What Happened Between July 2025 and July 2026

Draft Annex 22 on artificial intelligence was published for stakeholder consultation on 7 July 2025 as part of a wider digital update to EudraLex Volume 4, alongside a revised Chapter 4 on documentation and a revised Annex 11 on computerized systems.2 The consultation window closed on 7 October 2025.5 It was the first time artificial intelligence had been addressed directly in the EU GMP Guide rather than folded into the general provisions of Annex 11, which had not been substantially revised since 2011.4

The draft’s core structure was sensible and, for most readers, unsurprising. It applied to AI models used in critical applications with a direct impact on patient safety, product quality or data integrity. It required a documented intended use, a documented input sample space, representative and independent test data with strict separation from training data, predefined performance metrics and acceptance criteria set before testing begins, explainability through feature attribution methods such as SHAP, LIME or heat maps, with those features reviewed as part of test result approval, formal change control, and ongoing performance monitoring in production.25 Read as a whole, it is a recognizable extension of the validation logic the industry already applies to computerized systems, adapted for models rather than code.

What generated the reaction was the boundary the draft drew around model type. Static models with fixed parameters were permitted in critical applications. Dynamic models that continue to learn during use were not. And dynamic, adaptive and probabilistic models, with generative AI and large language models named explicitly, were placed outside critical GMP use altogether.4 Non-critical use remained open, provided qualified personnel reviewed outputs and retained documented responsibility for them.3

7 Jul 2025 Draft Annex 22 published for a three-month stakeholder consultation, closing 7 October 20252
30 Jun 2026 Day one of EMA’s two-day multistakeholder workshop, held as an open session in Amsterdam and online1
Q4 2026 Target in the Inspectors Working Group work plan for delivering final Annex 22 text to the European Commission3

The consultation response changed the question

EMA’s own description of what followed is worth reading closely. The agency states that the 2025 stakeholder consultation on the draft suggested support for potentially enabling the use of technologies such as generative AI and large language models in medicines manufacturing.1 That is a notable thing for a regulator to write down. It signals that the drafting group did not treat the prohibition as settled, and that the volume and quality of technical argument in the responses was enough to reopen it.

The result was the workshop. Day one, 30 June 2026, ran as an open session in which invited experts presented opinions and evidence. Day two, 1 July 2026, was a closed session in which the Annex 22 drafting group reviewed those contributions.16 EMA has said it expects the workshop to produce a report with expert input.6 The workshop was organized by the GMP/GDP Inspectors Working Group in collaboration with the Quality Innovation Group.1

What has not happened. The prohibition has not been lifted. No revised draft text has been published. No implementation date, transition period, or grandfathering arrangement has been announced for Annex 22 in any form.3 The workshop was an evidence-gathering exercise, and the outcome is genuinely open. Any vendor telling you that generative AI is now permitted in critical GMP applications is ahead of the record.

The timeline as it actually stands

The Inspectors Working Group work plan targets Q4 2026 for providing final text to the European Commission.318 Delivery to the Commission is not publication, and publication is not legal effect. For comparison, the revised Annex 1 on sterile manufacture was published on 25 August 2022 with a date of application of 25 August 2023, and one clause deferred a further year.20 EU GMP annex revisions have historically carried an operational date some months after publication, but nothing of the kind has been stated for Annex 22 and the draft contains no transition language.3

Annex 22 was drafted by EMA’s Inspectors Working Group in collaboration with the Pharmaceutical Inspection Co-operation Scheme.3 That matters for anyone operating across regions. Whatever position the final text takes on probabilistic models will not stay inside the EU for long.

Why the Prohibition Existed: Determinism Is a Load-Bearing Assumption

Most commentary has framed the original prohibition as regulatory caution, as though EMA simply had not caught up with the technology. That framing is wrong and it leads organizations to the wrong response. The prohibition existed because a model that can return a different answer to the same input breaks an assumption that GMP validation has depended on since the discipline was invented. That is an engineering problem before it is a policy problem, and it deserves to be understood as one.

What validation has always assumed

Computer system validation rests on a simple proposition: if you demonstrate that a system produces the correct output for a defined set of inputs, and you place that system under change control so it cannot be altered without re-qualification, then you have established that it will continue to produce the correct output for those inputs in the future. Installation, operational and performance qualification all borrow their evidentiary force from that proposition. So does the practice of testing a representative sample of inputs rather than every possible one.

