EU Annex 22 Readiness — a Whitepaper on AI in GMP
What EU Annex 22 will require of AI systems used in GMP-regulated processes — a working readiness framework, control-by-control gap assessment, and the assurance evidence regulators will look for.
Annex 22 readiness means being able to show, for every AI system touching a GMP process, what it is for, how well it performs against data it never saw in training, who remains accountable for the decision, how drift is detected, and what happens when the model is switched off. Most organisations have the AI in production and none of the evidence.
Know what you have
Readiness starts with an inventory, because the question an inspector opens with is how many AI systems are in use and which ones touch GMP.
- 1
AI inventory complete
Every model in use, including AI features inside purchased software that nobody classified as AI when it was bought.
- 2
GMP relevance determined per system
Which outputs feed a GMP decision or record, decided and documented rather than assumed.
- 3
Ownership assigned
A named accountable owner per system, not a department.
Intended use and accountability
- 4
Intended use written and bounded
What the model does, on what inputs, for which decision — narrow enough to be tested against.
- 5
Out-of-scope uses stated
What it must not be used for, so scope creep after go-live is visible.
- 6
Human accountability point identified
Who signs, what they see before signing, and whether they can realistically review it.
- 7
No autonomous GMP-critical decisions
Verified in the configuration, not asserted in a policy.
Evidence of performance
- 8
Held-out test set exists
Representative, frozen, version-controlled, and never used in training or tuning.
- 9
Acceptance thresholds set in advance
Tied to the consequence of error, agreed before results were seen.
- 10
Current performance recorded
The most recent evaluation, dated, against the current production model version.
- 11
Known limitations documented
Where the model performs worse, assessed deliberately rather than discovered in production.
Keeping it fit
- 12
Model version pinned and recorded
You know exactly which version is live, and a vendor cannot change it silently.
- 13
Drift monitoring active
Input and output monitoring with someone reviewing it who can suspend the system.
- 14
Re-evaluation scheduled
A defined interval at which the model is re-run against the test set regardless of whether anything looked wrong.
- 15
Model changes in change control
Retraining, fine-tuning and vendor upgrades handled as changes to a validated system.
- 16
Fallback documented and tested
The process runs with the AI disabled, and the people who would run it that way know how.
Annex 22 complements Annex 11; it does not replace it. Electronic record and signature obligations still apply in full to AI-assisted records.
If you can only do one thing this quarter, build the inventory. Every other item on this list depends on knowing what is actually running.
This is a working aid, not a regulatory document, and it does not replace your own quality system procedures.
Explore related resources, products and services: GxP Copilot, TraceDraft, validation services, AI transformation.
Sources
Primary documents referred to on this page, from their official publishers.
- EU GMP Annex 11: Computerised Systems (current version) · European Commission
- Consultation on EU GMP Chapter 4, Annex 11 and draft Annex 22 (Artificial Intelligence) · European Commission
Common questions
Prefer to talk first? Chat with us on WhatsApp or book a call with an expert.
What is Annex 22 readiness?
The ability to show, for every AI system touching a GMP process, its defined intended use, its performance against data independent of training, who remains accountable for the resulting decision, how drift is detected in production, how model changes are controlled, and what the process does when the AI is switched off.
Where should we start with Annex 22?
With an inventory. Most organisations cannot currently say how many AI systems are in use or which touch GMP records, partly because AI features arrive embedded inside purchased software. Every other readiness activity depends on knowing what is actually running and who owns it.
Does Annex 22 apply to AI features inside software we bought?
Yes, if the output contributes to a GMP decision or record. The obligation follows the use, not the procurement route. This is why inventories matter: AI capability frequently arrives as a feature update to an already-validated system rather than as a recognisable AI project.
What evidence will an inspector ask for?
Expect questions on intended use, what the model was evaluated against and when, who reviews its output and what they see, how you would know if performance degraded, how a model change is controlled, and what happens to the process if the system is unavailable. Each should have a document behind it.
Put this to work on your system.
Bring a URS. We show you risk-sized testing on your own requirements.
- We reply within one business day
- We run your URS live on the call
- You get a clear plan for your system