EU GMP Annex 22.
Annex 22 is the planned AI annex to EudraLex Volume 4, the EU GMP guideline. It is the first standalone set of rules for AI models inside the computerized systems used in pharmaceutical manufacturing. The computerized system is still validated under Annex 11, and the embedded AI model faces requirements that go further. The text is still a draft, yet it can already shape how inspectors proceed.
Ten sections, one narrow boundary for critical applications.
The draft applies to computerized systems in the GMP environment in which AI models operate in critical applications. Critical here means a direct impact on patient safety, product quality or data integrity. Such models typically predict values or classify data. Under the GMP definition of manufacture, the scope extends from production to quality processes such as deviation management. The draft covers machine-learning models that acquired their function through training.
In our reading of the ongoing discussion, "critical" is not a matter of direct impact alone. Errors that are hard to detect and a high degree of automation also point to a higher classification. The text deliberately draws a tight boundary and, for critical applications, provides only for static models with deterministic output. The ten sections show how this fits into the wider picture of AI in GxP.
Scope & principles · Sections 1-2
Section 1 limits the scope to critical applications and to static models with deterministic output. Section 2 provides for the parties to work closely together (process SMEs, QA, data science, IT and consultants), each with defined responsibilities. The regulated user reviews the related documentation, including for models supplied by a vendor. How far the measures go depends on the risk.
Intended Use · Section 3
The draft expects a detailed description of the model's task, with input data (input sample space), limitations and possible bias. The process SME is responsible for that description, which is to be approved before testing. The draft applies "Intended Use" to the model. In our view the purpose comes from the process, and the model performs a task within it.
Acceptance criteria · Section 4
Test metrics and acceptance criteria are set before testing. The acceptance criteria should be at least as high as the performance of the process the model replaces.
Test data · Sections 5-6
Test data should be representative and stratified, and it is to be kept strictly separate from model development, technically and in terms of personnel, secured by access control and an audit trail. Where separation of personnel is not possible, the draft calls for the four-eyes principle.
Testing & explainability · Sections 7-9
Testing runs under an approved test plan and checks whether the model generalizes. During testing in critical applications, the system records which features of the test data contributed to the outcome, and approval of the test results includes a review of whether the model relies on relevant features. Techniques such as feature attribution appear in the draft only as examples ("where applicable"). The model can flag uncertain results as "undecided". How they are handled is, in our view, for the process to decide.
Operation · Section 10
Before go-live, the draft puts the model, the system and the process under change control, with the tested model also under configuration control. Model performance and input data need monitoring for drift, and where the testing effort for the model has been reduced, records have to be kept. Depending on criticality, this may mean that a human reviews or tests every output according to a defined procedure.
The thread running through these sections is a shift in evidence. Demonstrating the performance of a trained model requires statistically robust evidence from suitable test data. It complements the functional and integration testing of the computerized system. Test data comes with its own requirements, and metrics show how well the model performs. For GMP this way of thinking is not new. Since 2015, Annex 15 has required ongoing process verification across the lifecycle. Where appropriate, statistical tools support the conclusions on process variability and capability (5.29 to 5.32). Read that way, Annex 22 carries that evidence over from processes to models.
Rule-based automation without machine learning is purely an Annex 11 case. Static machine-learning models are the subject of Annex 22. For critical applications, by contrast, the draft does not provide for dynamic, probabilistic or generative models. Outside critical applications they can still be used, with the computerized system they run in subject to the risk assessment under the current Annex 11. In our view, they should always run under human oversight. The draft makes such oversight an explicit condition for generative AI and LLMs.
Where the text stands today.
1,359 comments from 79 organizations in 39 countries, submitted by industry, regulators and academia, reflect the interest in the draft. The road to the final text runs through five stages.
- 1
Draft and consultation
In July 2025, the European Commission put the draft of the first standalone AI annex to the EU GMP guideline out for consultation. It was prepared by the Annex 22 drafting group of the GMDP Inspectors Working Group. The comment period ran until October 2025. The annex belongs to the EudraLex Volume 4 revision package, together with Chapter 4 (Documentation) and the Annex 11 revision.
- 2
Evaluation of comments
The evaluation presented by the chair of the GMDP Inspectors Working Group in April 2026 shows clear themes, above all the call for a risk-based approach without categorical technology exclusions.
- 3
Expert workshop
Day one, 30 June 2026, was an open session in which experts nominated by the associations presented their views and evidence. Day two, 1 July, was a closed session without broadcast. The six topic areas ranged from regulatory pathways for adaptive models through human oversight to cybersecurity.
