GxP AI

What Is GxP AI?

GxP AI is artificial intelligence applied within Good Practice regulated environments — pharmaceutical manufacturing (GMP), clinical trials (GCP), laboratory operations (GLP), and distribution (GDP). Unlike general-purpose AI, GxP AI must satisfy regulatory requirements for validation, explainability, audit trails, human oversight, and continuous monitoring.

The regulatory landscape is still forming. EU GMP Annex 22 is the most specific text written for AI in GMP environments, but it remains a consultation draft rather than a binding requirement. The FDA, EMA, and MHRA each have their own guidance, but the direction is consistent: AI is welcome in GxP, provided the company can demonstrate the system is validated, monitored, and operating under human oversight.

The challenge for most life sciences companies is not whether to adopt AI, but how to do it compliantly. Traditional CSV validation approaches do not work for AI systems because AI models are non-deterministic, drift over time, and require continuous monitoring rather than one-and-done qualification.

Which Regulations Apply to GxP AI?

The most detailed guidance available is the ISPE GAMP Guide: Artificial Intelligence, published in July 2025 and running to roughly 290 pages. It expands on Appendix D11 of GAMP 5 Second Edition, which was the first mainstream attempt to describe an AI/ML lifecycle — concept, project and operation, with deployment and continuous monitoring treated as part of the lifecycle rather than as afterthoughts. Neither document is a regulation. Both carry weight because quality groups and inspectors treat GAMP as the industry’s working consensus on how computerised systems get validated.

In the United States the FDA finalised its Computer Software Assurance guidance on 24 September 2025, superseding Section 6 of General Principles of Software Validation. It is not an AI guidance, but it matters for AI: it establishes that testing depth should follow the risk the software carries, and it covers software used in production and quality systems — which includes AI tools used there. The shift from CSV to CSA is what makes risk-proportionate AI validation defensible rather than improvised. 21 CFR Part 11 continues to apply unchanged to any electronic record or signature an AI system touches.

In Europe the picture is less settled than most vendor material suggests. EU GMP Annex 11 is under revision and the existing 2011 text still applies. Annex 22, the first EU GMP annex written specifically for AI, was published as a consultation draft on 7 July 2025; the consultation closed that October and EMA’s work plan targets a final text in late 2026. It is not in EudraLex Volume 4 and it is not in force. Anyone telling you that you must comply with Annex 22 today is describing a draft. It is still worth designing towards, because the direction is unlikely to reverse — but its scope is the part most likely to move. As drafted it places dynamic, probabilistic and generative models, large language models included, outside its scope and outside critical GMP applications — but that is now the part most likely to move. EMA’s workshop report of early October 2026 (EMA/156789/2026) records that the drafting group has discussed allowing them provided they are supported by a fully documented, robust, risk-based control strategy, and concludes there may be viable pathways. The position participants advocated was risk-based and technology-neutral: acceptability determined by intended use, risk and the effectiveness of controls rather than by the technology itself. Nothing is final.

Two frameworks from outside GxP now sit alongside it. The EU AI Act classifies AI systems by risk and places obligations on high-risk uses whether or not the system is GMP-relevant, so a single tool can carry duties under both regimes at once. ISO/IEC 42001:2023 specifies an AI management system — governance, roles, risk handling, lifecycle control — at the organisational level rather than for one system. Neither replaces GxP validation. Both come up in audits more often each year, and an organisation that has considered them has an easier conversation than one that has not.

Where Is AI Actually Used in GxP?

It is worth separating the parts of the pipeline where AI is routine from the parts where it is still being piloted, because the two get quoted interchangeably and they are not the same.

Before GxP applies. Drug discovery — target identification, molecular property prediction, candidate screening — has used machine learning for years and most of it sits outside GxP entirely, because nothing there is releasing product or supporting a submission yet. This is where the headline results come from, and it is also why those results say little about what you can validate.

Inside GxP, in production. Documentation and quality work is where AI is genuinely deployed today, because the output is a draft a qualified person reviews: validation and qualification packages, risk assessments, test cases, SOPs, deviation and CAPA write-ups, change control impact assessments, regulatory intelligence monitoring. Alongside it sits pattern work that was always statistical — batch record anomaly detection, environmental monitoring trends, predictive maintenance on qualified equipment, supplier risk scoring. Pharmacovigilance case intake and duplicate detection belong here too; the volumes made manual triage untenable well before anyone called it AI.

Inside GxP, still cautious. Clinical trial work — site selection, patient matching, monitoring risk signals — is active but carries GCP and privacy obligations that slow deployment. Visual inspection and QC release testing is where AI touches product disposition directly, and it is the hardest case: the Annex 22 draft points away from probabilistic models in critical GMP applications, and a model deciding release is exactly that.

The pattern across all of it is consistent. AI is adopted fastest where a human remains accountable for the output, and slowest where it would replace a regulated decision. That is not a limitation to be engineered around — it is the shape compliant adoption takes. See AI in GxP for where it belongs and where it must not go.