Two documents published within six months of each other have fundamentally shifted the regulatory landscape for artificial intelligence in pharmaceutical manufacturing. The first is non-binding. The second will be legally enforceable across the EU. Together they define where pharmaceutical AI regulation is heading and what quality systems need to do to be ready.
On January 14, 2026, the FDA and EMA jointly released the Guiding Principles of Good AI Practice in Drug Development - ten high-level principles covering the full medicines lifecycle. On July 7, 2025, the EMA published Draft Annex 22: Artificial Intelligence, the first dedicated GMP framework for AI in pharmaceutical manufacturing. Annex 22 consultation closed October 7, 2025 and finalization is expected during 2026, with a 6 to 12 month grace period before legal implementation.
This article explains what both documents require, what is different between them, what the April 2026 Purolea Pharmaceuticals warning letter tells us about FDA enforcement today, and what pharmaceutical sites should be doing right now to prepare.
The joint FDA/EMA guiding principles - what they say and what they mean
The January 2026 joint principles are non-binding. They do not replace the FDA's draft guidance on AI in regulatory decision-making or EMA's existing AI reflection paper. They are intended to lay the foundation for developing good practice and to inform future regulatory policies and guidelines in different jurisdictions.
The ten principles are: human-centric design; a risk-based approach; adherence to standards; clear context of use; multidisciplinary expertise; data governance and documentation; model design and development practices; risk-based performance assessment; lifecycle management; and clear essential information.
None of these will surprise anyone with experience in pharmaceutical quality systems. They map directly onto ICH Q10, FDA's data integrity guidance and existing cGMP expectations. That is the point. As the joint document states, AI does not change the basic rules for approving medicines - drugs must still meet established standards for quality, safety and effectiveness. What changes is the rigor and specificity with which those rules are applied to AI systems.
The joint FDA/EMA principles were developed following the FDA-EU Bilateral Meeting in April 2024 and explicitly build on EMA's 2024 AI reflection paper. They foreshadow closer regulatory convergence. For multinational pharmaceutical manufacturers the practical implication is clear: design your AI governance framework to meet the most demanding of the two jurisdictions and you will satisfy both.
Draft Annex 22 - the first binding GMP framework for AI
Annex 22 is six pages. But those six pages contain more operationally specific AI requirements than any regulatory document the pharmaceutical industry has previously produced. It was drafted by the EMA GMDP Inspectors Working Group in cooperation with PIC/S, ensuring alignment across more than 60 global regulatory authorities. The FDA and UK MHRA participated as observers - a strong signal of intended global harmonisation similar to the role 21 CFR Part 11 has played since the late 1990s.
The single most important clause - static and deterministic models only
The most operationally significant requirement in Draft Annex 22 is the restriction of AI in critical GMP functions to static and deterministic models - those that produce consistent outputs for the same inputs every time.
What this means in practice:
- Adaptive and self-learning models that continue to change during live use are excluded from critical GMP applications
- Generative AI and large language models are excluded from critical manufacturing decisions - processes that directly affect product quality or patient safety
- This is not a blanket ban on LLMs across the site - Annex 22 explicitly leaves the door open for LLM use in non-critical contexts such as document drafting and query assistance
- The boundary is around critical GMP functions - any AI that can affect a release decision, a specification or a patient safety outcome falls within the restriction
EMA held a two-day multistakeholder workshop on June 30 and July 1, 2026 to reconsider the LLM and generative AI restriction in the draft. Stakeholder consultation results suggested support for potentially enabling the use of generative AI and LLMs in medicines manufacturing under a risk-based approach with guardrails. EMA is still considering the implications. The static and deterministic restriction described above reflects the July 2025 draft - the final Annex 22 may take a more nuanced position on generative AI in non-critical GMP applications. A risk-based AI governance framework designed around the draft requirements will satisfy the final text regardless of how EMA resolves the generative AI position.
