EU GMP Annex 22 (Artificial Intelligence): A New Regulatory Framework for AI Applications in Pharmaceutical Manufacturing

In the pharmaceutical manufacturing industry, the adoption of artificial intelligence (AI) and machine learning (ML) technologies is rapidly advancing. AI holds tremendous potential to contribute to efficiency improvements and quality enhancement in pharmaceutical manufacturing through automated quality control, manufacturing process optimization, predictive maintenance, and more. However, in pharmaceutical manufacturing where patient safety and product quality are paramount, the introduction of these innovative technologies requires careful consideration and an appropriate regulatory framework.

Against this backdrop, the European Commission published a draft of Annex 22 “Use of Artificial Intelligence” as a new addition to the EU GMP Guidelines on July 7, 2025. This draft was prepared by the GMP Inspectors Working Group in cooperation with the European Medicines Agency (EMA) and PIC/S. This represents the first comprehensive regulatory document specifically addressing AI use in GMP-regulated environments and marks a groundbreaking step forward for the pharmaceutical industry.

Overview and Positioning of Annex 22

Positioning as a Regulatory Document

Annex 22 is a newly added appendix to the EU GMP Guidelines (EudraLex Volume 4). It is designed to complement the existing Annex 11 “Computerised Systems” and provides detailed guidance specifically for AI/ML models used in GMP environments.

This appendix is currently in draft stage, with public consultation conducted until October 7, 2025. The final version will be developed based on feedback from industry stakeholders, though the formal effective date remains undetermined at this time. Following the conclusion of the public consultation, it is expected to become officially effective after the evaluation of collected comments and the finalization process.

Clarification of Scope

The scope of Annex 22 is clearly defined. The following conditions identify AI systems subject to this regulation:

Static and deterministic AI/ML models – Pre-trained models that do not continuously learn or adapt during use

Applications with direct GMP impact – Critical applications that affect patient safety, product quality, and data integrity

Models used within computerized systems – Models integrated into existing computerized systems rather than standalone systems

On the other hand, AI systems that continue to learn dynamically and applications with indirect GMP impact are currently outside the scope. This demonstrates that regulatory authorities are adopting a phased and cautious approach.

Background and Need for Introduction

Current State of AI Utilization in Pharmaceutical Manufacturing

Modern pharmaceutical manufacturing facilities are beginning to utilize AI technology in various forms. For example, in predictive maintenance of manufacturing equipment, sensor data analysis enables prediction of failures in advance, reducing unplanned downtime. In the quality control field, concrete results have been reported, such as tablet appearance inspection using image recognition technology and yield improvement through optimization of manufacturing parameters.

However, challenges exist in introducing these technologies. The “black box” nature of AI models – that is, the opacity of their decision-making processes – has become a major concern from the perspectives of regulatory authority audits and quality assurance. Additionally, issues such as training data quality and bias, and model drift (performance degradation over time) are challenges that cannot be overlooked in the highly regulated environment of pharmaceutical manufacturing.

Need for Regulation

The necessity of regulatory guidance for AI use in pharmaceutical manufacturing is clear from the following perspectives:

Ensuring Patient Safety: When AI judgments or classifications directly affect product quality, mechanisms to guarantee their reliability and consistency are essential. Incorrect judgments can have serious impacts on patient health.

Maintaining Data Integrity: Data generated, processed, or influenced by AI systems must meet the same level of completeness, accuracy, and traceability as traditional GMP records.

Clarifying Accountability: Even when utilizing AI vendors or cloud service providers, ultimate responsibility lies with the pharmaceutical manufacturer. It is necessary to clarify where responsibility lies and establish appropriate management systems.

Promoting Innovation: With a clear regulatory framework, companies can invest in and implement AI technology with confidence. Regulatory uncertainty becomes a barrier to innovation.

Key Requirements

1. Governance and Responsibility Structure

Annex 22 requires a clear governance structure for the management of AI systems. This includes the following elements:

Multidisciplinary Collaboration: Quality assurance departments, IT departments, data scientists, and subject matter experts (SMEs) are required to collaborate in the design, training, testing, and deployment of AI models. It is necessary to clearly define the roles and responsibilities of each stakeholder and ensure appropriate qualifications and training.

Management Involvement: The introduction of AI systems requires not only technical decisions but also business and regulatory perspectives. Establishment of appropriate oversight and approval processes by management is required.

2. Lifecycle Management

Management throughout the entire lifecycle of AI models is required.

