Table of Contents

• 1. Introduction

• 2. What Annex 22 covers—and what it prohibits

• 3. Why it matters: compliance meets innovation

• 4. A case in point: Predictive Maintenance (PdM)

• 5. The technical path: from data to prediction

• 6. Prescriptive framework: 9 steps to compliance

• 7. The bigger picture: preparing for Annex 22

1. Introduction

Artificial Intelligence (AI) is transforming industries worldwide. In pharmaceutical manufacturing, the stakes are high. AI models here affect patient safety, product quality, and regulatory compliance.

The European Medicines Agency (EMA) introduced Annex 22—the first regulatory guideline for AI in GMP (Good Manufacturing Practice) environments. Published in 2023 and under industry consultation, it is expected to become law by late 2025 or early 2026.

Annex 22 is the world’s first in pharma AI regulation, setting a precedent others will likely follow. It complements updates to Annex 11 (Computerized Systems) and Chapter 4 (Documentation), ensuring regulations keep pace with technology.

2. What Annex 22 covers—and what it prohibits

Annex 22 defines how AI may be used in regulated pharmaceutical settings. It applies to computerized systems in GMP environments where AI/ML models support critical applications.

• Critical applications directly affect patient safety, product quality, or data integrity.

  • Allowed: Static models (deterministic outputs, no real-time learning).

  • Not allowed: Dynamic models (adaptive/probabilistic outputs) and Generative AI/LLMs.

• Non-critical applications have no direct patient safety impact.

  • Allowed: Generative AI and LLMs with Human-in-the-Loop (HITL) oversight.

This distinction allows AI innovation while ensuring life-critical functions remain governed and auditable.

3. Why it matters: compliance meets innovation

Annex 22 redefines how pharma companies develop and deploy AI. It calls for treating AI models not as “black boxes” but as regulated systems requiring validation, documentation, and lifecycle management like traditional software.

This raises key industry questions:

• How should companies prepare their data governance frameworks?

• How will AI models undergo validation in GMP environments?

• What are the implications for continuous monitoring and re-validation as models evolve?

4. A case in point: Predictive Maintenance (PdM)

Predictive Maintenance (PdM) is an AI use case gaining traction in pharma manufacturing.

PdM uses data from sensors and IIoT platforms to predict equipment failures. By analyzing vibration, temperature, torque, and operational data, AI models forecast when motors, conveyor belts, or bioreactors might fail.

The benefits include:

• Reduced downtime and unplanned shutdowns

• Optimized maintenance resource use

• Extended equipment lifespan

• Improved product quality and compliance through stable operations

For PdM in pharma, Annex 22 ensures data pipelines, feature engineering, and model validation are structured, auditable, and aligned with GMP principles.

5. The technical path: from data to prediction

Building a PdM model in pharma involves stages aligned with Annex 22:

1. Data gathering: Collect from sensors, logs, and operational parameters.

2. Data pre-processing: Address missing values, detect anomalies, normalize scales, align timestamps.

3. Feature engineering:

   • Time-based features: lag analysis, seasonality, rolling averages.

   • Frequency features: FFT, autocorrelation, seasonal patterns.

   • Classification features: categorical encodings, PCA for dimensionality reduction.

4. Modeling:

   • Forecasting (ARIMA, SARIMA, LSTM).

   • Error prediction (Random Forest, XGBoost, DNN).

   • Anomaly detection (Isolation Forest, TimeGPT).

5. Validation and deployment: Test models, deploy in parallel, then move to production.

Each stage must be documented, justified, and controlled to ensure predictive accuracy without sacrificing transparency or compliance.

6. Prescriptive framework: 9 steps to compliance

Annex 22 defines a lifecycle for AI/ML in critical GMP applications, ensuring systems are effective, governed, and auditable.

1. Intended use – Define the AI system's purpose.

2. Test metrics – Establish performance measures (accuracy, sensitivity, specificity).

3. Test data – Ensure robust data management controls.

4. Model development – Maintain engineering journals, design specs, and traceability.

5. Model testing – Conduct rigorous, documented evaluations.

6. Acceptance – Formal review and approval.

7. Parallel deployment – Run the AI model alongside existing processes to validate outputs.

8. Validation & release – Approve for GMP production use.

9. Maintenance & continuous validation – Monitor performance and re-validate as needed.

This framework adapts software validation lifecycles to AI’s unique risks and adaptive nature.

7. The bigger picture: preparing for Annex 22

Annex 22 signals a new era for pharma and life sciences, requiring:

• Building stronger data governance systems.

• Rethinking AI model development as a regulated, validated process.

• Investing in compliance-first AI strategies ensuring transparency, explainability, and audit-readiness.

• Identifying safe use cases like Predictive Maintenance that maximize ROI while meeting compliance.

This regulation is not a barrier but an enabler, pushing pharma toward responsible AI adoption.

As Winston Churchill said:
“To improve is to change; to be perfect is to change often.”

With Annex 22, there is a guidepost to change which is essential for improvement, trust, and long-term competitiveness.

8. Related Posts

• #069: EU's Annex 22 Draft Guideline on Artificial Intelligence