Artificial intelligence reached quality systems before the rules for it did. Teams are already using AI tools to summarize batch records, draft investigations and suggest root causes, while regulators are still deciding how those uses should be governed. On 7 July 2025 the European Commission published a draft Annex 22 on artificial intelligence, together with a revised Annex 11 on computerized systems and a revised Chapter 4 on documentation, and the consultation closed on 7 October 2025.
That draft is the first serious attempt to set GMP rules for AI, and it matters even for a site in the United States, because it shows how an inspector is likely to think about the subject. The gap is that most sites have not written down which of their AI uses fall inside or outside the draft’s scope. This post explains where the draft stands and what you can do now.
Where Annex 22 stands
As of 16 October 2026, the European Commission’s page for EudraLex Volume 4 lists Annex 1 through Annex 21, and the current Annex 11 and Chapter 4 still carry their 2011 versions. The Commission’s consultation page states that the response period has ended and gives no date for a final text. Treat any specific date you hear as a forecast rather than a fact, and expect the draft to change before it is adopted.
What the draft covers
As drafted, Annex 22 applies to AI models used in critical GMP applications, meaning applications that can affect patient safety, product quality or data integrity. It limits those applications to static models, which do not continue learning after deployment, and to deterministic models, which return the same output for the same input. It also states that generative AI and large language models should not be used in critical GMP applications, while allowing their use in non-critical applications as long as qualified personnel remain responsible for the output.
The question most sites have not answered
Is the task your people are doing with AI a critical GMP application? Drafting a deviation investigation, summarizing a batch record and proposing failure modes can each be argued either way, depending on how much the output influences a quality decision. The draft does not settle that argument for you. It expects you to settle it in writing, with a rationale, before the tool is used, and it expects a named qualified person to be accountable for what the tool produces.
I wrote about the reviewer’s role in AI Can Draft the Investigation. It Cannot Sign It. and about the UK regulator’s early position in MHRA’s Early Signal on AI in GxP Inspection Responses. Both point to the same practical problem, which is that the governance question is already live at sites using these tools today.
Four steps to take now
Step 1: Inventory every AI use that touches GMP data. List each tool in use or in pilot, including features inside vendor systems and licensed software that were switched on by an update, because those are the ones nobody remembers approving.
Step 2: Classify each use and write down why. Record whether the use is critical or non-critical, with a rationale that someone can be questioned on. If you cannot defend “non-critical,” treat the use as critical until you can.
Step 3: Name the accountable person and define what review means. Decide who signs for the output, what that person checks, and what evidence shows they checked it. A reviewer who can only describe clicking approve has not performed a review.
Step 4: Write intended use and acceptance criteria before testing. For any model you would rely on in a critical application, document what it is for and what performance counts as acceptable before the test begins, and keep the test data separate from the data used to build the model. These are the expectations as drafted, so confirm them against the final text.
What this means for a US site
Annex 22 is an EU document, and it applies directly to sites supplying the EU market. For a site that supplies only the US, it is a preview and not a requirement. The preview is still useful, because the same questions will come up in any inspection where AI touches a record: what the tool is for, how you know it works, and who is accountable for what it produced.
Conclusion
The final text of Annex 22 has not been published, and it may differ from the draft. The inventory, the classification and the accountability decision do not depend on the final wording, because any version of the rule will ask for them. A site that completes them now will be able to adjust to the final text in weeks instead of starting from nothing.
Key Takeaways
- Annex 22 is still a draft. The consultation closed on 7 October 2025 and no final text or date has been published.
- Scope matters. The draft limits critical GMP applications to static, deterministic models and says generative AI should not be used in them.
- Classify in writing. Decide whether each AI use is critical, and record the reason before the tool goes into use.
- Accountability is the hard part. Name the person who signs and define what their review actually involves.
If you want an outside read on where AI is already touching your GMP records, the Rapid Diagnostic is a fixed-scope review that can be completed in as little as two weeks, depending on the scope. Rapid Diagnostic