Consider a hypothetical manufacturer buying an AI vision system to reject defective units on a packaging line, or software that sorts deviations for a quality team. The offer combines a software license and a validation package. Yet the decisive issue is whether the regulated manufacturer can explain what the system does, test it against its own process, detect a failing model and keep the evidence when the supplier changes or leaves. Draft GMP Annex 22 sharpens those questions without yet answering them as binding requirements.
1. A Consultation Draft Is Not the GMP Baseline
The European Commission opened a joint consultation with PIC/S on a revision of EudraLex Volume 4, Chapter 4, a revised EU GMP Annex 11 for computerized systems and a new EU GMP Annex 22 for artificial intelligence on 7 July 2025. It closed on 7 October 2025. For the 22 October 2026 horizon, the Commission's published EudraLex Volume 4 listing identified EU GMP Annex 11 as the January 2011 revision and did not list an EU GMP Annex 22. The September 2026 PIC/S GMP annex compilation likewise retained PIC/S GMP Annex 11 without a PIC/S GMP Annex 22. An EMA account of its February 2026 industry meeting said the new annex was under revision after approximately 1,300 consultation comments and that a final document was expected by year end. The forecast did not make the text final. 1European Commission, Stakeholders’ Consultation on EudraLex Volume 4: Chapter 4, Annex 11 and New Annex 22 (7 July 2025), consultation status, opening and closing dates, and draft links.2European Commission, EudraLex Volume 4: Good Manufacturing Practice Guidelines, Annexes listing: Annex 11 (January 2011); no Annex 22 listed.3Pharmaceutical Inspection Co-operation Scheme (PIC/S), Guide to Good Manufacturing Practice for Medicinal Products, PE 009-18 (Annexes, 24 September 2026), cover, table of contents and Annex 11, pp 169–173.4Heads of Medicines Agencies and European Medicines Agency, Summary Notes of the HMA-EMA Group Focused on AI with Industry Stakeholders Meeting (4 February 2026 meeting; 11 February 2026 document), pp 1–2.
That source status matters in a transaction. A vendor's statement that its product is “EU GMP Annex 22 compliant” can mean that it was designed around the consultation text. It cannot, on that wording alone, establish conformity with an adopted EU GMP Annex 22. The proposal may still influence negotiations over test evidence and data access that would be expensive to add after deployment. A contractual reference to “all EU GMP Annex 22 requirements” can leave the supplier's deliverables unclear if the draft text changes before adoption. 15European Commission, Draft EudraLex Volume 4, Annex 22: Artificial Intelligence (consultation, 7 July 2025), §§ 1–10, especially §§ 1, 2.2, 3.1 and 3.3, 4–7 and 10.
The existing EU GMP Annex 11 is the immediate starting point for a computerized system used in GMP-regulated activity. Its principle calls for validation of the application and qualification of IT infrastructure, and rejects a resulting decrease in product quality, process control or quality assurance when a computer system replaces a manual operation. Section 1 of EU GMP Annex 11 ties the extent of validation and data-integrity controls to a justified, documented assessment of patient safety, data integrity and product quality. It does not prescribe the same validation exercise for every AI use. A model that directly decides whether a product passes an inspection presents a different risk from an internal tool that proposes headings for a training document. What staff actually do with the output matters more than the supplier's label for the software. 6European Commission, EudraLex Volume 4, Annex 11: Computerised Systems (revision 1, in operation from 30 June 2011), Principle, §§ 1, 3–4, 7, 9–11, 15–17.
The proposed EU GMP Annex 22 may affect supplier negotiations, but existing EU GMP Annex 11 still frames the immediate GMP question: can the manufacturer validate its use, control changes and produce the evidence?
