What the New AI Guideline Means for Pharma Manufacturers

Artificial intelligence has quietly and gradually established a presence in pharmaceutical manufacturing. However, until recently, companies lacked clear, defined regulatory direction for how AI should be validated, monitored, and integrated into GMP environments.

The previously ambiguous regulatory environment has now been clarified with the publication of draft EU GMP Annex 22, issued alongside revisions to Annex 11 and Chapter 4. Annex 22 aims to establish the first comprehensive framework governing the use of artificial intelligence models in the manufacture and control of medicinal products, marking the beginning of a new regulatory era for AI in the pharmaceutical industry. Its requirements are precise and practical – ensuring safe, transparent, and validated AI application in environments where quality and patient safety are paramount.

Scope

This draft applies only to computerised systems or applications with direct impact on GMP which use static or deterministic AI models. Deterministic AI refers to AI systems that always produce the same output for the same input, with no randomness involved. Static AI refers to AI that does not change after it is trained – its rules, parameters, and decision-making logic remain constant.

The guideline excludes generative AI (such as Microsoft Copilot or ChatGPT), dynamic AI (AI that can change its behaviour), and adaptive or self-learning models without fixed behaviours. Dynamic and adaptive AI are considered unsuitable for critical GMP activities due to their uncontrollable nature. The guideline emphasises that only secure, validated, and explainable models are suitable for critical decision making that can have an impact on GMP.

Key Requirements in Annex 22

1. Clear Definition of Intended Use

Each AI system must be accompanied by a documented description of what it is designed to do, the inputs and sub-groups it operates on, its boundaries and limitations, and the human-in-the-loop process. This steers companies away from experimental AI usage and toward controlled, justified, risk-assessed application.

2. Robust Performance & Acceptance Criteria

AI models must have pre-defined metrics such as accuracy, sensitivity, and false-positive/false-negative rates, with confidence thresholds and the ability to demonstrate performance using test data covering all relevant input conditions. Clear statistical justification is required, and underperformance or low confidence must always trigger human review.

3. Explainability, Transparency, and Human Oversight

Manufacturers must demonstrate how the AI model makes decisions, what different confidence levels mean, and how users should proceed when results are uncertain. Models must support auditability, as regulators expect traceable and interpretable behaviour.

4. Lifecycle Management & Monitoring

Like any GMP-regulated system, AI models must follow a full lifecycle approach encompassing change control, periodic review, re-validation after significant updates, incident and deviation management, and retirement. AI is not a one-time validation exercise – it is an ongoing controlled process.

5. Qualifications and Documentation

Annex 22 emphasises the need for trained and qualified personnel in AI, detailed documentation covering design, training, validation, and deployment, strong data governance and provenance, and supplier oversight for commercial AI systems.

How to Prepare

Inventory Existing and Planned AI Systems

Identify all current or under-evaluation uses of AI in manufacturing and QC, and classify each as critical or non-critical.

Assess Gaps Against Annex 22

Evaluate documentation, validation, model transparency, and monitoring processes against the new requirements.

Strengthen Data Infrastructure

High-quality, well-annotated, and representative data is essential for compliant AI. Review data governance frameworks accordingly.

Build Cross-Functional AI Competence

Annex 22 requires involvement from data scientists, QA and QC, manufacturing operations, and IT and CSV teams. Building this capability across the organisation is a prerequisite for compliance.

Re-evaluate Use of Generative or Adaptive Models

Certain AI models do not qualify for critical GMP use. Companies should develop clear internal guidelines on where such models can and cannot be utilised.

Key Takeaways

• If AI impacts product quality, it must meet GMP expectations.
• If AI influences decision making, it must be explainable and controlled.
• If AI adapts itself, it is unsuitable for critical GMP use.

Our consultants support clients with understanding emerging GMP expectations and developing practical, future-ready approaches. Please get in touch if you'd like to discuss your GMP needs or explore how we can help.