On January 14, 2026, FDA and EMA jointly released ten guiding principles for the use of artificial intelligence in drug development. Three months later, the European Commission published a draft of EU GMP Annex 22 - the first binding regulatory framework anywhere addressing AI specifically within pharmaceutical manufacturing. Together, the two documents represent the most significant regulatory movement on AI in the pharmaceutical industry to date, and the April 2026 warning letter to Purolea Cosmetics Lab has already shown what enforcement built on these principles looks like in practice.
This article covers what both documents actually require and what pharmaceutical quality systems need to do before Annex 22 finalises.
The Purolea warning letter of April 2, 2026 cited a section explicitly titled "Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing" - the first such enforcement action in FDA history. It applied 21 CFR 211.22(c), an existing regulation, to AI-generated documents that were implemented without quality unit review. The guiding principles and draft Annex 22 give shape to expectations that are already being enforced under existing law.
The ten FDA-EMA guiding principles
The joint principles released on January 14, 2026 are not binding regulation. They function as a statement of shared regulatory philosophy between the two largest pharmaceutical regulatory bodies in the world, and they signal where binding requirements - like draft Annex 22 - are heading.
Human oversight is non-negotiable
AI systems used in GxP-relevant processes must remain subject to meaningful human review and approval. AI output does not carry regulatory authority on its own.
Risk-based governance proportionate to impact
The rigour of AI oversight should scale with the AI system's potential impact on product quality, patient safety and data integrity - mirroring the CSA risk-based philosophy already applied to computer system validation.
Transparency and explainability
Organisations must be able to explain, to a regulator's satisfaction, how an AI system reached a given output relevant to a GxP decision - not simply that it produced one.
Data quality underpinning AI systems
The data used to train, validate and operate AI systems must itself meet data integrity expectations. Poor quality input data undermines every downstream AI-assisted decision.
Lifecycle management
AI systems require ongoing monitoring, revalidation triggers and change control across their operational lifecycle - not a one-time validation at deployment.
Traceability of AI-assisted decisions
Organisations must be able to trace which decisions were AI-assisted, what data and model version informed them, and who provided the human review.
Bias and fairness assessment
AI systems must be assessed for bias that could affect the reliability of GxP-relevant outputs, particularly where training data may not represent the full range of real-world conditions the system will encounter.
Security and robustness
AI systems must be protected against adversarial manipulation and must perform reliably and predictably under the range of conditions they will actually encounter in production.
Regulatory engagement and transparency with authorities
Organisations are encouraged to engage proactively with regulators regarding significant AI deployments in GxP processes rather than treating AI governance as an internal-only matter.
Continuous alignment with evolving regulatory expectations
AI governance frameworks must be built to evolve as regulatory expectations mature - explicitly anticipating documents like draft Annex 22 rather than treating current guidance as a fixed endpoint.
What draft EU GMP Annex 22 adds
Where the joint guiding principles are philosophical, draft Annex 22 is procedural - and it is the first document of its kind to bring AI governance into the binding EU GMP framework rather than leaving it as guidance. Once finalised, Annex 22 will function the same way Annex 11 functions for computerised systems and Annex 1 functions for sterile manufacturing: a specific, auditable set of requirements inspectors assess sites against directly.
The draft establishes several requirements that go beyond the principles-level language of the joint FDA-EMA document.
An AI system inventory is expected as a foundational requirement - a documented, maintained record of every AI system used in a GxP-relevant capacity, its intended use, its risk classification and its current validation status.
Formal risk classification of each AI system based on its GxP impact, determining the intensity of validation, monitoring and change control applied - directly mirroring the CSA intended-use and risk framework already established for computer systems generally.
Documented human review points built into any process where an AI system contributes to a GxP decision, with the specific individual and their qualification documented, not just a generic statement that human oversight exists.
Vendor and third-party AI system governance, extending quality agreement expectations to cover AI systems supplied or hosted by third parties, including transparency obligations the vendor must satisfy for the pharmaceutical manufacturer to meet its own Annex 22 obligations.
Why the Purolea warning letter matters here
The April 2026 warning letter to Purolea Cosmetics Lab did not cite draft Annex 22 or the joint guiding principles - neither was binding at the time of the underlying inspection. FDA cited 21 CFR 211.22(c), an existing regulation requiring quality unit review and approval of all specifications and procedures, regardless of how they were generated.
This is the point the guiding principles and draft Annex 22 make explicit: the obligation for human oversight of AI-generated GxP content already exists under current law. What the new documents add is specificity - a documented inventory, formal risk classification, defined review points - about how to demonstrate that obligation is being met, not whether it exists in the first place.
A pharmaceutical site does not need to wait for Annex 22 to finalise before addressing AI governance. The Purolea enforcement action shows FDA is already applying existing regulation to AI misuse. Building the AI system inventory, risk classification and review point documentation that Annex 22 will require is preparation for both the coming binding requirement and the enforcement risk that already exists today.
What to do now, before Annex 22 finalises
- Build an AI system inventory now. Identify every AI tool used anywhere near a GxP process - document generation, specification writing, batch record review, data analysis, regulatory submission support - even if usage feels informal or exploratory.
- Classify each system by GxP risk using the same intended-use and impact framework already applied under CSA to computer systems generally. This positions you ahead of the formal risk classification Annex 22 will require.
- Define and document human review points for every AI-assisted GxP decision, naming the specific role responsible for review and the criteria that review must satisfy.
- Review vendor agreements for AI-supplied systems to confirm they address the transparency and governance expectations both the guiding principles and draft Annex 22 anticipate.
- Update your quality system documentation to explicitly reference AI governance as a defined element, rather than leaving it as an implicit extension of existing computer system validation procedures.
The January 2026 guiding principles and draft Annex 22 are not creating a new obligation from nothing. They are formalising, in increasing detail, an expectation that already exists under 21 CFR 211.22 and equivalent EU GMP quality unit requirements - as the April 2026 Purolea enforcement action demonstrates directly. Sites that treat AI governance as a documentation exercise to complete once Annex 22 is finalised are already behind the standard being actively enforced.
Key regulatory references
- FDA-EMA Joint Guiding Principles for AI in Drug Development, January 14, 2026
- Draft EU GMP Annex 22 - Artificial Intelligence in GMP Manufacturing
- FDA Warning Letter 320-26-58, Purolea Cosmetics Lab, April 2, 2026
- 21 CFR 211.22(c) - Responsibilities of quality control unit
Our AI in GMP Manufacturing course covers both documents in full
The ten FDA-EMA guiding principles, draft EU GMP Annex 22 requirements, the April 2026 Purolea warning letter and what your quality system must do now. Certificate on completion.