EU GMP Annex 22: What it means for AI in pharma
EU GMP Annex 22 is the first draft EU guideline for using AI in pharmaceutical manufacturing. Here is what it requires, who it covers, and where it stands now.
Run your AI use against the draft annex and find your gaps.
What is EU GMP Annex 22?
EU GMP Annex 22 is a new annex to the EU Good Manufacturing Practice guidelines that sets expectations for how artificial intelligence (AI) may be used in regulated pharmaceutical manufacturing. It is the first piece of EU GMP guidance written specifically for AI.
The annex was published in draft on 7 July 2025 as part of a wider digital update to EudraLex Volume 4, alongside a revised Chapter 4 on documentation and a revised Annex 11 on computerized systems. It was drafted by the European Medicines Agency's GMDP Inspectors Working Group in cooperation with the Pharmaceutical Inspection Co-operation Scheme (PIC/S).
Its purpose is narrow and practical. AI has moved into manufacturing faster than the rules governing it, and the annex gives manufacturers and inspectors a shared reference for what acceptable AI use looks like in a GMP-critical context: which models belong there, how they should be validated, and who stays accountable for the output.
Is Annex 22 in force yet?
No. Annex 22 is a draft under revision and is not legally binding.
The public consultation closed on 7 October 2025 and drew roughly 1,300 comments, which the working group is now working through. A final version is expected by the end of 2026. Until then, the text can still change, so the safest reading is to treat it as a strong signal of regulatory direction rather than a fixed requirement.
That distinction matters for planning. A draft cannot be the basis of an inspection finding, so the value in acting now is preparation. The period before publication is time to assess where your current AI use sits, since the core principles are unlikely to reverse.
EU GMP Annex 22 readiness checklist
Download a section-by-section self-assessment for using AI in GMP environments to get a clear view of where you stand against the draft annex 22.
What does Annex 22 require for AI in GMP?
The draft sets expectations across model suitability, validation, oversight, data integrity, and lifecycle control. Most extend disciplines your quality system already runs. The sections below cover the provisions that matter most for a QA or validation team.
Static and adapting models
The draft draws its hardest line here. It distinguishes static models, which are locked after training and do not change during operation, from adapting models, which continue to learn from new data in use.
Adapting models are excluded from GMP-critical applications. The reasoning is a change-control one: a model that keeps changing its own behavior after deployment introduces uncontrolled change, which conflicts with the validated-state principle at the heart of GMP. For critical use, the draft expects deterministic behavior, where the same input reliably produces the same output.
So what counts as a critical application? Broadly, any use where the model's output feeds a decision affecting product quality, patient safety, or data integrity. Generative and probabilistic systems remain permitted in non-critical functions, with human oversight, while the draft keeps them out of GMP-critical use.
Validation and testing
The draft expects AI systems to be validated for their intended use, with test design suited to how models actually behave. In practice that means acceptance criteria defined before testing rather than fitted to the results, testing on data independent from the training set, and documented performance measures such as confidence scores and decision thresholds.
For models that predict or classify, the draft also points to explainability: being able to show which input features drove a given output and why those features are relevant. This is where traditional computer software validation, designed for deterministic rule-based systems, needs extending.
Human oversight and accountability
The draft keeps a competent person accountable for AI-supported decisions, with the level of oversight scaled to risk. For non-critical generative use in particular, it expects a documented point at which a human reviews or can intervene.
It is also explicit on vendor tools. The manufacturer remains responsible for GMP compliance regardless of which supplier provided the model. Vendor documentation supports your validation; it does not replace it. A model bought rather than built still has to be validated for your intended use.
Data integrity and traceability
Because Annex 22 sits alongside Annex 11, the data-integrity expectations you already meet for computerized systems extend to AI. Model inputs, outputs, and decisions are expected to follow ALCOA+ principles, with audit trails capturing model version, inputs, outputs, and any human override. You should be able to identify which model version produced any given result.
Change control across the model lifecycle
A validated model still needs ongoing control. The draft expects monitoring for performance drift, re-validation triggered by retraining or material changes in input data, and a defined process for retiring a model while preserving its records. The principle is familiar from any qualified system: the validated state has to be maintained, not assumed.
How does Annex 22 fit with Annex 11 and Chapter 4?
Annex 22 does not stand alone. It was published as one of three linked updates to EU GMP, designed to work together: Chapter 4 covers documentation across digital and hybrid systems, Annex 11 covers computerized systems generally, and Annex 22 addresses the specific case of AI within them.
The cleanest way to read it is as a layer on top of Annex 11. If a system is computerized, Annex 11 applies. If that computerized system uses AI, Annex 22 adds the AI-specific expectations on model suitability, validation, and oversight. Existing frameworks such as ICH Q9 on quality risk management carry through underneath both.
Also read: EU GMP Annex 11: what it requires for computerized systems
Does Annex 22 apply outside the EU?
Directly, it applies to the manufacture of medicinal products for the EU market. Its reach is wider than that, for two reasons. First, it was co-drafted with PIC/S, whose members include regulators well beyond the EU, so the principles are positioned for broad adoption. Second, manufacturers exporting to the EU are expected to meet EU GMP regardless of where they operate.
In the United States, there is no enforceable AI-specific regulation yet. The FDA works through existing 21 CFR Part 11 and cGMP frameworks, supported by a 2023 discussion paper on AI in drug manufacturing and a January 2025 draft guidance on AI in regulatory decision-making, both non-binding. In January 2026, the FDA and EMA jointly issued non-binding Guiding Principles of Good AI Practice in Drug Development, a signal of converging expectations. For a global manufacturer, Annex 22 is the most developed regulatory text on AI in manufacturing, which makes it a practical reference even outside the EU.
How to prepare for Annex 22 now
The period before publication is for preparation. A useful starting point is an inventory: which of your systems use AI, which of those touch GMP-critical decisions, and which are static rather than adapting. From there, check that critical-use models behave deterministically, that validation evidence ties to intended use, and that audit trails and change control already cover model behavior.
Most of this is data-integrity and validation discipline you apply to any GMP computerized system today, pointed at a new class of tool. For a fuller view of where AI in GxP is working and where it carries risk, see our overview of AI in GxP.
Download an Annex 22 readiness checklist
Download a section-by-section self-assessment for using AI in GMP environments to get a clear view of where you stand against the draft annex 22.
Frequently asked questions about EU GMP Annex 22
GMP data integrity, built into your thermal compliance solution
Eupry's compliance platform is built for GMP standards, with validated monitoring, complete audit trails, and a dedicated 21 CFR Part 11 module, so the data integrity AI guidance assumes is already in place.
- One vendor, one system, all you need for thermal compliance
- Mapping, monitoring and calibration in one digital solution
