EU GMP Annex 22 – What the draft means for quality and GxP teams

Annex 22 is the first dedicated GMP guidance on artificial intelligence. It arrives as AI moves out of pilot projects and into impact assessment, visual inspection, batch record review and quality management, the parts of manufacturing that authorities and inspectors look at most closely.

Three things matter right now. Annex 22 is still a draft: it was published for consultation in July 2025 and has not been adopted. The final text is expected to go to the European Commission in Q4 2026, and its scope may change before then, particularly for generative and probabilistic AI. And the draft’s core expectations on intended use, test data, explainability and monitoring are already clear enough to start acting on.

This guide sets out what the draft says, where it stands today and what QA and GxP teams can do now, so you are prepared for inspection whichever way the final text lands.

What is Annex 22?

Annex 22 is a proposed new annex to the EU GMP Guide (EudraLex Volume 4). It sets expectations for artificial intelligence and machine learning models used in critical GMP applications in the manufacture of medicines and active substances.

It does not stand alone. Annex 22 supplements Annex 11 on computerized systems rather than replacing it: Annex 11 still governs the system an AI model sits in, and Annex 22 adds expectations specific to the model. The draft was prepared by the EMA GMP/GDP Inspectors Working Group together with PIC/S, so the final text is expected to apply under both the EU and PIC/S GMP Guides.

EU GMP Annex 22 was published for consultation on July 7, 2025, as part of a package with a revised Annex 11 and a revised Chapter 4 (Documentation). The three documents are best read together.

Where does Annex 22 stand right now?

Annex 22 remains a draft. The timeline below shows how it has progressed since publication and what comes next.

What to expect next: the final text is targeted for submission to the European Commission in Q4 2026. No publication date or effective date has been confirmed. Once the annex is adopted, a transition period is likely before inspectors apply it, but its length has not been set.

Treat the scope as open. The workshop report states that the drafting group has discussed allowing dynamic, probabilistic and generative AI in GMP applications where a fully documented, risk-based control strategy supports their use. The final annex could therefore differ materially from the draft summarized here.

What does Annex 22 apply to?

Scope is where most of the confusion sits, so it is worth being precise. The deciding phrase in the draft is “critical applications with direct impact on patient safety, product quality or data integrity.” If an AI model’s output can directly affect any of those three, the use is critical and the full annex applies.

Within critical applications, the draft draws a second line based on how the model behaves.

In scope: static, deterministic models in critical applications

A static model is frozen once it has been tested, so it does not keep learning while in use. A deterministic model always gives identical outputs for identical inputs.

Typical examples include visual inspection systems that accept or reject units on the line, models that classify defects, and models that predict a quality attribute from process data. The draft also recognizes that a model may be made up of several sub-models, each of which needs to be understood and controlled.

Out of scope for critical use: dynamic, probabilistic and generative models

The draft states that three types of model should not be used in critical GMP applications: dynamic models that continue to learn and adapt during use, models with probabilistic outputs, and generative AI, including large language models (LLMs).

This is the part of the draft most likely to change. Industry pushed back during consultation, and the drafting group has since explored whether these models could be permitted under a robust, documented control strategy. Until the final text is published, the draft position is the one to plan against.

Non-critical uses and the human in the loop

The exclusion applies to critical applications only. Generative AI can still be used in non-critical GMP work, such as drafting documents, summarizing information or searching records, provided qualified, trained people remain responsible for checking that outputs are fit for purpose.

In practice, that review needs to be meaningful, and you should be able to show it took place. A reviewer who accepts every AI draft without challenge is not providing the oversight the draft expects.

The ten sections of Annex 22 at a glance

The draft is short and organized into ten sections. Read together, they describe a lifecycle: define what the model is for, decide how well it must perform, test it with independent data, understand how it reaches decisions, and keep it under control in operation. The table summarizes what each section expects and what it means for QA.

Much of this will look familiar to anyone who has validated a computerized system. The difference lies in test data independence, explainability and confidence scoring, which bring expectations that conventional validation does not cover.

How Annex 22 fits with Annex 11, Chapter 4 and the EU AI Act

Annex 22 is one part of a wider package, and it makes most sense read alongside the documents around it.

Annex 11 remains the foundation for any computerized system. Every AI model runs inside one, and that system still needs to meet Annex 11 expectations on validation, access control, audit trails, supplier oversight and security. Annex 22 adds AI-specific expectations on top; it does not replace them.

The revised Chapter 4 raises documentation and data integrity expectations, and these apply to AI records too. Intended use descriptions, test data records, test results, confidence logs and monitoring data all need to be attributable, complete and traceable. Sound good documentation practice is the starting point for an inspectable AI record.

The EU AI Act is different in kind. It is horizontal, cross-sector legislation that applies to AI systems across the economy, with obligations phasing in over several years. Annex 22 is sector-specific GMP guidance, applied through GMP inspection. A single AI system on a manufacturing site may need to satisfy both, and meeting one does not demonstrate compliance with the other.

