Annex 22 Is Not Law Yet. What to Invest in Now

Introduction

Every capital planning cycle has a version of this moment. A VP of Quality proposes budget for AI model validation infrastructure. Someone in Finance asks whether the rule is even final yet. The room nods, and the line item gets pushed to next year.

That instinct is understandable. It is also expensive, because Annex 22, the EU's new GMP annex on artificial intelligence, will not wait for anyone's budget cycle to catch up once it lands.

This piece verifies exactly where Annex 22 stands as of publication day, then lays out what forward-looking sites should fund now regardless of the exact date it becomes binding.

Confirming EudraLex Status on Publication Day

As of today, Annex 22 is a consultation draft. It is not adopted, not in force, and not yet part of EudraLex Volume 4.

Checking the European Commission's own EudraLex Volume 4 page directly confirms this. The published annex table currently lists Annex 11 (Computerised Systems) at its January 2011 revision, with no Annex 22 entry anywhere in the list. Chapter 4 (Documentation) is likewise still shown at its original January 2011 version. The draft package released for consultation in mid-2025 has not replaced either document on the Commission's official site.

The consultation itself ran from 7 July 2025 to 7 October 2025 and was jointly issued by the European Medicines Agency's GMDP Inspectors Working Group and the Pharmaceutical Inspection Co-operation Scheme. It drew roughly 1,300 stakeholder comments, which the working group has spent the months since sorting through.

The distinction between a target and a confirmed date matters here. EMA's own Inspectors Working Group has set Q4 2026 as the point by which it hopes to deliver final text to the Commission. No adoption date, effective date, or enforcement date has been published beyond that.

Annex 22 doesn't exist in a vacuum — see how it fits into the full EudraLex Volume 4 structure, and what every other GMP annex actually covers.

→ Read: EU GMP EudraLex Volume 4 Explained for Pharma Manufacturers

Why "Not Law" Does Not Mean "Not Urgent"

Here is the part that gets lost in the "wait and see" conversation. While Annex 22 itself is not binding, a related and genuinely enforceable obligation already is.

Certain transparency duties under the EU AI Act take effect on 2 August 2026, and AI literacy obligations for organizations deploying AI systems are already in effect. These sit outside GMP guidance entirely. They are horizontal EU laws and apply to pharmaceutical manufacturers using AI, regardless of whether Annex 22 is ever finalized in its current draft form.

So the honest framing for leadership is this: the GMP-specific annex is still being finalized, but the general legal floor beneath it has already been poured.

What the Draft Actually Signals, Even Unfinished

Even in draft form, Annex 22 has been stable on its central distinction since July 2025. Static, deterministic models, ones whose parameters are fixed and do not adapt during use, are permitted in GMP-critical applications, subject to validation. Generative AI and large language models are excluded from critical use in the current draft and confined to non-critical functions with documented human oversight.

The companion Annex 11 revision, which travels alongside Annex 22 in the same consultation package, is not a minor edit either. It grows from 5 pages to 19, organized into 17 chapters covering areas such as audit trails, supplier oversight, and cybersecurity, with cybersecurity now a formal GMP requirement for the first time.

That scale of change is itself a signal. Regulators do not rewrite a core annex from five pages to nineteen for a rule they intend to soften before publication.

What to Fund Anyway: Seven Investments That Hold Their Value

None of these requires a final legal text. Each one is useful under the current draft, under a revised draft and even if Annex 22's scope shifts before adoption.

1. A model inventory, owned by one named person

Most sites cannot currently produce a complete list of all AI or ML systems that touch a GMP-critical process. That includes vendor-embedded models inside instruments, LIMS plug-ins, and predictive maintenance tools that nobody classified as "AI" when they were purchased.

Fund a structured inventory exercise now: system name, vendor, intended use, criticality classification, and a single accountable owner per entry. This is a few weeks of cross-functional work, not a capital project, and it is the foundation on which everything else in Annex 22 depends.