The live annex also addresses the vendor. Formal agreements with third parties that provide, validate, maintain, modify or store the system, or process its data, must clearly state their responsibilities. The regulated user reviews commercial software documentation against its requirements; supplier competence, reliability and audit needs are risk assessed; quality and audit information must be available to inspectors on request. Validation records must justify standards, protocols and acceptance criteria. Change-control records, deviations, system inventory, critical data flows, and tests of parameter limits and error handling affect whether the manufacturer can explain the system during validation or inspection. 6
These are guidance requirements embedded in the EU GMP framework, rather than a freestanding European statute granting a regulator rights against an AI vendor. A supplier can undertake development, testing, hosting and support; the manufacturer must still demonstrate that its use remains suitable for its GMP process. The contract is the route by which the manufacturer obtains evidence and cooperation it cannot create alone. Treating the future annex as a substitute for those present controls would leave the actual validation decision unsupported. 65
2. The Proposed Annex Makes Intended Use Testable
The proposed EU GMP Annex 22 is narrower than a general rule for all AI in pharma. Its stated subject is AI models embedded in computerized systems used in manufacturing medicinal products and active substances in critical applications with direct impact on patient safety, product quality or data integrity. It addresses models trained on data, rather than explicitly programmed functions, and confines its proposed route to static models that do not learn during operation and deterministic outputs that repeat for identical inputs. The consultation draft says continuously learning and probabilistic-output models should not be used in critical GMP applications. It says the same of generative AI and large language models. For noncritical GMP uses, it envisages qualified, trained personnel taking responsibility for output suitability and suggests considering its principles where applicable. That is a proposal about defined use cases, not an adopted ban on generative AI anywhere in a drug business. 5
Even within that scope, classification is about the manufacturer's process, not a marketing category. A visual classifier that merely flags images for review could still affect product quality if operators routinely accept its judgment or if the interface hides uncertain results. Conversely, a drafting assistant used away from manufacturing decisions may not be a critical GMP application merely because the quality unit owns it. The answer turns on the intended task, the downstream human decision and what would happen if a plausible error escaped. The draft says a process subject matter expert should be responsible for the adequacy of a detailed intended-use description, including common and rare input variation, limitations and possible erroneous or biased inputs. The description should be documented and approved before acceptance testing. For a packaging-line model, this could mean different sites, cameras, lots, lighting conditions and defect classes. 5
The proposal then links that description to pre-agreed measures of success. Acceptance criteria can vary by subgroup, but should at least match the performance of the process replaced. A single aggregate accuracy score can conceal a high miss rate for a rare but serious defect. An aggregate result may leave the buyer unable to see subgroup performance, statistical uncertainty or the evidence behind the labels. The draft calls for representative and sufficiently large test data, verified labeling and a holdout that did not leak into training or validation. Its restriction on generated test data is also qualified: generation is “not recommended” and any use should be justified; it is not written as an unconditional ban. Where a vendor withholds proprietary training records, the manufacturer may be unable to explain how an independently held acceptance set covers its local use. 5
A generic qualification test at another plant would not establish whether a human inspector can identify defects on this line; a generic model test presents a similar evidence gap. The draft applies that discipline to a model, including testing on unseen data and recording deviations from the test plan. It adds feature attribution during testing where applicable, a review of whether the model relies on appropriate features, confidence logging for predictive or classificatory models where applicable, and a threshold that can return an “undecided” result instead of a weak decision. These are proposed evidentiary tools, not a promise that every model has an interpretable internal logic. 5
A human review step does not automatically erase model risk. The draft permits a lower model-testing effort where a human makes the decision only if the operator's responsibility is described and the operator's training and consistent performance are monitored like any other manual process. Without clarity about which results the system decides, escalates or merely presents, a human signature may conceal how much of the decision the model already made. Calling every workflow “human in the loop” without describing the person's information and authority will not answer whether a harmful automated pattern can be caught. 5
3. What the AI Supplier Agreement Must Make Possible
The existing EU GMP Annex 11 already requires formal agreements and controlled system changes. The proposed EU GMP Annex 11 would make supplier governance more explicit: a regulated user remains fully responsible for outsourced activities and their evidence; its requirements for a bought or hosted system must be maintained; it must have access to documentation, with the ability to explain that documentation from its facility. Its proposed contract provision would address reporting, audit and inspection support, quality and security communications, data exit, new versions and the customer's testing before release. Those details expose contractual dependencies, but describing them as already mandatory under the revised annex would misstate the consultation's status. 67European Commission, Draft Revised EudraLex Volume 4, Annex 11: Computerised Systems (consultation, 7 July 2025), §§ 2.5–2.6, 6 and 7.
