The Annex 11 revision and draft Annex 22: what they mean for your validated systems

In 2025 the European Commission published a draft rewrite of EU GMP Annex 11 on computerised systems and a new draft Annex 22 on artificial intelligence for public consultation. Both are still drafts. The final text may change, so treat this as preparation, not a compliance deadline.

The Annex 11 revision

The draft is far longer and more detailed than the current Annex 11. It puts more weight on areas that inspectors already look at closely:

• Risk management across the system life cycle.
• Oversight of suppliers and service providers, including cloud and SaaS vendors.
• Identity and access management.
• Audit trails and their review.
• Periodic review, backup and data integrity.

Draft Annex 22 on AI

Draft Annex 22 sets expectations for AI models used in critical GMP applications. As drafted, it covers static models with deterministic output and does not cover dynamic models that keep learning in use, or generative AI and large language models in critical applications. It expects a defined intended use, suitable test data, documented performance testing and human oversight.

How to prepare your validated systems

• Run a gap assessment of current SOPs and validated systems against the draft Annex 11.
• Check supplier oversight for SaaS systems such as Veeva Vault, including audit evidence.
• Review access controls and audit trail review practice system by system.
• List any AI or machine learning features in GxP use and note their intended use.
• Recheck once the final texts are published.

QFS supports CSV and CSA validation, software vendor audits and internal audits.