EU GMP Annex 22: What the AI Annex Means for 2026

Anyone running an LLM pilot on batch records, certificates of analysis or deviation reports in September 2026 is getting the same question from the head of quality: can this ever be validated? The draft Annex 22 gives a clear answer, it just is not final. And the US regulator has since shown that inspectors do not wait for a final European text.

Is Annex 22 already in force?

No. On 5 September 2026, Annex 22 is a consultation draft, not applicable law. The European Commission published it on 7 July 2025 together with revised versions of Chapter 4 and Annex 11 for stakeholder consultation, drafted by EMA's GMDP Inspectors Working Group in cooperation with PIC/S. The comment period closed on 7 October 2025.

The status has not changed since. The annex does not appear on the Commission's EudraLex page, PIC/S lists it among the drafts, and the three-year work plan of EMA's inspectors group for 2026 to 2028 sets the fourth quarter of 2026 as the target for delivering a final text to the Commission, in parallel with Annex 11 and Chapter 4. There is no date for entry into application. Consultancy estimates range from a six-month transition to "probably not before 2027"; none of them is sourced.

1. 7 July 2025

   Draft published

   Annex 22, revised Annex 11 and revised Chapter 4 go into consultation together.
2. 7 October 2025

   Consultation closed

   Trade sources speak of roughly 1,300 comments on Annex 22; EMA has not published an official figure.
3. 14 January 2026

   FDA and EMA: guiding principles of good AI practice

   Ten joint principles, risk-based, with context of use and lifecycle management.
4. 2 April 2026

   FDA warning letter Purolea

   First warning letter with its own section on inappropriate use of AI.
5. 30 June and 1 July 2026

   EMA workshop on Annex 22

   Two days on guardrails, human oversight and probabilistic models. Report announced, not yet published.
6. Q4 2026

   Target: final text to the Commission

   Per EMA work plan 2026 to 2028. Publication and PIC/S adoption are separate later steps.

What the draft actually says

The draft applies to all computerised systems used in the manufacturing of medicinal products and active substances in which AI models are used in critical applications, meaning those with a direct impact on patient safety, product quality or data integrity. It positions itself as additional guidance to Annex 11, not a replacement. It covers models that obtained their functionality through training with data rather than explicit programming.

The decisive boundary sits in section 1, lines 12 to 21. The draft applies only to static models that do not adapt during use by incorporating new data, and only to models with deterministic output that return identical outputs for identical inputs. Dynamic models and models with probabilistic output are not covered and should not be used in critical GMP applications. From that follows the sentence the whole debate turns on:

For non-critical applications the draft opens a door: such models may be used if adequately qualified and trained personnel are always responsible for ensuring the outputs are suitable for the intended use. That is the human-in-the-loop clause. It is the basis for practically every LLM pilot running in a GMP environment today.

For models in scope, the draft demands a complete evidence stack. Its ten sections read like a validation plan:

1. 01

   Describe the intended use

   Task, process integration and the full input sample space including rare variations, divided into subgroups such as site, equipment or defect type. A process SME owns and approves the description before acceptance testing starts.
2. 02

   Set acceptance criteria

   Test metrics such as confusion matrix, sensitivity, specificity, accuracy, precision or F1 score, per subgroup. The criteria must be at least as high as the performance of the process the model replaces, which means that performance has to be known.
3. 03

   Build the test data

   Representative of the whole input space, stratified, large enough for statistical confidence, labels verified to a very high degree of correctness. Generating test data with generative AI is explicitly not recommended.
4. 04

   Secure test data independence

   Whoever develops or trains must never have had access to the test data. Access control, audit trail, no copies outside the repository, four-eyes principle when staff move between roles.
5. 05

   Execute and document the test

   A test plan with intended use, metrics, criteria, data reference and script. Every deviation, every missed criterion and every unused test record is investigated and justified.
6. 06

   Record explainability and confidence

   Which features drove a decision, via SHAP, LIME or heat maps, is captured during testing and reviewed at approval. Confidence scores are logged per prediction; at very low confidence the model should rather flag 'undecided'.
7. 07

   Control in operation

   Model, system and the whole process go under change control before deployment, including physical inputs such as lighting or cameras. Performance and input drift are monitored with defined metrics; with human-in-the-loop, records of the human review are kept.

Two details deserve a second look. First, section 4.3 refers to Annex 11 clause 2.7 for the requirement of no decrease against the replaced process. In the Annex 11 draft consulted in parallel, 2.7 is "Security"; the matching clause is 2.8 "No risk increase". The final text will have to be renumbered. Second, the Annex 11 draft never mentions Annex 22 or AI; only the Chapter 4 draft refers to it, in clauses 4.23 to 4.25, and places accountability for the integrity of AI-produced documents and data with the regulated user.

Why the generative AI exclusion is wobbling

EMA itself has put the sentence up for review. On the page for its workshop of 30 June and 1 July 2026 it writes that the 2025 consultation suggested support for potentially enabling technologies such as generative AI or LLMs in medicines manufacturing. The agency is still considering the results and is seeking expert input on possible control and mitigation measures such as guardrails. The six workshop topics literally ask how adaptive and probabilistic models could be accommodated in Annex 22, how reliably guardrails prevent hallucinations and fabricated data, what human oversight is still required, and whether there are classes of critical decisions for which no combination of guardrails and oversight would suffice.

