EU Annex 11 - AtlaSent

EU Annex 11 is the EMA guideline for computerized systems in regulated GMP environments. It applies to AI agents processing GMP data, clinical trial data, and regulated manufacturing records.

Requirement-to-primitive mapping

Clause	Requirement	AtlaSent primitive
7.1	Data integrity	Audit chain is append-only + hash-linked; permits bind records to authorizations.
9	Audit trails	Every `/evaluate` call produces a timestamped, attributed chain entry.
12.1	Security — physical / logical controls restricting access	Scoped API keys; policy restricts agent action classes; policy-based authorization + fail-closed API.
13	Incident management	Deny events surface in the Console deviation queue.
14, 15	Electronic signature; batch release	Ed25519-signed permit tokens as the authorization record.
17	Archiving	Signed audit bundle export — verifiable long after retrieval.

Starter policy

[
  { "action_type": "batch:read",            "decision": "allow" },
  { "action_type": "batch:write",           "decision": "allow" },
  { "action_type": "batch:release",         "decision": "hold" },
  { "action_type": "batch:delete",          "decision": "deny",  "reason": "Annex 11 §7.1: data must not be deleted" },
  { "action_type": "audit:modify",          "decision": "deny",  "reason": "Annex 11 §9: audit trails must not be modified" },
  { "action_type": "access:bypass",         "decision": "deny",  "reason": "Annex 11 §12.1: access controls must not be circumvented" },
  { "action_type": "export:unvalidated",    "decision": "deny",  "reason": "Annex 11 §17: archived data must be checked for accessibility, readability and integrity" }
]

Implementation checklist

Import the EU Annex 11 starter policy from gxp-starter (not yet publicly available).
Assign a unique actor.id per AI system component.
Store permit_id with every batch record modification.
Route deny events into your QMS deviation workflow (Clause 13).
Include AtlaSent in your Computerized Systems Validation (CSV) documentation.
Archive signed audit bundles for the required retention period (typically 5–15 years).