Development Phase

• Clear definition and documentation of intended use
• Detailed description of training data characteristics and variability
• Establishment of data governance processes

Validation Phase

• Setting clear performance criteria and acceptance criteria
• Complete separation of training data and test data
• Demonstration of reliability equal to or greater than conventional processes

Operational Phase

• Continuous performance monitoring
• Drift detection of input data
• Regular revalidation

Decommissioning Phase

• Appropriate retention or disposal of data and models
• Maintenance of audit trails

3. Transparency and Explainability

Annex 22 emphasizes the transparency and explainability of AI systems.

Model Interpretability: AI models used must be understandable and explicable in their decision-making processes. The use of complete black box models is not recommended.

Documentation Requirements: All important aspects must be documented in detail, including model architecture, training process, datasets used, and performance metrics.

Auditability: All decisions and processes must be traceable to respond to audits by regulatory authorities.

4. Data Management

Data management in AI systems is particularly emphasized.

Data Quality: It is necessary to ensure the quality, completeness, and representativeness of data used as training data. Construction of unbiased datasets and collection of data that appropriately reflects actual variations in the manufacturing environment are required.

Data Security: When handling highly confidential manufacturing data or quality data, appropriate security measures are necessary. Comprehensive measures for data protection must be implemented, including access control, encryption, and maintenance of audit trails.

Data Separation: Training, validation, and test datasets must be clearly separated to prevent cross-contamination. In particular, it is necessary to ensure that data used for model validation has not been used in the training process at all.

Data Governance: It is necessary to establish management processes throughout the entire data lifecycle and perform appropriate management and documentation at all stages from data collection to disposal. This includes recording data provenance, processing history, and quality checks.

Application of ALCOA+ Principles: Data generated or processed by AI systems must meet the principles of Attributable, Legible, Contemporaneous, Original, and Accurate, as well as the additional principles of Complete, Consistent, Enduring, and Available, just like traditional GMP data.

Practical Considerations in Implementation

Risk-Based Approach

Annex 22 recommends adoption of a risk-based approach. Before introducing AI systems, it is necessary to conduct risk assessments from the following perspectives:

• Potential impact on patient safety
• Degree of impact on product quality
• Scope of impact in the event of system failure
• Availability of alternative means

Depending on the risk level, it is possible to adjust the depth of validation, frequency of monitoring, and level of detail in documentation.

Vendor Management

Recognizing the reality that many companies procure AI solutions from external vendors, Annex 22 includes requirements for vendor management.

Contractual Arrangements: In quality agreements, it is necessary to clearly define validation responsibilities, change management, and audit rights.

Technical Assessment: It is necessary to conduct technical assessments to determine whether the vendor’s AI solution meets the requirements of Annex 22.

Continuous Monitoring: It is necessary to continuously evaluate the impact of vendor system updates or changes on internal GMP compliance.

Response to Existing Systems

For companies that have already implemented AI systems, a phased approach to Annex 22 compliance is practical.

Current State Assessment: Compare existing AI systems against Annex 22 requirements and identify gaps

Prioritization: Determine response priorities based on degree of GMP impact

Improvement Plan: Develop and execute improvement plans for identified gaps

Enhancement of Documentation: Review existing documents and update them to align with Annex 22 requirements

Industry Impact and Future Outlook

Short-term Impact

With the introduction of Annex 22, pharmaceutical manufacturing companies will be compelled to take the following actions:

Need for Investment: Additional investment will be necessary for compliance. This includes personnel training, system upgrades, and enhancement of documentation.

Adjustment of Implementation Speed: Some companies may need to review AI implementation plans to meet regulatory requirements.

Changes in Competitive Advantage: Companies that complete their response early can enjoy the benefits of efficiency through AI utilization and gain competitive advantages.

Long-term Outlook

In the long term, Annex 22 is expected to promote standardization and maturation of AI utilization in pharmaceutical manufacturing.

Global Harmonization: The EU regulatory framework is highly likely to become the basis for guideline development by the FDA, PIC/S, and other regulatory authorities. In fact, PIC/S is also considering similar guidelines.

Direction of Technological Innovation: With clear regulatory requirements, vendors can focus on developing AI solutions that are more compliant with regulations. In particular, technological development emphasizing explainability and transparency is expected to advance.

Evolution of Quality Culture: Through the management of AI systems, data-driven quality management culture will be further strengthened.

Relationship with Other Regulatory Trends

Annex 22 does not exist in isolation but is closely related to other regulatory trends.