Title to the model and access to validation evidence raise different commercial questions. For an inspection, relevant evidence can include approved intended use, requirements traceability, test design, acceptance results, deviations, version identity and changes. A vendor may retain intellectual property in code, weights and training methods. Contract rights may allow the buyer to inspect relevant documentation, obtain a comprehensible validation package, show it to inspectors and preserve required records after termination. If confidentiality terms block such disclosure, a manufacturer may lack evidence it needs when a supplier invokes trade secrecy during an inspection. Ownership of an algorithm is not a GMP requirement; access to evidence for a GMP decision is the regulatory concern. 657
Responsibility at the boundary between supplier and site can remain uncertain even when each has tested its own component. A model's output may depend on a camera, a data normalization step, software configuration and how an operator receives the result. The vendor may verify its package on reference images, while the manufacturer validates the whole use in the line it actually runs. Existing EU GMP Annex 11 expects an up-to-date description of critical arrangements, flows, interfaces, prerequisites and security measures, and tests that include limits and error handling. The draft EU GMP Annex 22 asks for the process and system around the model to be under change control, including physical input objects; changes are assessed for retesting, with a reason recorded if retesting is waived. A supplier's ordinary update terms may cover a new model, preprocessing rule, threshold, API, hardware dependency or cloud component without preserving the site's opportunity to assess its effect before production use. 65
A generic service-level promise is weak protection if the supplier can silently retrain, replace or roll back the model. Complete source-code escrow may be disproportionate and might not let the buyer run or validate it. Whether the buyer can preserve a validated state depends on the version it can identify, the changes it can detect and the records it can recover. The regulatory retention period and the supplier's ordinary export and deletion terms may point to different outcomes, while a generic cooperation clause may fail during an inspection. 657
Continuity and exit are equally concrete. Existing EU GMP Annex 11 calls for planned, tested alternative arrangements for systems supporting critical processes and for archived data to remain accessible, readable and intact. Its supplier provisions require information for inspectors. The proposed revision calls for an exit strategy by which the regulated user may retain control of system data. If a vendor stops hosting the model, the buyer may need historical predictions, input records, audit trails and the ability to reconstruct the version that supported a batch decision. Exit can leave the manufacturer needing readable records from a provider whose hosting obligation has already ended. 67
A contract may allocate the cost of a recall, investigation or remediation, subject to its law and agreed limitations. It cannot make a supplier the holder of the manufacturer's GMP authorization by declaration. A vendor may supply evidence and perform tests, but existing EU GMP Annex 11 expects the manufacturer to justify its validation standards, protocols and acceptance criteria based on its risk assessment. When a computerized system records certification and batch release, it should allow only qualified persons to certify batch release and identify and record the person releasing or certifying each batch. 67
4. Swiss Manufacturing, the AI Act and Agency Guidance
A Swiss manufacturing site needs its own legal route into this discussion. The Swiss Medicinal Products Licensing Ordinance (AMBV) makes the authorization holder responsible for its manufacturing operations and requires GMP according to its Annexes 1 or 2. Annex 1 AMBV identifies both the European Commission's EudraLex Volume 4 and the PIC/S GMP principles and guidelines. The responsible technical person decides on technical batch release under Art. 7 AMBV. Art. 5(6) AMBV requires release or rejection decisions independent of management and permits Swissmedic to license small facilities without the prescribed separation if their size prevents it. That connection makes the existing EU and PIC/S computerized-system guidance relevant to Swiss operations. It does not transform a European or PIC/S consultation draft into a Swiss rule. The proposed revision may shape Swiss contract discussions without itself changing the existing standard. 8Verordnung vom 14. November 2018 über die Bewilligungen im Arzneimittelbereich (Arzneimittel-Bewilligungsverordnung, AMBV; SR 812.212.1), Art. 4(1)–(2), Art. 5(1)–(2) and (6), Art. 7, Annex 1 no. 1(c)–(d) (version of 15 March 2025).3
The EU AI Act is a second, separate screen, particularly for a supplier placing an AI system on the EU market or a group using its output in the Union. Its scope and duties depend on the provider or deployer role, the intended use and where the system or its output is used. A model does not become a high-risk AI system under the Act merely because GMP treats a particular production step as critical. The Act's product route and the use cases in Annex III AI Act turn on the actual system; a generic pharma manufacturing classifier is not, simply by being such a classifier, a listed high-risk use case. 9Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L 2024/1689 (AI Act), Art. 2 and Art. 6, Annexes I and III. After the July 2026 amendment, Art. 6(1a) AI Act excludes systems used solely for non-safety quality control from the safety-component category, while Art. 6(1b) AI Act keeps that category where a system's failure or malfunction would endanger health or safety. The function and failure consequences decide the answer; other applications in the same company can be classified differently. The separate analysis of the AI Act in German pharma R&D addresses a different use setting and an earlier publication horizon. 10Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence [2026] OJ L 2026/1744, amendments to Art. 4 and Art. 6 AI Act (n 9).