- 4
Report published, revised draft to follow
In early October 2026 the EMA published the workshop report (EMA/156789/2026). In it, the EMA reports that the drafting group has discussed widening the scope to dynamic, adaptive, probabilistic and generative models, provided they comply with the annex requirements and their use is supported by a "fully documented, robust, risk-based control strategy". As the next step, the report names the revision of the draft by the drafting group, but gives no date for it. On 12 and 13 November 2026, HMA and EMA host the AI and Data Forum in Amsterdam, on site and online. The agenda covers the status of AI guidance development across the European network and the lessons from the GMP workshop on Annex 22. Our overview Three Signals, One Line shows how closely the signals from Barcelona (rapporteur of the Annex 22 drafting group), Boston (FDA expert) and the EMA workshop align. There is a transatlantic signal as well. On 14 January 2026, EMA and FDA jointly published Guiding Principles of Good AI Practice. Principle 2 ties validation, risk mitigation and oversight to the context of use and the model risk that has been determined. Principle 9 covers lifecycle management of the AI system, which includes scheduled monitoring and periodic re-evaluation, for example with regard to data drift.
- 5
Finalization
Publication and transition periods are still pending. Until then Annex 11 applies unchanged.
Do generative AI and LLMs stay out?
In the consultation draft, yes. It does not apply to generative AI and Large Language Models, and in critical GMP applications they should not be used. Outside critical applications they can still be used, always with human review of the outputs (Human-in-the-Loop, HITL). Responsibility for their use lies with the regulated company. The workshop report published in early October 2026 records that the drafting group has discussed opening the scope to generative models and LLMs under a documented, risk-based control strategy. Before that, the EMA had summarized the key themes from the consultation as follows:
What will decide the final text of Annex 22?
The consultation and the expert workshop have narrowed the debate to three questions, and their answers will determine how far the final text departs from the consultation draft. The first question is whether the boundary stays tied to the model class or moves to the risk of the application. The second is about oversight: a fixed human-in-the-loop mechanism or human oversight with several forms. The third targets the evidence the EMA would require for guardrails if dynamic models were admitted to GMP applications. Since early October 2026, the state of the discussion has been public. The workshop report records that the drafting group has discussed widening the scope to dynamic and generative models.
Does the boundary stay tied to the model class?
For critical applications, the draft excludes dynamic, probabilistic and generative models. The logic of quality risk management points the other way. Higher risk means stronger controls, not a blanket ban. In its announcement of the workshop, the EMA counts guardrails among the elements of a risk-based approach. The report records the associations' view: intended use, the consequence of a decision, uncertainty, complexity and control strategy should decide whether a use is acceptable, not the technology label. The detectability of errors emerged from the discussion as a further risk consideration.
How much oversight will the final text require?
The draft relies on Human-in-the-Loop in three places, in the scope and in sections 3.3 and 10.5. At the workshop, industry proposed oversight as a concept with several forms. Which form is appropriate follows from the risk assessment. The report records that human-in-the-loop is one possible control, not a default requirement, and that oversight cannot compensate for inadequate validation. Our contribution to the GAMP D-A-CH Forum argues why that shift begins with responsibility: Who Pushes Back When the System Speaks? For ISPE iSpeak we made the case that a human in the loop does not by itself establish control: Human-in-the-Loop as an Illusion of Control?
What evidence for guardrails?
The workshop asked for evidence on the control measures and guardrails meant to support a risk-based approach. Industry presented GMP use cases and a three-layer guardrail architecture, from outlier detection at the input to drift detection at the output. The report notes that presenters described some examples as pilots or theoretical frameworks, and that industry suggested speaking of control mechanisms rather than guardrails. Many guardrails are themselves classifying systems with their own error rates. Such control mechanisms therefore need evidence too, with metrics, a testing approach and monitoring. That evidence applies to the overall package of controls.
How do Chapter 4, Annex 11 and Annex 22 interlock?
The three drafts of the EudraLex Volume 4 revision are interrelated. Chapter 4 governs documentation. It leaves responsibility for the integrity of documents, records and data with the regulated user, even when AI or other automated means produce or process that content. Where AI supports a decision in manufacturing, Annex 11 applies. In critical applications, the planned Annex 22 is intended to apply on top of it. The consultation draft limits it to static models. The Annex 11 draft forms the framework for every computerized system, with risk management, security, access management, audit trails and periodic review. That includes the principle that a new system should not increase the overall risk of the process. Annex 22 builds on that and, as supplementary guidance, describes what Annex 11 does not cover for a trained model: intended use of the model as the draft understands it, test data kept separate from the training and validation data used in model development, acceptance criteria at least at the level of the process it replaces, explainability, confidence thresholds and monitoring in operation.
The draft draws the line clearly.
Industry took up this boundary at the expert workshop. Its consolidated position addresses the same three points: the model class, the criticality of the application and the form of oversight.
"Following the above, the document does not apply to Generative AI and Large Language Models (LLM), and such models should not be used in critical GMP applications."
EU GMP Annex 22 (Artificial Intelligence), draft for consultation 2025, Section 1 "Scope".
