Guidance vs Regulation: Four Words Pharma Keeps Mixing Up

Introduction

Ask five people in a quality team what "the guidance says" means, and you'll likely get five different answers. Some mean a finalised document. Others mean a draft they read last month. A few actually mean an internal SOP built around industry habit, not any published text. This mix-up isn't just a language slip; it shapes audit findings, submission delays, and budget decisions. This guide breaks down what each term means under the law, why the confusion persists, and how regulatory intelligence teams can build a cleaner vocabulary around them.

Why This Confusion Matters

Regulatory writing and quality documentation both lean heavily on these four words, often without distinguishing them. A CAPA that cites "FDA guidance" as though it were law can weaken an audit response. A go-to-market plan built on a draft annex can leave a company compliant with a rule that never actually took effect in that form. Getting this vocabulary right is now part of good regulatory intelligence in pharma, especially as more agencies run open consultations and publish evolving drafts before finalising anything.

Regulation: The Only Legally Binding Term

A regulation is a law. A body issues it with legislative or statutory authority, the European Commission, the US Congress, or a national health ministry, and it carries enforceable obligations. Once a regulation is published in an official register, such as the Official Journal of the European Union or the US Federal Register, companies must comply within the stated timeline or face penalties.

Regulations go through a defined legal process: proposal, review, amendment, formal adoption, and publication. Nothing about a regulation is optional once it applies. This is different from guidance, which explains how to meet requirements but does not itself create new legal duties. 

Guidance: Official, But Not Law

Guidance documents, issued by agencies such as the FDA, EMA, or ICH, explain how a company can meet existing legal or regulatory requirements. They reflect current agency thinking on topics such as data integrity, stability testing, and clinical trial design.

Guidance is not law. Companies can deviate from it if they can justify an alternative approach that still meets the underlying regulation. In practice, though, guidance carries significant weight because auditors and inspectors use it as the reference point during inspections. Deviating from guidance without documented justification is a common audit finding, even though such deviations are technically permitted.

Key traits of guidance:

1. Represents the regulator's current interpretation, not a legal mandate

2. Can be updated, revised, or withdrawn without a formal legislative process

3. Often region-specific (an FDA guidance does not automatically apply in the EU)

Draft Guidance: Direction, Not Obligation

Draft guidance is exactly what it sounds like: a proposal open to public comment. It signals where an agency's thinking is heading, but it has no regulatory status. Companies read draft guidance to prepare early, not to comply. Building an entire validation strategy around a draft is risky because the final version can change substantially after the comment period, and the final publication itself may be delayed well beyond the original timeline.

This is where most of the confusion in pharma content and internal communication occurs. A draft is discussed in a webinar or on LinkedIn as though it were finalised, and by the time it circulates through internal teams, the distinction is lost.

Practice: What Companies Actually Do

Practice is the broadest and least formal of the four. It refers to what a company or the industry as a whole actually does, sometimes shaped by regulation, sometimes by guidance, and sometimes by habits that have simply become conventional over time. A "standard industry practice" might not be written down anywhere in regulatory text at all. It could be an SOP pattern that spread across companies, or an approach an audit team came to expect over the years without any formal document endorsing it.

Practice is useful, but it is also the most vulnerable term to misuse. Citing "industry practice" as justification during an inspection carries far less weight than citing an actual regulation or finalised guidance.

Comparison Table: Four Terms, Four Different Weights

Case Study: EU GMP Annex 11 and Annex 22

This distinction is playing out right now with EU GMP's revision of Annex 11 (computerised systems) and the new Annex 22 (artificial intelligence in GMP). Both went through public consultation, which closed in October 2025, and drafts have circulated widely across quality and IT compliance teams. As of late July 2026, both remain consultation drafts. The current applicable version of Annex 11 is still the one published in January 2011. Final publication has repeatedly been described as expected "in mid-2026," but the European Commission has issued no confirmed date or finalised text as of this writing.

This matters practically: companies preparing AI governance frameworks or computerised system upgrades based on the Annex 22 draft are preparing for likely guidance, not for confirmed obligations. Teams should track EudraLex Volume 4 directly for the actual publication date rather than relying on secondary blog summaries, which sometimes state expected timelines as though they were confirmed.

Annex 22 isn't the only AI governance framework pharma teams are tracking, see how ISPE's own guide fits into this evolving landscape.
→ Read: ISPE GAMP Guide for AI in Pharma: Leadership Guide

Case Study: The Critical Medicines Act

The EU Critical Medicines Act (CMA) offers a clearer example of the regulatory pathway in action. The European Commission proposed the CMA in March 2025 to address shortages of essential medicines and reduce dependence on non-EU supply chains. On 12 May 2026, the Council and the European Parliament reached a provisional political agreement on the text.

That agreement is a milestone, not a final law. The text still needs formal ratification by both the Council and Parliament, followed by legal-linguistic revision, before it can be published in the Official Journal of the EU. Publication is expected toward the end of 2026, at which point the application date will be confirmed. Until that formal publication happens, the CMA is a political agreement, not an enforceable regulation, an important distinction for supply chain and procurement teams planning around it.

Annex 22 shows the same guidance-vs-regulation pattern playing out in AI governance, read the full breakdown of what its draft status actually means.
→ Read: Static, Deterministic, Explainable: Reading Draft Annex 22
A Practical Checklist for Regulatory Teams

1. Confirm whether a document is final or still in consultation before citing it in internal SOPs.

2. Track primary sources directly (EudraLex, EUR-Lex, FDA.gov) rather than secondary summaries.

3. Label internal references clearly: "per draft Annex 22" vs. "per Annex 11 (2011, current)"

4. Flag any policy built on a provisional agreement as subject to change until formal adoption.

5. Set a calendar reminder to revisit key drafts around their expected finalisation window.

6. Avoid presenting industry "practice" as evidence of compliance during audits without formal backing.

Conclusion

The gap between guidance, draft guidance, regulation, and practice isn't academic; it directly affects how prepared a company actually is when a rule takes effect, and how defensible its documentation is during inspection. As agencies like the EMA and FDA increasingly work through public consultation drafts, precise language in internal regulatory intelligence work becomes a genuine risk-management tool, not just a writing preference.

FAQs

Q1. Is draft guidance enforceable?

No. Draft guidance is open for comment and has no legal or regulatory force until finalised.

Q2. Can a company be audited against a draft regulation?

No, inspectors audit against currently applicable regulations and finalised guidance, not drafts.

Q3. Is EU GMP Annex 11 (2011) still valid?

Yes, the 2011 version remains the applicable annex until the revised version is formally published.

Q4. Has the EU Critical Medicines Act become law yet?

Not yet. It has a provisional political agreement but awaits formal ratification and OJEU publication.

Q5. What's the safest source for regulatory status updates?

Primary regulator sources, EudraLex, EUR-Lex, and FDA.gov, rather than secondary industry blogs.