 313 (2026)



GUEST EDITORIAL: The Lights Are On, Is Anyone Home?


Author: Bob McDowall

Director

R D McDowall Limited


This is a personal opinion is about the apparent shortcomings of the European Medicines Agency (EMA) and Pharmaceutical Inspection Cooperation Scheme (PIC/S) to provide coordination and oversight of the recent draft updates of Good Manufacturing Practice (GMP) regulations.


At this time of the year, my thoughts turn to wondering if I’m on Santa’s naughty or nice list. I’m wondering if this article is a late entry for the 2025 naughty list or an early one for 2026? Could it make me a permanent member of the naughty list?


The topic of this discussion is to question the extent of EMA and PIC/S coordination and oversight of the recent updates to GMP regulations:

  • Chapter 1: Pharmaceutical Quality System (PQS) [1]

  • Chapter 4: Documentation [2]

  • Annex 11: Computerised Systems [2]

  • Separate GMP glossaries [3]


I’m ignoring Annex 22 on AI/ML here as the topic is new.


When a regulation is being updated, an Inspector’s Working Group (IWG) is formed from volunteers from EU and PIC/S members who have an interest in the subject. They work updating the regulation in the light of inspection findings and technological advances (Annex 22 is the result of the latter). These inspectors must do their normal job as well as updating a regulation. 


This article is not aimed at them and the hard work they do, rather at the oversight and coordination that should be provided by EMA and PIC/S before publication of draft and final documents. However, given the inconsistencies:

  • Do EMA and PIC/S have the expertise for adequate review?

  • Are they providing sufficient oversight and coordination?

As with the text in all FDA warning letters, the following comments are not an all-inclusive list.

 

Transition from Interpretive to Prescriptive Regulation

With both Annex 11 and Chapter 4 updates we have seen a ballooning of regulations.

  • Chapter 4 now has 85 clauses replacing the current 32

  • Annex 11 now has 117 clauses up from 32; many of the new requirements have no place in a regulation or are wrong such as the requirement for password complexity (see NIST SP800-63-B4, July 2025 [4])


As Judge Jenkins stated in the FDA versus Utah Medical court judgement in 2005:

… the general nature of the regulations themselves, which have the virtue of generality and the vice of imprecision.

Regulations should be general and flexible so as to cover a broad spectrum of products and activities, and that the regulations place a great deal of responsibility on the manufacturer to adopt and document practices and procedures that ensure the safety of a product [5].


The prescription offered by these two updates would remove much of the ability of regulated users to develop risk-based processes applicable to their products e.g. tablets and ATMP. Indeed, one European inspector remarked to me that he had to inspect from a camomile tea producer to a gene therapy product.


Where was the oversight by EMA and PIC/S in reviewing drafts produced by the two IWGs?

Is this the future of GMP regulation?

 

Regulations Written in Silos?


Evidence of co-ordination is hard to find: 

PQS Requirements in Annex 11

  • Why does 3.1 draft Annex 11 state that regulated users should implement a PQS?

  • This has been the current Chapter 1 regulation since 2013 [6]? 

  • All of section 3 in draft Annex 11 should be merged into Chapter 1 especially the requirement for management oversight of computerised systems.

Data Governance in the Wrong Place

  • This is a key requirement for data integrity and is contained in Chapter 4 clauses 4.10 – 4.14 [2].  However, some, if not all, of these clauses should be in Chapter 1 as data governance starts and ends with senior management and is an integral component of a PQS.   

Chapter 4 Hybrid Systems

  • Hybrid systems are computerised systems, so why are four clauses on computerised systems in Chapter 4 when they should be in Annex 11?

Annex 11 and Chapter 4 Hybrid Solutions

  • Hybrid systems are NOT a solution. 

  • Hybrids are the worst of all worlds

  • Chapter 4 draft can’t make up its mind as it refers to both hybrid systems and hybrid solutions [2]

  • WHO (2016) [7] and PIC/S PI-041 [8] guidances recommended that hybrid systems are not recommended and should be replaced at the earliest opportunity

  • EMA and PIC/S oversight and coordination have failed to ensure consistent terminology or continued with the recommendation to get rid of hybrids at the earliest opportunity

ALCOA+ or ALCOA++

  • The biggest lack of coordination and oversight between Chapter 4 and Annex 11 is the use of ALCOA

    • Annex 11 references ALCOA+ criteria

    • Chapter 4 references ALCOA++ criteria

    • There is NO consistency!

  • Given that EMA added the + and ++ to the ALCOA criteria in two clinical guidance documents in 2010 [9] and 2023 [10], did anybody read BOTH documents?  Highly unlikely!