Whether this exclusion holds in the final text remains an open question. The logic of evidence behind it applies either way: intended use, independent test data, monitoring and a criticality assessment that looks beyond direct impact. In our view the draft goes beyond what is necessary in section 6.5, staff independency, for example. The intent behind it is clear. Test data must not quietly flow back into training just so that the model passes on paper. The draft's own answer, separating staff or, failing that, applying the four-eyes principle, is one way of doing it. Depending on an organization's digital maturity, more effective solutions exist: access control and an integrated MLOps infrastructure with data lineage that makes it traceable which data were used where and for which model variant. The review then checks whether that infrastructure was used as required. That keeps the focus on the question that matters, whether the test data are suitable and meaningful enough to allow a realistic performance statement for operation. In a similar way, 4.3 and 8.2 mix the what with the how. In 4.3, the principle of "no decrease in performance" presupposes a known predecessor process and a one-to-one replacement. In 8.2, the draft provides for a review of whether relevant and appropriate features underpin the decision, without limiting this to any model class. Image-processing models allow such a review, other model classes hardly in that sense any more, and interpretability appropriate to the context of use would be the better goal.
What you can put in place before the final text.
Annex 11 provides the framework for the building blocks of the draft, and oversight belongs in AI governance with human oversight.
We worked through what this looks like in practice in June 2026, in a workshop at the ISPE AI in Life Sciences Summit in Boston. A RAG system built on a third-party language model classifies deviation reports in GMP operations as critical, major or minor. QA exercised human oversight and reviewed every classification before it took effect. Whether such an application counts as critical is decided by the operator's criticality assessment, independently of the downstream review. The supplier and the regulated company sorted ten gaps independently of each other into dealbreakers, fixable items and acceptable risks, then negotiated a joint list of mandatory evidence. The company could not delegate the intended use in its own process, the acceptance criteria or the residual risk. A model card, class-specific metrics and a test set kept separate from training were part of the evidence the company required from its supplier.
These are the building blocks we assess and put in place with you:
Frequently asked questions about Annex 22.
No date has been set. The consultation ended in October 2025, and the EMA expert workshop took place on 30 June and 1 July 2026. The EMA published the workshop report in early October 2026. After that, a revised draft, finalization and transition periods are expected. Until then the computerized system is validated under Annex 11. Quality risk management under ICH Q9(R1) guides the extent of the evidence.
In the consultation draft, generative AI and LLMs fall outside the scope of Annex 22, yet the draft is clear about them. Under the draft, they should not be used in critical GMP applications, and the evidence sections apply only to static models. Outside critical applications they may be used, provided a human reviews the outputs. The regulated company is responsible for that use. This exclusion was the central point of criticism in the consultation. According to the workshop report of October 2026, the drafting group has discussed admitting these models under a documented, risk-based control strategy.
Under the draft, an application is critical when the model has a direct impact on patient safety, product quality or data integrity. In Barcelona, the rapporteur of the drafting group explained the guiding question behind it: what effect would an error have, and would it be detected? Impact and detectability determine criticality. At this stage, the technology used plays no part in this classification. Which model classes the draft admits in critical applications is a separate question.
No. Annex 22 is designed as supplementary guidance to Annex 11. The computerized system is still validated under Annex 11, and the planned Annex 22 is intended to govern the evidence for the embedded model in addition, from intended use to operation.
Annex 22 concentrates on the model, that is, on training, testing and the evidence of its fitness for purpose. We take a wider view. An AI system or AI subsystem integrates one or more models and additional functions, such as technical control mechanisms, often called "guardrails" in the debate, into a system component. Performance can then be measured at several levels, so that the suitability of all subcomponents and their interplay can be checked.
Section 2.1 of the draft calls for close cooperation among everyone involved, from algorithm selection through training, validation (in the model-development sense) and testing to operation. It names process SMEs, QA, data science, IT and consultants, each with adequate qualifications, defined responsibilities and appropriate access rights. For generative models outside critical applications, qualified personnel carry the responsibility for ensuring the outputs are suitable for the intended use. The cooperation under section 2.1 is also Knowledge Management. ICH Q10 names it, alongside quality risk management, as one of the two enablers of the quality system. That keeps knowledge about models, data and their limits inside the organization. The H² Academy, our e-learning program on AI in GxP, builds the qualification this calls for.
Regulated companies can meet the core of the requirements before finalization. An AI inventory, intended use and criticality assessment per application, test metrics, independent test data, monitoring and human oversight can all be implemented under the current Annex 11. ICH Q9(R1) guides how far the evidence has to go. Since July 2025, the methodology for AI-enabled systems has had a home of its own, the ISPE GAMP Guide: Artificial Intelligence. The draft makes much of this explicit for AI models.
Last updated:
Annex 22 needs the full context.
Annex 22 readiness starts before the final text.
In an initial conversation, we explore what you plan to do with AI, where your applications stand today and what Annex 22 means for you. Free of charge, about 30 minutes.
Book an initial conversation
