> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atlasent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# EU Annex 11

> EMA guideline for computerized systems in GMP — which clause maps to which AtlaSent primitive.

EU Annex 11 is the **EMA guideline for computerized systems** in regulated GMP environments. It applies to AI agents processing GMP data, clinical trial data, and regulated manufacturing records.

## Requirement-to-primitive mapping

| Clause | Requirement | AtlaSent primitive |
| - | - | - |
| 7.1 | Data integrity | [Audit chain](/concepts/audit-chain) is append-only + hash-linked; permits bind records to authorizations. |
| 9 | Audit trails | Every `/evaluate` call produces a timestamped, attributed chain entry. |
| 12.1 | Security — physical / logical controls restricting access | Scoped [API keys](/api-reference/authentication#scopes); [policy](/concepts/policy) restricts agent action classes; policy-based authorization + fail-closed API. |
| 13 | Incident management | Deny events surface in the Console deviation queue. |
| 14, 15 | Electronic signature; batch release | Ed25519-signed [permit tokens](/concepts/permit) as the authorization record. |
| 17 | Archiving | [Signed audit bundle export](/quickstart/audit-export) — verifiable long after retrieval. |

## Starter policy

```json theme={null}
[
  { "action_type": "batch:read",            "decision": "allow" },
  { "action_type": "batch:write",           "decision": "allow" },
  { "action_type": "batch:release",         "decision": "hold" },
  { "action_type": "batch:delete",          "decision": "deny",  "reason": "Annex 11 §7.1: data must not be deleted" },
  { "action_type": "audit:modify",          "decision": "deny",  "reason": "Annex 11 §9: audit trails must not be modified" },
  { "action_type": "access:bypass",         "decision": "deny",  "reason": "Annex 11 §12.1: access controls must not be circumvented" },
  { "action_type": "export:unvalidated",    "decision": "deny",  "reason": "Annex 11 §17: archived data must be checked for accessibility, readability and integrity" }
]
```

## Implementation checklist

* [ ] Import the EU Annex 11 starter policy from `gxp-starter` (not yet publicly available).
* [ ] Assign a unique `actor.id` per AI system component.
* [ ] Store `permit_id` with every batch record modification.
* [ ] Route deny events into your QMS deviation workflow (Clause 13).
* [ ] Include AtlaSent in your Computerized Systems Validation (CSV) documentation.
* [ ] Archive signed audit bundles for the required retention period (typically 5–15 years).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.