Drafts Published: Annex 11 & New Annex 22
On July 7, 2025, the European Commission, together with PIC/S, published the long-awaited drafts for the revision of Annex 11 “Computerised Systems” and the entirely new Annex 22 “Artificial Intelligence.” In parallel, Chapter 4 “Documentation” of the EU GMP Guide was also revised.
These guidelines are central components of the GMP regulatory framework for computerized systems and AI applications in regulated industries such as pharma, biotechnology, and medical technology. They define requirements for the integrity, validation, and control of IT systems that support GMP-relevant processes.
Corresponding documents for the GLP and GCP sectors have already been published in recent years. The drafts mark a decisive step toward a modern, risk-based approach to digital technologies in the GMP environment, but also place high demands on the operator (regulated user).
What's new in Annex 11 and Annex 22?
The revised content of Annex 11 brings clarity, precision and updates in many areas, particularly with regard to:
- Lifecycle management of computerized systems
- Data integrity and audit trails
- Cloud and SaaS usage
- Supplier management and role allocation
- IT security
At the same time, however, certain provisions that were included in the earlier version (from 2011) are also missing.
The new Annex 22 takes artificial intelligence (AI) and machine learning (ML) explicitly into the regulatory focus for the first time. It addresses, among other things:
- Validation requirements for AI/ML models
- Transparency, explainability and bias control
- Responsibilities for training, deployment and monitoring
- Risk-based assessment of algorithmic decisions
The document represents a good initial approach to regulation that will certainly need to be revised frequently to keep pace with the rapid changes in technology. This makes it clear: the authorities are creating a defined framework to bring innovation and regulation into balance, while complexity and responsibility for GxP managers continue to grow.
In the revised Chapter 4 (Documentation) of the EU GMP Guide, several important elements for IT systems in manufacturing and control are being reconsidered (e.g. hybrid documentation, raw data, electronic signatures). This means that certain regulations within companies will also need to be adapted.
What does this mean for compliance officers?
The drafts require concrete actions from companies that use GxP-relevant IT systems or AI-based functions, whether in quality assurance, manufacturing, or logistics. Those responsible for compliance, IT, quality, and validation should now:
- Analyze the drafts and assess which systems, technologies, and processes are affected
- Conduct risk-based gap analyses against the new requirements
- Revise validation and QM documentation, e.g., regarding roles, system responsibility, cloud usage, or IT security.
- Reassess AI projects with GxP relevance: Has the model used been reviewed according to the requirements? Is the model explainable? Is “AI Lifecycle Management” in place?
Important: Even existing systems that are already validated must be reviewed in the context of the new requirements, especially if new technologies, automation, or external services (service providers) are involved.
How can DHC support you in meeting the regulatory requirements of Annex 11 and 22?
As a specialist in SAP solutions for the life sciences environment and with nearly 30 years of experience in GxP compliance and validation, we support companies specifically in the following areas:
- Gap analysis & impact assessment
- Structured evaluation of the new Annex 11, Annex 22, and Chapter 4 requirements on your IT and QM landscape
- Prioritization of action areas based on risk and relevance
- Validation strategy & documentation
- Revision of validation concepts, SOPs, RACI matrices, and test strategies
- Establishment of traceable lifecycle management for AI-supported systems
- AI compliance & AI readiness
- Support in the regulatory assessment of AI/ML systems
- Definition and implementation of control mechanisms (e.g., model monitoring, bias detection, explainability)
- Tool-supported implementation with SAP
- Consulting on integrating validation into SAP processes (e.g., via SAP Cloud ALM)
- Use of the DHC Smart Validation Accelerator for cost-effective automation and documentation of validation processes in the SAP environment
- Guidance within the SAP End-to-End Digital Validation Platform (E2E DVP)
Drafts for AI & ML Published: Annex 11 & New Annex 22
Receive an initial assessment of the impacts and concrete starting points for gap analysis, validation strategy, and AI compliance.