Governance · EU GMP Annex 22 and AI

Built with draft Annex 22 in mind.

AI is starting to show up in GMP (Good Manufacturing Practice) decisions. The question is not whether AI can give answers, it is whether AI can be controlled, explained, reviewed, and kept in its lane. ChatQP is built with that in mind.

A note on wording

EU GMP Annex 22 is draft guidance following its public consultation; it is not adopted law. ChatQP is built with the draft Annex 22 expectations in mind. It does not claim to be "Annex 22 compliant." ChatQP is not a validated GMP system. It is a private beta tool, built with these expectations in mind.

It is about control, not capability.

If AI is used in GMP work, the system needs a clear purpose, testing, human review, change control, and control over the data it uses. The European Commission's draft Annex 22 is expected to outline expectations for the use of AI and machine learning in the manufacture of active substances and medicinal products. It covers how the model is chosen and trained, how it is validated, how it is measured, and the quality of the training and test data.

The problem Annex 22 is responding to is not that AI gives answers. It is whether an AI system can be controlled, explained, reviewed, and kept inside a quality system.

The themes, as we read them.

Intended use
Defined scope of the AI system
A clear, written statement of what the model is for, and what it is not for.
Model selection & training
Justified choices
Documented rationale for the model and how it was trained or configured.
Validation
Demonstrated fitness for use
Evidence the system performs as intended for its defined purpose.
Performance metrics
Measured and monitored
Defined metrics, with monitoring over the system's lifecycle.
Training-data quality
Controlled inputs
Quality and provenance of the data the system relies on.
Test-data management
Independent evaluation
Managed test data, separate from training, for credible evaluation.

Industry commentary also describes expectations around continuous monitoring, change control, model-performance monitoring, and human review.

Each theme has a plain answer.

Draft Annex 22 themeWhat ChatQP does
Intended useQP (Qualified Person) and QA (Quality Assurance) decision support only. It is not a certification authority.
Human oversightThe QP makes the decision. Outputs are there to be reviewed.
Validation and performanceBenchmark scenarios and decision tests against constructed cases.
Data controlRuns locally and offline. No batch data leaves the machine.
ExplainabilityOutputs cite sources and expose the reasoning path for review.
Change controlVersioned corpus, rules, and model setup.
Model riskHard GMP rules run in code, outside the model.

Annex 22 doesn't stand alone.

ChatQP's outputs rest on the binding rules and guidance QPs already work to. The FDA also has draft guidance on using AI to support regulatory decision-making for drugs and biological products. It describes a risk-based way to judge whether an AI model is credible enough for the decision it informs. That is not the same context as QP batch certification, but the core idea, credibility proportional to decision risk, fits naturally next to Annex 22.

EU GMP Annex 16
Batch certification by a QP
Final certification remains the QP's legal responsibility. ChatQP is subordinate to this.
EU GMP Annex 11
Computerised systems
Framing for validation, data integrity, and control of computerised systems.
FDA Guidance (AI)
AI for regulatory decision-making
Risk-based credibility assessment for AI models supporting regulatory decisions.

Honesty is the position.

Not claimed

ChatQP is not a validated GMP system out of the box. It is not "Annex 22 compliant," and it does not make regulatory decisions. Using it in a regulated setting would need local validation, SOPs, access control, control of the data, change control, and user training.

AI in pharma: the enforcement lesson