Do FDA and EU Regulators Allow AI in Pharma Manufacturing?
Yes, with conditions. Draft Annex 22, FDA guidance, the first AI-focused warning letter, and the Jan 2026 FDA–EMA principles mapped in plain words. Read on.
Quick answer: Yes, with conditions, and 2026 made the conditions clearer. The EU’s draft Annex 22 allows locked, predictable AI models in quality-critical uses and keeps generative AI to non-critical tasks under human oversight. The FDA has no binding AI rule yet, but its guidance, the joint FDA–EMA principles, and its first AI-focused warning letter all point the same way: AI drafts, humans decide.
Most leadership teams still ask the AI question as a yes or no: are we allowed, or aren’t we? After ten years in pharmaceutical quality assurance, can tell you regulators almost never answer in yes or no. They answer in categories, and through 2025 and 2026 the FDA and the European regulators finally wrote the categories down. Reading them as a ban is wrong. So is reading them as a green light.
In plain words: what the draft Annex 22 permits, where the FDA stands, what the January 2026 joint FDA–EMA principles signal, and what it means for each department in a small or mid-size plant. Every date was verified as of August 2026.
Do regulators actually allow AI in pharma manufacturing?
Yes. No major regulator has banned artificial intelligence from good manufacturing practice (GMP) environments. Not the FDA, not the European Medicines Agency (EMA), not MHRA, not PIC/S. What they have done is sort AI by two properties: how predictable the model is, and how critical the decision it touches. Together, the texts form what I call the Three-Lane Map of AI in GMP:
- Lane 1 : Locked, predictable models in critical uses: allowed, with validation. The draft Annex 22 covers static, deterministic models (fixed parameters, identical output for identical input) in applications with direct impact on patient safety, product quality, or data integrity, provided the validation expectations are met.
- Lane 2 : Learning and probabilistic models: parked. The draft states these should not be used in critical GMP applications. EMA revisited the position at a 30 June-1 July 2026 workshop; as of August 2026 it stands.
- Lane 3 : Generative AI: non-critical tasks, human-supervised. Summarising, searching, and drafting are open on one condition that never moves: a qualified person reviews the output before it becomes anything official.
The lanes regulate accountability, not intelligence. Most GMP AI failures I’ve seen up close were governance failures, not model failures. The 2026 texts read like their authors know it.
Regulators haven’t banned AI in pharma. They’ve banned unaccountable AI. That distinction is the whole 2026 story.
What is Annex 22, in simple terms?
Annex 22 is the first EU GMP text written specifically for artificial intelligence. The European Commission published it as a consultation draft on 7 July 2025, drafted by EMA’s GMDP Inspectors Working Group together with the Pharmaceutical Inspection Co-operation Scheme (PIC/S), alongside a revised Chapter 4 and a revised Annex 11 in EudraLex Volume 4.
Its scope is narrow on purpose: critical applications, meaning direct impact on patient safety, product quality, or data integrity. Inside that scope it takes the three lane positions above, spelling out Lane 1’s validation expectations: intended use, independent test data, acceptance criteria, confidence thresholds, performance monitoring.
Status, as of August 2026: still a draft. The consultation closed on 7 October 2025 with roughly 1,300 comments, no final text appears in EudraLex yet, and the mid-2026 workshop is weighing whether generative and adaptive models could re-enter under risk-based safeguards. Commentary expects finalisation in late 2026. The takeaway: the draft already shows how inspectors are thinking; waiting for final text before sorting your own uses is the expensive reading.
“In ten years of vendor qualification and batch record review, the systems that survived audits were never the impressive ones. They were the boring, predictable ones: same input, same output, every time. Annex 22’s preference for static, deterministic models isn’t regulators being cautious for its own sake. It’s them writing down what every working QA team already knew.”
– Kinjal Patel, Senior Consultant QMS, Validation & GMP Compliance
What are the FDA's rules and why is there no binding AI regulation yet?
The FDA regulates AI in manufacturing mainly through the rules it already has. 21 CFR Parts 210 and 211 govern the process and its records whether a person or a model produced them; 21 CFR Part 11 governs the electronic records and signatures around them. On that base it has layered guidance: a 2023 discussion paper on AI in drug manufacturing, then a January 2025 draft guidance introducing a risk-based framework for establishing a model’s credibility for its context of use. The agency has received more than 500 submissions with AI components since 2016. As of August 2026 that guidance is still listed as draft on CDER’s own page; a final version is expected.
Anyone reading the absence of a binding rule as an absence of enforcement got corrected on 2 April 2026. FDA Warning Letter 320-26-58 to Purolea Cosmetics Lab was the agency’s first with a dedicated AI-use section: AI-generated specifications and master production records used without adequate human review, cited under existing current good manufacturing practice (CGMP) requirements. The firm later ceased drug production. The takeaway: the FDA’s message is engage early and govern properly; the existing rulebook already reaches your AI output.
What did FDA and EMA jointly agree in January 2026?
On 14 January 2026, the FDA and EMA jointly published ten Guiding Principles of Good AI Practice in Drug Development, the first coordinated transatlantic position on AI across the medicines lifecycle, research through manufacturing. The principles are deliberately high-level: a humancentric, risk-based approach, defined context of use, data governance, multidisciplinary expertise, lifecycle management. They bind no one.
Their value is directional: both agencies state the principles will underpin future AI guidance in their jurisdictions. For a plant leader: the two regulators you most likely answer to are aligned on fundamentals, so a governance model built on human oversight and documented accountability travels across both markets. The takeaway: build to the shared principles once, not to two rulebooks twice.
Annex 22 doesn’t ask whether your model is intelligent. It asks whether it’s predictable.
What does the 2026 map mean for each department?