The AI Act's amended literacy provision already bears on providers and deployers: they take measures supporting the literacy of staff and other people operating or using systems on their behalf, with attention to their knowledge, experience, training, context and affected people. Regulation (EU) 2026/1744 also clarifies that the duty does not require guaranteeing a specific level of literacy for each individual. That is neither a substitute for GMP qualification of personnel nor a reason to describe every employee's training as an EU GMP Annex 22 requirement. The relevant training record depends on the person's actual role in operation, review or quality decision making. The separate analysis of AI literacy after the Digital Omnibus treats that cross-sector duty in its own setting. 910
Other agencies' AI publications help frame the evidence but have different force and scope. The EMA's 2024 reflection paper discusses manufacturing applications such as process optimization, in-process control and batch release, with lifecycle and quality-risk considerations. The ten EMA/FDA guiding principles published in January 2026 address context of use, data governance, model performance and lifecycle oversight across drug development; they do not themselves enact a GMP annex. The February meeting recorded industry's request for greater flexibility without a regulatory position on the points raised. An EMA workshop report published on 2 October 2026 subsequently recorded the drafting group's discussion of expanding EU GMP Annex 22 to adaptive, probabilistic and generative models under a fully documented, robust, risk-based control strategy. Concerns remained about that strategy; the report described ongoing drafting work rather than adopted permission for a particular GMP use. 11European Medicines Agency, Reflection Paper on the Use of Artificial Intelligence in the Medicinal Product Lifecycle (2024), § 2.3.6 (manufacturing), p 7.12European Medicines Agency and US Food and Drug Administration, Guiding Principles of Good AI Practice in Drug Development (January 2026), principles 1–10 and scope.413European Medicines Agency, Good Manufacturing Practice (GMP) Multistakeholder Workshop on Expert Contributions to Artificial Intelligence Guidance Development (Annex 22), EMA/156789/2026 (workshop 30 June 2026; report first published 2 October 2026), p 3 and pp 13–14 (scope discussion and next steps).
For a US group, the FDA analogy also has limits. The FDA's January 2025 draft guidance addresses AI-generated information supporting regulatory decision making, including manufacturers' actions under FDA drug-GMP authority. Its exclusion for operational-efficiency uses depends on their not affecting patient safety, drug quality or the reliability of nonclinical or clinical study results; the guidance remains a draft. 14US Food and Drug Administration, Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products (draft guidance, January 2025), Introduction fn 4; § II (Scope), p 3; § IV.A.1–3, pp 6–9; § IV.B, pp 16–17. US drug GMP has its own controls for automatic equipment under 21 C.F.R. § 211.68, and electronic-record rules under Part 11 apply within their stated predicate-rule scope. 1521 C.F.R. § 211.68 (2025), automatic equipment controls.1621 C.F.R. Part 11 (2025), electronic records and signatures. The FDA's final February 2026 computer software assurance guidance addresses medical-device production and quality systems; it does not by itself amend drug GMP. 17US Food and Drug Administration, Computer Software Assurance for Production and Quality Management System Software (final guidance, February 2026), Scope (medical-device production and quality management system software). A transatlantic procurement may share technical evidence, but regulatory sign-off depends on the applicable regime.
5. Strategic Considerations for Pharma Manufacturers Buying AI
While EU GMP Annex 22 remains unsettled, the same software purchase can conceal several different quality decisions. Which use is genuinely critical to product quality or data integrity, and which only helps staff prepare material for a later, independent GMP decision? Who knows the performance of the process being replaced, and can the vendor's test set represent the buyer's rare defects and site conditions? These questions determine whether a model that looks strong in a demonstration can be accepted at the plant. The existing annex's risk approach and the proposed annex's detailed evidence route point to the same factual inquiry, even though their legal status differs. 65
Implementation costs can lock the parties together before supplier and site have the same view of the model. A confidentiality clause may restrict disclosure of test reports when an inspector asks for them. Hosting terms may allow an automatic update before the site has assessed a new version. On termination, the supplier may have a short export window while GMP records must remain readable longer. What happens if the supplier changes the model during production while the site’s acceptance results still describe the old version? Who can reconstruct a batch decision after hosting ends? Model ownership alone does not answer either question. 657
The final issue is the decision chain. A human reviewer with no visibility of the model's uncertainty may add a signature but little protection. A quality unit that receives a generic validation certificate but cannot reproduce the site's acceptance test may have the same problem. A responsible person cannot outsource the batch-release decision by embedding a vendor score in the electronic record. The supplier's performance and disclosure role may still leave gaps in the evidence, change authority and independent judgment the manufacturer's GMP obligations require. If a final EU GMP Annex 22 expands the proposed boundary for generative or adaptive models, would those gaps change for the individual use? 658