The proposition holds only if the system is deterministic. A deterministic system given the same input under the same configuration returns the same output every time. That is what allows a test result from qualification to say something about production behavior six months later. Remove determinism and the test result stops generalizing. You have evidence that the system produced the right answer once, for that input, on that day.

The precise nature of the problem

It is not that probabilistic models are less accurate than deterministic ones. Many are considerably more accurate at the tasks they are suited to. The problem is that accuracy measured on a test set does not transfer to a per-transaction guarantee. A model that is correct 99.4 percent of the time on a validation set gives you a population statistic. GMP records are made one at a time, and each one has to be right.

Why generative models are nondeterministic even when you tell them not to be

Practitioners often assume that setting a language model’s sampling temperature to zero makes it deterministic. It does not, and understanding why is useful when you are arguing a control strategy in front of an inspector. Research published by Thinking Machines Lab in 2025 traced the residual variability not primarily to floating-point rounding and GPU scheduling, as had been widely assumed, but to the batch-size dependence of reduction kernels during inference.9 The same prompt dispatched under a different dynamic batch size travels through a different reduction order inside operations such as matrix multiplication, normalization and attention, and the numerical result can differ.

The practical consequence is that determinism in a hosted inference service is a property of the serving infrastructure, not just of the model or the request parameters. Your prompt can be identical, your model version can be identical, your temperature can be zero, and the answer can still change because someone else’s traffic changed the batch composition. The same research demonstrated that batch-invariant kernels can restore bit-identical outputs across repeated runs, with a measurable reduction in throughput.9 That is a meaningful result for regulated use, because it converts determinism from an impossibility into an engineering trade-off you can specify and pay for.

The second problem: fabrication

Nondeterminism is only half the reason for the draft’s position. The other half is that generative models can produce fluent, well-formed output that is factually wrong, with no signal in the output itself that anything went wrong. In a GMP record, that failure mode is worse than an error that is obviously an error. A batch number that is transposed, a specification limit that is confidently misquoted, an assay result that is plausible but not the one in the source document: these pass visual review precisely because they look correct.

Work on guardrails for language models in medical safety-critical settings has made this point in the pharmacovigilance context, where the consequences of a fabricated or dropped adverse event detail are immediate and regulatory.11 The conclusion in that literature is not that the models are unusable. It is that unconstrained free-text generation is the wrong interface for a safety-critical record, and that the useful question is what constraints turn a generative capability into a controllable one.

A framing worth avoiding. Treating the prohibition as a compliance obstacle rather than an engineering statement leads organizations to look for classification arguments that reclassify a critical application as non-critical. Inspectors will assess intended use and decision pathway, not the department that owns the system or the label on the software.3 Reclassification arguments that do not change the decision pathway do not change the risk, and they will not survive an inspection.

The Questions EMA Actually Put to the Workshop

The most useful document in this whole sequence is not the draft annex. It is the workshop agenda, because it tells you exactly which arguments the drafting group considered worth hearing. EMA framed six topic areas for expert input, and every one of them is a question about controls rather than about whether the technology is good.1

TOPIC 1

Regulatory pathways for adaptive and probabilistic models

What quality risk management framework would allow adaptive or probabilistic models into GMP applications at all, and on what conditions.

TOPIC 2

Technical reliability of guardrails

How reliable are guardrails at preventing hallucinations and fabricated data, and what should happen when a guardrail fails.

TOPIC 3

Human oversight where guardrails exist

What accuracy and accountability requirements still apply to the human reviewer once technical controls are in place.

TOPIC 4

Validation lifecycle as models evolve

How the validated state is maintained when the model changes, and what evidence demonstrates that a guardrail is effective.

TOPIC 5

Strategic risk limits in high-risk areas

Where the outer boundary sits in data integrity and process control, and which decisions should remain unsuitable for AI regardless of controls.

TOPIC 6

Cybersecurity and cloud supply chain

What security and third-party risk considerations attach to models served from cloud infrastructure outside the manufacturer’s control.

Read those six together and the drafting group’s position becomes legible. EMA is not asking whether generative models are accurate enough. It is asking whether the failure modes can be bounded, detected, escalated and evidenced. Topic 2 in particular, which pairs guardrail reliability with escalation protocols when guardrails fail, is the question of a regulator who has already accepted that guardrails will sometimes fail and wants to know what the system does next. That is a substantially more advanced conversation than a debate about whether to permit the technology.