 

Why so Few References to Other Chapters?


There is poor cross referencing to existing GMP Chapters and Annexes:

Annex 11 Section 5 Training

  • Section 5.2 only suggests initial training with no assessment of understanding.

  • There is no cross reference to Chapter 2.11 that states: Continuing training should also be given, and its practical effectiveness should be periodically assessed.

Annex 11 Section 7 Supplier and Service Management

  • Why is there a shopping list of contract requirements in 7.5 and yet no reference to Chapter 7 on Outsourced Activities? 

  • Or should Chapter 7 be updated to accommodate cloud computing? This is the natural location as it deals with outsourcing

Again, it is a lack of oversight and coordination by EMA and PIC/S.

 

Glossary Inconsistencies


The greatest lack of EMA and PIC/S oversight are the glossaries. Shown in the table below are a selection of entries from the EU Glossary (unchanged since Noah was navigating the world), the current and draft update of Annex 11 and draft Chapter 4.

 

Table 1 Inconsistencies in Current and Proposed GMP Glossaries from [3]

Some glossary problems:

  • Wrong definition: Raw data definition is wrong – update this from Good Laboratory Practice (GLP) regulations [11, 12] and for more information: https://www.spectroscopyonline.com/view/quo-vadis-raw-data [13]

  • Omissions from the draft Annex 11 or EU Glossary:Deviation (yes, really)IT Incident and IT problemSystem owner, process owner (in the current Annex 11)Cloud / third party / supplier

  • Inconsistent definitions:COTS: Copied from a GLP document and references Test Facility Management; COTS is not consistent with GAMP 5 SE software categoriesConfiguration (only considers application configuration not system configuration)

  • Differences Across Glossaries:ALCOA+ / ALCOA++Computerised systemQualification / ValidationRegulated userSpecification


There is a simple solution: ONE GMP GLOSSARY!


A single source of consistent definitions across all Chapters and Annexes. Kept current.


Conclusion

Looking at the problems across the draft updates and the glossaries, there is an inescapable conclusion that EMA and PIC/S have provided very limited oversight and coordination before release of the drafts for public comment.


References

1.          Stakeholders’ Consultation on EudraLex Volume 4 - Good Manufacturing Practice Guidelines: Chapter 1. 2025  30 September 2025]; Available from: https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-1_en.

2.          Stakeholders’ Consultation on EudraLex Volume 4 - Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and New Annex 22. 2025  7 July 2025]; Available from: https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en.

3.          M.Lotfinia and R.D.McDowall. Draft Annex 11 Revision: From Interpretive to Prescriptive Regulation. 2025  29 August 2025]; Available from: https://www.technologynetworks.com/tn/articles/draft-annex-11-revision-from-interpretive-to-prescriptive-regulation-403706.

4.          D.Temoshok, et al., NIST Special Publication 800-63B-4 Digital Identity Guidelines, Authentication and Authenticator Management. 2025, National Institute of Standards and Technology: Gaithersburg,MD.

5.          B.S.Jenkins, United States of America versus Utah Medical Products Inc:, in Case number 2: 04-CV-733 BSJ, U.S.C.f.D.o. Utah, Editor. 2005.

6.          EudraLex - Volume 4 Good Manufacturing Practice (GMP) Guidelines, Chapter 1 Pharmaceutical Quality System. 2013, European Commission: Brussels.

7.          WHO Technical Report Series No.996 Annex 5 Guidance on Good Data and Records Management Practices. 2016, World Health Organisation: Geneva.

8.          PIC/S PI-041 Good Practices for Data Management and Integrity in Regulated GMP / GDP Environments 2021, Pharmaceutical Inspection Convention / Pharmaceutical Inspection Cooperation Scheme: Geneva.

9.          Reflection paper on expectations for electronic source data and data transcribed to electronic data collection tools in clinical trials. 2010, European Medicines Agency: London.

10.        EMA Guideline on Computerised Systems and Electronic Data in Clinical Trials. 2023, European Medicines Agency: Amsterdam.

11.        21 CFR 58 Good Laboratory Practice for Non-Clinical Laboratory Studies. 1978, Food and Drug Administration: Washington, DC.

12.        OECD Series on Principles of Good Laboratory Practice and Compliance Monitoring Number 1, OECD Principles on Good Laboratory Practice. 1998, Organisation for Economic Co-operation and Development: Paris.

13.        R.D.McDowall, Quo Vadis Raw Data? Spectroscopy, 2018. 33(12): p. 8-11.




 
 
 

Comments

bottom of page