---
title: "AI in GMP quality: what Annex 22 expects | QLogixCMC"
description: "EU GMP Annex 22: what the draft asks of AI in GMP, the questions inspectors already ask, and an interactive look at AI-drafted deviation investigations."
url: https://qlogixcmc.com/blog/ai-in-gmp-quality-system-annex-22
markdown: https://qlogixcmc.com/blog/ai-in-gmp-quality-system-annex-22.md
updated: 2026-10-13
publisher: "QLogixCMC (QLogixCMC LLC)"
language: en-US
---

AI and digital quality 13 October 2026 3 min readBy QLogixCMC

# AI in the GMP quality system: what Annex 22 and your next inspector will ask
EU GMP Annex 22, published for consultation in 2025, is the first GMP text written for artificial intelligence. It allows AI in GMP work on conditions: a defined intended use, test data and acceptance criteria that show the model performs for that use, a person who reviews the output where the application is critical, and the model and its configuration under change control. Inspectors already ask the same questions of any site that has switched on an AI feature in its quality system.

## What the draft annex says
- It applies to AI and machine learning models used in GMP activities, alongside the computerised systems requirements of Annex 11, whose own revision was published for consultation at the same time
- Critical applications, where the output affects product quality, patient safety or data integrity, are reserved for static, deterministic models with a defined intended use, tested against data independent of the training data and against acceptance criteria set in advance
- Dynamic models that keep learning in use, and generative models, are kept out of critical applications and used where a qualified person reviews the output
- Performance is monitored in operation, and the model, its configuration and the data it sees are under change control and documented
- The text is a consultation draft and may change before it is adopted; its direction has not been contested

## The questions an inspector asks today
- Which GMP decisions does the AI touch, and where is its intended use written down
- How was it tested for that use, with what records and what acceptance criteria
- Who reviews the output, and how does the record show that a person did
- Is the AI's contribution labelled in the record, so a reviewer can tell draft from decision
- What happens when the model or the prompts are updated, and who approves that
- What happens when it is wrong: how is a wrong output caught, recorded and fed back

Interactive
Where the hours go in an investigation, with and without AI drafting
AI drafts the gathering and drafting steps
6.3hours per investigation
Down from 17 hours; the 5 hours of human review and approval are unchanged.

- Gathering and drafting
- Human decision steps
- Hours before AI drafting
- Defined intended use
- Validated against test records
- Output labelled as AI draft
- Named reviewer on every draft
- Model and prompts under change control
- Audit trail of draft and decision

Illustrative hours for one deviation. AI can take the gathering and drafting from hours to minutes; the review, the conclusion and the approval stay with people and take the same time, because that is where the GxP decision is made. The controls listed under the chart are what an inspector asks to see for any AI function in the quality system.

## Decision support, not decision making
The design pattern that satisfies both the draft annex and an inspector is the same: the AI gathers, drafts, trends and flags; a named, qualified person reviews, concludes and signs; the audit trail records both. Investigations are the natural first use, because the gathering and drafting take hours and the decision takes judgement, and because every draft gets a reviewer by procedure anyway.

## How QLogixCMC helps
QLogixCMC runs the AI readiness assessment, selects the first use cases by value and risk, writes the intended use and the governance, validates the function against records with known answers, and designs the workflow so that every AI output is a draft until a person signs. The work applies to whatever quality system a site runs.

## Related services
- [Validation and computer software assurance](https://qlogixcmc.com/services/validation-and-csa)
- [Investigations, CAPA and backlog remediation](https://qlogixcmc.com/services/investigations-and-capa)
- [AI and digital quality](https://qlogixcmc.com/services/ai-and-digital-quality)

## Facing this at your site?
Bring the numbers from the figure above. We will say what we would assess first and what we would leave alone.
[Request a meeting](https://qlogixcmc.com/contact)

## Questions this post answers

### Can generative AI be used in GMP at all?

Yes, in decision-support and non-critical roles with a qualified person reviewing the output, which is the direction of the draft Annex 22. Critical applications call for static, tested models. Treat generative output as a draft that a person checks, labels and signs.

