1Where Annex 22 stands.
Annex 22 is a draft. The European Commission and PIC/S put it out for consultation from 7 July to 7 October 2025, alongside a revised Chapter 4 on documentation and a revised Annex 11 on computerised systems. All three were drafted by the EMA GMP/GDP Inspectors Working Group with PIC/S, for both the EU and the PIC/S GMP Guides.¹² The consultation is closed. On 6 November 2026 EudraLex Volume 4, where final EU GMP annexes are published, lists no Annex 22, and its Annex 11 is still the January 2011 text.³
The draft is being revised. HPRA told the QP Forum in May 2026 that it “is under revision and further focused stakeholder consultations are scheduled for 2026”.⁴ EMA’s report of its expert workshop of 30 June and 1 July 2026, published on 2 October 2026, says consultation comments supported allowing large language models and generative AI in GMP applications, critical or not, and that the drafting group has discussed widening the scope to dynamic, probabilistic and generative models backed by “a fully documented, robust, risk-based control strategy”.⁵⁶ The only published text is still the July 2025 draft, which the rest of this page describes.
2What the draft covers.
Annex 22 would add to Annex 11 for computerised systems with embedded AI models used in manufacturing medicinal products and active substances “in critical applications with direct impact on patient safety, product quality or data integrity, e.g. to predict or classify data”. It applies to machine learning models that get their function from training on data rather than from explicit programming, and only to some kinds of them.⁷
| Kind of model or use | Position in the draft |
|---|---|
| Static: parameters fixed, no adaptation in use | Covered |
| Deterministic: identical inputs give identical outputs | Covered |
| Dynamic: keeps learning and adapting in use | Not covered, and should not be used in critical GMP applications |
| Probabilistic: identical inputs may give different outputs | Not covered, and should not be used in critical GMP applications |
| Generative AI and large language models | Not covered, and should not be used in critical GMP applications |
| Generative AI and LLMs in non-critical applications | Qualified, trained personnel always responsible for checking the output is suitable: a human in the loop |
So the draft would allow AI in critical GMP work when a static, deterministic model, such as one classifying product as accept or reject, has been tested as the annex sets out. It does not stop generative AI being used for work that is not critical, but it makes a qualified person responsible for each output.⁷
3What a model needs before it is used.
| Section | What the draft asks |
|---|---|
| 2. Principles | Close cooperation between process experts, QA, data scientists and IT; documentation reviewed by the regulated user even when a supplier trained the model |
| 3. Intended use | A detailed description of the task and of the input sample space, with common and rare variations, limitations and possible biased inputs, a process subject matter expert responsible for it, documented and approved before acceptance testing |
| 4. Acceptance criteria | Test metrics such as a confusion matrix, sensitivity, specificity or F1 score, with criteria defined by a process subject matter expert, approved before acceptance testing and at least as high as the performance of the process the model replaces |
| 5. Test data | Representative and stratified across subgroups, large enough for statistical confidence, with verified labels; generating test data or labels, for example with generative AI, not recommended and any use fully justified |
| 6. Independence | Test data never used in development, training or validation, protected by access control and audit trail, and staff who saw it kept out of training or, where that is impossible, paired with a colleague who has not |
| 7. Test execution | An approved test plan; any deviation, failure or unused test data documented, investigated and justified; all test documentation kept |
| 8. Explainability | For critical applications, the features behind each classification or decision recorded during testing, with techniques such as SHAP, LIME or heat maps, and reviewed as part of approving the results |
| 9. Confidence | A confidence score logged for each output where applicable, and an appropriate threshold, with an “undecided” flag considered when confidence is very low |
Every row comes from sections 2 to 9 of the draft.⁷ The intended use, the acceptance criteria and the test plan are all fixed and approved before testing starts, so a model cannot be judged against criteria written after its results are known.
4What happens once a model is in use.
Section 10 puts the tested model, its system and the process it supports under change control before deployment. Any change to the model, the system, the process or the physical objects the model uses as input is documented and evaluated for retesting, and a decision not to retest must be fully justified. The model is placed under configuration control, with measures to detect unauthorised change. Its performance is monitored against its metrics, and its input data is monitored for drift outside the sample space it was tested on.⁷
Where the model gives input to a decision a human operator makes, and testing has been reduced on that basis, the intended use must say what the operator is responsible for, the operator’s training and performance are monitored like any manual process, and records of the human review are kept. Depending on criticality, that can mean reviewing every output.⁷
5How it relates to Annex 11 and the AI Act.
Annex 22 is extra guidance on top of Annex 11, which applies to computerised systems used in GMP activities and expects that a system replacing a manual operation causes no decrease in product quality, process control or quality assurance.⁸ The draft’s “no decrease” acceptance criterion carries the same idea into model testing.⁷
Annex 22 is not part of the EU AI Act. The AI Act is Regulation (EU) 2024/1689 of 13 June 2024, and its annexes run from I to XIII. Annex 22’s glossary does take its definition of an AI system word for word from Article 3(1) of the AI Act.⁹⁷ How the AI Act itself applies is covered in the EU AI Act and pharma.