There is parallel activity in the US. The joint FDA and EMA guiding principles published in January 2026 point in a shared direction at a high level, but they are non-binding. For manufacturers supplying both markets, AI in GMP adds to a wider pattern in which US and EU regulations are diverging on detail, even where principles align.

What QA and GxP teams should do now

You do not need to wait for the final text to start. The steps below are low-regret: they will be needed under almost any version of the final annex, and most also strengthen your position under Annex 11 today.

1. Build an inventory. List every AI and machine learning model touching GMP processes, including those embedded in supplier systems and equipment.
2. Classify each use. Assess each one as critical or non-critical against the patient safety, product quality and data integrity test, and record the rationale.
3. Document intended use. For critical models, describe the task and input data, with a named subject matter expert (SME) responsible for ownership and approval.
4. Establish today’s baseline. Measure the performance of any process an AI model will replace, so acceptance criteria have a defensible reference point.
5. Govern test data. Put segregation, access control, audit trail and records of use in place so test data stays independent of training data.
6. Ask suppliers for evidence. Request training, validation and test documentation you can review, and build this into contracts and vendor selection.
7. Extend change control. Bring AI models, and the equipment and data that feed them, under change and configuration control.
8. Define monitoring. Set metrics for model performance and input drift, plus a procedure for human review when the model is unsure or performance degrades.
9. Track the guidance. Set up ongoing monitoring of Annex 22, Annex 11 and related guidance so that each change triggers an impact assessment.

If you are building the wider framework these steps sit within, our practical guide to quality assurance in the pharmaceutical industry covers the foundations.

How Draft Annex 22 will impact regulatory intelligence

Annex 22 is aimed at manufacturing, but regulatory intelligence (RI) teams will feel it first. They are the ones who have to track it, interpret it and turn it into action across the business, often before QA has a final text to work with.

For regulatory intelligence professionals, Annex 22 is a clear example of the trends we explored in opportunities and risks for regulatory intelligence professionals in 2026: guidance that evolves in public, more interim signals to interpret, and closer scrutiny of how AI is used inside the function itself.

Tracking a multi-agency change from draft to final text

Annex 22 is harder to monitor than a typical guideline update. It moves through several bodies: the European Commission, EMA’s inspectors, PIC/S and the national competent authorities that will inspect against it. It comes as a package with Annex 11 and Chapter 4, so a change in one document can affect how the others are read. And it produces interim signals, such as consultation feedback and the October 2026 workshop report, that point toward the final direction well before anything is adopted.

RI teams need to monitor those signals as well as the documents. Just as important is being clear internally about status, so stakeholders always know whether they are looking at draft text, a signal of direction or adopted guidance.

Scrutiny of the AI in RI’s own tools

Regulatory monitoring is generally not a critical GMP application in the sense the draft uses. But where generative AI is used in non-critical GMP work, the draft expects qualified people to stay responsible for checking outputs. RI teams using AI to summarize or triage guidance should expect the same question from QA and auditors: who checked this, and how?

When assessing vendors, ask how outputs trace back to source documents, how the system explains its results and where human review sits in the workflow. Infodesk AI is built on a human-first, source-traceable approach, so every insight links back to its original source for expert review. For a wider view of where AI helps and where it needs guardrails, see our guide to AI in regulatory intelligence.

Watching how inspectors apply it

Once Annex 22 is adopted, the most useful intelligence will come from how inspectors actually apply it. Inspection observations, enforcement actions and Q&A documents will reveal how terms such as “critical application” are interpreted, and where companies fall short.

RI is well placed to spot these patterns early and feed them back to QA. That loop turns external findings into practical inspection readiness, before the same questions are asked on your own site.

Keeping track of a moving target

Annex 22 is a multi-agency, multi-stage change. The European Commission, EMA, PIC/S and national inspectorates all have a role, FDA activity runs in parallel, and the final text could differ materially from the draft. Tracking it manually, alongside everything else on the horizon, is where gaps appear.

Infodesk helps regulatory intelligence and quality assurance and GxP teams follow changes like this from first signal to final text:

• Our regulatory intelligence surveillance covers 300+ health authorities in one feed, so new drafts, workshop reports and Q&As from the Commission, EMA, PIC/S and national authorities reach you as they are published.
• An editable impact assessment workflow routes the final text to the right experts for review and sign-off, with a traceable record of every decision.
• Our inspection and enforcement intelligence shows how inspectors begin citing AI-related findings, so you can prepare before the questions reach your site.

Join the conversation: The Limits of AI in Regulatory and Quality Intelligence

Where does AI belong in regulatory and quality work? Join our free virtual forum on November 17. The Limits of AI in Regulatory and Quality Intelligence explores where AI adds value in regulatory and quality intelligence, and where human judgment needs to stay in control.

  Register now 

Want to see how Infodesk tracks changes like Annex 22 from draft to final text?

  Book a meeting