### Does an AI feature in our eQMS need to be validated?

Yes, for the site's intended use. The vendor's testing covers the product; the site documents what the feature is used for, assesses the risk of a wrong output, tests it on its own records and keeps the configuration under change control, as it does for any other GMP function.

## More from the blog
- [Technology transfer · 20 October 2026Onshoring drug manufacturing: the tech transfer and validation path to a US site](https://qlogixcmc.com/blog/onshoring-drug-manufacturing-tech-transfer)
- [Sterile manufacturing · 6 October 2026Annex 1 three years on: the contamination control strategy inspectors now read first](https://qlogixcmc.com/blog/annex-1-contamination-control-strategy)
- [Validation · 29 September 2026Computer software assurance: how much testing does your system actually need?](https://qlogixcmc.com/blog/computer-software-assurance-how-much-testing)

## Talk it through with someone who has run a plant
Bring your backlog, your submission timeline or the Form 483. We will tell you plainly what we would do first, what it would take, and what we would leave alone.
[Request a meeting](https://qlogixcmc.com/contact)[Email us](mailto:contact@qlogixcmc.com)

In the first meeting we cover
- What is on your mind: a backlog, a submission, a validation program, an inspection date or a system that is not working
- What we would assess first, and what we would leave alone
- Whether an engineer on your site, a fixed-scope assessment or a defined deliverable is the right way to start

## More from QLogixCMC

- [Onshoring drug manufacturing: the tech transfer and validation path to a US site](https://qlogixcmc.com/blog/onshoring-drug-manufacturing-tech-transfer.md): Bringing a product to a new US site: gap analysis, qualification, method transfer, engineering and PPQ batches and PAI readiness, with an interactive timeline.
- [Annex 1 three years on: the contamination control strategy inspectors now read first](https://qlogixcmc.com/blog/annex-1-contamination-control-strategy.md): What the revised EU GMP Annex 1 asks of sterile manufacturers, where inspections find gaps, and an interactive EM trend that catches a contamination shift early.
- [Computer software assurance: how much testing does your system actually need?](https://qlogixcmc.com/blog/computer-software-assurance-how-much-testing.md): FDA's CSA approach scales validation testing to the risk of each function. What changed from CSV, how to apply it, and an interactive estimate of the effort saved.
- [Comparability for cell, gene and mRNA therapies: proving a process change left the product unchanged](https://qlogixcmc.com/blog/cell-gene-mrna-therapy-comparability.md): Why advanced therapies change process so often, what ICH Q5E and FDA's CGT guidance expect, and an interactive study showing why lot count decides the result.
- [Why 21 CFR 211.192 stays the most-cited observation, and how a backlog really comes down](https://qlogixcmc.com/blog/211-192-investigations-backlog.md): What 211.192 requires, the three ways investigations fail, and an interactive burn-down showing when a deviation backlog clears and which records go first.
- [QLogixCMC home](https://qlogixcmc.com/index.md): CMC consulting for biotech, pharma and CDMOs: Module 3 from IND to BLA, control strategy, GMP quality systems, validation, CAPA and FDA inspection readiness.
- [Services](https://qlogixcmc.com/services.md): QLogixCMC services, on site or remote: CMC and regulatory, quality systems, validation and CSA, investigations and CAPA, inspection readiness, GxP systems and AI.
- [Request a meeting](https://qlogixcmc.com/contact.md): Talk to QLogixCMC about a CMC submission, your quality system, validation, an investigation backlog or an FDA inspection. We reply to set up a time.
- [llms.txt: a summary of the site for AI assistants](https://qlogixcmc.com/llms.txt)
- [Site map](https://qlogixcmc.com/sitemap.md)

---
Source: https://qlogixcmc.com/blog/ai-in-gmp-quality-system-annex-22
Cite this page as https://qlogixcmc.com/blog/ai-in-gmp-quality-system-annex-22
QLogixCMC · contact@qlogixcmc.com · +17146639012