1. Introduction

Biotechnology Audit Trail Requirements Law in Russia concerns the legal and regulatory obligations imposed on biotechnology companies, pharmaceutical manufacturers, clinical research organisations, genetic laboratories and other regulated entities to maintain reliable, traceable and tamper-resistant records of their scientific, manufacturing and quality-control activities.

An audit trail is a chronological electronic record that identifies activities performed within a computerised system. It helps establish:

Who created or accessed particular information.

When information was created, modified or deleted.

What changes were made to the original information.

Why a modification or deletion occurred.

Whether information was approved by an authorised person.

Whether the integrity of scientific and manufacturing records was compromised.

Audit trails are particularly important in biotechnology because inaccurate or manipulated records can affect medicine safety, genetic research, clinical-trial outcomes, biological-product manufacturing and public health.

Russian law does not establish one universal audit-trail statute exclusively for biotechnology. Instead, the applicable requirements arise from pharmaceutical legislation, Eurasian Economic Union (EAEU) Good Manufacturing Practice (GMP), laboratory standards, electronic-document legislation and personal-data protection requirements.

An important legislative development is Federal Law No. 304-FZ of 31 July 2025, which amended the Russian pharmaceutical manufacturing framework. Under the amended Article 45 of Federal Law No. 61-FZ, manufacturing of medicines for human use in Russia is governed by EAEU GMP requirements.

Consultant Plus+1

2. Constitutional and Legislative Framework

Several legal instruments establish the regulatory foundation for biotechnology audit trails.

A. Constitution of the Russian Federation, 1993

Constitutional protections are relevant to the collection, processing and preservation of biotechnology information.

Important provisions include:

Article 23 – Privacy and confidentiality

Protects privacy and confidential communications.

Article 24 – Personal information

Restricts the collection, storage, use and dissemination of information concerning an individual's private life without an appropriate legal basis.

Article 41 – Right to health protection

Provides the constitutional foundation for protecting public health.

Article 44 – Intellectual property

Protects intellectual and scientific achievements.

These constitutional principles become relevant when biotechnology companies maintain electronic medical records, genomic databases, clinical-trial documentation and research information.

B. Federal Law No. 61-FZ of 12 April 2010 – On Circulation of Medicines

Federal pharmaceutical legislation

Federal Law No. 61-FZ is one of the principal laws governing pharmaceutical biotechnology in Russia.

Article 8 addresses licensing of pharmaceutical manufacturing.

Article 9 establishes government supervision over the circulation of medicines.

Article 45 regulates pharmaceutical manufacturing and requires compliance with applicable GMP requirements.

These provisions are important for biotechnology companies manufacturing:

Recombinant proteins.

Monoclonal antibodies.

Vaccines.

Gene-therapy medicines.

Cell-based medicinal products.

Biological pharmaceutical substances.

Manufacturing documentation must permit regulators to establish whether the manufacturing process complied with applicable quality requirements.

A manufacturer cannot rely exclusively on a final quality-control report if the underlying production records are incomplete or unreliable.

WIPO+1

C. EAEU GMP Rules – Decision No. 77 of 3 November 2016

Central regulatory framework

The Council of the Eurasian Economic Commission adopted Decision No. 77 on 3 November 2016, approving the EAEU Good Manufacturing Practice Rules.

These rules are particularly important for pharmaceutical biotechnology manufacturing.

They require manufacturers to maintain appropriate documentation, control computerised systems and preserve the integrity of production records.

The framework addresses:

Documentation and record management.

Computerised-system validation.

Electronic data protection.

Access controls.

Changes to electronic records.

Data backup and recovery.

Electronic signatures.

Incident reporting.

Archiving and record retention.

Under the documentation principles, entries should be made when activities occur. Changes to records must preserve the original information and be appropriately signed and dated.

Контур.Экстерн+1

D. Ministry of Industry and Trade Order No. 916 of 14 June 2013

Order No. 916 approved Russian GMP rules and historically provided an important domestic framework for computerised-system controls.

Its Annex 11, entitled Computerised Systems, contains specific audit-trail requirements.

The relevant provisions include:

Paragraph 3: validation of computerised systems.