Topic 5 also deserves attention because it is the one that will not go away. Even a generous final text is likely to preserve a category of decisions that no amount of control makes appropriate for a probabilistic model. Batch disposition is the obvious candidate. Organizations that plan as though every restriction will fall are planning badly.

The Candidate Control Set for a Defensible Probabilistic Model

Here is the substance of the article. If you take EMA’s six topics seriously and work backward, you can build the control set that a probabilistic model would need in order to be defensible in a critical GMP application. None of these controls is speculative. Each one exists in production somewhere today. What has not been done well is assembling them into a single argument that a quality organization can present and an inspector can test.

The set below is six controls, presented in the order they act on a transaction. It is deliberately assembled so that each control compensates for a limitation in the one before it. The design principle is defense in depth: no single layer is sufficient, and the argument only holds when the layers are combined and the combination is evidenced.8

1

Constrain the output space

Structure the task so the model selects from a defined set of permitted values rather than generating free text. Classification into a controlled vocabulary, extraction into a fixed schema, and selection from an enumerated list all qualify. Grammar-constrained decoding enforces this at the token level by masking any token that would lead to an output outside the permitted grammar, which makes schema conformance a property of the decoder rather than a hope about the model.

2

Apply deterministic post-checks before the record

Every output passes through rule-based validation that runs outside the model and does not involve one. Range checks, referential integrity against the source system, arithmetic recomputation, cross-field consistency, and confidence thresholds that route low-confidence outputs to an undecided state rather than a value. Nothing reaches a GMP record until the deterministic layer has passed it.

3

Pin the model and prompt under change control

A specific model version, a specific prompt or template version, specific inference parameters, and a specific retrieval index version, all recorded as a configuration item and all subject to formal change control with defined re-qualification triggers. Silent upstream model updates from a vendor are treated as an unapproved change, not as an improvement.

4

Set human verification proportionate to risk

A defined and documented review model with defined reviewer competence, tied to the risk of the specific decision rather than applied uniformly. Full review of every output where the decision is high-consequence, sampled review with defined sampling rules where it is not, and mandatory review of anything the post-check layer flags. The reviewer’s accountability is documented and does not transfer to the model.

5

Monitor drift with defined action limits

Continuous measurement of model performance against the qualified baseline, with numerical action limits set in advance and a defined response when a limit is breached. Input distribution drift, output distribution drift, post-check rejection rate, confidence distribution, and human override rate are all monitored signals. Breaching an action limit triggers a documented investigation, not a dashboard color change.

6

Record full traceability of input, model version and output

For every output that touches a GMP record: the exact input, the model and prompt version, the inference parameters, the retrieval context used, the raw output, the post-check result, the confidence value, and the reviewer decision. Retained for the record retention period and reconstructable on demand. This is what makes a probabilistic system auditable at the transaction level rather than only at the population level.

Two supporting controls that are not optional in practice

Alongside the six, two further controls appear consistently in the technical literature and would be difficult to leave out of a serious submission. The first is grounding: constraining the model to answer only from a defined, version-controlled body of source material through retrieval, rather than from parametric knowledge. Retrieval reduces the rate of fabrication by controlling the context the model works from, though the published position is clear that it does not eliminate fabrication and that its effectiveness depends entirely on the quality and currency of the underlying knowledge base.8

The second is escalation on guardrail failure. EMA asked about this explicitly, and it is the control most often missing from vendor architectures. When a post-check rejects an output, when confidence falls below threshold, or when a monitoring action limit is breached, there has to be a defined path: what happens to the transaction, who is notified, what the interim manual process is, and how the event is recorded and trended. Without it, a guardrail is a filter that quietly discards work rather than a control that produces evidence.

The shape of the argument. Notice what this control set does. It does not claim the model is deterministic. It claims that the system containing the model produces a bounded, checkable, traceable output, and that every path from an unbounded model to a GMP record passes through a deterministic gate. That reframing is the whole argument. Annex 22 asks for validated behavior at the boundary of the system, and the boundary is where the deterministic controls sit.

