What Does EU GMP Annex 22 Mean for ERP Systems?

By Thomas Brünger, Managing Partner

annex-22 · ai · gxpJuly 18, 2026

EU GMP Annex 22 sets the expectations for using artificial intelligence in GMP-relevant processes. For ERP systems it means that AI features and AI agents — not the deterministic parts of the ERP — need defined boundaries, human oversight, complete audit trails, and validation appropriate to their risk. It extends the existing computerised-systems expectations (Annex 11) to cover the specific characteristics of AI.

Annex 22 status: is it in force yet?

No. As at 15 August 2026, Annex 22 is still a draft and has not been adopted.

  • Published in draft on 7 July 2025, prepared by the EMA GMDP Inspectors Working Group in cooperation with PIC/S.
  • The public consultation ran to 7 October 2025 and is closed.
  • It does not appear in EudraLex Volume 4, the index of applicable GMP guidance. Annex 11 there is still the January 2011 version, and Chapter 4 is still January 2011.

Draft status is not the same as no consequence. The draft is the clearest available statement of what the inspectorate expects of AI in GMP-relevant processes, and it was drafted alongside the Annex 11 revision rather than separately - so the two are intended to be read together. Systems being designed now will still be operating when it applies.

Status verified against the primary sources on 15 August 2026: the EudraLex Volume 4 index and the stakeholder consultation page.

What changes for an ERP

Standard, deterministic ERP logic continues to fall under Annex 11. Annex 22 becomes relevant where an ERP applies AI or machine learning to GMP-relevant decisions — demand forecasting that drives production, anomaly detection in quality data, or agents that act on records. For those, the non-deterministic nature of AI raises specific questions about test coverage, explainability, human oversight, and control of the model over time.

Annex 22 and Annex 11: the difference

The two annexes do not replace each other, they interlock.

  • Annex 11 covers computerised systems in general - the deterministic ERP logic that makes up most of an ERP.
  • Annex 22 applies where AI or machine learning touches GMP-relevant decisions.
  • An ERP with AI features therefore normally falls under both, not one or the other.

In practice the Annex 11 controls stay exactly as they were, and the AI components add questions about explainability, human oversight, and how the model behaves over time.

The practical implication

Manufacturers should know where AI is used or planned in GMP-relevant processes, assess each use by risk, and ensure oversight and validation are in place before deployment. See AI in regulated manufacturing (Annex 22) for the detail, and can AI agents be used in a validated ERP system? for how this applies to agents specifically.

Independent architecture governance can help scope where Annex 22 applies in your environment.

Frequently asked questions

Is EU GMP Annex 22 in force yet?
No. As at 15 August 2026 Annex 22 is still a draft. It was published for consultation on 7 July 2025, the consultation closed on 7 October 2025, and it does not yet appear in EudraLex Volume 4 - where Annex 11 remains the January 2011 version. Draft status still matters: it is the clearest available statement of what inspectors will expect of AI in GMP-relevant processes.
Does Annex 22 apply to standard ERP features?
It applies to AI/machine-learning functionality used in GMP-relevant processes. Deterministic ERP logic falls under Annex 11; where an ERP uses AI (forecasting, anomaly detection, agents) that touches GxP decisions, Annex 22 considerations apply.
What is the difference between Annex 22 and Annex 11?
Annex 11 is the GMP expectation for computerised systems in general and still governs the deterministic ERP logic. Annex 22 adds the expectations specific to AI - non-determinism, explainability, model behaviour over time. They do not replace each other: an ERP with AI features normally falls under both.
What should manufacturers do now?
Inventory where AI is used or planned in GMP-relevant processes, assess the risk, and put oversight and validation in place before deployment — the same discipline as any computerised system, adapted for AI's non-determinism.