Data compliance · GLP · 21 CFR Part 11 · EU GMP Annex 11
Every number traceable to its image. Ready for the auditor.
In a regulated lab, a correct result is only half the job. You also have to show who produced it, from which raw image, with which method version, and who approved it. We set up image analysis so that record builds itself, without breaking between tools.
Raw image imported
B-114-07.tif · checksum stored
LockedMethod Grain size v3.2
Released by method owner, locked
Versioned
Result G 7.0
173 grains · calculated by a.lind
CalculatedReviewed
e.berg · electronic signature
SignedApproved for release
m.koch · electronic signature
Signed
Covers
- Audit trails
- Electronic signatures
- User roles and access
- Method versioning
- Raw data protection
- Validation
- Training and SOPs
Where it usually breaks
The analysis is fine. The chain around it is not.
Most findings in image analysis are not about the measurement itself. They are about the gaps between steps: files anyone can overwrite, methods changed without a record, numbers retyped into a spreadsheet. Switch between the two to see the difference.
Acquire
Images saved to a shared folder that anyone can overwrite.
Analyse
Threshold tweaked in the software. Nobody knows what changed, or when.
Report
Numbers copied into Excel by hand, one typo at a time.
Review
Initials on a printout, not linked to the data they approve.
Archive
Results on a USB stick or someone’s laptop.
None of the “typical” steps is unusual. Each one is a small shortcut. Together they mean that a result cannot be reconstructed, which is exactly what an inspector will ask you to do.
Try it
An audit trail you can poke at
Pick a user and try things, including the things you should not do. Every action ends up in the trail, and some are stopped before they happen. This is how a controlled system behaves.
Signed in as
Do something
Electronic signature
| Time | User | Action |
|---|
Example users and data. The trail cannot be edited, only added to. Nothing is stored or sent anywhere.
Part 11 and Annex 11
Two rulebooks, mostly the same idea
FDA 21 CFR Part 11 defines what a trustworthy electronic record and signature look like. EU GMP Annex 11 defines how to run a computerised system so its records can be trusted. If you supply both markets, build to the stricter rule in each area.
| Area | 21 CFR Part 11 | EU GMP Annex 11 | Who sets the bar |
|---|---|---|---|
| Audit trail | §11.10(e)Secure, computer-generated, time-stamped, independent of the operator, never obscures earlier entries. | §9Risk-based record of GMP-relevant changes and deletions, with the reason, regularly reviewed. | Both · combine |
| Electronic signatures | §11.50 · §11.70 · §11.100 · §11.200 · §11.300Name, date, time and meaning shown; linked to the record; unique to one person; two identification components; password controls. | §14Same impact as a handwritten signature, permanently linked to the record, with time and date. | Part 11 |
| Access and security | §11.10(d) · (g) · §11.300Limited access, authority checks, password controls. | §12Physical and logical controls, individual access, recorded changes to authorisations. | Both |
| Accurate copies | §11.10(b)Accurate, complete copies in readable and electronic form. | §6 · §8Accuracy checks on critical data, clear printouts that show if data were changed. | Both |
| Validation | §11.10(a)Validated for accuracy, reliability and detection of altered records, without saying how. | §4Lifecycle documentation, traceable requirements, supplier assessment, risk-based testing. | Annex 11 |
| Risk management | Implicit, through FDA’s 2003 guidance. | §1Required across the whole lifecycle. | Annex 11 |
| Change control | §11.10(k)Control of system documentation. | §10All changes controlled, documented and validated where needed. | Annex 11 |
| Backup and archiving | §11.10(c)Records protected, accurate and retrievable. | §7 · §17Tested backups, checked archives, verified data migration. | Annex 11 |
| Periodic review | Not addressed. | §11Regular evaluation that the system is still valid. | Annex 11 only |
| Suppliers | Not addressed. | §3Assess supplier competence, formal agreements, right to audit. | Annex 11 only |
| Incidents and continuity | Not addressed. | §13 · §16Incident management and business continuity plans. | Annex 11 only |
| Open systems | §11.30Extra measures such as encryption and digital signatures. | Not addressed. | Part 11 only |
Rule of thumb: signatures to Part 11, lifecycle, suppliers and review to Annex 11, audit trail to both. Coming change: in 2025 the European Commission consulted on a revised Annex 11 and a new Annex 22 on AI in GMP. The drafts expand audit trail, IT security and periodic review requirements. As of autumn 2026 they are not yet adopted, so the 2011 Annex 11 still applies.