How this maps to published control frameworks

This is not an isolated view. A framework published in ISPE’s Pharmaceutical Engineering in early 2026 sets out seven control layers for large language models in GMP decision-making, covering input guardrails, retrieval-based domain grounding, LLM selection and capabilities, fine-tuning, output guardrails, system monitoring, and explainability with audit trails.8 The framework’s stated position is that no single layer is sufficient and that the strategy depends on complementary controls compensating for each other’s limits.8 The same publication notes the option of configuring for deterministic responses, or of detecting whether an input has been processed before, while acknowledging that this adds development and deployment complexity.8

ISPE’s GAMP 5 second edition introduced AI and machine learning concepts through Appendix D11, and ISPE followed with a dedicated GAMP Guide on artificial intelligence in 2025 that extends GAMP principles to AI-enabled systems.1213 Organizations building a control argument now have more published scaffolding to work from than they did during the consultation, and citing it is worth more than inventing terminology.

What Each Control Buys, and Where It Falls Short

A control set that only lists strengths is a sales document. The version that survives an inspection is the one that states each control’s limits, because the limits are where the residual risk lives and residual risk is what the risk assessment is for. Here is the honest version.

Control What it buys Where it falls short
Constrained output space Eliminates entire categories of failure. A model that can only return one of twelve permitted deviation categories cannot fabricate a batch number, invent a specification, or produce an unparseable answer. Structural conformance becomes a property of the decoder.10 Does not make the selection correct. The model can still pick the wrong permitted value with high confidence, and constraint offers no protection against that. Also narrows the tasks the model can perform, which removes some of the reason for using a generative model at all.
Deterministic post-checks The strongest control in the set and the one that carries the regulatory argument. Rules that can be specified in advance can be tested, qualified and re-tested exactly like any other software. This is the deterministic gate between the model and the record. Only catches what the rules anticipate. A plausible, in-range, internally consistent wrong answer passes cleanly. Rule coverage becomes its own maintenance obligation and its own source of validation debt.
Version pinning and change control Restores the qualified-configuration concept that validation depends on. Makes re-qualification triggers explicit and turns a vendor model update into a controlled change rather than an undetected one. Hosted services may deprecate versions on the vendor’s schedule, not yours. Pinning a model you do not host is a contractual arrangement as much as a technical one, and the contract has to say so.
Risk-proportionate human verification Places accountability with a qualified person and provides a detection layer for failures the automated controls miss. Regulators have been consistent that oversight expectations rise as technical controls thin out.8 Human review of fluent, plausible output has a known weakness: reviewers accept what looks right. Review quality degrades with volume and with time as trust in the system builds. Sampling rules and reviewer performance both need their own monitoring.
Drift monitoring with action limits Turns the validated state into something maintained rather than something asserted once. Detects the slow failures that qualification testing structurally cannot see because they happen after it. Detects, does not prevent. There is always a window between the onset of degradation and its detection, and records made in that window were made by a degraded system. Setting the action limits requires a stable baseline that new deployments do not yet have.
Full traceability Makes the system auditable at the transaction level. Allows any individual record to be reconstructed and defended, and allows a discovered defect to be scoped precisely rather than triggering a review of everything. Produces no protection on its own. Traceability is entirely retrospective: it tells you what happened after something has already reached a record. Storage volume and retention obligations are substantial and are frequently underestimated at design time.

The residual risk that does not go away

Stack all six and one failure mode survives: the confidently wrong answer that is inside the permitted output space, passes every deterministic rule, arrives from a pinned model version, looks correct to a competent reviewer, sits inside the monitoring action limits, and is fully traced. This is the irreducible residual risk of a probabilistic system in a GMP application, and any control strategy that does not name it is not credible.

What you can do about it is bound its consequence. That is why topic 5 in EMA’s agenda matters so much. The correct response to an irreducible failure mode is to restrict the decisions it is allowed to touch, not to add a seventh control and hope. A model that mis-categorizes a deviation for triage produces a recoverable error caught downstream by quality review. A model that mis-classifies a result as within specification produces one that is not recoverable. The controls are the same. The decision consequence is not, and that is the axis the risk assessment has to be built on.

The credibility framing FDA already uses

FDA’s January 2025 draft guidance on the use of AI to support regulatory decision-making for drug and biological products builds its framework around model risk, defined by model influence on the decision and the consequence of the decision being wrong, with credibility evidence developed proportionate to that risk for a specific context of use.16 The vocabulary differs from Annex 22’s, but the logic is the same one this control set implies: controls are calibrated to consequence, not to technology.

