Computerised systems and AI in GMP are being rewritten.
The EU rules for computerised systems in medicines manufacturing date from 2011. A much longer Annex 11 and a new Annex 22 on artificial intelligence were consulted on in 2025. Both are still drafts, but the direction is clear.
A technical view, not legal advice. Facts checked against the official sources below on 1 November 2026.
- Manufacturers of medicinal products in the EU
- Computerised systems used in GMP activities, including cloud services
- AI models used in GMP, under the draft Annex 22
- Jan 2011 Current Annex 11 and Chapter 4 in force.
- Jul–Oct 2025 Public consultation on revised Annex 11, Chapter 4 and new Annex 22.
- Oct 2026 EMA workshop report: support for allowing generative AI with documented controls. Nothing decided.
- Not set No adoption or effective date yet.
What the drafts would change.
A far fuller Annex 11
From a short annex to 17 sections, covering cloud services, identity and access management, and supplier agreements.
Audit trails and integrity
Documented, independent audit-trail review, before batch release where relevant, and explicit data-integrity principles.
Security
Multi-factor authentication for remote access, penetration testing for internet-facing critical systems, and disaster recovery.
AI in critical uses
The draft Annex 22 allows only static, deterministic models in critical GMP uses, with acceptance criteria, independent test data and explainability.
Generative AI
The draft excludes generative AI and large language models from critical uses. Consultation feedback pushed back, and the scope is under review.
From requirement to working system.
Systems commissioned now will live under the new rules. Designing to the drafts costs little today and saves a revalidation later.
- Assess current and planned systems against the draft requirements
- AI validation with acceptance criteria and independent test data
- Audit trails, access control and supplier agreements built in
- A clear line between critical and non-critical AI uses
What does this mean for your systems?
Tell us what you build or run. We will give you a straight, technical answer.
Book a consultation