Each department uses AI differently, but human review and accountability remain essential.
| Department | AI use | AI’s role | Human responsibility |
|---|---|---|---|
| QC laboratory | Visual inspection and anomaly detection | Flags defects and unusual results | Review flagged results and validate the model |
| Production | Predictive maintenance and process monitoring | Detects early signs of process drift | Investigate issues and approve changes |
| QA documentation | SOPs, deviation summaries and batch records | Drafts and summarises records | Review, approve and sign records |
| Engineering | Maintenance scheduling and utility monitoring | Tracks trends and highlights risks | Assess risk and qualify changes when needed |
| Regulatory affairs | Submission drafting and regulatory research | Prepares drafts and gathers information | Verify content and own every filed statement |
Takeaway: AI can reduce routine work, but people remain responsible for decisions, approvals and the final record.
Does the EU AI Act apply to a GMP plant and where does the revised Annex 11 fit?
Mostly not the way vendor decks imply, and not yet. The EU AI Act is horizontal law, and whether typical plant uses count as “high-risk” is unresolved, with European Commission classification guidelines still pending. The timeline moved too: the AI Omnibus, in force since 27 July 2026, pushed Annex III high-risk obligations to 2 December 2027 and Annex I embedded-product rules to 2 August 2028. Medicinal products are not an Annex I regime, so the GMP layer, not the AI Act, is the operative rulebook inside your plant.
That GMP layer is being rebuilt in parallel. The revised Annex 11 and Chapter 4 drafts, published alongside Annex 22, pull the 2011-era computerised-systems rules into the same governance era. The takeaway: track the AI Act, act on the GMP texts.
Where does "regulators allow it" go wrong?
Even a permissive map gets misread. Three failure modes recur:
- Treating drafts as optional. Annex 22 isn’t binding and neither is the FDA’s guidance. But inspectors are already asking draft-shaped questions. Ignoring them until final text is how firms end up retrofitting governance under observation pressure.
- Reading FDA silence as permission. The Purolea letter is the counterexample: no AI-specific regulation existed, and existing CGMP still produced a warning letter with a dedicated AI section. If your AI output feeds a specification or a record, the current rulebook already owns it.
- Running generative AI in the critical lane “because it’s only a pilot.” A pilot that writes into a master document or a batch record is not a pilot; it’s an uncontrolled critical application. Keep generative tools in Lane 3, mark every AI draft as a draft, and keep a human signature between draft and record.
The takeaway: the map is permissive precisely because the lanes are enforced
What does misreading the map cost?
1st
— AI-focused CGMP warning letter (WL 320-26-58, 2 Apr 2026); the recipient later ceased drug production.
(FDA; BioSpace, 2026)
500+
— FDA submissions containing AI components since 2016.
(FDA, 2025)
65% / 61%
— European manufacturers planning predictive-maintenance / machine-learning investment within twelve months.
(Forrester survey via European Pharmaceutical Review, 2026)
The pressure to adopt is real, the enforcement is real, and the distance between them is governance. Plants that treat
QA release review of an AI draft
as the load-bearing control are reading the map correctly.
I’ve sat in audits and inspections for a decade. The pattern is always identical: when a new technology appears on the floor, the inspector’s questions are never about the technology. They’re about who signed, and where the record lives. The fix is rarely a smarter tool. It’s a governance decision that makes every output’s status unmistakable before anyone asks.
FAQ
Frequently asked questions
Yes. No major regulator prohibits AI in GMP manufacturing. The EU’s draft Annex 22 sets conditions by model type and criticality; the FDA applies existing CGMP regulations plus draft guidance. The real question is placement: which lane your use case sits in, and whether your governance validation, human oversight, audit trail matches it.
The first EU GMP text written specifically for AI, published as a consultation draft on 7 July 2025. In plain words: locked, predictable models may support critical decisions if properly validated; models that keep learning stay out of critical uses; generative AI is limited to non-critical tasks with a qualified human reviewing every output. It remains a draft as of August 2026.
Yes, through existing regulations rather than an AI-specific rule. 21 CFR Parts 210, 211, and Part 11 apply to manufacturing records and systems regardless of what produced them. Its January 2025 draft guidance adds a risk-based credibility framework, and its April 2026 warning letter with a dedicated AI section confirmed enforcement does not wait for new regulation.
For non-critical tasks summarising a deviation report, searching procedures, drafting a maintenance note the EU draft direction says yes, with a qualified human in the loop. No text supports generative output entering a specification, master document, or batch record without qualified review and signature. Uncontrolled generative use near records is where inspection findings start.
Static means the model’s parameters are fixed; it does not keep learning in use. Deterministic means identical inputs always return identical outputs. Together they make a model testable the way GMP demands critical systems be testable: you can validate it, monitor drift, and reproduce any past decision. Predictability, not intelligence, is the qualifying property.
Not squarely, and not yet. Whether plant AI qualifies as high-risk is unresolved pending European Commission classification guidelines; the AI Omnibus (in force 27 July 2026) extended high-risk deadlines to December 2027 and August 2028. Inside a GMP facility, the operative rulebook is the GMP layer: Annex 22, Annex 11, and Chapter 4.
Where they touch GMP-critical decisions, yes, with AI-specific additions. GAMP 5 Second Edition and the draft Annex 22 point the same way: defined intended use, independent test data, acceptance criteria, explainability appropriate to risk, and performance monitoring. How to run that validation in practice is its own discipline, covered in a dedicated guide.
About the author
Kinjal Patel
Kinjal has spent 10 years in pharmaceutical quality assurance across QMS, validation, qualification, vendor management, quality risk management, documentation, and in-process quality control, on oral solid and injectable manufacturing including batch document preparation and issuance, batch record review, IPQA, product quality review, and training management.
Leave a Reply