What Is EU GMP Annex 22 and Does It Apply to Your Operations?
If your organisation uses any form of artificial intelligence or machine learning within a GMP-regulated manufacturing environment, the answer is yes. EU GMP Annex 22 on Artificial Intelligence is the first dedicated regulatory framework in Europe that directly governs how AI systems must be selected, validated, monitored, and controlled in pharmaceutical manufacturing. And with the final publication expected imminently in 2026, the window to prepare is narrowing faster than most manufacturers realise.
This blog breaks down what Annex 22 actually requires, what types of AI are permitted and prohibited under the new rules, and the specific steps GMP-regulated manufacturers need to take right now before the effective date arrives.
Why Annex 22 Exists and Why It Matters Now
Annex 11 on Computerised Systems has long been the primary reference for digital systems under EU GMP. However, it was written before the rise of modern machine learning and artificial intelligence, and it does not address the unique compliance challenges that AI-driven decision-making introduces into regulated environments.
In July 2025, the European Commission published the draft of the entirely new Annex 22 on Artificial Intelligence, alongside a revised Annex 11 and an updated Chapter 4 on Documentation, for public consultation. The consultation period closed in October 2025, and the final versions of all three documents are expected to be formally adopted in 2026. Industry experts recommend acting during the typical six to twelve month grace period following publication, which means preparation should already be underway now.
Annex 22 does not exist to slow AI adoption. It exists to ensure that AI used in critical GMP processes is fully understood, validated, and controllable, so that patient safety and product quality are never compromised by an algorithmic decision that cannot be explained or challenged.
What Types of AI Are Permitted Under Annex 22
One of the most operationally significant aspects of Annex 22 is that it draws a clear boundary around which types of AI can and cannot be used in critical GMP applications.
Permitted for critical GMP use:
- Static, deterministic AI models that produce consistent, repeatable outputs when given identical inputs
- Machine learning models that are trained on data and deployed in a fixed, validated state
- Models used for quality control classification, process monitoring, deviation detection, and batch review support
Explicitly prohibited for critical GMP use:
- Dynamic AI models that continuously learn and adapt after deployment
- Generative AI and large language models (LLMs) in any decision that directly affects product quality or patient safety
- Probabilistic models whose outputs may vary even when given identical inputs
- Any AI system that cannot be explained, traced, or validated in line with GMP documentation standards
Permitted but with strict human-in-the-loop controls:
- Dynamic and generative AI tools in non-critical GMP applications, provided a qualified person is responsible for evaluating every output and documented human review records are maintained
This boundary setting is a direct reflection of GMP’s core principle: no automated system should reduce accountability or introduce uncontrolled uncertainty into pharmaceutical manufacturing.
The Core Compliance Requirements of Annex 22
Annex 22 is structured around the full lifecycle of an AI model, from selection and training through to deployment, monitoring, and change control. The key requirements manufacturers must understand and act on are as follows.
Intended Use Must Be Clearly Documented
Every AI model used in a GMP environment must have a clearly defined and approved intended use statement before testing begins. This document must describe:
- The specific task the model is designed to perform
- The data it will process and the conditions under which it operates
- Any known limitations or sources of bias
- How the model’s output will be used in decision-making
This is not a new concept in GMP, but applying it to AI requires QA teams to engage with data scientists and IT in a structured, documented way that many organisations have not yet formalised.
Validation Must Use Independent Test Data
Annex 22 requires that the data used to test and validate an AI model must be kept entirely separate from the data used to train it. This guards against bias, prevents overfitting, and ensures the model’s predictive performance reflects real-world operating conditions rather than its own training history.
Additional validation requirements include:
- Documented performance metrics established before testing begins, tailored to the specific application and product risk profile
- Feature attribution analysis to confirm the model is making decisions based on relevant inputs
- Confidence scoring, where the system flags low-confidence outputs rather than proceeding with an unreliable prediction
- Defined thresholds for acceptable and unacceptable model performance, with clear criteria for escalation
Human-in-the-Loop Records Must Be Maintained
Where an AI model is used to support a human decision rather than replace it, the human operator retains full documented responsibility for the final outcome. Annex 22 requires that records are kept of every instance where a human reviewed an AI output, particularly during early deployment phases where consistent review of every model output may be necessary.
Continuous Post-Deployment Monitoring Is Mandatory
AI models do not remain static in real-world conditions. Input data changes over time, processes evolve, and model performance can drift without any visible warning. Annex 22 requires:
- Ongoing monitoring of AI system performance throughout its operational life
- Regular checks to confirm that input data remains within the model’s validated sample space
- Immediate corrective action if input data begins to diverge from validated conditions, which may require retraining, revalidation, or suspension of model use
- Full change control procedures whenever a model is updated, retrained, or redeployed
Supplier Qualification Extends to AI Vendors
If your organisation uses AI systems supplied by a third party, the vendor qualification requirements under Annex 22 and the revised Annex 11 apply directly. Manufacturers cannot outsource accountability for GMP compliance to a software provider. Contracts must include:
- Defined validation responsibilities
- Audit rights
- Service level commitments covering data integrity and system availability
What GMP Manufacturers Must Do Before the Effective Date
The final text of Annex 22 will be published in 2026 and will be followed by a grace period for implementation. However, organisations that wait for the final publication before beginning preparation will not have sufficient time to achieve compliance. The following actions should be initiated now:
- Conduct an AI systems inventory: identify every AI or machine learning tool currently in use across GMP-regulated processes, including vendor-supplied tools embedded in quality systems or manufacturing equipment
- Classify each system against Annex 22 scope: determine whether each tool falls under critical or non-critical GMP applications and whether it uses static deterministic models or any prohibited model types
- Commission a gap analysis: assess your current validation documentation, data governance procedures, and change control processes against Annex 22 requirements
- Review vendor contracts: update agreements with AI system suppliers to include validation responsibility, audit rights, and data integrity commitments
- Update SOPs: revise or create procedures covering intended use documentation, AI model validation, confidence scoring, human review records, and post-deployment monitoring
- Train QA and quality teams: ensure quality assurance professionals, QPs, IT leads, and data science contacts all understand Annex 22 requirements and their respective responsibilities
- Pilot compliant AI use in non-critical settings: if your organisation is planning to expand AI use, begin in non-critical applications where human-in-the-loop controls can be established and tested before critical deployment
How Quality and Vigilance Ltd Can Help
At Quality and Vigilance Ltd, we support GMP-regulated manufacturers in preparing for regulatory change through practical, audit-ready quality consulting. Our services relevant to Annex 22 readiness include:
- GMP audit services and gap assessments against Annex 22 and revised Annex 11 requirements
- QMS design and optimisation to embed AI governance frameworks
- SOP development and controlled document review for AI validation and monitoring procedures
- Supplier qualification and vendor audit support for AI system providers
- CAPA management support for organisations addressing findings identified through AI gap assessments
- GMP training for quality, IT, and operations teams on Annex 22 obligations
Get in touch to discuss how Annex 22 affects your current AI use and what steps your organisation needs to take before the effective date.