Häufig gestellte Fragen
What does GxP validation mean in concrete terms for a pharma ERP?
GxP validation means that a pharma ERP demonstrably works exactly as specified, with documentation to prove it, before it is allowed to process GMP-relevant data. In practice it usually follows the V-model with a user requirements specification (URS), design and risk assessment, and the qualification stages IQ, OQ and PQ, all of which are documented in an audit-proof manner. The methodological standard for this is GAMP 5 in its second edition from 2022, which typically classifies ERP systems as category 4 (configured standard products) and focuses the validation effort on configuration and workflows rather than the base platform. This also makes it possible to use supplier documentation so that functions already validated by the vendor do not have to be fully retested.
What requirements does EU GMP Annex 11 place on an ERP system?
Annex 11 is the EU GMP guideline for computerised systems and applies to any ERP that generates or stores GMP-relevant data. Core requirements are a validated application, a non-editable audit trail across all data changes, and adherence to the ALCOA+ data integrity principles (attributable, legible, contemporaneous, original, accurate and complete). The draft of the revised Annex 11 published in July 2025 expands the standard from around five to roughly 19 pages and adds, among other things, periodic validation reviews as well as cybersecurity aspects referencing frameworks such as ISO 27001 and the NIS2 Directive. The final version is expected for 2026, so manufacturers should already factor the additional requirements into system selection.
How does the FDA requirement 21 CFR Part 11 differ from Annex 11?
21 CFR Part 11 is the US regulation of the FDA that gives electronic records and electronic signatures the same legal standing as paper and handwritten signatures; it becomes relevant as soon as products are exported to or marketed in the USA. Among other things, it requires tamper-proof, time-stamped audit trails as well as non-biometric electronic signatures with at least two distinct identification components such as user ID and password. Every signed record must clearly show the printed name of the signer, the date and time, and the meaning of the signature (such as approval or review). In substance, Part 11 and Annex 11 overlap considerably, which is why many ERP solutions address both sets of rules together.
What obligations does the EU Falsified Medicines Directive (FMD) impose on manufacturers?
The Falsified Medicines Directive obliges manufacturers of prescription medicines to equip every pack with a unique 2D DataMatrix code and an anti-tampering device. The code contains four data elements: product code (GTIN), serial number, batch and expiry date, and the serial numbers must be uploaded to the European verification system EMVS. Under Delegated Regulation (EU) 2016/161, records of every operation involving the unique identifier must be kept for at least one year after the expiry date or five years after release, whichever period is longer. A pharma ERP must therefore be able to map this serialisation and the EMVS data transfer on the process side.
What changes in 2026 with EUDAMED and the UDI obligation for medical technology?
From 28 May 2026, the first four EUDAMED modules become mandatory, including actor registration and UDI/device registration for medical devices and IVDs. New products must be registered before being placed on the market, while products already placed on the market before this date must be entered retrospectively by 28 November 2026. The UDI information must be consistent across labelling, packaging, production, ERP, distribution and EUDAMED submissions, which is why manufacturers with large portfolios often use machine-to-machine interfaces between ERP/PLM and EUDAMED. An ERP suitable for medical technology should therefore support UDI management and this data consistency out of the box.
How long does a validated pharma ERP project take and what does it cost?
Mid-market ERP implementations in the pharma sector realistically take around 6 to 18 months, while large multi-site or on-premise projects tend more towards 18 to 36 months, since validation under Annex 11 and 21 CFR Part 11 usually extends the timeline by several weeks to several months compared with non-regulated industries. Total costs over the first three to five years often range between around 500,000 euros and several million euros depending on user count and depth of customisation. GAMP 5-compliant validation with URS, IQ, OQ and PQ documentation frequently adds a further 80,000 to 320,000 euros and in complex cases can exceed the licence costs. Added to this are annual maintenance of around 18 to 22 percent of the licence sum for on-premise, or a cloud subscription that scales roughly at 100 to 350 euros per user per month depending on the platform.