GxP Computerised System Validation Plan Template (CSA, Annex 11, Part 11)

Computerised System Validation Plan: [System name]

Validation plan and record set for a computerised system used in a GxP-regulated activity (good manufacturing, laboratory, clinical or distribution practice) in the pharmaceutical, biotech or medical device industry. It follows a risk-based, critical-thinking approach in the spirit of computer software assurance (CSA), and maps to EU GMP Annex 11 (Computerised Systems, revision of January 2011, in force; a revised draft was consulted on from July to October 2025), US 21 CFR Part 11 (electronic records and electronic signatures), the FDA final guidance on Computer Software Assurance for Production and Quality Management System Software (February 2026), and the structure of ISPE GAMP 5 Second Edition (July 2022), which is cited by name and section only. Replace every [bracketed] value and every row marked Example. This is a documentation format, not regulatory or legal advice: follow your quality system, check the current official texts and consult qualified quality and regulatory professionals.

Document control

Approvals

Revision history

Contents

1. Intended use and system description
2. Regulatory basis
3. GxP assessment and system categorisation
4. Risk assessment
5. Supplier assessment
6. Requirements
7. Assurance approach and testing
8. Data integrity controls
9. Electronic records and signatures controls
10. Traceability matrix
11. Release and validation report
12. Operational phase
13. Roles and responsibilities
14. Glossary and references

1. Intended use and system description

1.1 Intended use

[Example: The laboratory information management system records sample receipt, test assignment, instrument results and result review for release testing of finished product at the [Site] quality control laboratory. Approved results are the basis for batch certification. The system does not control instruments; chromatography data comes from a separate validated system through an interface.]

1.2 System description

1.3 Context diagram

The diagram shows the system boundary used for this plan: components inside the boundary are validated here; components outside are validated or qualified under their own records.

2. Regulatory basis

Notes:

• Annex 11 is organised as a Principle and 17 numbered clauses: General (1 Risk management, 2 Personnel, 3 Suppliers and service providers), Project phase (4 Validation) and Operational phase (5 Data, 6 Accuracy checks, 7 Data storage, 8 Printouts, 9 Audit trails, 10 Change and configuration management, 11 Periodic evaluation, 12 Security, 13 Incident management, 14 Electronic signature, 15 Batch release, 16 Business continuity, 17 Archiving). Section 9 of this plan maps controls to these numbers.
• When the revised Annex 11 is published, record its effective date in this table and re-assess section 9 against it.
• GAMP 5 is a paid publication. Official text: ISPE, purchase or licensed access: https://ispe.org/publications/guidance-documents/gamp-5-guide-2nd-edition. This plan cites its structure only.

3. GxP assessment and system categorisation

3.1 GxP assessment

3.2 Software category and function classification

GAMP 5 groups software by configurability: infrastructure software (category 1), non-configured products (category 3), configured products (category 4) and custom applications (category 5). The category helps judge supplier evidence; risk, not category alone, sets the assurance effort.

4. Risk assessment

Example method: severity (S), likelihood (L) and detectability (D) are each scored 1 to 3 (for D, 3 means hard to detect). The risk priority is S x L x D, from 1 to 27. In this example, 12 or more is high, 6 to 11 is medium, and below 6 is low. Thresholds are set by your quality risk management procedure, not by this template.

5. Supplier assessment

Supplier observations become actions with owners in section 11.

6. Requirements

7. Assurance approach and testing

7.1 Method by risk class

7.2 Test plan

7.3 Deviations during testing

Record every unexpected result as a test incident with an ID, impact assessment, resolution and retest. A test incident that reveals a requirement or risk error updates sections 4 and 6 before release.

8. Data integrity controls

9. Electronic records and signatures controls

10. Traceability matrix

General method: traceability matrix (requirements/traceability-matrix).

11. Release and validation report

12. Operational phase

Artificial intelligence and machine learning: if a future change adds a model that influences GxP decisions, assess it against the draft EU GMP Annex 22 and its final version when published, and treat model updates as changes under OPS-001.

13. Roles and responsibilities

14. Glossary and references

14.1 Glossary

14.2 References

Standard and licence note

Based on public regulatory texts (EU GMP Annex 11 and Chapter 4, 21 CFR Part 11) and the FDA guidance on computer software assurance; structure aligned with ISPE GAMP 5 Second Edition, which is a paid publication cited by name, edition and public structure only. Official text: ISPE, purchase or licensed access: https://ispe.org/publications/guidance-documents/gamp-5-guide-2nd-edition. No text from GAMP 5 or the regulations is reproduced; clause and section numbers are given for reference and all descriptions are original text written for this collection. Check the current official texts, in particular the status of the Annex 11 revision and the new Annex 22, before use. This is a documentation format, not regulatory or legal advice; follow your quality system and consult qualified professionals. GAMP is a trademark of ISPE; this template is not affiliated with or endorsed by ISPE, the European Commission or the FDA. Template licence: MIT.