6How it runs in Seal.
Neil, Seal’s AI agent, is built on large language models, and Seal’s validation and AI assurance guide treats it on the terms the draft sets for them: Neil is not used in GMP execution. It helps set up and change configuration, such as workflows, limits, required fields and review gates, which your team verifies and releases under change control, so what runs in the work is a configured rule rather than model output. It also gathers evidence and drafts findings for investigations and reviews; a qualified person assesses them, and authorised people make the approval and disposition decisions.
The guide maps the three principles of the draft that carry over directly: defining the reviewer’s responsibility for each use, keeping the request, sources, output and reviewer’s decision, and assessing a change of model or AI configuration like any other change. AI can be limited or switched off for the organisation. Neil signs, approves and releases nothing, and Regulatory and validation sets Annex 22 beside Part 11, Annex 11 and GAMP 5.
References
- 1Stakeholders’ Consultation on EudraLex Volume 4, Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and New Annex 22, European Commission, July 2025. https:/
/ health. ec. europa. eu/ consultations/ stakeholders- consultation- eudralex- volume- 4- good- manufacturing- practice- guidelines- chapter- 4- annex_ en (read 6 November 2026) - 2Joint stakeholders consultation on the revision of Chapter 4 on Documentation, Annex 11 on Computerised Systems and on the new Annex 22 on Artificial Intelligence of the PIC/S and EU GMP Guides, PIC/S, 7 July 2025. https:/
/ picscheme. org/ en/ news/ 131/ joint- stakeholders- consultation- on- the- revision- of- chapter- 4 (read 6 November 2026) - 3EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026) - 4Question and Answers, Richard O’Sullivan, GMP Inspector, HPRA, QP Forum, Trinity College Dublin, 12 May 2026. https:/
/ www. tcd. ie/ media/ tcd/ pharmacy/ images/ qp- forums/ qp- forum- 2026/ presentations/ 9. 3- HPRA- QA. pdf (read 6 November 2026) - 5Multistakeholder workshop on expert contributions to artificial intelligence guidance development (Annex 22), report, EMA/156789/2026, European Medicines Agency, 2026. https:/
/ www. ema. europa. eu/ en/ documents/ report/ report- multistakeholder- workshop- expert- contributions- artificial- intelligence- guidance- development- annex- 22_ en. pdf (read 6 November 2026) - 6Good manufacturing practice: Multistakeholder workshop on expert contributions to artificial intelligence guidance development (Annex 22), event page with the report first published 2 October 2026, European Medicines Agency. https:/
/ www. ema. europa. eu/ en/ events/ good- manufacturing- practice- multistakeholder- workshop- expert- contributions- artificial- intelligence- guidance- development- annex- 22 (read 6 November 2026) - 7EudraLex Volume 4, Annex 22: Artificial Intelligence, draft for consultation, European Commission and PIC/S, July 2025. https:/
/ health. ec. europa. eu/ document/ download/ 5f38a92d- bb8e- 4264- 8898- ea076e926db6_ en?filename=mp_ vol4_ chap4_ annex22_ consultation_ guideline_ en. pdf (read 6 November 2026) - 8EudraLex Volume 4, Annex 11: Computerised Systems, revision 1, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 9Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), EUR-Lex, 13 June 2024. https:/
/ eur- lex. europa. eu/ legal- content/ EN/ TXT/ HTML/ ?uri=OJ:L_ 202401689 (read 6 November 2026)
AQuestions and answers
Is Annex 22 in force?
No. It is a draft that was open for consultation from 7 July to 7 October 2025. Final EU GMP annexes are published in EudraLex Volume 4 with a date for coming into operation, and on 6 November 2026 EudraLex does not list Annex 22.
When will Annex 22 be final?
No date has been published. HPRA said in May 2026 that the draft was under revision with further focused consultations planned for 2026, and EMA’s workshop report, published in October 2026, says the drafting group will use the expert input to inform the revision.
Does Annex 22 ban ChatGPT and other large language models?
The July 2025 draft says generative AI and large language models should not be used in critical GMP applications, those with direct impact on patient safety, product quality or data integrity. It allows them in non-critical work if qualified, trained people are responsible for checking the output. The drafting group has since discussed allowing them more widely under a documented control strategy.
What counts as a critical GMP application?
In the draft, one with direct impact on patient safety, product quality or data integrity, for example a model that predicts or classifies data used in a GMP decision. The draft ties its risk management to those same three things, so the regulated company assesses each use and records the result in that use’s intended use.
Does Annex 22 apply outside the EU?
It was drafted jointly with PIC/S for both the EU and the PIC/S GMP Guides, and the European Commission and PIC/S ran the consultation together. PIC/S annexes reach other countries through their own GMP guides: when PIC/S adopted the revised Annex 19 in September 2026, it invited its participating authorities and applicants outside the EEA to transpose it into theirs.
Is Annex 22 part of the EU AI Act?
No. The AI Act, Regulation (EU) 2024/1689, is a separate law with thirteen annexes numbered I to XIII. Annex 22 belongs to the EU GMP Guide, although its glossary uses the AI Act’s definition of an AI system.