中文字幕一级黄色A级片|免费特级毛片。性欧美日本|偷拍亚洲欧美1级片|成人黄色中文小说网|A级片视频在线观看|老司机网址在线观看|免费一级无码激情黄所|欧美三级片区精品网站999|日韩av超碰日本青青草成人|一区二区亚洲AV婷婷

自2025年7月7日起，EMA 網(wǎng)站上發(fā)布了3份新的指南草案——EU GMP 指南附錄 11“計算機(jī)化系統(tǒng)”、附錄 22“人工智能”和第4 章“文件記錄”，業(yè)界可以在 2025 年 10 月 7 日之前對其發(fā)表意見。這些文件由 EMA GMP/GDP 檢查員工作組與PIC/S 共同起草，將于 2026 年作為最終版本發(fā)布。

 

新版附錄11 計算機(jī)化系統(tǒng) 草案

 

自2022年發(fā)布新版EU GMP附錄11 概念文件后，新發(fā)布的EU GMP附錄 11草案對計算機(jī)化系統(tǒng)新法規(guī)的預(yù)期范圍提供了初步見解，已經(jīng)可以預(yù)期重大創(chuàng)新。在丹麥檢查員 Ib Alstrup 的領(lǐng)導(dǎo)下，國際工作組考慮了 IT 領(lǐng)域現(xiàn)代技術(shù)的發(fā)展，并完善了許多不明確的問題。

 

The pharmaceutical quality management system mentioned in section 3. clarifies not only the usual topics (deviations, changes, self-inspections) but also the responsibility of senior management to regularly review all elements that influence the proper operation of the system.

 

第 3 節(jié)中提到的藥品質(zhì)量管理體系。不僅闡明了通常的主題（偏差、變更、自查），而且還闡明了高級管理層定期審查影響系統(tǒng)正常運行的所有要素的責(zé)任。

 

The elements of risk management referred to in section 4. reference ICH Q9; there is also an initial reference to the IT security requirements mentioned later in the document.

 

第 4 節(jié)中提到的風(fēng)險管理要素。參考 ICH Q9；該文件還初步提到了IT 安全要求。

 

Almost one page is reserved for requirements specifications  (section 6. User Requirements), which are often neglected in practice, and there - as in many other places in the document - reference is made to the      possibility of using modern electronic tools to compile them.

 

第 6 節(jié) 用戶需求：幾乎有一頁內(nèi)容提到需求規(guī)范（URS），他們在實踐中經(jīng)常被忽視，文件還提到了使用現(xiàn)代電子工具編寫它們的可能性。

 

Section 7. deals in detail with the services of external IT companies that are widely employed today and the various requirements for their control (audit, contract, documentation), where the expected contractual regulations are mentioned with nine subsections.

 

第 7 節(jié)：詳細(xì)處理了當(dāng)今廣泛使用的外部 IT 公司的服務(wù)及其控制（審計、合同、文件）的各種要求，其中通過九個小節(jié)提到了預(yù)期的合同法規(guī)。

 

A new topic is the very detailed specification under 8. for the requirements for alarms and their verification with associated documentation, for example in the batch record. A non-erasable/deactivatable record (log) with a corresponding annotation, similar to an audit trail, is expected here.

 

第 8 節(jié)是一個非常詳細(xì)的新的主題——報警及其確認(rèn)的要求，使用相關(guān)記錄，例如在批記錄中。這要求具有相應(yīng)注釋的不可擦除/不可停用的記錄（日志），類似于審計追蹤。

 