Paragraph 22: protection and availability of stored data.

Paragraph 23: backup and recovery.

Paragraph 25: printouts identifying whether data have been changed.

Paragraph 26: audit trails.

Paragraph 27: controlled changes to computerised systems.

Paragraph 28: periodic system assessment.

Paragraph 33: recording and evaluating incidents.

Paragraph 26 is especially important because it requires risk-based provision for records of significant changes and deletions, documentation of the reasons for those changes or deletions, accessibility and regular review of audit trails.

Order No. 916 remains important for understanding the historical development of Russian pharmaceutical audit-trail regulation. However, its provisions must be read alongside the EAEU GMP framework and subsequent legislative amendments, rather than automatically treated as the sole current manufacturing standard.

Документы ленты ПРАЙМ: ГАРАНТ.РУ+2

3. Meaning and Legal Importance of Audit Trails in Biotechnology

Biotechnology operations generate different categories of regulated information.

For example, a biotechnology company manufacturing a vaccine may generate:

Raw-material testing records.

Cell-culture records.

Fermentation parameters.

Temperature-monitoring data.

Batch-production records.

Laboratory testing results.

Sterility testing records.

Quality-control approvals.

Product-release documentation.

An audit trail creates a historical record of significant activities involving these records.

Consider the following hypothetical situation.

A pharmaceutical biotechnology company records a vaccine batch's temperature as 37°C. Later, an employee changes the recorded temperature to 35°C.

A compliant audit trail should preserve:

The original temperature entry.

The modified temperature.

The identity of the person making the modification.

The date and time of modification.

The reason for the change.

Any relevant review or approval.

Without these records, the regulator may be unable to determine whether the vaccine batch was manufactured under appropriate conditions.

The central legal objective is therefore data integrity and accountability throughout the data lifecycle.

4. Mandatory Audit Trail Requirements

A. Identification of Users

Biotechnology organisations must establish appropriate controls to identify individuals accessing regulated computerised systems.

Examples include:

Individual user accounts.

Unique identification credentials.

Role-based access.

Authorised administrator accounts.

Access-control procedures.

Shared accounts create serious accountability problems because they prevent reliable identification of the person responsible for a particular activity.

B. Recording Changes and Deletions

Significant modifications and deletions must be recorded where required by the applicable GMP provisions and the system's risk assessment.

The audit trail should identify:

Original information.

Modified information.

User identification.

Date and time.

Reason for modification.

The original information should not simply disappear when an employee changes a record.

C. Time and Date Recording

Audit trails should provide reliable chronological information.

This is important for determining whether:

Laboratory tests were performed before product approval.

Quality-control procedures were completed on time.

Manufacturing deviations were investigated.

Clinical-trial information was entered retrospectively.

Product-release approvals occurred in the proper sequence.

D. Electronic Signatures

Electronic signatures are relevant when employees approve regulated electronic records.

Federal Law No. 63-FZ of 6 April 2011, On Electronic Signatures, provides the general legal framework.

Depending on the applicable legal requirements and electronic-signature type, electronic signatures may establish the identity of the signer and the authenticity of an electronic document.

Under the GMP framework, electronic approvals should be attributable to authorised personnel and linked to the relevant records.

Документы ленты ПРАЙМ: ГАРАНТ.РУ+1

E. Data Backup and Recovery

Biotechnology organisations must protect important electronic information against:

Accidental deletion.

System failure.

Cyberattacks.

Hardware damage.

Software malfunction.

Unauthorised modification.

Regular backups should be performed, and their accuracy and recoverability should be tested.

F. Periodic Audit Trail Review

Maintaining an audit trail is not sufficient by itself.

Organisations should establish documented review procedures to identify suspicious or unexplained activities.

Examples include:

Repeated modification of laboratory results.

Deletion of failed test results.

Unauthorised changes to manufacturing parameters.

Unusual administrator activity.

Modification of records after batch approval.

The frequency and depth of review should reflect the risk and criticality of the data.

zakonbase.ru+2

5. Application to Different Biotechnology Sectors

A. Genetic Engineering and CRISPR Research

High-Efficiency Gene Editing - Fred Hutch

fredhutch.org

Genetic-engineering laboratories use computerised systems to record experimental procedures, gene-editing outcomes and laboratory observations.