Data integrity
ALCOA+, translated into image analysis
Inspectors judge data against ALCOA+. Here is what each letter means when the data is an image and a measurement.
Attributable
Every action tied to a named user login, never a shared account.
Legible
Records readable for their whole life, on screen and as printouts.
Contemporaneous
Time-stamped by the system at the moment it happens.
Original
Raw images locked on import and never overwritten.
Accurate
A validated recipe calculates the result. Nobody retypes it.
Complete
Nothing is deleted. A re-run adds to the record instead of replacing it.
Consistent
Same method version, same sequence, every sample.
Enduring
Stored and backed up on your own servers for the retention period.
Available
Retrievable for review or inspection, years later.
Your evidence
Together, this is what lets you rebuild any result in front of an inspector.
What we deliver
Compliant software, and the work around it
No software is compliant on its own. Compliance comes from the technical controls in the software, plus validation, plus your procedures. We deliver all three.
The software
MIPAR Checkpoint
MIPAR’s compliance edition, powered by TotalLab. Recipes are built and tested in MIPAR, then deployed to Checkpoint for routine use in the regulated lab.
- Sign-in control with user groups and roles
- Project history and full traceability of who did what
- Electronic signature approval, with check-out and check-in of work
- Results exported only by approved users
- Runs on your internal network. Images, measurements and user data stay inside it
- Designed for 21 CFR Part 11 and EU GMP Annex 11
Licensed as an annual subscription. See also MIPAR.
The service
SciSpot compliance support
We have set up the image analysis ourselves, so we know where the controls have to sit. You stay in charge of your quality system. We do the groundwork.
- Gap assessment of your current image analysis workflow
- User requirements and risk assessment
- Installation and configuration of roles, signatures and traceability
- Validation documentation and test scripts for you to approve
- SOP templates and training for operators, reviewers and method owners
- Support for change control and periodic review
Quoted per project after a free first call. Works alongside your QA, not instead of it.
How a project runs
From first call to routine use
- Step 1
Gap assessment
A short call about your workflow and the rules you work under. Free.
- Step 2
Requirements and risk
What the system must do, and where the risks to your data are.
- Step 3
Install and configure
Checkpoint on your network, with roles, signatures and traceability set up.
- Step 4
Validate
Methods locked and tested, with documentation for your approval.
- Step 5
Train and go live
Operators, reviewers and method owners trained on the new SOPs.
- Step 6
Stay compliant
Change control, updates and periodic review, with us on call.
This page explains the regulations in plain language. It is not legal advice. Your quality unit decides what applies to your lab.
Questions
Data compliance in image analysis, answered
Is MIPAR “21 CFR Part 11 compliant”?
No software is compliant on its own, whatever the brochure says. Part 11 compliance is the combination of technical controls in the software, a validated set-up, and your procedures. MIPAR Checkpoint provides the technical controls. We help with validation, SOPs and training.
What is the difference between 21 CFR Part 11 and EU GMP Annex 11?
Part 11 is a US regulation focused on electronic records and signatures. Annex 11 is the EU guideline for computerised systems, focused on the whole lifecycle: risk, suppliers, validation, periodic review. They overlap a lot. Part 11 is stricter on signatures, Annex 11 on lifecycle management. See the table above.
We work under GLP, not GMP. Does this apply to us?
Yes, in a very similar way. The OECD Principles of GLP, and the OECD guidance on computerised systems in GLP, expect validation, access control, audit trails and secure archiving of electronic data. The same controls cover both.
Will our images leave our network?
No. Checkpoint is not a cloud service. It runs on your internal network with a database server for storage and traceability, and images, measurements and user data stay inside your network.
What about AI and deep learning models?
Treat a trained model like any other analysis method: versioned, validated on representative images, and changed only under change control. The EU’s draft Annex 22 sets out expectations for AI in GMP. It is not adopted yet, but planning for it now is sensible.
How is it priced?
Checkpoint is licensed as an annual subscription. Our services are quoted per project after the free gap assessment, so you know the scope before you commit.
Not sure where your gaps are?
Book a free 30-minute compliance check. Tell us what you measure and which rules you work under, and we’ll show you where the chain breaks and what it takes to close it.