A simple, plain-language guide for quality, regulatory, and IT teams in pharma
Artificial intelligence is showing up everywhere in pharma today — from spotting defects on a packaging line to predicting quality problems before they happen. But when a computer model starts making or supporting decisions in a GMP environment, regulators want to know it is safe, controlled, and well understood. That is where Annex 22 comes in.
This guide breaks down what Annex 22 is, why it matters, and what your team can start doing today to get ready. We keep the language simple, so you do not need a law degree or a data science degree to follow along.
What Is Annex 22?
Annex 22 is the name being used for a new, dedicated set of GMP rules that the European Union is developing for the use of artificial intelligence (AI) and machine learning (ML) in the manufacture and quality control of medicines.
It sits under EudraLex Volume 4, which is the rulebook that already contains the EU’s Good Manufacturing Practice (GMP) requirements, including Annex 11 on computerised systems. Think of Annex 11 as the rulebook for normal software and databases, and Annex 22 as the newer rulebook built specifically for AI, because AI systems behave differently — they learn from data, and their logic is not always easy for a human to trace step by step.
A quick note on timing: at the time of writing, Annex 22 is still developing. EU regulators (through the European Medicines Agency and the GMP/GDP Inspectors Working Group) have published reflection papers and draft thinking on AI, and a formal annex is expected to follow. Always check the official EMA and European Commission pages for the latest confirmed status before making compliance decisions.
Figure 1: How EU GMP guidance has been moving step by step toward dedicated AI rules.
Why Pharma Needs Special GMP Rules for AI
Normal software does exactly what it is programmed to do, every single time. AI is different. Many AI systems, especially machine learning models, learn patterns from data and can change their output as new data comes in. This creates a few extra questions that regulators want answered:
- Can we explain why the AI made a certain decision?
- What happens if the training data has hidden bias or errors?
- How do we know the model still works correctly after it has been running for months?
- Who is responsible if an AI-supported decision leads to a quality problem?
- How do we keep a clear audit trail when the model itself keeps changing?
Annex 22 aims to answer these questions with clear, practical expectations, so companies do not have to guess.
Who Does Annex 22 Apply To?
Annex 22 is expected to apply to any pharmaceutical company using AI or ML in GMP-regulated activities. That is a broad group, and can include:
- Drug manufacturers using AI for process monitoring or predictive maintenance
- Quality control labs using AI to read test results or spot defects
- Companies using AI-based demand forecasting that feeds into batch planning
- Contract manufacturers and testing labs supporting the above
- Software and equipment vendors who supply AI tools used in GMP processes
Expected Core Principles of Annex 22
While the final text is still being shaped, the direction from EU regulators and related guidance (like the EMA reflection paper on AI) points to a set of core ideas. Here is a simple summary:
| Principle | What It Means in Plain Words |
| Risk-based approach | Higher-risk AI uses (like batch release decisions) need stronger controls than low-risk uses (like scheduling). |
| Human oversight | A qualified person should always be able to review, question, and override an AI decision. |
| Data governance | Training and input data must be accurate, complete, and free from unfair bias. |
| Validation and testing | AI models must be tested and shown to work correctly before and during use, not just once. |
| Explainability | Teams must be able to explain, in reasonable terms, why the AI reached a result. |
| Change control | Any update to the model or its data must go through a formal change process. |
| Continuous monitoring | Performance must be checked regularly, since AI models can drift over time. |
| Documentation and audit trail | Every key decision, dataset, and model version must be traceable. |
Table 1: Expected core principles behind Annex 22.
Annex 22 vs. Annex 11: What Is the Difference?
People often ask how Annex 22 is different from Annex 11, since both deal with computer systems. Here is a simple side-by-side view:
| Topic | Annex 11 (Computerised Systems) | Annex 22 (AI, expected) |
| Focus | Traditional software and databases | AI and machine learning models |
| System behaviour | Fixed rules, predictable outputs | Learns from data, output can evolve |
| Validation approach | One-time validation, then periodic review | Ongoing monitoring, since models can drift |
| Key concern | Data integrity and system control | Data integrity, plus bias, explainability, and model performance |
| Change control | Standard change management | Change management plus model retraining controls |
Table 2: A simple comparison between Annex 11 and the expected Annex 22.
The AI Lifecycle: A Simple Way to Think About Governance
Whether or not the final Annex 22 text uses this exact structure, it helps to think of AI governance as a repeating cycle rather than a one-time project. Here is a simple version your team can use as a mental model:
Figure 2: A simple AI lifecycle governance loop for GMP environments.
- Define the business need: Be clear on what problem the AI is solving and how critical it is to product quality.
- Design and build the model: Choose data sources carefully and document assumptions from day one.
- Validate and test: Check accuracy, bias, and edge cases before the model goes live.
- Deploy and monitor: Track real-world performance and set alerts for unusual behaviour.
- Review and retrain: Refresh the model when needed, using a controlled, documented process.
- Document and audit: Keep records at every step so inspectors can follow the full story.
Steps Pharma Companies Can Take Now
You do not need to wait for the final Annex 22 text to start preparing. Here are practical steps that fit almost any organisation:
- Make a list of every AI or ML tool currently used in GMP-related work, even small ones.
- Rate each tool by risk: how much could it affect patient safety or product quality if it went wrong?
- Check that a qualified person can always review and override AI-based decisions.
- Ask vendors for clear documentation on how their AI models were trained and tested.
- Set up a simple change control process specifically for AI model updates.
- Train quality and IT staff on basic AI concepts, so reviews are meaningful, not just a formality.
- Start a lightweight AI inventory and risk log now, so you are not scrambling later.
Benefits and Challenges of Annex 22
| Benefits | Challenges |
| Clear, EU-wide expectations instead of guesswork | Extra work to document and validate AI systems |
| Builds patient and inspector trust in AI-driven decisions | Finding staff who understand both GMP and AI |
| Encourages safer, more consistent AI use across the industry | Keeping up with a rulebook that is still evolving |
| Helps companies avoid costly compliance failures later | Balancing innovation speed with regulatory caution |
Table 3: A quick look at the upside and the extra effort involved.
Frequently Asked Questions
Is Annex 22 already in force?
Not officially confirmed at the time of writing. It is being developed as part of the EU’s broader work on AI in medicine regulation, alongside reflection papers from the European Medicines Agency. Always check the official EMA website for the current status.
Does Annex 22 replace Annex 11?
No. Annex 22 is expected to work alongside Annex 11, not replace it. Annex 11 will likely continue to cover general computerised systems, while Annex 22 focuses specifically on AI and machine learning.
Do small and mid-size pharma companies need to worry about this too?
Yes. Annex 22 is expected to apply based on how AI is used, not on company size. A small lab using AI for defect detection would still need to meet the relevant expectations.
What is the biggest first step a company can take?
Start with a simple inventory: list every place AI is already being used in GMP-related work, and rate each one by risk. This single step makes everything else easier.
Will AI be banned in GMP manufacturing without Annex 22?
No. AI can be used today under existing quality risk management principles and Annex 11, as long as it is properly validated and controlled. Annex 22 is meant to add clarity, not block AI use.
Final Thoughts
AI is not going away from pharma manufacturing and quality control — if anything, it is growing fast. Annex 22 is the EU’s way of making sure this growth happens safely, with patients protected at every step. The companies that start building good AI governance habits now, even before the final rule is published, will have a much easier time when it does arrive.
External References
• EMA – Reflection paper on the use of Artificial Intelligence in the medicinal product lifecycle
• European Commission – EudraLex Volume 4, Good Manufacturing Practice
• EMA – Good Manufacturing Practice (GMP) overview