The European Commission has published the first version of a GMP guideline written specifically for artificial intelligence. Annex 22 to EudraLex Volume 4 sets out what manufacturers will be expected to do when an AI or machine-learning system touches the production of an active substance or a medicinal product. It is short, six pages, and it is not yet in force. It is also the clearest signal so far of what a regulator will ask for when AI enters a GMP process.
What changed
On 7 July 2025 the Commission opened a consultation on three documents at once: a revised Chapter 4 on documentation, a revised Annex 11 on computerised systems, and a wholly new Annex 22 on artificial intelligence. The drafts were prepared by the EMA GMDP Inspectors’ Working Group in cooperation with PIC/S, which means the expectations are intended to align across more than sixty regulatory authorities rather than the EU alone.
The comment period closed on 7 October 2025. The text is now in the hands of the regulators. Formal adoption is expected during 2026, with enforcement following in the 2027 to 2028 window. Nothing here is law today. That is precisely why it is worth reading today.
Who it applies to
The instrument is Annex 22 of EudraLex Volume 4, the EU’s GMP guidance. It applies to AI and machine-learning models used in the manufacture of active substances and medicinal products, where the model’s output can affect product quality, patient safety, or data integrity. It does not cover every use of AI in a pharmaceutical company. It covers the uses that sit inside the regulated process.
Read it alongside the two documents it travelled with. Annex 11 governs the computerised systems an AI model runs on. Chapter 4 governs the records that prove what the system did. Annex 22 is the AI-specific layer on top of both.
Why it matters for AI workflows
Most discussion of AI in regulated work argues about whether the model is good enough. Annex 22 moves the question. It does not ask whether your model is clever. It asks whether you can show what it was for, what it learned from, how you tested it, who reviews its output, and how you would notice if it drifted.
The draft sets expectations in a recognisable shape. Define the model’s intended use before anything else. Establish the performance metrics that decide whether the model is acceptable for that use. Account for the quality and the provenance of the training data, and manage the test data separately so the evaluation means something. Validate the system. Then keep watching it: change control, performance monitoring, and a defined point at which a human reviews the output rather than the system acting alone.
If you are putting an agent or a model anywhere near a GMP process, that list is the bar you will be measured against. It is written down now, eighteen months or more before you have to meet it.
The preflight implication
Every requirement in that list is a thing you can check before a workflow runs, not after an inspector asks. That is the whole argument for a preflight.
- Intended use declared. The workflow states what the model is for, in scope terms, before it acts.
- Training-data provenance recorded. The lineage of what the model learned from is captured, not assumed.
- Validation evidence present. The performance metrics and the test results exist and are linked to the intended use.
- Human-review gate defined. The point at which a person must review, rather than the system deciding alone, is named and enforced.
- Ongoing monitoring in place. There is a defined way to notice drift and a change-control path when the model changes.
A preflight check asserts each of these on the ground, every time, before the work is in the air. It does not depend on how confident the model sounded. Annex 22 is, in effect, a regulator writing down the checklist. The work left for a manufacturer is to run that checklist before the process does, and to keep the evidence that it was run.
What you can do now
You cannot comply with a guideline that has not been adopted. You can do something more useful than wait. Map the AI-touching steps in your GMP workflows against the five expectations above and find the gaps now, while the cost of finding them is a note rather than a deviation. Build the evidence trail (intended use, data provenance, validation, the human-review gate, monitoring) so that when Annex 22 is adopted you are reading your own records rather than starting them. The draft is stable enough to design against. The expensive version of this work is the one that begins after the rule is in force.
Sources
- European Commission, DG Health and Food Safety. Stakeholders’ Consultation on EudraLex Volume 4: Chapter 4, Annex 11 and new Annex 22. Consultation opened 7 July 2025, closed 7 October 2025. health.ec.europa.eu
- EudraLex Volume 4, EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use.
Status note: Annex 22 is a draft. The comment period has closed. It is not in force. Dates and status above are current as of 11 June 2026 and will be updated here as the instrument is adopted.
Corpus anchor: this change touches eu-gmp-annex-11 (Computerised Systems) and pics-pi-011-3 (PIC/S Good Practices for Computerised Systems), both already in the Preclari corpus. Preclari checks against these today.