Note: Annex 22 is available as a draft (as of 5 October 2026). This content is not legal, regulatory or compliance advice.
Short answer
Annex 11 applies to every computerised system in a GMP environment, including one that contains an AI model. In its draft form, Annex 22 adds requirements that apply only to the AI model itself: intended use, test data, performance monitoring and human oversight. Annex 22 does not replace Annex 11. And unlike the Annex 11 currently in force, Annex 22 is still a draft.
Where the two texts come from
On 7 July 2025, three drafts were opened for consultation together: a revised Chapter 4 (Documentation), a revised Annex 11 (Computerised Systems) and the new Annex 22 (Artificial Intelligence). They were prepared by the EMA GMP/GDP Inspectors Working Group together with PIC/S. The consultation ran until 7 October 2025.
That the three texts were published together is no coincidence. They interlock: Chapter 4 sets out how things are documented. Annex 11 sets out how computerised systems are validated and operated. Annex 22 sets out what applies in addition when an AI model works inside such a system.
Annex 11 vs Annex 22 at a glance
| Point | Annex 11 (Computerised Systems) | Annex 22 (Artificial Intelligence) |
|---|---|---|
| Subject | Computerised systems in general | AI models in GMP applications |
| Covers | Any software and hardware that creates, processes or stores GMP data | Models whose outputs feed into GMP processes |
| Typical requirements | Validation, access control, data integrity, audit trail, backup, change control | Intended use, separation of training and test data, performance monitoring, human oversight |
| Stance on generative AI | No specific rule | Draft: excluded from critical applications, EMA is examining a risk-based approach |
| Status (5 October 2026) | Current version in force, revised version as draft | Draft, not in force |
Annex 11 is getting much longer
If you focus only on Annex 22, it is easy to miss that Annex 11 is changing substantially too. The revised draft grows from 5 to 19 pages. For AI applications, this means the requirements for the surrounding system become more detailed, regardless of what ends up in the final Annex 22. An AI model never runs on its own, but always inside software with users, data, interfaces and changes. All of that falls under Annex 11.
Why Annex 22 does not replace Annex 11
Annex 22 complements Annex 11 and Chapter 4, it does not replace them. In practice, this means a two-level check:
- System level (Annex 11): Is the software validated? Is access controlled? Is there an audit trail? Is data backed up and are changes controlled?
- Model level (Annex 22): Is the intended use defined? Was the model tested with separate test data? Is its performance monitored in operation? Who checks the results?
A model that performs well at model level but runs in software without an audit trail meets the framework just as little as properly validated software with an untested model.
And GAMP 5?
GAMP 5 is not a legal text but an ISPE guide for validating computerised systems. The second edition includes Appendix D11, an appendix on AI and machine learning. For many validation teams, GAMP 5 is the practical bridge between the requirements of Annex 11 and Annex 22 and their own validation documentation.
What this means for a lab
For labs, this leads to a simple order:
- System first: every AI application that touches GMP data is a computerised system first. Check whether it is integrated into your existing Annex 11 processes, especially change control and access management.
- Then the model: record the intended use for each model, clarify whether it is static and returns reproducible results, and decide who checks the results.
- Then the documentation: Chapter 4 applies to AI too. The model version and inputs behind a result should be documented if the result feeds into a GMP decision.
The article Generative AI in GMP: Where the EMA Stands covers what role generative AI and LLMs may play. The pillar page AI in the GxP Lab and EU GMP Annex 22 gives the full overview.
Frequently asked questions
Does Annex 11 apply to AI systems?
Yes. An AI system that creates or processes GMP data is a computerised system and falls under Annex 11. In its draft form, Annex 22 adds an extra level for the model.
Is the revised Annex 11 already in force?
No. Like Annex 22, the revised Annex 11 was opened for consultation as a draft in July 2025. Until it is adopted, the current version applies.
Do I have to wait for the final Annex 22?
No. The system level under Annex 11 applies today. If you list your AI applications now and integrate them into your existing processes, you will have done most of the work by the time Annex 22 is final.
Next step
Check how far your lab has got on system, model and responsibility with the Annex 22 Readiness Check: 14 questions, answered yes, partly or no.
Sources
- PIC/S and European Commission, consultation on Chapter 4, Annex 11 and Annex 22: health.ec.europa.eu
- IntuitionLabs, EU GMP Annex 22 and AI compliance: intuitionlabs.ai
- PharmaNow, Annex 22 is not law yet: pharmanow.live
- ECA Academy, drafts of Annex 11, Annex 22 and Chapter 4 (scope of Annex 11): gmp-compliance.org
- ISPE, GAMP 5 Second Edition: ispe.org
Annex 22 is available as a draft (as of 5 October 2026). This content is not legal, regulatory or compliance advice.