Brendan Cuddy, chair of EMA's inspectors group, described the drafting group's task in May 2026 as deciding whether the text can move from whether a model is deterministic or probabilistic to consideration of the impact it has on product quality and patient safety. Industry had asked for exactly that in the consultation. ISPE recommends allowing advanced models including generative AI and LLMs in critical applications when justified by science and quality risk management, and criticises the binary split into critical and non-critical as an oversimplification at odds with ICH Q9. The German QP Association considers the restriction too strict and proposes allowing AI drafts for deviations, CAPAs and changes on a risk basis, as long as assessment and conclusion remain with a responsible person.

What comes of it is open. EMA has not committed, a workshop report is announced but not published. There are dissenting voices too: an article in ISPE Pharmaceutical Engineering from spring 2026 still considers generative AI and LLMs unsuitable for active critical GMP decision processing. Anyone betting on a particular outcome is betting.

The US precedent: FDA warning letter to Purolea

While Europe is still debating the text, FDA has already enforced the control logic. The warning letter to Purolea Cosmetics Lab dated 2 April 2026, following an inspection in October 2025, contains the first dedicated deficiency section on inappropriate use of artificial intelligence in US CGMP practice. The firm told investigators it had used AI agents to create specifications, procedures and master production and control records. The finding sits under 21 CFR 211.22(c), the rule that requires the quality unit to approve or reject all procedures and specifications affecting identity, strength, quality and purity.

Investigators also documented that no process validation had been performed before distribution, as 21 CFR 211.100 requires. The firm's reply: it was not aware of the requirement because the AI agent had never mentioned it. That sentence is the core of the case. The violation was not the use of AI but the absence of qualified review of its output, and the assumption that the tool knows the regulations completely.

The case concerns a small firm with homeopathic OTC products, not big pharma. It transfers anyway, because the legal basis is not an AI rule but the decades-old responsibility of the quality unit. FDA's stated expectation also matches the human-in-the-loop logic of the European draft: an authorized human reviews and clears, documented, every time.

Which document tasks can be validated

The practical question is not whether AI is allowed but which task goes to a dedicated static model and where an LLM may only assist in a non-critical role. The following classification is an editorial reading of the draft; the text itself names only predicting or classifying data and accept/reject product classification as critical examples.

Across every row: whoever supplies the model, the evidence belongs to the regulated user. The draft requires documentation whether a model was trained in-house or by a supplier, the Annex 11 draft keeps the user fully responsible for outsourced activities, and the Chapter 4 draft explicitly places accountability for AI-produced data with the user. A model update at a cloud provider is therefore a change control event that you must be able to see.

The decision rule that holds under either outcome

Whether EMA keeps the exclusion of generative models or replaces it with risk-based guardrails, four things do not change. You can plan on them today.

That yields an order of work that does not wait for the final text:

1. 01

   Inventory AI uses by GMP criticality

   Classify every application with the draft's scope formula: direct impact on patient safety, product quality or data integrity, yes or no. Shadow AI in business units belongs on the list.
2. 02

   Put generative tools behind documented human-in-the-loop procedures

   Who reviews, by which procedure, with which record. The reviewer is qualified and their performance is monitored like any manual process. Purolea is the template for how not to do it.
3. 03

   Build the Annex 22 stack for static models

   Intended use, subgroups, metrics, baseline, independent test data, explainability, confidence, change control, drift. That is what an inspector can already ask for under Annex 11 and Chapter 4.
4. 04

   Make suppliers commit to visibility

   Model version, change notifications, auditability, no silent updates. EMA's workshop topic 6 aims at exactly this.
5. 05

   Measure the baseline

   Collect the error rates of today's manual review before accepting a model. Without a baseline clause 4.3 cannot be met, and almost nobody has one.

What the draft does not regulate

Four gaps are worth knowing before aligning internal policies with the draft. First, it does not define "critical application" in its glossary; the scope formula is the only description, and ISPE has explicitly asked for a definition. Second, the word "agent" does not occur anywhere in the text, although agentic systems are exactly what triggered the Purolea finding. Third, the draft copies the "AI system" definition verbatim from the AI Act without referencing its risk classes. Medicinal products are not an Annex I product category of the AI Act; an AI tool in medicines manufacturing is therefore usually not high-risk under the AI Act, but fully within the scope of Annex 11 and the Annex 22 draft. For AI inside a medical device the opposite holds: Annex I, high-risk obligations from 2 August 2028 under the AI Omnibus of July 2026. Fourth, metrics for regression models and text-based systems are missing; the draft's examples are classification metrics.

Add a vocabulary problem. Annex 22 speaks of "intended use", FDA and the joint FDA-EMA principles of "context of use" and "credibility". And "validation" means computerised system validation in Annex 11, but the validation data set in the data science sense of the Annex 22 draft. Anyone merging both worlds in one document should define the terms in the first paragraph.

What to expect by the end of 2026

EMA's work plan names the same target for Annex 22, Annex 11 and Chapter 4: a final text to the Commission in the fourth quarter of 2026. Publication by the Commission and adoption by PIC/S follow as separate steps, with a transition period nobody knows yet. The three documents will most likely arrive together, because they reference each other and the cross-references need cleaning up anyway.

EMA's workshop report is the next signal. It will show whether the drafting group takes the step from model class to impact. For practice it does not change the order above. It only changes whether a well-controlled probabilistic model may one day hold a critical role, or stays in assistance. The evidence stack is the same in both cases.