{"id":5495,"date":"2026-10-28T11:36:46","date_gmt":"2026-10-28T10:36:46","guid":{"rendered":"https:\/\/docuply.io\/?page_id=5495"},"modified":"2026-10-28T11:36:49","modified_gmt":"2026-10-28T10:36:49","slug":"edms-requirements-gxp-biotech-cro","status":"publish","type":"page","link":"https:\/\/docuply.io\/en\/edms-requirements-gxp-biotech-cro\/","title":{"rendered":"eDMS Requirements for Biotechs and CROs: What GxP-Compliant Document Management Must Deliver (2026)"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Last updated: October 28, 2026<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

 <\/p>\n

A GxP-compliant eDMS must manage controlled documents across their entire lifecycle so that every record is attributable to a named individual, fully traceable and legible for the whole retention period. In practice, that means a validated system with personal user accounts and role-based permissions, an automatically generated audit trail that no one can edit (who, what, when, why, old and new value), electronic signatures showing name, timestamp and meaning that are permanently linked to the document, and controlled versioning with approval workflows. The governing frameworks are 21 CFR Part 11, EU GMP Annex 11 (currently under revision), ICH E6(R3) and the ALCOA+ principles. Responsibility for validation and data integrity always stays with the regulated company, even when the supplier provides validation documentation. This guide sets out the position as of October 2026 and closes with a checklist for organisations of up to around 150 staff.<\/p>\n\n

Regulatory frameworks and their core eDMS requirements (as of October 2026)<\/h3>\n
\n\n\n\n\n\n\n\n\n\n\n
Framework<\/th>\nScope<\/th>\nStatus<\/th>\nCore requirement for the eDMS<\/th>\n<\/tr>\n<\/thead>\n
21 CFR Part 11<\/strong><\/td>\nElectronic records kept under FDA predicate rules or submitted to FDA<\/td>\nIn force since 1997; interpreted through the 2003 guidance and the October 2024 Q&A<\/td>\nValidation, audit trail, access control, signature manifestation, signature\u2013record linking<\/td>\n<\/tr>\n
EU GMP Annex 11<\/strong><\/td>\nComputerised systems used in GMP activities<\/td>\n2011 version in force; July 2025 revision draft not yet final<\/td>\nRisk management, supplier oversight, audit trail review, identity and access management, backup, archiving<\/td>\n<\/tr>\n
ICH E6(R3)<\/strong><\/td>\nGood Clinical Practice for sponsors, CROs and investigator sites<\/td>\nPrinciples and Annex 1 in effect in the EU since 23 July 2025; Annex 2 from 15 January 2027<\/td>\nData governance, inventory of systems with validation status, essential records<\/td>\n<\/tr>\n
EMA guideline on computerised systems (2023)<\/strong><\/td>\nSystems used in clinical trials, including cloud and SaaS<\/td>\nIn effect since 10 September 2023<\/td>\nALCOA++, audit trail review, qualified service providers, inspector access<\/td>\n<\/tr>\n
EU CTR 536\/2014, Art. 58<\/strong><\/td>\nTrial master file in the EU<\/td>\nFully applicable since 31 January 2022<\/td>\nArchiving for at least 25 years, legibility, traceability of every change<\/td>\n<\/tr>\n
ALCOA+ (MHRA, FDA, PIC\/S, WHO)<\/strong><\/td>\nAll GxP data, paper and electronic<\/td>\nGuidance from 2018 to 2021, still authoritative<\/td>\nAttributability, contemporaneity, originality, completeness, durability, availability<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

What regulatory requirements must a GxP eDMS meet?<\/h2>\n

A GxP eDMS must satisfy 21 CFR Part 11 for the US, Annex 11 for EU GMP, and ICH E6(R3) together with the EMA guideline on computerised systems for clinical trials.<\/b> The common thread across all of them is data integrity under ALCOA+: records must be attributable, traceable without alteration and permanently available. Which rules apply in practice depends on the documents the system holds and the markets the company serves.<\/p>\n\n

