On October 2, 2026, the European Medicines Agency published the workshop report (EMA/156789/2026) in which industry set out its proposal for Annex 22 to the EU GMP Guide. Industry is asking for a technology-neutral annex that allows generative AI and dynamic and probabilistic models under a risk-based control strategy. It is input to the drafting group, not new text: the published draft is unchanged.
What does the draft Annex 22 say today?
The consultation draft is clear about its scope:
- Dynamic models, which keep learning during use, should not be used in critical GMP applications.
- Neither should models with a probabilistic output.
- The document does not apply to generative AI or large language models (LLMs), which should not be used in critical applications. In non-critical applications, personnel with adequate qualification and training should always be responsible for ensuring that their outputs are suitable for the intended use (human-in-the-loop).
As of October 12, 2026, Annex 22 is not listed in EudraLex Volume 4: the last annex it lists is Annex 21. Our Annex 22 guide summarizes the draft section by section.
Why did the EMA hold the workshop?
According to the report, comments from the public consultation showed support for letting manufacturers use LLMs and generative AI in GMP applications, critical or not. The drafting group then discussed extending the scope to dynamic, probabilistic and generative models, provided they comply with the annex and are supported by a fully documented, robust, risk-based control strategy. The report adds that concerns remain about the elements such a strategy needs.
The workshop took place on June 30, 2026. Industry associations registered with the EMA presented a consolidated response; the next day, the drafting group reviewed the contributions in a closed session.
What did industry propose?
These are the ideas the report records:
- Technology neutrality. A technology label should not decide whether a use is acceptable; intended use, impact, uncertainty, complexity and control strategy should.
- Detectability as a risk factor. It matters most where model failures are hard to spot.
- "Do not use" is a valid outcome of the risk assessment when uncertainty cannot be controlled.
- Accountability is not delegated to AI. It stays with the responsible people.
- Human oversight is one possible control, not a requirement for every use, and it cannot make up for inadequate validation. Regulators raised automation bias; the evidence mentioned includes recording AI outputs and human modifications.
- Layered controls: at the input, inside the model and at the output. Examples cited include retrieval-augmented generation with source citation, uncertainty quantification, confidence thresholds and fallback to a validated state.
- Validation is a lifecycle, not a one-time event, and test data should stay independent from development and training data.
- Suppliers and the cloud. A third-party model must provide enough evidence and transparency, and the regulated user remains accountable even when using third-party AI or cloud services. Annex 11 Chapter 7 was considered applicable at a principle level.
Does anything change for a project today?
Not in what is required. The report sets no dates, no new draft and no new consultation: it only says the drafting group will review the contributions for the ongoing revision of Annex 22. Its conclusions are cautious: they speak of possible viable pathways for adaptive, probabilistic and generative AI in GMP applications.
For a model entering a critical GMP process today, the reference is still the draft: a static model, deterministic output, an approved intended use, independent test data and acceptance criteria set before testing. What the report does make clear is where attention is heading: intended use, risk and the effectiveness of controls. Designing and documenting with that logic from the start is what avoids redoing the validation when the final text arrives.
At ComplAI we build AI software for GxP processes and deliver its validation documentation, including the model's. If you are assessing a use case, the checklist in our guide is a good place to start.