Drawing the Critical Line Without Gaming It

Annex 22’s scope statement is narrower than most readers assume, and getting the boundary right is the single highest-value analysis a quality organization can do this year. The draft applies to AI models used in critical applications with a direct impact on patient safety, product quality or data integrity.2 Everything outside that boundary sits outside Annex 22, though it remains subject to general GMP, data integrity, security and confidentiality controls.3

The temptation, obviously, is to classify aggressively toward non-critical. That is a poor strategy and it is the one inspectors will be looking for. The published guidance is that classification should follow the intended use and the decision pathway, not the department that owns the system or the label the vendor put on the software.3

Four questions that resolve most classification arguments

  • Does the output reach a GMP record? If the model’s output is written into a batch record, a deviation record, a validation document, a released specification, or anything that an inspector could ask to see, you are in the critical conversation regardless of what the system is called.
  • Does the output influence a decision that a qualified person makes? Influence is the word FDA uses and it is the right one.16 A model that pre-populates a field a reviewer will almost certainly accept has more influence than an organization chart suggests. Recommendation is not the same as advice when the recommendation is usually followed.
  • Is there a competent, independent check downstream that would catch the error? Not a check that theoretically exists, but one that is defined, performed, evidenced, and capable of detecting the specific failure mode. If the only downstream check is the same reviewer looking at the same screen, it is not independent.
  • What happens if the model is wrong and nobody notices for six months? This is the question that separates real criticality from paperwork criticality. Work the consequence forward through product, patient and record, and the classification usually answers itself.

Applied honestly, these four questions push some systems that organizations wanted to call non-critical into the critical band, and they pull some systems out of it that had been classified critical purely because the word AI appeared in the specification. Both movements are useful. Over-classification is not a safe default: it burdens the quality organization with validation work that produces no risk reduction and slows down the deployments that would have been straightforward.

A boundary case worth thinking about now. A model that drafts a document a human then edits and approves looks non-critical, and often is. But if the model drafts a deviation investigation and the investigator’s editing pattern is to accept the structure and adjust the wording, the model has shaped the reasoning recorded in a GMP document. The classification depends on observed reviewer behavior, not on the design intent. Monitoring override rates, which the control set requires anyway, is how you find out which situation you are actually in.

The Non-Critical Band Is Where Most of the Value Sits Today

Here is the point that gets lost in the argument about the prohibition. A large share of the practical value of generative AI in a GMP organization sits in the non-critical band, where it was never prohibited, where the control argument is far easier, and where organizations can build real capability and real evidence while the final text is being written.

The draft is explicit that qualified personnel must review outputs and retain documented responsibility for them. Trade and vendor commentary has suggested non-critical candidates such as summarizing deviation reports, searching standard operating procedures, and drafting maintenance notes. Those examples are commentary rather than draft text, and each would still need its own risk assessment.43 That list is narrower than what is actually available.

READY NOW

Retrieval over the procedural corpus

Answering “which SOP covers this, and what does it say” across a document set that a person cannot hold in their head. Output is a pointer to a controlled document that the user then reads. The controlled document remains the record.

READY NOW

Drafting support with mandatory human authorship

First drafts of investigation narratives, change descriptions and training material, where the author rewrites rather than approves and the authorship is documented as human. Watch the override rate.

READY NOW

Retrospective trend and pattern analysis

Reading across closed deviations, complaints and CAPA records to surface patterns for human investigation. The output is a hypothesis for a person to test, not a conclusion entering a record.

READY NOW

Readiness and gap assessment support

Comparing internal procedures against a regulatory text to produce a candidate gap list that a subject matter expert then verifies line by line. Speeds preparation without owning the conclusion.

Why building here is the right sequencing decision

Non-critical deployments are not a consolation prize. They are where an organization develops the four things it will need if and when the critical band opens: a working retrieval architecture over its own controlled content, real measurements of model performance on its own data and its own language, a quality organization that has reviewed enough model output to have calibrated judgment about it, and a monitoring and traceability layer already running in production.

An organization that has those four things when the final Annex 22 text lands can move quickly, and can present evidence gathered from its own operations rather than from a vendor’s benchmark. An organization that waited will be starting the measurement work at the moment it wants to deploy. That gap is measured in quarters.

The one thing not to do in the non-critical band. Do not build the non-critical deployment without traceability, version pinning or monitoring on the grounds that it is non-critical. Those three controls are exactly what you will need to reuse later, they are cheap to build in at the start and expensive to retrofit, and they are what turns a pilot into evidence. A non-critical deployment with no record of which model version produced which output has taught you nothing you can use.

The Position to Take Before the Text Is Final

Annex 22 is not final. Organizations are nonetheless making architecture and vendor decisions now that will either age well or need to be undone. Here is the position we think holds up across the plausible range of outcomes.