8. Alarms8. 報警 8.1.Reliance on system. Alarms should be implemented in computerised systems where a regulated user is relying on the system to notify about an event. This is required when the user must take a specific action, without which product quality, patient safety or data integrity might otherwise be compromised.8.1. 依賴系統(tǒng)：在受監(jiān)管用戶依賴系統(tǒng)就某一事件進(jìn)行通知的計算機(jī)化系統(tǒng)中，應(yīng)設(shè)置報警功能。當(dāng)用戶必須采取特定行動（若不采取該行動，產(chǎn)品質(zhì)量、患者安全或數(shù)據(jù)完整性可能會受到損害 ）時，需設(shè)置此類報警。 8.2.Settings. Alarm limits, delays, and any early warnings or alerts, should be appropriately justified, and set within approved and validated process and product specifications. Setting, changing or deactivation should only be available to users with appropriate access privileges and should be managed by an approved procedure.8.2. 設(shè)置：報警限值、延遲時間以及任何預(yù)警或警報，都應(yīng)經(jīng)過合理論證，并在已批準(zhǔn)且經(jīng)驗證的工藝和產(chǎn)品質(zhì)量標(biāo)準(zhǔn)范圍內(nèi)進(jìn)行設(shè)置。報警的設(shè)置、更改或停用操作，僅應(yīng)向具備相應(yīng)訪問權(quán)限的用戶開放，且應(yīng)通過已批準(zhǔn)的程序進(jìn)行管理。 8.3.Signalling. Alarms should set off visible and/or audible signals when set alarm limits are exceeded and after any defined delay. The signalling should accommodate a timely reaction and should be appropriate to the work environment.8.3. 信號發(fā)出：當(dāng)超出設(shè)定的報警限值且經(jīng)過任何規(guī)定的延遲時間后，報警應(yīng)觸發(fā)可見和 / 或可聽信號。信號的發(fā)出應(yīng)便于及時做出反應(yīng)，且應(yīng)與工作環(huán)境相適配。 8.4. Acknowledgement. Critical alarms potentially impacting product quality, patient safety or data integrity should only be acknowledged by users with appropriate access privileges. As part of the acknowledgement, i.e. a confirmation that the alarm has been seen and appropriate action will be taken, a comment should be added about why the alarm was acknowledged (see 12 Audit Trails).8.4. 確認(rèn)：可能影響產(chǎn)品質(zhì)量、患者安全或數(shù)據(jù)完整性的關(guān)鍵報警，僅應(yīng)由具備相應(yīng)訪問權(quán)限的用戶進(jìn)行確認(rèn)。作為確認(rèn)的一部分（即確認(rèn)已看到報警并將采取適當(dāng)行動 ），應(yīng)添加一條關(guān)于為何確認(rèn)該報警的注釋（見 12 審計追蹤 ）。 8.5.Log. All alarms and acknowledgements should be automatically added to an alarm log. This should contain the name of the alarm, date and time of the alarm, date and time of the acknowledgement, username and role of the user acknowledging the alarm and any comment about why the alarm was acknowledged. It should not be possible for users working according to GMP to deactivate or edit alarm logs.8.5. 記錄：所有報警及確認(rèn)信息都應(yīng)自動添加到報警日志中。日志應(yīng)包含報警名稱、報警發(fā)生的日期和時間、確認(rèn)的日期和時間、確認(rèn)報警的用戶的用戶名和角色，以及關(guān)于為何確認(rèn)該報警的任何注釋。遵循藥品GMP開展工作的用戶不應(yīng)能夠停用或編輯報警日志。 8.6.Searchability and sortability. Alarm logs should be searchable and sortable in the originating system, or it should be possible to export logs to a tool which provides this functionality. Other methods of reviewing alarms may also be used, if they provide the same effectiveness.8.6. 可搜索性和可排序性：報警日志應(yīng)能在生成系統(tǒng)中進(jìn)行搜索和排序，或者應(yīng)能夠?qū)⑷罩緦?dǎo)出到具備該功能的工具中。若其他查看報警的方法能達(dá)到相同效果，也可使用。 8.7.Review. Alarm logs should be subject to appropriate periodic reviews based on approved procedures, in which it should be evaluated whether they have been timely acknowledged by authorised users and whether appropriate action has been taken. Reviews should be documented, and results should be evaluated to identify any trends that could indicate negative performance of a system or process, or impact on the product. The frequency and Page 7 of 19detail of reviews should be based on the risk to product quality, patient safety and data integrity.8.7. 審核：應(yīng)依據(jù)已批準(zhǔn)的程序，對報警日志進(jìn)行適當(dāng)?shù)亩ㄆ趯徍?。審核中?yīng)評估報警是否已被授權(quán)用戶及時確認(rèn)，以及是否已采取適當(dāng)行動。審核應(yīng)形成文件記錄，且應(yīng)對結(jié)果進(jìn)行評估，以識別任何可能表明系統(tǒng)或流程存在不良表現(xiàn)或?qū)Ξa(chǎn)品產(chǎn)生影響的趨勢。審核的頻率和詳細(xì)程度應(yīng)基于對產(chǎn)品質(zhì)量、患者安全和數(shù)據(jù)完整性的風(fēng)險。

