Annex 22 is a draft addition to EU GMP, the first written specifically for AI. It applies to AI models used in critical GMP applications, meaning uses that can affect patient safety, product quality or data integrity. For those uses the draft allows only static, deterministic models. Generative AI and large language models are not for critical use, though they can support non critical work where a qualified person stays responsible for the result. At the time of writing it is still a draft.
What is draft Annex 22?
In July 2025 the European Commission opened a public consultation on three linked documents: a revised Chapter 4 on documentation, a revised Annex 11 on computerised systems and, for the first time, a new Annex 22 on artificial intelligence. The texts were drafted by the EMA's GMDP Inspectors Working Group together with PIC/S. The consultation closed in October 2025. As of October 2026 we are not aware of a final text, so treat everything below as a description of a draft and check the current status on the Commission's EudraLex pages.
Which AI does it apply to?
It applies to computerised systems that contain AI models used in critical GMP applications. Critical means the output can directly affect patient safety, product quality or data integrity. A model that helps decide whether a batch can be released is critical. A model that helps a colleague find a paragraph in an SOP is not.
This is the point most often missed. The annex is about the consequence of a use, not about the technology in the abstract. The same model can be non critical in one job and critical in another.
What does it allow, and what does it rule out?
For critical applications the draft allows static models, which do not keep learning once in use, that are also deterministic, meaning the same input gives the same output. It does not accept dynamic models that continue to learn in service, or models with probabilistic outputs, in critical applications. Generative AI and large language models fall on the wrong side of that line for critical use.
For non critical applications the draft does not forbid generative AI. It expects qualified personnel to remain responsible for confirming the output is suitable.
What does it ask of you?
Reading the headings of the draft in order gives a workable programme for any AI you use in a GMP setting. In plain terms:
- Intended use. Write down precisely what the model is for, who uses it, on which inputs, and what it must not be used for.
- Acceptance criteria. Decide in advance what performance is good enough, using metrics suited to the task, before you test.
- Test data. Test on data that is representative and independent of the data used to build or tune the model.
- Test execution. Run the tests as documented, keep the results, and deal with deviations from the plan.
- Explainability. Be able to show which features of the input drove an output, to the extent the model type allows.
- Confidence. Where the model gives a confidence score, use it, and define what happens to low confidence outputs.
- Operation. Keep the system under change control and monitor for drift in the inputs once it is live.
Common misreadings
- "Annex 22 bans AI in pharma." It does not. It sets conditions for critical uses and leaves room for a great deal of non critical use.
- "Staff can never use a chat assistant." The draft is about computerised systems used in GMP activities. Whether a particular use is acceptable depends on intended use, consequence and the controls around it. Your own policy and your Quality system decide the rest.
- "It will not affect us because it is only a draft." Inspectors already ask about intended use, validation and data integrity under Annex 11. Organisations that wait for the final text will be building evidence late.
What to do now
- Build an inventory of AI use, including AI switched on inside software you already own and AI used by suppliers.
- Classify each use by the consequence of a wrong output. Most will be low or moderate. Find the few that are not.
- Write an intended use statement for each, starting with the highest consequence ones.
- For uses near the critical boundary, ask whether the AI can be moved one step back from the decision, with a deterministic record and a qualified person in between.
- Agree who owns each use, and how evidence will be kept.
Frequently asked questions
Is Annex 22 in force?
No. It was published as a draft for consultation in July 2025, and the consultation closed in October 2025. Check the European Commission's EudraLex Volume 4 pages for the current status before relying on any detail.
Does draft Annex 22 ban generative AI in pharmaceutical manufacturing?
It does not ban it. The draft excludes generative AI and large language models from critical GMP applications, and for non critical applications it expects qualified personnel to remain responsible for the output.
Does Annex 22 apply outside the EU?
It is part of EU GMP, so it applies to manufacturers whose sites are inspected under EU rules or who supply the EU market. It was drafted together with PIC/S, so it is also worth watching if you work to PIC/S member standards.
Sources and further reading
- European Commission: consultation on draft Annex 22 (Artificial Intelligence), revised Annex 11 and Chapter 4
- EudraLex Volume 4: EU Guidelines for Good Manufacturing Practice
- EMA: Reflection paper on the use of artificial intelligence in the medicinal product lifecycle (PDF)
This article is general information, not legal or regulatory advice. Regulatory texts change, and some discussed here are drafts: check the current official text before relying on any detail.
