Annex 22 and generative AI

Annex 22 and Generative AI: What Will Change for Pharma Manufacturing in the Coming Months

On June 30 and July 1, the EMA convened a group of experts online for two days to provide their views on the draft Annex 22. This is the guideline that will govern the use of artificial intelligence in European pharmaceutical manufacturing. The first day was open, with presentations from experts appointed by industry, academia, the European regulatory network, and international authorities. The second day was closed and dedicated to the EMA drafting group, which reviewed the contributions.

On paper, this may look like a procedure for industry insiders. In reality, something significant was being decided: under what conditions generative models will be allowed into critical GMP applications in pharma manufacturing over the coming years. And for those working in the industry, the answer to that question matters a great deal.

The regulatory framework being shaped in these weeks will govern the use of AI in the pharmaceutical industry for the next decade. Those who understand where the debate stands now will have an advantage. Those who wait for the final text will find themselves playing catch-up.

What the Current Draft Says

The July 2025 draft introduces a distinction that many commentators overlook, but which lies at the heart of the entire framework. It does not treat AI as a single category. It divides models into two categories and treats them very differently.

There are static, deterministic models. Given the same input, they always produce the same output, and their behaviour does not change after release. These are traditional machine-learning models, trained on defined datasets and frozen at a specific version. They can be qualified using today’s GAMP 5 frameworks, with some adaptations. Under the draft, they may also be used in critical GMP applications, provided that they meet requirements for validation, lifecycle management, explainability, and human oversight.

Then there are dynamic, adaptive, and probabilistic models. This category includes GenAI and Large Language Models. Here, the draft is unequivocal: they are excluded from critical GMP applications. The rationale is compelling. A system that produces a different response from one query to the next, or behaves differently after a model update, is not reproducible. And without reproducibility, GMP does not work.

That is the regulatory picture today. But it is a moving picture, because the framework is shifting.

Why the Workshop Matters

The 2025 public consultation produced an outcome that surprised even the EMA. Pharmaceutical companies, industry associations, and technology providers all said more or less the same thing: a blanket ban on GenAI in critical applications is too restrictive. A risk-based approach, with technical and procedural control measures, would be preferable. Guardrails, to use the term that has become central to the debate.

The EMA listened and reopened the issue. That was precisely the purpose of the workshop held at the end of June: to determine whether sufficiently robust guardrails exist to allow GenAI in certain regulated applications, and under what conditions.

The questions raised by the EMA are very concrete. How effective are the guardrails available today at actually preventing, detecting, or containing hallucinations, incorrect recommendations, or fabricated data when a probabilistic model is operating within a GMP workflow? If a guardrail fails, or indicates uncertainty, what mechanisms are triggered to ensure timely escalation? And how much human oversight remains necessary, given that the underlying model continues to evolve?

These are technical questions with enormous industrial consequences. The answers emerging from the workshop, and subsequently from the work of the drafting group, will determine what pharmaceutical companies will actually be able to do with GenAI over the next five to ten years.

The Timeline and What It Means

Across the regulatory community, expectations regarding the timeline are fairly consistent. Final publication of Annex 22 is expected by the end of 2026. Transition and effective implementation are expected between 2027 and 2028. In practical terms, European pharmaceutical companies have between twelve and twenty-four months before they find themselves operating under a new regime that will be subject to regulatory inspection.

That is not a great deal of time. Not so little as to require rushed decisions, but enough to make a wait-and-see strategy a poor choice. If the final text is issued by the end of 2026, companies that have not yet developed internal expertise, governance tools, and qualification procedures will have to do so in a hurry. And building these capabilities takes months, not weeks. Companies that start now have real room to prepare.

What Companies Taking Action Are Doing

Based on what can be gathered from across the industry, the most active companies are moving in three different directions.

The first is to operate outside the critical GMP scope. GenAI, yes, but outside the critical GMP perimeter. It is being used in regulatory activities, quality documentation, training, and supplier management: areas where compliance risk is lower. Drafting documentation, summarising regulations, and supporting SOP drafting are examples. In all these cases, the final say remains with a qualified person, and AI accelerates the work without replacing the decision. For a mid-sized company, this is probably the most sensible choice: it allows the organisation to build internal experience without exposing itself to undue risk.

The second is the static-model approach. This means making a serious investment in deterministic, qualifiable models while accepting the constraints of the draft. Traditional machine learning, closed datasets, frozen versions, and continuous monitoring. Less impressive than GenAI, perhaps, but this is the category that the framework explicitly allows. And it has an advantage: once qualified, a static model can remain in production for years.

The third is the most demanding. It involves pilot projects using GenAI in critical applications, but in direct dialogue with the authorities and on an experimental basis. This requires a strong regulatory function, significant resources, and a tolerance for reputational risk that not every company has. Those that pursue this path, however, position themselves as a reference point for the regulation to come, and in the long term that can deliver significant returns.

Looking at these three approaches, the combination of the first two appears to offer the best risk-return balance for most companies: building internal capabilities through low-risk applications outside the critical GMP scope, while simultaneously investing in static, qualifiable models for critical applications. When the final text arrives, these companies will already have the necessary infrastructure and know-how in place.

A Final Reflection

There is something fascinating about what is happening. A technology that originated outside pharma is spreading throughout the rest of the economy at remarkable speed. And pharma, a conservative industry for good reasons, has to find a way to integrate it without undermining the foundations that have enabled it to manufacture safe and effective medicines for decades.

It is not a comfortable position. On the one hand, competitive pressure is real: companies that do not use AI in manufacturing will face higher costs and slower response times. On the other hand, regulatory and safety pressures carry just as much weight. With Annex 22, the EMA is trying to strike a balance between the two, and it will get things wrong on both sides. Too restrictive in some cases, too open in others. That is always the case with the first regulations governing something new.

But the message this debate sends to those working in the industry is fairly clear. The question is no longer whether AI will work in pharma manufacturing. For static models, the regulatory answer is already a conditional yes. The real question is how it will work in your applications, at which points in the process, and under what constraints. And the sooner you start building the expertise needed to manage it, the better, before those skills become a scarce and highly sought-after resource in the labour market.

Companies that reach the end of 2026 with structured AI governance, static models already qualified and in production, and some documented experience with GenAI outside the critical GMP scope will be ahead for the following five years. The others will be scrambling to catch up, with qualified personnel already committed elsewhere.

It is not a dramatic conclusion. But in a regulated industry, dramatic effect is rarely what predicts success.

Share the Innovation Insights