Annex 22 vs Annex 11: what applies to AI in GMP today?

Why “Annex 22 or Annex 11?” is the wrong question

As soon as AI enters GMP processes, the same question comes up: does Annex 22 apply now — or still Annex 11? The answer begins with status: Annex 11 applies today. Annex 22 is a consulted draft that shows a possible future AI addition.

Annex 11 (Computerised Systems) is the established, generic framework for computerised systems in EU GMP. In its applicable version it dates from 2011 — long before productive machine learning. Annex 22 (Artificial Intelligence) is the first GMP annex specifically for AI; its draft was published for consultation in July 2025, together with a revision of Annex 11 (details in the Annex 22 overview).

Put simply: Annex 11 governs the system today. Draft Annex 22 may in future complement the model within it. This article shows what each covers — and where the responsibility overlaps.

What Annex 11 covers generically — for every computerised system

The Annex 11 guide explains the applicable text, its control points and the status of the 2025 revision in detail.

Annex 11 sets the frame for computerised systems used as part of GMP-regulated activities — classical software or AI:

• Access control & attribution: physical and logical access controls; an unambiguous, timestamped attribution of user identities at every data entry.
• Audit trail: risk-based consideration of a system-generated record of GMP-relevant changes and deletions, available, intelligible and reviewed regularly.
• Operational controls: backups, data transfers / migrations, change and configuration management, incident management.
• Business continuity: measures to maintain critical processes during system outages.
• Electronic signatures: within the company, the same impact as handwritten signatures, permanently linked to the record and carrying date and time.

These requirements do not disappear with AI — they remain the base on which everything else stands. They are also the foundation of data integrity under ALCOA+.

What the Annex 22 draft adds for AI

The Annex 22 draft picks up exactly where Annex 11 reaches its limits: at systems that derive their functionality through data-based learning rather than being explicitly programmed. It describes AI-specific requirements a pre-ML framework was never designed for:

• Intended use & human-in-the-loop: a precise purpose and a built-in human oversight over the model result.
• Static models: for critical applications, frozen models that do not keep learning from new data in operation.
• Deterministic output: Within the scope of the draft, identical inputs produce identical outputs; probabilistic models are not covered by the draft and should not be used in critical GMP applications.
• Test data & test data independency: controlled data and a demonstrably independent test-data separation.
• Explainability & confidence: traceability of the model results and a handling of model confidence.
• Operation: the ongoing operation of the model including monitoring.

That is the gap the draft addresses: the behaviour of the model, which Annex 11 as a software framework could not address.

The draft begins where a model learns its function from data — instead of from explicit code.

The relationship: layering, not replacement

For readiness, the relationship can be read as a layering: Annex 11 as the foundation for the computerised system and the Annex 22 draft as a possible additional layer for the learning model. Today, an AI-enabled system used in a GMP process must address the applicable Annex 11 framework. The Annex 22 controls are a useful readiness lens, but remain draft requirements.

On generative AI and LLMs specifically: the draft does not foresee them in critical GMP applications. It does not exclude them from non-critical use. Adequately qualified and trained personnel must remain responsible for output suitability for the intended use; human-in-the-loop and the draft principles may be considered where applicable.

What this means in practice for QA and validation teams

From the relationship follows a clear way of working:

• Secure the Annex 11 baseline first. Access, audit trail, backup/change control, e-signature — this base must stand for every system before AI specifics even become relevant.
• Use draft Annex 22 as a readiness check. For every model in a critical application: intended use, independent test data, explainability, human-in-the-loop, operational monitoring — what that looks like in practice is in the GAMP 5 validation path for AI.
• Separate critical from supporting. That line decides which additional draft controls make sense — and whether generative AI is an option at all.
• Track the draft state. Annex 22 and the Annex 11 revision are drafts; the final version can shift details.

Teams that ground their AI work in controlled sources, attributable human review and a demonstrable audit trail address the applicable Annex 11 baseline and prepare many of the controls anticipated in draft Annex 22. That is what the traqx approach to AI in GxP is built for: as a control framework, not a promise of fulfilment.

The honest limits

Three clarifications:

• Applicable vs. draft: the applicable Annex 11 version is from 2011. The Annex 11 revision and Annex 22 exist as drafts — always check the current state for decisions.
• Do not blur the LLM scope. The draft excludes LLMs from critical applications and names human responsibility for non-critical use. It is not a general technical LLM guide.
• This is orientation, not advice. The original documents and your context-validated assessment, aligned with QA, are what govern.

Frequently asked questions

Is Annex 11 alone enough for an AI-enabled GMP system?

For the system framework, EU GMP Annex 11 applies today: validate the application, qualify the IT infrastructure and justify the extent of controls through documented risk assessment. What Annex 11 does not address in detail is the learning model itself — that is where draft Annex 22 begins. The Annex 11 guide explains the applicable text in detail.

What is the difference between Annex 22 and Annex 11?

Annex 11 is the generic EU GMP annex for computerised systems used in GMP-regulated activities. Annex 22 is a draft for AI systems used in the manufacture of active substances and medicinal products. In short: Annex 11 governs the system today; Annex 22 may add AI-specific model controls in future.

Does Annex 22 replace Annex 11?

No. Annex 11 remains the applicable system framework. Draft Annex 22 is designed as an AI-specific addition but is not yet in force. Organisations can assess its controls for readiness, but should not present them as current requirements.

Is Annex 22 already in force?

No. The Annex 11 version in force is from 2011. Annex 22 and a revision of Annex 11 were published as a draft for consultation in July 2025. For decisions you should always check the current status — the final version can shift details.

Are LLMs or generative AI allowed under Annex 22?

The draft does not foresee LLMs or generative AI in critical GMP applications. It does not exclude them from non-critical use; adequately qualified and trained personnel remain responsible for output suitability for the intended use.