Revision of Annex 11: Annex 11 on computerized systems has also been revised simultaneously, with strengthened requirements for cloud computing and digital service providers.

Revision of Chapter 4: Chapter 4 on documentation has also been revised, emphasizing the importance of data governance and metadata management.

Data Integrity Regulations: Data handled by AI systems must also meet existing data integrity requirements (such as ALCOA+ principles).

Best Practices for Preparation

Organizational Structure Development

For effective response, the following organizational structure development is recommended:

Establishment of AI Governance Committee: Establish a committee composed of representatives from quality, IT, manufacturing, regulatory, and other departments to oversee the development and execution of AI strategy.

Securing Specialized Personnel: It is necessary to recruit or develop personnel with specialized knowledge, such as data scientists and AI engineers.

Implementation of Training Programs: Provide training to all employees on basic AI concepts and their use in GMP environments.

Technical Preparation

Implementation of Pilot Projects: Implement pilot projects in low-risk areas to accumulate experience and know-how.

Development of Validation Methodology: Develop and standardize validation methodologies specific to AI systems.

Introduction of Monitoring Tools: Introduce tools and processes for continuous monitoring of AI model performance.

Documentation Strategy

Template Development: Develop templates for validation documents, risk assessment documents, SOPs, and other materials for AI systems.

Knowledge Management System: Construct a system for centralized management of technical information, training records, change history, and other information related to AI models.

Implementation Challenges and Countermeasures

Technical Challenges

Ensuring Explainability: Some high-performance AI models, such as deep learning models, are inherently highly black-box in nature. The following approaches can be considered for this challenge:

• Adoption of Explainable AI (XAI) technologies
• Selection of simpler, more interpretable models
• Hybrid approaches (human final confirmation of AI outputs)

Detection of Data Drift: The characteristics of input data for AI models may change due to changes in the manufacturing environment. Regular data quality checks and statistical monitoring are necessary.

Organizational Challenges

Inter-departmental Cooperation: AI implementation requires cooperation from multiple departments, but differences in language and priorities between departments can become barriers. Establishment of common language and clear role allocation are important.

Resistance to Change: Resistance from employees accustomed to traditional methods is expected. Phased implementation and sharing of success stories are important for gaining understanding and cooperation across the organization.

Regulatory Challenges

Interpretation of Regulations: Annex 22 is still in draft stage, and ambiguity may remain in the interpretation of some requirements. Continuous dialogue with industry organizations and regulatory authorities is necessary.

International Consistency: For global companies, responding to differences in regulatory requirements across countries becomes a challenge. Consideration of a unified approach aligned with the most stringent requirements is recommended.

Conclusion

The introduction of EU GMP Annex 22 heralds the dawn of a new era in AI utilization in pharmaceutical manufacturing. This regulatory framework does not hinder innovation but rather promotes responsible AI utilization and provides a pathway for advancing technological innovation while ensuring patient safety and product quality.

For pharmaceutical manufacturing companies, responding to Annex 22 is not merely a matter of regulatory compliance. It is also an opportunity to realize more efficient and higher-quality manufacturing processes as part of digital transformation. Early preparation and a phased, strategic approach to response are keys to success.

There is still time before the final version of the regulation becomes effective. It is important to effectively utilize this period to advance organizational structure development, technical preparation, and personnel training. Additionally, by participating in the public consultation, it is possible to contribute to regulatory formation from a practical perspective.

AI technology will continue to evolve rapidly in the future. Annex 22 is only the first step in balancing this technological innovation with regulatory requirements. Through continuous learning and adaptation, the pharmaceutical manufacturing industry should be able to maximize the benefits of AI while maintaining the highest standards of quality and safety.

Reference Information

Key Dates

Date	Event
July 7, 2025	European Commission published Annex 22 draft
October 7, 2025	End of public consultation
To be determined	Formal effective date (to be decided after evaluation of comments and finalization following the end of public consultation)

Related Regulatory Documents

• EU GMP Annex 11 “Computerised Systems” (Revised version)
• EU GMP Chapter 4 “Documentation” (Revised version)
• PIC/S Annex 22 (Under development)
• FDA Draft Guidance on AI/ML in Medical Devices

Note on Translation: This document has been translated from Japanese while maintaining the original content, arguments, opinions, and perspectives. Factual information has been verified against the latest regulatory developments and international standards. The content has been prepared to be accessible to beginners while maintaining professional rigor, with appropriate use of tables for readability and comprehension where suitable.