 

Qualification and validation of the computerized system (Section 9.) correspond to the regulations in the old Annex 11, but reference is made to the possibility of using an application in a limited scope even if validation has not been fully completed, provided that this is explicitly stated in the validation report.

 

計算機(jī)化系統(tǒng)的確認(rèn)和驗證（第9節(jié)）與舊版附錄11中的規(guī)定相對應(yīng)，但提到即使驗證尚未完全完成，也可以在有限范圍內(nèi)使用該系統(tǒng)，但必須在驗證報告中明確說明。

 

9.8.Completion prior to use. Qualification and validation activities should be successfully completed and reported prior to approval and taking a system into use. Conditional approval to proceed to taking a system into use may be granted where certain acceptance criteria have not been met, or deviations have not been fully addressed. A condition for this is, that there is a documented assessment, that any deficiencies in the affected system functionality or Page 8 of 19 GMP processes, will not impact product quality, patient safety or data integrity. Where a conditional approval is issued, it should be explicitly stated in the validation report and there should be close follow-up on approval of outstanding actions according to plan.9.8. 使用前完成：確認(rèn)和驗證活動應(yīng)在批準(zhǔn)并啟用系統(tǒng)之前成功完成并報告。在某些接受標(biāo)準(zhǔn)未滿足或偏差未完全解決的情況下，可有條件批準(zhǔn)啟用系統(tǒng)。前提是應(yīng)有書面的評估，證明受影響的系統(tǒng)功能或藥品GMP流程中的任何缺陷不會影響產(chǎn)品質(zhì)量、患者安全或數(shù)據(jù)完整性。若有條件批準(zhǔn)，應(yīng)在驗證報告中明確說明，且應(yīng)根據(jù)計劃密切跟進(jìn)未完成行動的批準(zhǔn)情況 。

 

The risk of manual data entry instead of electronic interfaces between systems is pointed out in section 10. This section also contains an initial reference to the encryption of critical data.

 

第10節(jié)指出了系統(tǒng)之間手動輸入數(shù)據(jù)而不是電子接口的風(fēng)險。本節(jié)還包含對關(guān)鍵數(shù)據(jù)加密的初始引用。

 

The correct management of access to computerized systems (Section 11.) is discussed in detail in a number of subsections. In 11.3 it is outlined that system access by means of a smart card, which could be used by another person, for example, is not adequate. Requirements for secure passwords can be found in 11.5; the working group limits this to the general requirements, but does not specify a minimum length or a maximum validity period for passwords, nor for the regular verification of user accounts (11.11). The need to separate administrator rights from user rights (Segregation of Duties, SoD) is briefly discussed in 11.10.