2. Static-versus-dynamic classification for every model in that inventory

The draft's entire risk logic hinges on one distinction. Static, deterministic models, ones with fixed parameters that do not change during use, are treated as eligible for critical applications, subject to validation. Dynamic, generative, or adaptive models are confined to non-critical functions with human oversight.

Classifying each system against that split now means the inventory is already usable the day a final text lands. Waiting means doing this work under a deadline instead of on your own schedule.

3. Human oversight protocols with a name attached, not a department

Regulators have made clear that "QA has oversight" is not an answer they will accept. An inspector wants to know who specifically reviews an AI output before it is fed into a regulated decision, and what authority that person has to reject it.

Fund the documentation work now: a short protocol for each critical AI touchpoint, naming the reviewer, the review trigger, and the escalation path. This is inexpensive to build and expensive to be caught without.

4. Validation and drift monitoring, not a one-time qualification

A model validated once at installation and never re-checked is a liability under any GMP-critical AI framework, draft or final. Performance drift is the central technical risk that Annex 22 is built to catch.

This is the investment that actually costs money: monitoring infrastructure, defined performance thresholds, and a re-validation trigger tied to those thresholds. Sites running any AI-assisted release testing, batch record review, or deviation triage should prioritize this over the cheaper documentation items above.

5. AI literacy training tied to obligations already in force

This is not speculative. EU AI Act literacy obligations already apply, independent of Annex 22's timeline. Fund a baseline training program now for any staff who interact with or rely on AI system outputs in a regulated context.

This is the lowest-cost, highest-certainty item on this list, since it addresses a legal obligation that exists today rather than one still in draft.

6. Change control extended to cover model updates and retraining

Most existing change control procedures were written for equipment and software, not for models that get retrained or updated by a vendor without a formal release cycle. Fund an update to change control SOPs that explicitly capture AI model version changes, retraining events, and vendor-pushed updates as change-controlled events.

7. Vendor evidence packages sufficient to survive an audit

If a critical or near-critical process depends on a third-party AI tool, the vendor's own validation and change-control documentation becomes part of your audit trail. Many vendors are not currently set up to provide this in an inspection-ready format.

Fund the contractual and documentation work now, before a renewal cycle forces the conversation under time pressure. This negotiation goes better before an inspection than during one.

Annex 22 isn't the only AI governance framework worth funding for. ISPE's 290-page GAMP AI Guide offers a parallel roadmap for GxP-compliant AI deployment.

→ Read: ISPE GAMP AI Guide for Pharma: Leadership Governance

Conclusion

Annex 22 is not law, and pretending otherwise would be its own kind of inaccuracy. But the underlying expectation that AI touching a regulated decision needs a named owner, a validated model, and a documented oversight trail will not change, even if individual clauses do.

Sites that fund infrastructure now are not betting that a specific draft will survive intact. They are betting on the direction of travel, which every available signal, from the consultation volume to the scale of the companion Annex 11 rewrite, points the same way.

FAQs

Is Annex 22 legally binding right now? 

No. It remains a consultation draft. The European Commission's own EudraLex Volume 4 page does not list it, and the existing Annex 11 and Chapter 4 remain at their pre-draft versions.

When will Annex 22 become law?

There is no confirmed date. EMA's Inspectors Working Group has set Q4 2026 as an internal target for delivering the final text to the European Commission, but that is a work-plan target, not an adoption or effective date.

Does that mean pharma companies have no AI-related legal obligations yet?

No. Separate from Annex 22, certain EU AI Act transparency duties apply from 2 August 2026, and AI literacy obligations are already in effect. Those obligations exist independent of the GMP annex timeline.

Will generative AI and LLMs be allowed in GMP-critical processes?

Not under the current draft. As written, Annex 22 confines generative AI and large language models to non-critical functions with documented human oversight, while static, deterministic models are permitted in critical applications subject to validation.

What is the single biggest mistake sites are making right now?

Treating "not adopted yet" as "not worth funding yet." The model inventory, oversight protocols, and validation processes described above take months to build properly and do not become less necessary if the final text shifts slightly from the draft.