Any pharmaceutical site that has deployed or is planning to deploy adaptive AI or LLMs in critical manufacturing functions - automated release decisions, real-time process control, specification setting - needs to reassess those deployments against the Draft Annex 22 restriction before finalization. The direction is clear even though the final text is not yet published.
The five operational requirements
Beyond the static/deterministic model restriction, Draft Annex 22 establishes five core operational requirements.
Validation. AI systems used in GMP manufacturing must be validated. This is not traditional Computer System Validation extended to a new system type - it is AI-specific validation covering the intended use, the training data, the model performance under expected operating conditions and the ongoing monitoring programme. Validation documentation must address model architecture, training data quality and lineage, performance metrics and the conditions under which the model was assessed.
Explainability. AI outputs used in critical GMP functions must be explainable. Inspectors and quality professionals must be able to understand how the AI reached its conclusion. This requirement has a direct implication for model selection - highly complex black-box architectures that cannot generate interpretable outputs will be difficult to deploy in critical functions under Annex 22.
Human-in-the-loop oversight. High-impact AI applications require human oversight. The specific operational requirements for human-in-the-loop vary by use case and impact tier, but the principle is consistent - the quality unit cannot delegate a critical manufacturing decision entirely to an AI system without human review of the output before action is taken.
Lifecycle management. AI systems require lifecycle management covering model training, deployment, monitoring, performance drift assessment and eventual retirement or retraining. This extends the pharmaceutical product lifecycle management concept to the AI systems that support manufacturing - and it requires documentation that traditional CSV programmes were not designed to produce.
Data governance. Training data must meet defined quality standards with documented lineage. Training, test and production datasets must be independent - a model trained and evaluated on the same data does not provide reliable performance evidence. Data governance for AI under Annex 22 is an extension of existing pharmaceutical data integrity requirements into the AI domain.
How Annex 22 interacts with the EU AI Act
Annex 22 does not exist in isolation. AI use cases in pharmaceutical manufacturing that fall within Annex 22's scope may also fall under the EU AI Act's high-risk classification, which carries its own documentation, conformity assessment and post-market monitoring obligations.
Most high-impact AI under Annex 22 will also be high-risk under the EU AI Act. The two regimes overlap but are not identical. Sponsors operating in Europe need a governance framework that satisfies both simultaneously. Parallel compliance programmes are operationally expensive. An integrated framework designed from the start to address both Annex 22 and EU AI Act requirements is the more efficient approach.
A key area of interaction is post-market monitoring. The EU AI Act requires post-market monitoring for high-risk AI systems. Annex 22 requires lifecycle management and ongoing performance monitoring. A single well-designed monitoring programme can satisfy both requirements - but the documentation must address both frameworks.
What FDA is doing now - the Purolea warning letter
While Annex 22 was still in consultation, FDA was already enforcing existing cGMP regulations against AI misuse. The April 2026 warning letter to Purolea Pharmaceuticals is the clearest signal of FDA's current enforcement posture.
The warning letter cited three specific AI-related violations under existing regulations:
- AI-generated batch records accepted without human verification - a 21 CFR 211.68 finding
- AI-generated SOPs that contradicted validated process parameters - a 21 CFR 211.100 finding
- No validation of the AI system used in manufacturing - a 21 CFR 211.68 finding
FDA did not need new AI-specific regulations to issue that warning letter. It used the regulations already in place. This is an important signal: the compliance obligation for AI in pharmaceutical manufacturing is not contingent on Annex 22 or any new FDA guidance being finalised. Under existing 21 CFR cGMP regulations, any AI system used in a process that affects product quality must be validated, its outputs must be reviewed by a qualified person and it must not generate documentation that contradicts approved specifications without quality unit oversight.
"The validation question is not waiting for the guidance. It is already an inspection risk."
