The latest from QFINITY and the field.

In early October 2026 the EMA published the report on its expert workshop of 30 June 2026. In 15 pages, document EMA/156789/2026 records what the industry associations presented on six topics, and it contains one sentence that reaches beyond the workshop: the drafting group has discussed widening the scope of EU GMP Annex 22 to dynamic, adaptive, probabilistic and generative models. The condition would be a "fully documented, robust, risk-based control strategy". Here is our reading of what the report confirms and what it leaves open.

We followed the publicly broadcast workshop day and brought the signals from Barcelona, Boston and the workshop together in our August article Three Signals, One Line. With the report, a written account of the workshop by the EMA itself is available for the first time.

The sentence that matters

The 2025 consultation draft excludes generative AI and Large Language Models from its scope and, like dynamic and probabilistic models, does not provide for them in critical GMP applications. The report quotes that sentence in its introduction and sets the consultation feedback against it. The comments supported allowing such models in GMP applications, "whether critical or non-critical". The drafting group, the EMA writes, has therefore discussed widening the scope, "provided they comply with the requirements of the annex and are supported by a fully documented, robust, risk-based control strategy".

Two things belong to that sentence. First, it records a discussion, not a decision. As the next step, the report names the revision of the draft by the drafting group, without giving a date. Second, the question of which elements such a control strategy needs was the very reason for the workshop. The drafting group wanted to hear from experts whether a risk-based approach can be applied to generative AI and which control mechanisms would carry it.

Four lines across six topics

For each topic, the report gives the associations' positions and the regulators' questions. Each topic closes with key messages and a section on the potential impact on the annex text. Four lines run through the topics.

What has not been worked out yet

What the workshop left open is just as telling. Some of the use cases presented were, according to the report, not yet production systems but pilots or concepts. On the question of how independent test data can be preserved for a model that keeps learning in operation, the report records that the answer did not define one mandatory technical approach and that implementation for continuously learning systems needs clarification. And for the particular behaviors of generative models, hallucination, fabrication, overconfidence in the output, the workshop set no method for estimating rates or confidence. The revised draft will have to settle these questions, or hand them openly to the operator's risk assessment.

Our reading

For QFINITY, the report overlaps with the architecture we describe on our Annex 22 page and in Validation of AI in the GxP environment. The model is a component with its own evidence, and it is verified. The computerized system in which it works with control mechanisms, process and people is validated in its process. The report does not commit to this distinction. It uses "validation" for lifecycle and system questions as well and keeps the objects of evidence open side by side: in its outlook on the validation topic it writes "revalidation/re-verification" and names an "AI validation/qualification package" as a possible consequence, mirroring the industry presentation rather than stating a regulatory position. The conceptual core of what an operator should be able to show is nevertheless visible in the report: evidence of model performance, information on the training data, controls around input and output, and evidence that the system works as expected in operation. In substance that matches the evidence we have described since the GAMP workshop at the ISPE summit in Boston in June, on whose core team Frank Henrichmann worked for QFINITY: intended use in the company's own process, acceptance criteria, a test set kept separate from training, the supplier's model card, and the residual risk the operator carries.

On oversight, the report meets the line we presented in March at the GAMP D-A-CH Forum under the question Who Pushes Back When the System Speaks? and deepened in September for ISPE iSpeak under the title Human-in-the-Loop as an Illusion of Control? Human-in-the-loop alone does not establish control. Control comes about when the reviewing person understands the context of use, knows the limits of the model and is allowed to push back, and when that capability can be evidenced in operation. In the report, one speaker puts it this way: oversight provides knowledge, detection and triggers for action, and it is the action that reduces the risk.

Which of your AI-supported applications would you operate today on the basis of a documented, risk-based control strategy? And for which would the assessment conclude not to use them?

A checklist for operators

The revised draft has no date. Until then the 2025 consultation draft remains the reference for preparation, not an annex in force, and the report does not change its wording. Anyone planning an AI application in a GMP environment today can use the four lines of the report as a checklist. It starts with a criticality assessment that, beyond direct impact, takes in decision consequence, model influence, uncertainty and the detectability of errors. The form of oversight must fit the risk assessment, and its effectiveness must be demonstrable. The evidence for the control mechanisms rests on the overall package of controls rather than on each mechanism in isolation. Supplier agreements secure access to evidence, participation in change control and transparency of the controls. How this can be anchored in AI governance with human oversight is described on our page on the subject. We have also worked the state of the report into the three open questions on our Annex 22 page.

Further reading: EMA: Report of the multistakeholder workshop on expert contributions to AI guidance development (Annex 22), EMA/156789/2026↗EMA: workshop page with agenda and report↗Three Signals, One Line: AI in the GxP environment between Barcelona, Boston and the EMA workshop (QFINITY)↗