 

對計算機(jī)化系統(tǒng)的訪問的正確管理（第 11 節(jié)）在一些小節(jié)中進(jìn)行了詳細(xì)討論。11.3 中概述了通過智能卡（例如，門禁卡）進(jìn)行系統(tǒng)訪問是不夠的，例如，智能卡（例如，門禁卡）可以被另一個人使用。安全密碼的要求可以在 11.5 中找到;工作組將此限制在一般要求范圍內(nèi)，但沒有規(guī)定密碼的最短長度或最長有效期，也沒有規(guī)定用戶帳戶的定期驗證（11.11）。11.10 簡要討論了將管理員權(quán)限與用戶權(quán)限（職責(zé)分離，SoD）分開的必要性。

 

11.3.Certain identification. The method of authentication should identify users with a high degree of certainty and provide an effective protection against unauthorised access. Typically, it may involve a unique username and a password, although other methods providing at least the same level of security may be employed (e.g. biometrics). Authentication only by means of a token or a smart card is not sufficient, if this could be used by another user.11.3. 可靠識別：身份驗證方法應(yīng)能高度可靠地識別用戶，并有效防止未經(jīng)授權(quán)的訪問。通常，這可能涉及唯一用戶名和密碼，不過也可采用其他至少具備同等安全級別的方法（如生物識別 ）。僅通過令牌或智能卡進(jìn)行身份驗證是不夠的，如他們可以被其他用戶使用。

 

The fact that there was no details on the management of audit trails in the old Annex 11 has been taken into account in section 12: the requirements for the technical setup and an on-time review are clarified in ten neatly structured subsections.

 

第12節(jié)考慮到了舊版附錄11中沒有關(guān)于審計追蹤管理的細(xì)節(jié)這一事實：結(jié)構(gòu)整齊的十個小節(jié)澄清了技術(shù)設(shè)置和及時審查的要求。

 

Electronic signatures are addressed in Section 13, which also uses some of the definitions listed in 21 CFR Part 11 (e.g. Open Systems) and also discusses hybrid solutions.

 

第 13 節(jié)涉及電子簽名，該節(jié)還使用了 21 CFR 第 11 部分中列出的一些定義（例如開放系統(tǒng)），并討論了混合解決方案。

 

The periodic reviews of the systems (Section 14), which were not included in the old Annex 11, take up a lot of space. The expectations      of the periodic review are listed in twelve subsections.

 

對舊版附錄11中未包括的系統(tǒng)的定期審查（第14節(jié)）占用了大量篇幅。定期審查的要求列在十二個小節(jié)中。

 

It is positive that the current topic of IT security (Section 15.) is treated in detail, with clearly defined requirements for the IT infrastructure (firewalls, disaster recovery - RTO/RPO, patches, virus protection, etc.). In this context, the necessity of regular penetration tests for critical systems is also emphasized, which will unfortunately have a considerable impact on costs.

 

積極的是，當(dāng)前的 IT 安全主題（第 15 節(jié)）得到了詳細(xì)處理，并明確定義了對 IT 基礎(chǔ)設(shè)施的要求（防火墻、災(zāi)難恢復(fù) - RTO/RPO、補丁、病毒防護(hù)等）。在此背景下，還強調(diào)了對關(guān)鍵系統(tǒng)進(jìn)行定期滲透測試的必要性，不幸的是，這將對成本產(chǎn)生相當(dāng)大的影響。

 

The topic of back-up can be found in section 16 with a definition of the requirements for physical and logical separation as well as regular restore tests.

 

備份主題可以在第 16 節(jié)中找到，其中定義了物理和邏輯分離以及定期恢復(fù)測試的要求。

 

It is most welcome that - as in the OECD GLP guidelines - the new Annex 11 addresses the archiving of data (Section 17.), as this was previously handled very briefly in the GMP regulations.

 

與OECD GLP 指南一樣，新的附錄 11 涉及數(shù)據(jù)歸檔（第 17 節(jié)），這是非常受歡迎的，因為此前在 GMP 法規(guī)中對此僅進(jìn)行了非常簡短的處理。

 

At the end of the document there is a glossary where a large number of technical terms are explained.

 

在文件的末尾有一個詞匯表，其中解釋了大量技術(shù)術(shù)語。