Raising the Bar in GxP Compliance – Part 23: EMA’s Annex 22 and the AI Revolution in Pharma.
Welcome to the 23rd instalment of Raising the Bar in GxP Compliance, Rephine’s expert-led blog series for QA and regulatory professionals. In this edition, we explore the groundbreaking draft of EMA Annex 22—the first dedicated regulatory framework for Artificial Intelligence and Machine Learning in GxP environments. As pharma companies adopt AI-driven tools for prediction, automation, and decision support, Annex 22 sets clear expectations for validation, oversight, and lifecycle management.
Learn how Rephine is helping organisations translate regulatory guidance into practical governance models that ensure AI readiness, patient safety, and future-proof compliance.
AI is no longer a futuristic add-on—it’s an operational reality.
With the release of Annex 22, regulators are drawing clear lines around how Artificial Intelligence must be governed in GxP environments. Clarity, control, and compliance are now non-negotiable.
Introducing EMA’s Draft Annex 22: A Milestone for AI in Pharma
The new draft Annex 22, published by the EMA in July 2025, introduces for the first time a dedicated GxP framework for Artificial Intelligence and Machine Learning (AI/ML) systems used in the manufacture of active substances and medicinal products.
This landmark annex recognises the increasing role of AI in pharmaceutical operations, while setting clear expectations for model validation, intended use, oversight, and data quality.
Why Annex 22 Matters for GxP Compliance
Until now, AI applications in GxP environments operated in a regulatory grey zone. Annex 22 closes that gap by:
- Defining how AI systems must be selected, trained, validated, and monitored
- Requiring explicit intended use statements and performance specifications
- Emphasising data quality, traceability, and change control
- Demanding clear human oversight and explainability
It creates regulatory clarity for AI in predictive quality tools, image processing, batch release support, and smart decision-making.
Key Compliance Requirements in Annex 22
- Intended Use Definition: Each AI model must have a documented and approved intended use aligned with GxP processes.
- Model Training & Validation: Training and test data must meet GxP standards for accuracy, integrity, and traceability. Models must be validated against predefined metrics.
- Performance Monitoring: Continuous oversight is required to detect performance drift and ensure fitness for use.
- Change Management: AI model updates must follow formal change control, including versioning and impact assessment.
- Human Review: Decisions made or proposed by AI must be subject to qualified human review, particularly for critical process steps.
Implications for Pharma and Biotech Companies
Companies using or planning to use AI systems must:
- Classify their AI use cases under GxP-relevant categories
- Establish governance procedures for AI lifecycle management
- Ensure data governance and model explainability
- Integrate AI into QMS, validation, and audit frameworks
Annex 22 Within the Broader Digital Compliance Landscape
Annex 22 complements:
Revised Annex 11 (computerised systems lifecycle and validation)
Revised Chapter 4 (digital and hybrid documentation)
Together, they define a 21st-century regulatory model for digital, data-driven pharma operations.
📅 The EMA consultation remains open until 7 October 2025. Rephine is reviewing and preparing its input.
🧭 This article is part of Rephine’s 2025 GMP update series, helping our clients prepare for the future of compliance.
How Rephine Helps You Prepare for Annex 22
We support our clients in:
✅ Assessing AI readiness and classifying existing tools under Annex 22
✅ Defining intended use and validation strategies for AI models
✅ Designing performance metrics, monitoring plans, and human oversight protocols
✅ Aligning AI integration with QMS, CSV, and Annex 11 frameworks
✅ Establishing governance models for AI lifecycle and risk management
Final Thoughts: Aligning AI Innovation with Global Compliance
The rise of AI in GxP environments demands both innovation and compliance. While the EMA focuses on manufacturing integrity, and the USFDA on regulatory flexibility, both agree that trust, transparency, and technical robustness are non-negotiable. Forward-looking pharma and biotech firms must align with both to maintain global regulatory acceptance and patient safety.
Dr. Eduard Cayón
CSO (Chief Scientific Officer)
About the Author:
Dr. Eduard Cayón is the Chief Scientific Officer (CSO) at Rephine, a global leader in GxP compliance and quality assurance.
We don’t just deliver audits or consultancy services — we partner with clients at every stage of their quality journey, offering end-to-end solutions that empower confidence and compliance.
With over 25 years of experience, Rephine has built an enviable reputation as the gold standard in the industry operating from four primary locations: Stevenage in the UK, Barcelona in Spain, India, and Shanghai in China.
Dr. Cayón, who holds a Ph.D. in Organic Chemistry, is a deeply experienced pharmaceutical industry consultant and auditor.
He is dedicated to supporting pharmaceutical, biotech, and medical device companies in meeting the highest standards of manufacturing and supply chain integrity.