On this page
What Annex 22 is and where it stands
Annex 22 is a new annex to the EU GMP guidelines covering artificial intelligence. The European Commission put it out for consultation from 7 July to 7 October 2025, together with a revised Chapter 4 on documentation and a revised Annex 11 on computerised systems. It was drafted by the EMA GMDP Inspectors Working Group in cooperation with PIC/S.
On the EudraLex Volume 4 page, checked on 3 November 2026, the Annex 11 in force is still the January 2011 version and Annex 22 is not listed. It is a draft and may change. So our advice is not to describe your equipment as Annex 22 compliant or certified. There is no final text yet to measure it against.
Which AI the draft covers and which it leaves out
Under section 1, the annex applies to machine learning models used in critical applications, meaning those with a direct impact on patient safety, product quality or data integrity. It only covers static models, which do not change while in use, and deterministic ones, which always give the same output for the same input.
Models that keep learning during use, and models that can give different outputs for identical inputs, should not be used in critical GMP applications. Nor should generative AI or large language models. If they are used in non-critical GMP applications, qualified staff should always be responsible for making sure the output is suitable. The text calls this human-in-the-loop.
In 2023 the FDA published a discussion paper, explicitly not guidance, listing possible uses in drug manufacturing. They include process design and scale-up, advanced process control, process monitoring and fault detection, vision-based inspection of packaging, labels and vials, and trend monitoring of deviation reports.
Is EU GMP Annex 22 mandatory yet?
No. It is a draft that went out for public consultation from 7 July to 7 October 2025. As of 3 November 2026, the EudraLex Volume 4 page still does not list it and keeps the 2011 Annex 11. The text may change, so no equipment can be presented as compliant.
What your customer's QA team will ask
Section 2.2 says the regulated user should have access to the model documentation and review it, even when a supplier trained and tested the model. The list sums up what the draft asks for. Our reading is that your customer's QA team will raise these points, so your website and datasheet should already answer them.
- Intended use (3.1). What task the model performs, what input data it takes and where its limits are.
- Metrics and acceptance criteria (4.1 and 4.2). For an accept or reject model, for example a confusion matrix, sensitivity, specificity, accuracy, precision or F1 score.
- No decrease (4.3). The acceptance criteria should be at least as high as the performance of the process the model replaces, so that performance has to be known.
- Test data (5 and 6). Representative, correctly labelled and kept apart from training data. Generating it with generative AI is not recommended.
- Explainability and confidence (8 and 9). Which features drive each decision, and what happens when the model is unsure, such as flagging the case as undecided.
- Operation (10). Change and configuration control, performance monitoring, input drift monitoring and human review.
Want us to check whether your datasheet answers what QA will ask? Leave your details and we will tell you what is missing.
Check my datasheetWhat to put on your website, datasheet and demo
We suggest leading with the intended use in one plain sentence. For example, the vision system sorts vials into pass or review, or the model flags when a process parameter starts trending away from normal. Then say what the model decides and what the operator decides, and whether the model is static or gets updated.
State what documentation you hand over and how model updates are handled. Under section 10.1, any change to the model, the system or the process should be documented and assessed to decide whether the model needs retesting.
Keep R&D messaging apart from GMP production messaging. In a development lab, a model that suggests scale-up parameters can be sold on speed. In a GMP plant, the same claim needs the intended use, the limits and the human review alongside it.
Can ChatGPT or another LLM be used in a GMP plant?
According to the draft, generative AI and large language models should not be used in critical GMP applications, those with a direct impact on patient safety, product quality or data integrity. If they are used for non-critical tasks, qualified staff should always be responsible for making sure the output is suitable.
Phrases to avoid and what to say instead
Some words that work well in a tech campaign make a pharma buyer wary. The table is our own suggestion and does not come from the annex. It lists the most common ones, with an alternative that makes the same point without promising more than your documents can back up.
The same goes for demos. Show a case where the model is unsure and how the operator sees it. That way the buyer sees the confidence threshold at work, which the draft covers in section 9.2.
| Avoid | Better | Why |
|---|---|---|
| Annex 22 compliant | Documentation built around the questions in draft Annex 22 | It is still a draft and not in force |
| Self-learning AI | Static model, updated under change control | The draft says dynamic models should not be used in critical applications |
| Autonomous inspection | The model classifies and an operator reviews borderline cases | The customer needs to know who decides |
| Zero defects guaranteed | Metrics and test data available to your QA team | A promise without test data cannot be verified |
| Generative AI GMP assistant | Documentation search assistant with human review | Generative AI is out of scope for critical GMP uses |
What should a supplier of AI-enabled equipment hand over?
Section 2.2 says the regulated user, your customer, should have and review the model documentation even if the supplier did the testing. The draft asks for documented intended use (3.1), acceptance criteria (4.2), a test plan (7.2) and change control (10.1). If you have this ready, say so on your website.
Where a generative AI assistant fits
A generative AI chatbot should not be marketed as a GMP tool, because the draft says these models should not be used in critical applications. It can help with non-critical work, such as searching an instrument's technical documentation, as long as a person reviews the output.
If you offer one, say on your website what it is for and what it is not for. Our guide to AI assistants for technical documentation covers how to scope it. Also look at the draft revised Annex 11, which the consultation page says reinforces supplier oversight, data integrity, audit trails, electronic signatures and security.