Audit trails can help establish:

Which researcher modified a genetic sequence.

When experimental parameters were changed.

Whether the original experimental results were preserved.

Whether data were altered after an unsuccessful experiment.

Whether research records were approved.

Where research generates regulated medicinal products, applicable GMP requirements become particularly important.

B. Vaccine Manufacturing

Corona-Impfstoffe: Was bringt eine Aufhebung des Patentschutzes? | DIE ZEIT

zeit.de

Vaccine manufacturers must maintain reliable records of manufacturing and quality-control activities.

Audit trails can document changes to:

Temperature settings.

Fermentation conditions.

Biological-material quantities.

Sterilisation parameters.

Batch-testing results.

Quality-control approvals.

An unexplained alteration of critical manufacturing information may raise questions about batch quality and regulatory compliance.

C. Stem Cell Research

A culture change for regenerative medicine

nature.com

Stem-cell research generates sensitive scientific and biological information.

Audit trails can help establish:

Cell-line identification.

Sample-transfer history.

Laboratory handling activities.

Experimental modifications.

Researcher responsibility.

Approval of research documentation.

Where human biological samples or identifiable donor information are involved, privacy and consent requirements must also be considered.

D. Clinical Biotechnology Trials

Clinical-trial electronic systems may record:

Patient enrolment.

Informed-consent documentation.

Clinical observations.

Adverse events.

Laboratory findings.

Trial protocol deviations.

Investigator approvals.

Audit trails are particularly important when clinical-trial data are submitted to regulatory authorities.

A retrospective alteration of patient information without an adequate record may undermine the reliability of the clinical evidence.

E. Pharmaceutical Biotechnology

Companies manufacturing biological medicines must maintain reliable records covering the entire manufacturing process.

This includes raw materials, production, laboratory testing, deviations, quality assurance and batch release.

The audit trail should enable investigators to reconstruct significant activities affecting product quality.

6. Other Relevant Russian Laws

A. Federal Law No. 152-FZ of 27 July 2006 – Personal Data

This law regulates personal-data processing.

It becomes relevant when biotechnology audit trails contain:

Patient identification information.

Genetic information associated with identifiable individuals.

Clinical-trial participant information.

Medical records.

Research-subject information.

Organisations must establish lawful processing, appropriate security measures and controls against unauthorised access.

Importantly, audit trails themselves may contain personal data, particularly employee identifiers and patient-related information.

B. Federal Law No. 323-FZ of 21 November 2011 – Fundamentals of Health Protection

This legislation regulates the protection of health information and medical confidentiality.

It is relevant to biotechnology companies and clinical research organisations processing medical information.

Audit-trail systems should support accountability without unnecessarily exposing confidential patient information.

C. Federal Law No. 63-FZ of 6 April 2011 – Electronic Signatures

This legislation governs electronic signatures and their legal use.

It supports the authentication and evidentiary reliability of electronic documents.

However, an electronic signature and an audit trail are different things:

An electronic signature identifies or authenticates an approval.

An audit trail records the history of relevant actions and modifications.

Both may be necessary for reliable electronic documentation.

7. Regulatory Authorities and Enforcement

Several Russian authorities have responsibilities relevant to biotechnology records.

Roszdravnadzor is particularly important because it supervises the circulation of medicines, including relevant manufacturing and quality-control requirements.

roszdravnadzor.gov.ru+1

8. Case Laws and Judicial Decisions

Russian courts have addressed pharmaceutical GMP compliance, manufacturing documentation, regulatory inspections and electronic reporting. However, there is an important distinction: not every pharmaceutical GMP judgment is a direct decision about audit-trail functionality.

The following decisions are relevant to the legal principles governing audit trails.

Case 1: Arbitration Court of the Moscow District, 7 December 2017

Case No. А41-26971/2017

Pharmaceutical quality-management and documentation compliance

This case concerned pharmaceutical manufacturing compliance and deficiencies in the manufacturer's pharmaceutical quality system.

