AI and digital quality13 October 20263 min readBy QLogixCMC

AI in the GMP quality system: what Annex 22 and your next inspector will ask

EU GMP Annex 22, published for consultation in 2025, is the first GMP text written for artificial intelligence. It allows AI in GMP work on conditions: a defined intended use, test data and acceptance criteria that show the model performs for that use, a person who reviews the output where the application is critical, and the model and its configuration under change control. Inspectors already ask the same questions of any site that has switched on an AI feature in its quality system.

What the draft annex says

It applies to AI and machine learning models used in GMP activities, alongside the computerised systems requirements of Annex 11, whose own revision was published for consultation at the same time
Critical applications, where the output affects product quality, patient safety or data integrity, are reserved for static, deterministic models with a defined intended use, tested against data independent of the training data and against acceptance criteria set in advance
Dynamic models that keep learning in use, and generative models, are kept out of critical applications and used where a qualified person reviews the output
Performance is monitored in operation, and the model, its configuration and the data it sees are under change control and documented
The text is a consultation draft and may change before it is adopted; its direction has not been contested

The questions an inspector asks today

Which GMP decisions does the AI touch, and where is its intended use written down
How was it tested for that use, with what records and what acceptance criteria
Who reviews the output, and how does the record show that a person did
Is the AI's contribution labelled in the record, so a reviewer can tell draft from decision
What happens when the model or the prompts are updated, and who approves that
What happens when it is wrong: how is a wrong output caught, recorded and fed back

Interactive

Where the hours go in an investigation, with and without AI drafting

AI drafts the gathering and drafting steps

6.3hours per investigation

Down from 17 hours; the 5 hours of human review and approval are unchanged.

Gathering and drafting
Human decision steps
Hours before AI drafting

Defined intended use
Validated against test records
Output labelled as AI draft
Named reviewer on every draft
Model and prompts under change control
Audit trail of draft and decision

Illustrative hours for one deviation. AI can take the gathering and drafting from hours to minutes; the review, the conclusion and the approval stay with people and take the same time, because that is where the GxP decision is made. The controls listed under the chart are what an inspector asks to see for any AI function in the quality system.

Decision support, not decision making

The design pattern that satisfies both the draft annex and an inspector is the same: the AI gathers, drafts, trends and flags; a named, qualified person reviews, concludes and signs; the audit trail records both. Investigations are the natural first use, because the gathering and drafting take hours and the decision takes judgement, and because every draft gets a reviewer by procedure anyway.

How QLogixCMC helps

QLogixCMC runs the AI readiness assessment, selects the first use cases by value and risk, writes the intended use and the governance, validates the function against records with known answers, and designs the workflow so that every AI output is a draft until a person signs. The work applies to whatever quality system a site runs.

Questions this post answers

Can generative AI be used in GMP at all?

Yes, in decision-support and non-critical roles with a qualified person reviewing the output, which is the direction of the draft Annex 22. Critical applications call for static, tested models. Treat generative output as a draft that a person checks, labels and signs.

Does an AI feature in our eQMS need to be validated?

Yes, for the site's intended use. The vendor's testing covers the product; the site documents what the feature is used for, assesses the risk of a wrong output, tests it on its own records and keeps the configuration under change control, as it does for any other GMP function.