Annex 22 is still a draft. Prepare as if it were coming anyway.

Be clear about its status

Annex 22 was published for consultation in 2025. It is not binding. The text has been discussed at length since, including at an EMA workshop whose report suggests the scope may move towards a more technology-neutral approach, with room for generative AI under appropriate controls. Nobody outside the drafting group knows exactly what the final text will say or when it will apply.

That matters, because describing a draft as a requirement causes real harm. Procedures get written around wording that may not survive. Vendors start selling "Annex 22 compliance", which cannot exist yet. And inspectors, who know the status perfectly well, will be unimpressed by a quality system that cites a draft as law.

What will not change

Here is the useful part. Whatever the final wording, some things are very unlikely to change, because they already exist in rules that are in force today.

You will need to know what AI you use. An inventory of AI in GxP processes is the starting point for every regulatory approach published so far, and Annex 11 already expects you to know your computerised systems.

You will need a clear intended use for each AI system. What it does, what it produces, and how the output is used. Without this, nothing can be tested.

You will need evidence the AI works for that use, scaled to the risk. Every framework, from FDA's draft credibility guidance to the Annex 22 discussions, points the same way.

You will need human oversight where it matters, designed and recorded, not assumed.

You will need to control change. Models are updated, data drifts, and uses widen. A change to an AI system is a change to a computerised system.

And you will need to manage your AI suppliers. Annex 11's supplier expectations already apply to AI vendors. You do not need Annex 22 for that obligation to exist.

A sensible plan for the next twelve months

Build the inventory. Most companies find more AI in use than they expected, including features switched on inside software they already own.

For each item, write the intended use and decide the risk, using the factors regulators have been discussing: how much the AI influences the decision, how bad a wrong decision would be, and how easily an error would be detected.

For the higher-risk uses, put the basics in place now: defined acceptance criteria, a test set from real data, recorded human review, and monitoring. These are good practice under existing rules regardless of what Annex 22 becomes.

Then write your procedures to reference principles, not draft clause numbers. When the final text arrives, you will be mapping it to controls you already run, rather than starting from nothing.

The cost of waiting

Teams that wait for the final text tend to discover two things when it arrives. Their AI inventory is far larger than they thought, and the evidence for the AI already in use was never collected. Both take months to fix, and the second cannot be fixed retrospectively for decisions already made.

The draft is a draft. Treat it honestly as one. But the direction it points in is clear enough to act on, and the work it implies is work your existing rules already ask for.

For the practical detail, see the control strategy Annex 22 is likely to ask for.