The inspection identified problems involving:

Pharmaceutical quality-system reviews.

Documentation procedures.

Quality reviews.

Contractual oversight.

Compliance with GMP requirements.

The court considered the relationship between the manufacturer's quality-management procedures and the regulatory requirements established under Order No. 916.

Legal significance

The decision illustrates that pharmaceutical manufacturers must maintain documented systems capable of demonstrating compliance.

For audit-trail purposes, this supports the importance of preserving reliable records of regulated activities and ensuring that documented procedures are actually followed.

It is not a judgment specifically establishing a standalone audit-trail obligation.

ГАРАНТ

Case 2: Moscow Arbitration Court, 20 May 2026

Case involving Jodas Expoim

Case concerning GMP certification and pharmaceutical registration information

The dispute involved Jodas Expoim and the Russian Ministry of Health.

The company challenged regulatory action concerning the suspension of a medicinal-product registration certificate.

The dispute concerned:

GMP certification.

Manufacturing-site compliance.

Information submitted in the registration dossier.

Regulatory inspections.

The reliability and completeness of supporting documentation.

The company argued that its GMP certification and submitted documentation satisfied the relevant EAEU requirements.

The dispute demonstrates the importance of reliable regulatory documentation and the need to establish manufacturing-site compliance through appropriate evidence.

Legal significance

For biotechnology manufacturers, the case illustrates that documentary compliance is not merely an internal administrative matter. Information submitted to regulatory authorities may directly affect the legal status of medicinal products.

This decision is relevant by analogy to audit-trail compliance, rather than being a direct ruling on audit-trail software.

Sudact

Case 3: Ninth Arbitration Court of Appeal, 19 August 2026

Case No. А40-282474/2025

Decision No. 09АП-27783/2026

Important recent decision

This case involved Jodas Expoim and the Russian Ministry of Health.

The dispute concerned the suspension of a medicinal-product registration certificate following regulatory concerns about the manufacturing site's GMP compliance and the reliability of information in the registration dossier.

The court considered:

The validity of GMP documentation.

The significance of manufacturing-site inspections.

The reliability of regulatory information.

The existence of critical GMP deficiencies.

The legal basis for suspending the registration certificate.

The appellate court upheld the regulatory action.

Legal significance

The judgment demonstrates that pharmaceutical companies must provide reliable and sufficiently substantiated GMP documentation.

For biotechnology audit trails, this is significant because electronic production records, laboratory records and quality-control histories may form part of the evidence used to establish manufacturing compliance.

Again, the case does not directly decide the technical requirements of an electronic audit trail.

ГАРАНТ

Case 4: Administrative Enforcement Concerning the MDLP System

Administrative offence under Article 6.34(2) of the Russian Code of Administrative Offences

This dispute concerned the Russian medicinal-product movement monitoring system, known as MDLP.

During an inspection, authorities identified a discrepancy between the actual storage location of medicinal products and the location recorded in the electronic monitoring system.

The organisation argued that its supplier was responsible for entering the incorrect information.

The court rejected that argument and found that the organisation had confirmed inaccurate information about the receipt and location of the products.

Legal significance

This dispute illustrates an important principle of electronic regulatory accountability: a regulated organisation cannot necessarily avoid responsibility by blaming another participant in the supply chain after confirming inaccurate information.

For biotechnology businesses, this principle is relevant to electronic batch records, biological-product distribution records and digital supply-chain traceability.

Юридическая фирма БРЭЙС | BRACE Law Firm

9. Legal Consequences of Audit Trail Violations

Failure to comply with applicable audit-trail and record-integrity requirements can create several forms of legal exposure.

Depending on the circumstances, the consequences may include:

Corrective and preventive action (CAPA).

Additional regulatory inspections.

Reassessment of manufacturing compliance.

Restrictions on manufacturing activities.

Suspension of a medicinal-product registration.

Administrative penalties under applicable legislation.

Civil liability where legally established harm occurs.

The applicable sanction depends on the specific violation, the responsible party and the relevant statutory provision. Not every audit-trail deficiency automatically results in suspension or criminal liability.