GMPify Training - based on FDA enforcement data 2025-2026FDA versus EU - what is binding and what is not
| Document | Jurisdiction | Binding | Scope | Status |
|---|---|---|---|---|
| Joint FDA/EMA Guiding Principles | US and EU | No | Full medicines lifecycle | Published January 2026 |
| FDA Draft Guidance - AI in Regulatory Decision-Making | US | No (draft) | Regulatory submissions | Draft January 2025 - final Q2 2026 |
| EMA Draft Annex 22 | EU | Yes (when final) | GMP manufacturing | Draft July 2025 - final 2026 |
| 21 CFR Part 11 and cGMP regulations | US | Yes | All cGMP operations including AI | In force - currently enforced |
| EU AI Act | EU | Yes (phased) | High-risk AI including pharma | Phased implementation 2024-2027 |
What pharmaceutical sites need to do right now
Annex 22 has not finalised. The FDA final guidance on AI in regulatory decision-making has not published. But the direction is clear and the grace period after Annex 22 publication - typically 6 to 12 months - will not be enough time to build compliance from scratch. The operational work required is real and the organisations that start now will be materially better prepared than those that wait for the final text.
Step 1 - Conduct an AI inventory of manufacturing systems
Most pharmaceutical sites underestimate how much AI is already active in their manufacturing operations. AI features are embedded in MES platforms, LIMS systems, environmental monitoring systems and quality management systems as vendor-enabled features that may not have been formally inventoried or assessed. The inventory exercise consistently surfaces active AI use cases that quality leaders were not aware of. This inventory is the foundation for everything else.
Step 2 - Classify each use by impact tier
Annex 22 uses a risk-based approach. High-impact AI affecting product quality or patient safety faces the strictest requirements including the static/deterministic model restriction and human-in-the-loop oversight. Lower-impact uses face proportional requirements. The tier classification determines the compliance obligations for each AI use case in your inventory and must be documented with justification.
Step 3 - Assess high-impact uses against the static/deterministic restriction
For each high-impact AI use case identified in step 2, determine whether the model meets the static and deterministic requirement. Adaptive models, self-learning systems and generative AI in critical GMP functions will require either remediation - replacing the AI with a static equivalent - or reclassification with documented justification that the function is not critical under Annex 22's definition.
Step 4 - Review validation and documentation programmes
Traditional CSV documentation was not designed to capture model documentation, training data lineage, explainability evidence or ongoing performance monitoring. These are the documentation gaps that will become inspection findings under Annex 22. Review your existing validation SOPs and identify what needs to be added to cover the Annex 22-specific requirements.
Step 5 - Read Annex 22 alongside the Chapter 4 and Annex 11 revisions
Annex 22 was published in consultation alongside revisions to Chapter 4 (Documentation) and Annex 11 (Computerised Systems). The three documents are designed to work together. Chapter 4 revisions extend documentation expectations to include AI-related artifacts. Annex 11 revisions address computerised systems incorporating AI components. Sites that prepare for Annex 22 in isolation without reading the companion revisions will miss the broader documentation and CSV changes the full package introduces.
GMPify will publish a dedicated course on EU GMP Annex 22 requirements when the final text is published. Subscribe to the full catalog at learn.gmpify.com for immediate access when it launches. In the meantime the GMPify tools page at gmpify.com/tools.html includes the Regulation Explainer - paste any regulatory reference including the Annex 22 draft clauses and get an immediate plain-language explanation of what they require.
The strategic conclusion
The pharmaceutical industry has been told for years that AI regulation was coming. In 2026 it has arrived - in two forms. Non-binding principles that signal where both FDA and EMA are heading. And a detailed, operational, binding EU GMP framework that will reshape how AI is deployed in pharmaceutical manufacturing.
For a global pharmaceutical manufacturer the practical hierarchy is clear. Existing cGMP regulations apply to AI now - the Purolea warning letter proves it. Annex 22 will add explicit AI-specific requirements when it finalises. The joint FDA/EMA principles signal that a similar US framework will eventually follow.
The question is not whether AI regulation will affect your site. It already does. The question is whether your quality system is ready.