Cannabis Data Integrity: ALCOA+ and Annex 11 for LPs in 2026

ALCOA+ is not a European invention. It is the shorthand regulators use for what a trustworthy record looks like, and it runs through EU GMP guidance and through the PIC/S guidance on data management, PI 041-1, which came into force on 1 July 2021. Health Canada has been a PIC/S participating authority since 1999, so none of this vocabulary should be foreign to a Canadian quality team.

Applied to a cannabis batch record, the nine attributes read like this:

• Attributable: the entry names the person who made it and when, not just which shift was on.
• Legible: readable for the whole retention period, including handwriting on a drying room log.
• Contemporaneous: written when the work happened, not reconstructed on Friday afternoon.
• Original: the first capture, or a verified true copy of it, never a retyped summary.
• Accurate: matches what actually happened, with deviations recorded rather than tidied away.
• Complete: includes repeat tests, out of specification results and aborted runs.
• Consistent: dates, units and formats behave the same way across every system you run.
• Enduring: survives the retention period on media someone can still open.
• Available: retrievable for an inspector or an auditor without a three week search.

Software does not buy you five of these

Count how many of those nine are about behaviour rather than technology. You can install a validated LIMS and still fail on contemporaneous entry, because contemporaneous is a habit, not a feature. Your third party lab's ISO/IEC 17025 accreditation covers how the sample was analysed. It says nothing about how your team recorded the result when it came back.

That split matters more than the software budget. An auditor who finds one backdated entry stops trusting the rest of the file, and there is no technical fix for lost trust.

Canadian record keeping rules sit in Part 11 of the Cannabis Regulations. The default retention period is two years after a document is prepared. Section 221 goes further and requires records to be kept in a form that allows an audit to be made in a timely manner. Adverse reaction records are the long outlier at twenty five years. Section 232 adds documentation of the standard operating procedures in use at the site.

EudraLex asks a different question of the same paperwork. Chapter 4 governs documentation, Annex 11 governs the computerised systems holding it, and the Qualified Person certifying your batch inside the EU has to be satisfied with both. Here is where the two frameworks pull apart.

The middle column gets misread as sufficient. It is not. Your monthly CTLS reporting satisfies a federal tracking obligation and proves almost nothing to a European auditor, because it reports quantities rather than decisions. Likewise, the quality assurance person named on your licence is not the person releasing product in Germany. That is the Qualified Person on the importer's side, and they carry personal liability for the certification.

So the practical test is simple. Would your batch file convince somebody whose own licence is on the line? Federal compliance is the floor, not the answer.

A concept paper announcing the Annex 11 revision appeared in November 2022. Nearly three years passed before the draft itself landed in July 2025, arriving alongside a revised Chapter 4 on documentation and an entirely new Annex 22 covering artificial intelligence. Annex 11 is restructured into seventeen chapters plus a glossary, and PIC/S has signalled it intends to adopt an equivalent version. Read that timing carefully. When PIC/S adopts, the reach extends past the EU to every regulator in the scheme, Health Canada included.

What the draft tightens

Four areas move from interpretation to expectation. Audit trails get a dedicated chapter rather than a single clause, with capture of who changed what, when and why, plus targeted review before batch release instead of a rubber stamp. Access management gets specific about unique personal accounts, with shared logins ruled out and administrator rights separated from ordinary GMP user rights. Security appears as a GMP discipline in its own right. Supplier and service management brings your cloud and software vendors inside the contract perimeter.

Annex 22 goes the other way and narrows what you may do. It limits artificial intelligence in GMP critical applications to static, deterministic models, which rules out generative tools for decisions that touch product quality.

Shared logins on a GMP system are indefensible in front of an EU inspector. If your cultivation ERP still has one sitting on the packaging line, fix that before you book another audit, because no amount of documentation rescues a record nobody can attribute to a person.

None of this is retroactive kindness. The draft offers no grandfather clause, which means the work is a gap assessment now or a compressed scramble later. LPs already carrying EU-GMP certification for a Canadian facility will find the lift smaller, though nobody escapes the audit trail chapter entirely.

Five steps, in this order, because each one depends on the last. Call it the AlphaLeaf 5-point data integrity readiness path and run it before your importer's auditor arrives rather than during their visit.

1. Inventory every system that touches a batch decision: cultivation ERP, environmental monitoring, scales, LIMS, the spreadsheet somebody still keeps on a shared drive.
2. Map each record type to the nine ALCOA+ attributes and write down who signs it, who reviews it and where it lives.
3. Turn audit trails on where they are off, then schedule review as a step before release rather than an annual exercise.
4. Retire shared accounts, give every operator a unique login and split administrator rights away from GMP user rights.
5. Rehearse retrieval. Pick a batch from eighteen months ago and reconstruct the full file in one working day.

Step five is the one that exposes everything. Teams that sail through the first four often discover their 2024 environmental data lives on a laptop that left with a former employee. Better to find that out yourselves. Pair this work with your GPP audit preparation so the same evidence serves both inspections.

AlphaLeaf is a Montreal Licensed Producer of indoor grown, hand trimmed cannabis flower with refined genetics and ISO certified batch testing. We hold export authorisation under the Cannabis Act and maintain the traceability and documentation records that EU importers and their Qualified Persons expect to see before a batch moves.

If you are qualifying a Canadian supplier and want to see how a batch file holds up under ALCOA+ questioning, talk to our quality team and we will walk you through a real one. Bring your auditor's checklist. Start with the audit trail.

What is ALCOA+ in cannabis manufacturing?

ALCOA+ is the data integrity standard requiring records to be attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available. It appears throughout EU GMP guidance and in the PIC/S guidance PI 041-1, which came into force on 1 July 2021. For a cannabis Licensed Producer it applies to batch records, environmental monitoring, testing results and release decisions.

Does Health Canada require data integrity for cannabis licence holders?

Health Canada does not use the ALCOA+ label, but Part 11 of the Cannabis Regulations requires licence holders to retain documents and to keep them in a form that allows an audit to be made in a timely manner. The default retention period is two years after a document is prepared. Adverse reaction records must be retained for twenty five years.

Does EU GMP Annex 11 apply to a Canadian cannabis producer?

Annex 11 binds manufacturers inside the EU, so it does not apply to a Canadian LP directly. It applies through your customer. An EU importer and its Qualified Person are inspected against EudraLex, so they push Annex 11 and Chapter 4 expectations down to their suppliers through audits and quality agreements.

What changed in the 2025 Annex 11 draft revision?

The draft published on 7 July 2025 expands Annex 11 from five pages to nineteen across seventeen chapters, adds a dedicated audit trail chapter, tightens access management and identity control, treats security as a GMP discipline and brings software suppliers under formal oversight. It arrived with a revised Chapter 4 and a new Annex 22 on artificial intelligence. Consultation closed on 7 October 2025.

What do EU auditors look at first in a cannabis data integrity review?

Auditors typically start with audit trail configuration and user access, because those two answer whether any other record can be trusted. Shared logins, disabled audit trails and administrator rights held by production staff are findings that undermine the whole file. Retrieval speed for older batches is usually the second area tested.

Does a certificate of analysis prove data integrity?

No. A certificate of analysis reports results, while data integrity is about whether the record behind those results can be reconstructed and trusted. An auditor will ask to see the raw instrument data, the audit trail and the review signature that sit behind the certificate.