10. Practical Compliance Requirements for Biotechnology Companies

A biotechnology organisation operating in Russia should establish a comprehensive audit-trail compliance programme.

The following measures are particularly important.

1. Computerised-system inventory

Maintain an inventory of all systems used for regulated activities, including laboratory information management systems (LIMS), electronic batch records and manufacturing execution systems (MES).

2. System validation

Validate computerised systems according to their intended use and relevant quality risks.

3. Individual user identification

Ensure that every regulated user has an identifiable account.

4. Tamper-resistant records

Prevent unauthorised deletion, modification or concealment of critical information.

5. Change documentation

Record the original value, modified value, user, date, time and reason for significant changes.

6. Electronic approval

Ensure that regulated approvals are attributable to authorised personnel.

7. Audit trail review

Establish periodic and risk-based review procedures.

8. Backup and archiving

Maintain accessible, readable and recoverable records throughout the applicable retention period.

9. Employee training

Train laboratory employees, quality-control personnel, IT administrators and manufacturing managers in data-integrity requirements.

10. Vendor accountability

Establish appropriate contractual responsibilities when external providers host, maintain or process regulated information.

11. Important Legal Challenges

A. Retrospective Data Manipulation

One of the most significant risks is retrospective modification of scientific records.

For example, a laboratory employee may change an unsuccessful biological experiment into a successful result.

If the original result is not preserved, regulators may be unable to reconstruct the actual scientific process.

B. Artificial Intelligence and Automated Laboratories

Modern biotechnology increasingly uses AI for:

Genetic sequence analysis.

Drug discovery.

Automated laboratory testing.

Biological-process optimisation.

Clinical-data evaluation.

Where such systems generate or modify regulated records, organisations must assess their validation, access controls, data integrity and auditability.

Russian GMP principles apply to regulated computerised systems; the use of AI does not remove the manufacturer's responsibility for reliable records.

C. Cloud-Based Biotechnology Records

Cloud platforms create additional compliance challenges involving:

Remote access.

Data ownership.

Cybersecurity.

Backup arrangements.

Third-party service providers.

Data location and cross-border transfers.

Companies must ensure that outsourced technology does not undermine their ability to maintain and produce reliable regulated records.

D. Genetic Privacy

Audit trails involving genomic information may contain sensitive personal information.

Companies must balance two legal objectives:

Maintaining scientific and regulatory accountability.

Protecting the confidentiality of individuals whose biological information is processed.

This requires appropriate access restrictions, security controls and lawful processing arrangements.

12. Conclusion

Biotechnology Audit Trail Requirements Law in Russia is based primarily on pharmaceutical GMP regulation, particularly the EAEU GMP framework, together with electronic-document, electronic-signature and personal-data legislation.

The legal objective is to ensure that scientific, manufacturing and quality-control records remain complete, accurate, attributable, accessible and reliable throughout their lifecycle.

The principal regulatory principles are:

Preservation of original information.

Recording of significant modifications and deletions.

Identification of responsible users.

Accurate date and time recording.

Documentation of reasons for changes.

Electronic approval and authentication.

Periodic review of audit trails.

Protection against unauthorised interference.

Reliable backup and archival arrangements.

The judicial decisions discussed above demonstrate the importance of documentary reliability and regulatory accountability in Russian pharmaceutical law. They should not, however, be misrepresented as direct precedents on every technical feature of audit-trail systems.

Ultimately, audit trails are essential to ensuring that biotechnology innovation operates within a framework of scientific reliability, pharmaceutical quality, patient safety and legal accountability.

13. Important Legal References

Primary research sources:

EAEU GMP Rules – Decision No. 77.

EAEU Good Laboratory Practice – Decision No. 81.

Russian GMP Order No. 916.

Federal Law No. 61-FZ – Article 45.

Arbitration Court of the Moscow District – Case No. А41-26971/2017.

Ninth Arbitration Court of Appeal – Case No. А40-282474/2025.

Research qualification: For litigation or regulatory submissions, the current consolidated Russian and EAEU legal texts should be checked, particularly the amendments effective in 2026. The case-law examples above concern related GMP and electronic-record accountability issues, not a settled body of judgments specifically interpreting Annex 11 audit trails.