AI in GMP: Decoding the New PIC/S Annex 22 for Regulatory Teams

Key Provisions of Annex 22 

Annex 22 is a new addition rather than a revision, designed to complement Annex 11 with AI-specific requirements. 

The annex strictly limits the scope of AI use in GMP: only static AI/ML models with deterministic outputs may be deployed in critical applications. Systems using dynamic models, probabilistic outputs, or adaptive learning are prohibited in critical GMP contexts. 

Generative AI and Large Language Models (LLMs) are not permitted in critical operations. In non-critical contexts, their use is only acceptable with Human-in-the-Loop (HITL) oversight by qualified personnel. 

Implementation must be multidisciplinary, involving quality assurance (QA), data scientists, IT teams, SMEs, and consultants. Every stage of the AI lifecycle—from algorithm selection and training to validation, testing, and deployment—must be risk-informed, traceable, and documented. 

The regulatory intent is clear: prevent unpredictable AI behavior, reinforce explainability and auditability, preserve data integrity, and ensure human accountability. 

Why It Matters 

Annex 22 significantly raises compliance expectations for pharmaceutical manufacturers considering AI. Companies using dynamic or adaptive AI models may need to rethink system design and strategy. Requirements for explainability, test data independence, and traceability could also increase audit readiness demands and necessitate closer cross-functional collaboration. 

Relevance 

This update is critical for: 

• Regulatory and Quality teams ensuring compliance with GMP expectations 
• Data scientists and IT specialists managing AI system development and integration 
• Pharmaceutical manufacturers planning or operating AI-driven processes within GMP-regulated environments 

Next Steps for Industry 

Organizations should begin internal gap assessments to compare current AI/ML systems with Annex 22 requirements. Special focus should be on model validation, testing rigor, and data transparency. While Annex 22 is new, early alignment can mitigate compliance disruption once implementation becomes mandatory. 

Stakeholders are encouraged to review the annex closely and prepare to contribute feedback during any future consultation periods. 

Transitioning from preparation to proactive adaptation, companies can benefit from structured support. 

In this case, RegASK is an AI-driven solution for Regulatory Intelligence and Workflow Orchestration helping life sciences and consumer packaged goods companies keep pace with changing global regulations and guidelines. It combines smart documentation, automated workflows, and integrated experts to enable faster adaptation, which ultimately reduces operational risk.

Definitions and Acronyms: 

• AI/ML: Artificial Intelligence / Machine Learning—systems that learn patterns from data rather than following fixed programming. 
• Static model: An AI model that does not change once trained; required in critical GMP applications. 
• Dynamic model: Continuously learning/adaptive AI systems; not allowed in critical GMP use. 
• Deterministic output: Predictable, repeatable results for a given input. 
• Probabilistic output: Variable results even with identical input; disallowed in critical use cases. 
• Generative AI / LLM: Content-generating models (e.g., text or image creators) that operate probabilistically. 
• HITL (Human-In-The-Loop): Oversight mechanism requiring human review or validation of AI decisions in non-critical uses. 
• Explainability: Ability to understand and interpret AI decisions and logic. 
• Test Data Independency: Use of datasets separate from training data to objectively validate AI performance. 

FAQs

Annex 22 is new guidance issued by PIC/S that sets regulatory expectations for the use of AI and ML in GMP-regulated pharmaceutical manufacturing.

Dynamic, adaptive, or probabilistic AI models are prohibited in critical GMP applications. Generative AI and LLMs may only be used in non-critical applications with Human-in-the-Loop oversight. 

Static and deterministic models provide predictable, repeatable results, reducing risks to patient safety, product quality, and data integrity. 

RegASK provides AI-driven regulatory intelligence and workflow orchestration to monitor new requirements like Annex 22, map them against existing company processes, and highlight compliance gaps. Our platform supports structured documentation, validation workflows, and expert insights, helping teams adapt faster and reduce regulatory risk.