Data integrity is still a warning letter staple

In a review of 85 FDA drug warning letters posted in 2025, “15% of all warning letters reviewed cited DI concerns” (Pharmaceutical Online). Data integrity problems rarely appear alone: they undermine every batch record, test result and investigation that depends on the data.

FDA defines data integrity as the “completeness, consistency, and accuracy of data,” and expects data to be “attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA)” (FDA, 2018).

For what GMP documentation drug makers must keep and the errors FDA cites most, see GMP Documentation: Records, ALCOA+ and the Documentation Errors FDA Cites Most.

What regulators expect

SourceKey expectation
FDA Data Integrity Q&A (Dec 2018)Shared logins break attribution: “When login credentials are shared, a unique individual cannot be identified through the login.” Audit trail review frequency should be set by risk where regulations do not specify it. A printout “does not preserve the dynamic record format” of original electronic data. “FDA prohibits sampling and testing with the goal of achieving a specific result.”
MHRA GXP Data Integrity Guidance (Mar 2018)ALCOA+ adds “Complete, Consistent, Enduring, and Available.” “Users should not be able to amend or switch off the audit trail.” Shared logins “should not be used” for GxP data.
PIC/S PI 041-1Data management and integrity guidance in force since July 1, 2021
21 CFR Part 11”secure, computer-generated, time-stamped audit trails” and “Limiting system access to authorized individuals”

2026 trend: Europe is rewriting the computerized systems rules

The European Commission consulted from July 7 to October 7, 2025 on revised GMP Chapter 4 (documentation), a revised Annex 11 (computerized systems) and a new Annex 22 on AI (European Commission). The draft Annex 11 grows “from 5 pages to 19,” with new sections on supplier and service management, identity and access management, audit trails and periodic review (NSF). It explicitly covers cloud services and states that responsibility “cannot be outsourced” (GMP Insiders). As of October 2026 the texts are still drafts, but they signal where inspectors in the EU and PIC/S countries are heading.

The GMP data integrity checklist

Governance

  • A data governance policy assigns ownership for each GxP system and data flow
  • Data criticality and risk are assessed for each system
  • Management reviews data integrity metrics and audit findings

Access and attribution (A in ALCOA)

  • Every user has a unique login; no shared or generic accounts for GxP data
  • Administrator rights are separated from users who generate or review data
  • Access is reviewed periodically and removed promptly when roles change

Audit trails

  • Audit trails are enabled and cannot be amended or switched off by users
  • Audit trail review frequency is defined by risk and documented
  • Audit trail review is part of record review before batch release where relevant

Original records and dynamic data (O in ALCOA)

  • Original electronic records are retained, not just printouts
  • True copies are verified and controlled
  • Backup and restore are tested; records remain available for the retention period

Contemporaneous, legible, accurate

  • Entries are made at the time of the activity; no back-dating or pre-recording
  • Blank forms are controlled and reconciled
  • System clocks are synchronized and protected

Laboratory practices

  • No trial, test or “equilibration” runs using actual samples
  • All injections and results, including aborted runs, are retained and reviewed
  • OOS results are investigated, not invalidated without root cause

Computerized systems and suppliers

  • Systems are validated for intended use, including cloud and SaaS services
  • Supplier agreements define data ownership, access, retention and audit rights
  • Periodic reviews cover configuration, security and audit trail status

Find data integrity gaps in your procedures

Most data integrity findings trace back to procedures that never said what “good” looks like: no audit trail review step, no rule against shared logins, no definition of original records. AI document assessment can read your SOPs against FDA, MHRA and Part 11 expectations, flag missing controls and cite the passage behind every finding.

Run a sample regulatory document assessment on your data governance or lab SOP. AskDona shows the evidence; your QA team decides.

FAQ

What is ALCOA+? Attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available (MHRA).

How often should audit trails be reviewed? FDA says that where regulations do not set a frequency, “you should determine the review frequency for the audit trail” based on risk (FDA).

Are shared logins ever acceptable? MHRA says shared logins “should not be used” for GxP data; limited exceptions need justified, documented alternative controls.

Is the new EU Annex 11 in force? Not as of October 2026. It was consulted on in 2025 and remains a draft (European Commission).

References

All pages opened and checked by October 9, 2026.

SourceTypeDateUsed for
FDA: Data Integrity and Compliance With Drug CGMP Q&ARegulator guidanceDec 2018ALCOA, shared logins, audit trails, dynamic data
MHRA: GXP Data Integrity GuidanceRegulator guidanceMar 2018ALCOA+, audit trails, shared logins
PIC/S: PI 041-1 adoptionRegulator networkJul 1, 2021PIC/S guidance
eCFR: 21 CFR Part 11Regulation textCurrentAudit trails, access
European Commission: Chapter 4, Annex 11, Annex 22 consultationRegulatorJul–Oct 2025Draft revisions
NSF: Revised EU GMP draftsIndustry newsJul 21, 2025Annex 11 new sections
GMP Insiders: 2025 EU GMP draftsIndustry analysisJul 7, 2025Cloud scope, responsibility
Pharmaceutical Online: 2025 warning lettersExpert columnDec 15, 202515% DI