Can AI be used in GMP?

1What applies today.

Neither the US nor the EU has a final GMP rule written for AI. What applies is the set of rules that already governs computerised systems and quality decisions. US CGMP allows computers and automated equipment in manufacturing, provided they are routinely checked under a written programme and their input and output are checked for accuracy.¹ The quality control unit approves or rejects every procedure and specification affecting the identity, strength, quality and purity of the drug product.² In the EU, Annex 11 covers every computerised system used in GMP activities, and says that a system replacing a manual operation should cause “no resultant decrease in product quality, process control or quality assurance”.³

Regulators have said how those rules reach AI. EMA’s reflection paper of September 2024 makes it the responsibility of the sponsor, the marketing authorisation applicant or holder, or the manufacturer to ensure that “all algorithms, models, datasets, and data processing pipelines used are fit for purpose”. For AI in manufacturing it asks for quality risk management principles to be followed and, for human medicines, the principles of ICH Q8, Q9 and Q10 to be considered, “awaiting revision of current regulatory requirements and GMP standards”.⁴ Ireland’s HPRA told the May 2026 QP Forum that the company and the people responsible for a GMP activity “are responsible for the decisions made based on the outputs” of an AI model.⁵

2What the EU draft Annex 22 would allow.

The draft Annex 22, consulted on by the European Commission and PIC/S from 7 July to 7 October 2025, is the GMP text written specifically for AI.⁶ It sorts uses by whether they are critical, meaning they have “direct impact on patient safety, product quality or data integrity”, and by the kind of model.⁷

The draft is changing. EMA’s report of its expert workshop of 30 June and 1 July 2026, published on 2 October 2026, says consultation comments supported allowing large language models and generative AI in GMP applications, critical or not, and that the drafting group has discussed widening the annex to dynamic, probabilistic and generative models backed by “a fully documented, robust, risk-based control strategy”.⁸⁹ On 6 November 2026 Annex 22 is not in EudraLex Volume 4, so it is not yet part of EU GMP.¹⁰ The detail is in what Annex 22 allows.

3What FDA has said.

FDA has not written AI into the CGMP regulations. Its January 2025 draft guidance sets out a risk-based credibility assessment for AI that produces information or data supporting regulatory decisions on drug safety, effectiveness or quality, including in manufacturing, and is still a draft, not for implementation. It says AI used in manufacturing “must be implemented in accordance with current good manufacturing practice”, and that the quality control unit’s responsibilities in 21 CFR 211.22 and 211.68 apply.¹¹ In January 2026 FDA and EMA added ten guiding principles of good AI practice, which industry and product developers “can consider”.¹² FDA’s 2023 discussion paper on AI in drug manufacturing lists uses such as process design and scale-up, advanced process control, process monitoring and fault detection, vision-based inspection of packaging, labels and vials, and trend monitoring of complaints and deviation reports.¹³

The clearest statement so far is an enforcement one. In a warning letter of 2 April 2026, FDA found that a manufacturer had used AI agents to create drug product specifications, procedures and master production records, cited 21 CFR 211.22(c) for failing to review them, and said that any AI output used for CGMP activities “must be reviewed and cleared by an authorized human representative of your firm’s QU”.¹⁴ What that letter said is set out in FDA’s AI warning letter.

4What inspectors will ask.

HPRA says inspectors may ask at the opening meeting whether AI is used in any GMP system or process, and may change the inspection plan to make time to look at it. A company that says a tool is for “business use only” needs to be sure the system does not fall under GMP.⁵ HPRA names three things that keep AI output accurate: in-depth knowledge of the process the model is part of, review and verification of AI outputs, and training and validation of the systems.⁵

5Where to start.

List every place AI touches GMP work, including drafting tools people use on their own. For each, decide and record whether the use is critical, write down its intended use and who is responsible for checking its output, and keep a record of each review. Draft Annex 22 asks for an intended use approved before testing. Where a person decides on the model’s output and testing has been reduced on that basis, it asks for the person’s responsibility to be written into the intended use and records of the review to be kept, and it puts the model, its system and its process under change control before use.⁷ For a model that makes or informs critical decisions, plan the testing described in how to validate AI for GxP use.

6How it runs in Seal.

Neil, Seal’s AI agent, is built on large language models, and Seal treats it on the terms draft Annex 22 sets for them: Neil is not used in GMP execution. It helps set up and change configuration, such as workflows, limits, required fields and review gates, which your team verifies and releases under change control, so what runs in the work is a configured rule rather than model output. It also gathers evidence and drafts findings for investigations and reviews, which a qualified person assesses. Neil signs, approves and releases nothing, and never sees more than the person asking it.

The validation and AI assurance guide sets out what to keep for an AI-assisted decision (the request, the source records and versions, the output and the reviewer’s decision), how a change of model is assessed, and how AI can be switched off for the organisation. Each of Neil’s 52 jobs shows the records Neil works from, the draft it prepares and the review a person makes before anything changes.