Assume the control set, not the outcome

Whatever the final text says, it is very unlikely to say that probabilistic models are permitted in critical applications with no additional controls. Every signal points the other way: EMA asked about guardrails, escalation, oversight, validation lifecycle and evidence of guardrail effectiveness.1 The reflection paper on AI across the medicines lifecycle already established a risk-based and human-centered approach as EMA’s stated position.1415 Build the control set now. If the prohibition is retained, you have a well-controlled non-critical capability and a strong position for the next revision. If it is relaxed, you are already compliant with the conditions.

Make the deterministic gate an architectural rule, not a project decision

The single most durable design commitment available right now is this: no model output enters a GMP record without passing a deterministic check that is specified, tested and version-controlled independently of the model. Make that a standing architectural rule that applies to every AI deployment in the regulated estate. It is defensible under the current draft, it is defensible under any relaxation, and it is the control that will still be there in five years when today’s models have been replaced twice.

Write model and prompt version pinning into vendor contracts now

This is the requirement organizations most often discover too late. If a supplier can update the model behind an API without notice, you cannot maintain a qualified configuration, and no amount of internal process fixes that. The contractual requirements are specific: version pinning with a defined minimum support period, advance notification of deprecation, access to model documentation sufficient to support a supplier assessment, and the right to run your own qualification testing against the pinned version. Supplier transparency and documented capabilities and limitations are already treated as part of model selection in the published control frameworks.8 Cloud supply chain risk was one of EMA’s six workshop topics for a reason.1

Start the classification inventory before you need it

Every AI-touched system in the regulated estate needs a documented criticality determination based on intended use and decision pathway, with the reasoning written down. Most organizations do not have this and will need it either way, because the same inventory answers the Annex 11 revision and any FDA credibility assessment question. It is unglamorous work that is genuinely urgent, and it does not depend on the final text at all.

Contribute to the record

EMA reopened this question because the consultation responses contained enough technical argument to justify it.1 Industry bodies including EFPIA have published positions on AI across the medicinal product lifecycle,17 and the workshop model shows a drafting group willing to take evidence from practitioners. Organizations with real operational data on model performance, guardrail effectiveness and human override rates hold something the drafting group has explicitly asked for. That is an unusual position to be in with a regulator, and it will not stay open indefinitely.

The five commitments, in order of durability. One: no model output enters a GMP record without passing a deterministic check. Two: model version, prompt version and inference parameters are configuration items under change control. Three: input, model version, output and reviewer decision are traced for every transaction. Four: performance is monitored against numerical action limits with a defined escalation path. Five: criticality is determined by decision pathway and consequence, documented, and reviewed when reviewer override behavior changes. All five hold regardless of what the final text says.

Conclusion

The June 2026 workshop is being read across the industry as a signal that EMA is about to permit generative AI in critical GMP applications. That reading is premature and, more importantly, it points attention in an unhelpful direction. The prohibition in the July 2025 draft was not a failure of regulatory imagination. It was a correct observation that a model which can return a different answer to the same input breaks the assumption that computer system validation has always rested on. Reopening the question does not repeal that observation. It asks whether the observation can be engineered around, and what evidence would show that it had been.

The answer available today is that it can be, at the system boundary rather than in the model. Constrain the output space, gate every path to a record behind a deterministic check, pin the model and prompt under change control, set human verification proportionate to the consequence of the decision, monitor drift against numerical action limits, and trace every transaction from input through model version to reviewer decision. That set does not make a probabilistic model deterministic. It makes the system containing it bounded, checkable and auditable, which is what Annex 22 has been asking for all along. What it does not do, and what no control set does, is eliminate the confidently wrong answer that passes every check. That residual risk is real, and the honest response is to restrict the decisions it is allowed to touch rather than to add another layer and stop counting.

For most pharma and biotech organizations, the practical work for the rest of 2026 sits in the non-critical band, where the argument was never in dispute and where the retrieval architecture, the performance measurements, the monitoring layer and the calibrated quality judgment all get built. Those are the assets that determine how fast you can move when the final text arrives, whichever way it goes. Sakara Digital works with pharma and biotech organizations building AI control strategies that hold up under GxP inspection. If you are working through where your Annex 22 line actually sits, or what a defensible control set looks like for a specific use case, we are happy to have that conversation.

For Further Reading

For Further Reading