Static, Deterministic, Explainable: Reading Draft Annex 22
Draft Annex 22 draws a clear line on AI in GMP manufacturing, static, deterministic, explainable models are in, generative AI is out for critical use.
Introduction
Pharmaceutical manufacturing has quietly become one of the biggest testing grounds for artificial intelligence. Predictive maintenance models flag failing pumps before they break. Vision systems catch defects on packaging lines. Process models predict batch outcomes before a product reaches final testing. This growth has outpaced the rules meant to govern it, leaving quality teams to decide, largely on their own, which AI tools are safe to trust with decisions that affect patient safety.
Regulators have watched this growth closely, and in July 2025, they answered it with a new rulebook: draft Annex 22 of the EU GMP guidelines. Its central idea can be summed up in three words: static, deterministic, explainable. This article breaks down what those words mean, why they matter, and what they signal for AI model choice in regulated manufacturing.
What Draft Annex 22 Actually Is
Annex 22 is a new addition to EudraLex Volume 4, the rulebook that governs Good Manufacturing Practice (GMP) across the European Union. It was jointly drafted by the European Medicines Agency's GMP/GDP Inspectors Working Group and the Pharmaceutical Inspection Co-operation Scheme (PIC/S), whose membership extends well beyond the EU. The draft was published for public consultation on 7 July 2025, alongside a revised Annex 11 on computerised systems and an updated Chapter 4 on documentation.
As of this writing, Annex 22 remains a draft. It has not been published as final EU GMP guidance, and the official EudraLex Volume 4 page still lists only the earlier versions of Chapter 4 and Annex 11. Estimates for final publication vary across industry sources, ranging from mid-2026 to later in the year, but no confirmed date has been announced. Manufacturers should treat the current text as direction, not law, while preparing for its likely shape.
The Rule Explained in Three Words
Annex 22's core scope restriction rests on three linked ideas:
Static means the model's internal parameters are frozen once deployed. It does not keep learning from new data while running in production.
Deterministic means the same input always produces the same output. There is no randomness built into the result.
Explainable means the reasoning behind a model's output can be traced and justified in terms that a quality reviewer or inspector can understand, rather than left inside as a "black box."
Put together, these three properties describe a model that behaves like a well-validated piece of software: predictable, repeatable, and auditable, even though it was built using machine learning rather than hand-written code.
What's Allowed and What's Excluded
The scope of Annex 22 is narrow by design. It applies only to AI and machine-learning models used in GMP-critical applications, meaning uses with a direct link to product quality, data integrity, or patient safety.
Model type | Status in critical GMP use | Example |
|---|---|---|
Static, deterministic ML models | Permitted, with validation | Predictive maintenance model with frozen parameters |
Dynamic or continuously learning models | Excluded from critical use | A model that trains itself on live production data |
Probabilistic-output models | Excluded from critical use | A model giving a different answer each run on identical input |
Generative AI and large language models | Excluded from critical use; allowed non-critically with human review | A chatbot summarising a deviation report |
This means tools built for open-ended reasoning or content generation, however useful elsewhere in a company, are not designed for the kind of fixed, testable behaviour that Annex 22 requires in critical roles.
Why Regulators Drew the Line Here
The logic follows directly from how GMP has always worked. A validated system is expected to behave consistently whenever it is presented with the same input. That is the foundation of process validation, computer system validation, and batch release decisions under Annex 11. A model that keeps adapting after deployment breaks that assumption, because a validation exercise performed last month may no longer describe how the system behaves today.
Explainability solves a related problem. Under GMP, someone, usually a Qualified Person, must be able to justify a batch release decision. If an AI model contributes to that decision, its logic needs to be sufficiently traceable for a human to defend it during an inspection. Annex 22 requires models to log feature attributions and confidence scores, so the basis for a prediction is visible rather than hidden.
Seen together, the three requirements read less like a ban on modern AI and more like an attempt to extend familiar validation thinking into machine learning. Annex 11 was written for rules-based software that behaves consistently every time it runs. Annex 22 is trying to hold newer, data-trained models to that same standard, rather than inventing a completely separate set of expectations from scratch.
Annex 22 isn't the only place AI governance is reshaping GMP, see how AI governance itself is becoming the new compliance baseline.
→ Read: Is AI Governance In Pharma The New GMP?
What Counts as "Critical" Use
Not every AI application in a pharmaceutical plant falls under Annex 22. The annex distinguishes between:
Critical applications, where an AI output directly affects product quality, patient safety, or data integrity — for example, a model deciding whether a batch parameter is within specification.
Non-critical applications, where AI supports work without directly driving a quality decision — for example, drafting a first pass at a report, which a human then reviews and finalises.
Non-critical uses have more flexibility, including limited use of generative tools, provided a qualified person reviews the output before it is acted on. Critical uses do not get that flexibility; the model itself must meet the static, deterministic, explainable standard.
A Pre-Deployment Checklist
Manufacturers preparing for Annex 22 are advised to check the following before putting an AI model into a critical GMP role:
Confirm the model does not continue learning or updating after deployment.
Confirm outputs are reproducible: same input, same result, every time.
Document feature attribution and confidence scoring for each prediction type.
Use test data that is independent from the data used to train the model.
Define acceptance criteria and a documented test plan before go-live.
Assign a multidisciplinary team, quality assurance, process experts, data scientists, and IT, with clear ownership.
Build in a fallback path to human review if confidence falls below a set threshold.
Keep full audit-trail documentation ready for inspection.
Where the Debate Still Stands
Not everyone agrees with drawing the line exactly where Annex 22 draws it. Industry groups have pushed back on excluding generative AI and large language models from critical use altogether, arguing that a narrower, risk-based approach might serve better as the technology matures. This sits within a broader wave of EU pharmaceutical policy, moving in tandem.
The Critical Medicines Act, aimed at strengthening medicine supply chains, reached only a provisional political agreement between the Council and Parliament on 12 May 2026; it still needs formal adoption and legal-linguistic revision before it takes effect. Annex 22 sits at a similar stage: politically discussed, technically drafted, but not yet law. For now, treat both as signals of direction rather than settled compliance obligations.
Annex 22 isn't law yet, but that doesn't mean manufacturers should wait to prepare — see what's worth investing in now.
→ Read: Annex 22: Not Law Yet, What To Invest In
Conclusion
Draft Annex 22 draws a clear, if cautious, boundary around AI in GMP-critical work: keep it static, keep it deterministic, and make sure every decision can be explained. That boundary rules out today's most talked-about AI tools from critical roles, while leaving room for the steadier, well-understood models already proving useful in predictive maintenance and quality monitoring. The rule is still a draft, but the direction is clear enough that manufacturers gain little by waiting for the final text before preparing.
FAQs
Q: Is Annex 22 legally binding right now?
A: No. It remains a draft. Public consultation closed on 7 October 2025, and no final version has been published as of this writing.
Q: Can a pharmaceutical company use ChatGPT-style tools in manufacturing?
A: Not for GMP-critical decisions under the current draft. Non-critical tasks may use such tools with human review before any action is taken.
Q: What does "static" mean for an AI model under Annex 22?
A: It means the model's parameters are fixed after deployment and do not change through ongoing learning during use.
Q: Does Annex 22 apply to every AI tool in a pharma company?
A: No. It applies specifically to models used in GMP-critical applications tied to product quality, data integrity, or patient safety.
Q: When will Annex 22 become final?
A: There is no confirmed publication date. Industry estimates point to sometime in 2026, but manufacturers should watch EudraLex Volume 4 directly for the official release.
Reporting on the science, business and regulation shaping the pharmaceutical industry.
Discussion