21 CFR Part 11: when is a document an “electronic record”?<\/h3>\n

Under \u00a711.1(b), 21 CFR Part 11<\/a> covers electronic records created, modified, maintained, archived or transmitted under an FDA predicate rule, plus records submitted to FDA electronically. An SOP, protocol or monitoring report held in an eDMS rather than on paper is therefore in scope. The core controls sit in \u00a711.10: validation (a), accurate and complete copies (b), protection of records throughout retention (c), limited access (d), a computer-generated, time-stamped audit trail (e), operational, authority and device checks (f to h), training (i), written accountability policies (j) and control of system documentation (k).<\/p>\n

For signatures, \u00a711.50 requires the printed name, date and time, and meaning (such as review or approval); \u00a711.70 requires signatures to be linked to their records so they cannot be excised, copied or transferred. \u00a711.100 to \u00a711.300 cover uniqueness, written certification to FDA, two distinct identification components (for example user ID and password) and password controls. FDA’s 2003 “Scope and Application” guidance announced enforcement discretion for validation, audit trails, copies, retention and legacy systems, but not for access controls or signatures; predicate rules continue to apply in full.<\/p>\n

The final FDA guidance “Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers” (October 2024, Revision 1)<\/a> applies this to clinical research: records may be kept in cloud services provided authenticity, integrity and metadata are preserved (Q5); validation is risk-based and may draw on an IT provider’s documentation (Q7); sponsors should hold a data-flow diagram (Q8); and FDA does not pre-assess systems but evaluates them at inspection (Q16). Regulated entities remain responsible for Part 11 compliance even when IT services are outsourced. For more depth, see our 21 CFR Part 11 electronic signatures guide<\/a>.<\/p>\n\n

EU GMP Annex 11: the current text and the revision draft<\/h3>\n

The 2011 Annex 11 remains in force, covering risk management, supplier agreements, validation, audit trails, electronic signatures, data storage, backup, archiving and business continuity. On 7 July 2025 the European Commission and PIC\/S published a revision draft<\/a> (19 pages, 17 chapters) alongside a revised Chapter 4 and a new Annex 22 on AI; the consultation<\/a> closed on 7 October 2025. As of October 2026 no final text has been published; according to GuideGxP (as of September 2026), finalisation of Annex 11, Annex 22 and Chapter 4 is expected between late 2026 and 2027, with application dates to be set in the final texts and typically a transition period of 6 to 12 months.<\/p>\n

The points that matter most for document management are: personal accounts with no shared logins (11.1), multi-factor authentication for remote access to critical systems (11.6), separation of GMP users from administrators (11.10), documented, independent audit trail reviews (12.5, 12.6), complete, searchable electronic copies including the audit trail (12.9), contracts with service providers that define an exit strategy and pre-release testing of new versions (7.5), and read-only archiving with integrity checks (17.1, 17.2). Anyone selecting an eDMS now should assess it against the draft, because inspectors already read its expectations as the current state of the art.<\/p>\n\n

ICH E6(R3): what changes for sponsors and CROs?<\/h3>\n

ICH E6(R3)<\/a> reached Step 4 on 6 January 2025; the Principles and Annex 1 have applied in the EU since 23 July 2025. According to ICH<\/a>, Annex 2 (decentralised and pragmatic elements, real-world data) was adopted on 3 June 2026 and takes effect in the EU on 15 January 2027. New compared with E6(R2) is a dedicated Section 4 on data governance, covering the data lifecycle, metadata and audit trails (4.2) and computerised systems (4.3). Sponsors should keep an inventory of important systems with their validation status and responsibilities, and ensure that validation, audit trails, user management, backup and disaster recovery are proportionately in place. “Essential documents” have become technology-neutral “essential records” (Appendix C), which explicitly accommodates electronic TMFs and eDMSs.<\/p>\n\n

ALCOA+ and data integrity: what does it mean technically?<\/h3>\n

ALCOA stands for Attributable, Legible, Contemporaneous, Original and Accurate; ALCOA+ adds Complete, Consistent, Enduring and Available. The key guidance documents are the MHRA “GXP Data Integrity Guidance and Definitions” (2018), FDA’s “Data Integrity and Compliance With Drug CGMP” Q&A (2018), PIC\/S PI 041-1<\/a> (in force since 1 July 2021) and WHO TRS 1033 Annex 4 (2021). The EMA guideline on computerised systems and electronic data in clinical trials<\/a> (adopted March 2023, in effect since 10 September 2023) uses the term ALCOA++ and adds emphasis on traceability.<\/p>\n