.webp)
Does draft EU GMP Annex 22 mean generative AI (GenAI) has no place in GxP validation? The answer depends in large part on how and where AI is being used.
Annex 22 is still evolving, and so is the broader regulatory conversation around AI. For validation leaders, the more useful question may therefore be less about whether AI is simply “allowed” or “not allowed” and more about where AI is being used, what it is being asked to do, what risk that creates, and what controls are needed to govern it responsibly.
What Does Annex 22 Actually Say About GenAI?
Draft Annex 22 focuses on AI used in critical GMP applications that directly impact patient safety, product quality, or data integrity. Within that scope, the draft centers on static AI and machine learning models that produce deterministic outputs. Dynamic models that continuously learn during use, probabilistic outputs, GenAI, and large language models (LLMs) fall outside the covered model class for critical GMP applications.
That is an important boundary, but it is not the same as saying these technologies have no place in GxP environments. The draft explicitly contemplates non-critical use where qualified personnel remain accountable for determining whether the output is suitable for its intended purpose. This distinction shifts the conversation from the technology alone to its intended use and potential impact (European Commission, 2025).
The Regulatory Conversation Is Still Evolving
Public feedback on Annex 22 reflects the same tension. Industry groups have broadly welcomed AI-specific GMP guidance while questioning whether broad exclusions based on model type could become too restrictive as the technology evolves. BioPhorum and the International Society of Quality Assurance have both advocated, in different ways, for approaches that place greater emphasis on quality risk management (QRM), appropriate controls, and practical implementation (BioPhorum, 2025; International Society of Quality Assurance, 2025).
The European Medicines Agency’s (EMA) June 2026 multistakeholder workshop adds useful context. The discussion examined how GenAI and LLMs might be responsibly governed in medicines manufacturing, including QRM, data governance, model evaluation, lifecycle controls, transparency, cybersecurity, accountability, and human oversight. This does not mean critical GenAI use is already permitted under Annex 22. Rather, it shows that the conversation continues to explore what evidence and controls may be necessary to govern these technologies appropriately (EMA, 2026).
Not Every AI Use Case Carries the Same Risk
Consider the difference between using AI to draft validation content from approved source information and allowing AI to independently make a critical GMP decision. In the first scenario, a qualified validation professional can review, correct, and approve the content before it becomes part of the controlled record. In the second, an incorrect AI output could directly affect a critical decision without qualified human intervention.
Both scenarios involve AI, but treating them as equivalent overlooks a fundamental principle of QRM: the level of control should reflect the intended use and potential consequence. For AI, that means asking what task the technology is performing, what happens if it is wrong, whether an error can be detected or reversed, who reviews the output, and whether that output directly influences a GMP decision or record. The underlying idea is straightforward: greater reliance on AI requires stronger evidence and control (ICH, 2023).
AI Extends Data Integrity Into Decision Integrity
Life sciences organizations already understand the importance of data integrity. Records must be complete, accurate, attributable, and traceable. But as AI begins to draft content, identify gaps, interpret evidence, compare information, or flag anomalies, the integrity question starts to extend beyond the underlying data.
Organizations also need to understand what happened around an AI-assisted output. What information was used? What was the AI expected to do? Why was its output accepted, changed, rejected, or escalated? Who remained accountable for the decision? This broader concept can be described as decision integrity: the ability to reconstruct and defend how an AI-assisted recommendation, classification, exception, or action was handled.
This does not replace data integrity. It extends the same discipline into AI-assisted work. As AI becomes more deeply embedded in validation processes, demonstrating that the surrounding decision process was understood, controlled, and reviewable may become increasingly important to inspection readiness.
Govern AI According to Risk, Not Hype
A practical path forward does not require organizations to choose between unrestricted AI adoption and waiting until every regulatory question has been answered. Organizations can begin with clearly bounded applications, define what AI is and is not allowed to do, control the information available to it, maintain source traceability, keep qualified people accountable, and monitor how the technology performs over time.
Importantly, these controls do not make a probabilistic model deterministic. They make the process surrounding AI use more bounded, reconstructable, and governed. This distinction matters because responsible AI adoption is ultimately about more than the model itself. It is about whether the organization can demonstrate that AI operates within a controlled process appropriate to its intended use and risk(European Medicines Agency/ICH, 2023).
Annex 22 Readiness Can Start Today
The final Annex 22 may differ from today’s draft, but organizations do not need to wait to start building readiness. Validation leaders can begin by understanding where AI is already being used, classifying use cases by intended use and criticality, establishing clear boundaries and human oversight, and determining what evidence would be needed before greater reliance on AI could be justified.
That reframes the Annex 22 conversation around a more practical question. Rather than asking only, “Can we use AI in validation?” organizations should ask, “Can we demonstrate that the way we use AI is controlled, evidence-based, accountable, and appropriate for the risk?” Building that foundation now can help organizations prepare not only for Annex 22, but for the broader shift toward governed AI across GxP environments.
Table of Contents
