EU GMP Annex 22: The First Draft Rules for AI in Pharmaceutical Manufacturing

In July 2025 the European Commission published the first draft rules anywhere in the world for using artificial intelligence inside pharmaceutical manufacturing. The document is Annex 22 to the EU GMP Guide, developed by the EMA’s GMDP Inspectors Working Group together with PIC/S, and it arrived alongside a substantially rewritten Annex 11 on computerised systems and a revised Chapter 4 on documentation.

Status. Annex 22 is a draft. The consultation opened on 7 July 2025 and closed on 7 October 2025. It is not yet in force and the text may change. What follows describes the draft as published, because the direction it sets is already shaping how manufacturers plan.

The striking thing about Annex 22 is not that it regulates AI. It is how it does so. There is no new technology oversight body and no algorithm approval process. Instead the draft takes GMP’s oldest instrument — qualified people with defined responsibilities — and applies it to machine learning.

What is in scope, and what is banned outright

Section 1 limits the annex to computerised systems used in the manufacture of medicinal products and active substances where an AI model is used in a critical application with direct impact on patient safety, product quality or data integrity. Within that boundary it covers machine learning models whose functionality derives from training on data rather than from explicit programming.

Two characteristics define what is permitted:

• Static models — models that do not change their performance during use.
• Deterministic outputs — identical inputs produce identical outputs.

Everything else is excluded, and the exclusion is not neutral. Dynamic models that continue to learn and adapt during use are outside the annex and, in the draft’s words, should not be used in critical GMP applications at all. The same applies to models with probabilistic outputs. And the same applies to generative AI and large language models.

That is the line most organisations will need to absorb. The draft does not propose to regulate how you validate an LLM in a critical GMP application; it proposes that you do not use one there. For non-critical uses, generative AI and LLMs fall outside the annex, though its principles may be considered where applicable — and even then, qualified personnel remain responsible for checking the outputs.

Personnel comes before documentation

The ordering of Section 2 is itself a statement. The Principles section opens with 2.1 Personnel, ahead of 2.2 Documentation and 2.3 Quality Risk Management. The requirement is short: all personnel should have adequate qualifications, defined responsibilities and an appropriate level of access, and there should be close cooperation between all relevant parties during algorithm selection.

Section 1 makes the same point in the scope itself, stating that personnel with adequate qualification and training should always carry the responsibility. The draft does not define the qualification. As with the Qualified Person Responsible for Pharmacovigilance and the Person Responsible for Regulatory Compliance, the law names the obligation and leaves the evidence of competence to the organisation.

The subject matter expert is a named role

Annex 22 repeatedly assigns specific decisions to a process subject matter expert rather than to a data science function. The SME should be responsible for the adequacy of the description of intended use (3.1), responsible for defining the acceptance criteria (4.2), and involved in developing the test plan (7.2).

This matters more than it first appears. The judgements the draft reserves for the SME — what the model is for, what counts as good enough, and how that will be tested — are the ones that determine whether the system is safe. Placing them with a process expert rather than with whoever built the model is a deliberate allocation of accountability toward the people who understand the manufacturing process.

Human-in-the-loop, and the training requirement inside it

Section 3.3 covers human-in-the-loop arrangements, and it contains the single most significant training provision in the draft. Where a model feeds a decision made by a human operator, the description of intended use must include the responsibility of that operator — and the training and consistent performance of the operator should be monitored like any other manual process.

Read that carefully. It means an operator reviewing AI output is subject to the same competence regime as an operator performing a manual manufacturing step: trained, qualified, and monitored for consistent performance over time. “A human checks it” is not a control unless that human’s competence is itself under control.

Section 10.5 adds the operational detail. Where a model provides input to a human decision, this may imply a consistent review or test of every output from the model, according to a documented procedure. A human-in-the-loop design is therefore not a lighter-touch option. It transfers the validation burden onto a person whose reliability now has to be demonstrated.

Staff independence, written as a data rule

Sections 6.2 and 6.5 impose a segregation requirement that will surprise teams used to small project groups. Employees involved in developing and training the model must never have had access to the test data (6.2). Conversely, staff who have had access to test data must be prevented from involvement in training and validation (6.5), and may only have access to training and validation of the same model when working together.

This is a segregation of duties control of the same family as the data integrity rule that administrator rights should not sit with anyone holding a direct interest in the data, which our guide to data integrity training and MHRA GxP expectations covers. The logic is identical: independence is the control, and in a five-person team it has to be designed rather than assumed.

Explainability and confidence are mandatory, not optional

Section 8 requires explainability through feature attribution (8.1) and feature justification (8.2) — it must be possible to understand which inputs drove a decision, and to justify that those are the right ones. Section 9 requires a confidence score for predictions (9.1) and a defined threshold (9.2), so that low-confidence outputs can be handled rather than acted on silently.

Section 10 then places models, systems and processes under change control (10.1) and configuration management (10.2), with ongoing system performance monitoring (10.3) and input sample space monitoring (10.4) — the latter being a check that the data arriving in production still resembles the data the model was tested on.

Annex 11 changed at the same time

Annex 22 does not stand alone. The revised Annex 11 on computerised systems grew from roughly five pages to nineteen. It adds lifecycle management, data integrity, outsourced activities and cloud services; aligns its data integrity provisions with ICH Q9 risk management principles; adds a Pharmaceutical Quality Systems section placing computerised systems alongside physical operations; and adopts the GAMP 5 approach to requirements, supplier and service management, and qualification and validation. Configuration requirements cover alarms, access and identity management, audit trails, electronic signatures and security.

Any organisation treating Annex 11 as a settled document it validated against years ago should expect the ground to move.

Why this matters beyond pharmaceutical manufacturing

Annex 22 is the clearest evidence yet that AI governance in regulated industries is arriving as a competence obligation rather than a purely technical one. The draft’s controls are qualified personnel, a named subject matter expert, monitored operator training, and segregation of duties. Those are training and quality-system instruments, not engineering ones.

That puts it in the same family as the management system route to AI assurance described in our explainer on ISO/IEC 42001 and AI management systems, and in the same family as the convergence now visible across regulated sectors: EU GMP Chapter 2 requires training effectiveness to be periodically assessed, as our guide to GMP training requirements explains; the FDA’s Quality Management System Regulation adopted ISO 13485 clause 6.2 and its risk-proportionate effectiveness checks, covered in our QMSR explainer; and medical device manufacturers must name a Person Responsible for Regulatory Compliance with defined qualifications.

For anyone planning AI adoption in a GMP environment, the practical reading of the draft is short. Static and deterministic only, in critical applications. A process SME accountable for intended use, acceptance criteria and the test plan. Test data genuinely independent of the people who trained the model. Explainability and confidence thresholds built in, not retrofitted. And if a human is the control, that human’s training and performance must be monitored exactly as a manual process would be.