Draft Annex 22 in plain words
What it allows, what it excludes, and what a QA team using AI on its documents should do now.
What it covers
AI models used in computerised systems in the manufacture of medicines and active substances, where the model is used in a critical application: one with a direct impact on patient safety, product quality or data integrity. It adds to Annex 11; it does not replace it.
What the draft accepts in critical use
For critical applications the consultation draft describes only static models, which do not change while they are used, with deterministic output: the same input gives the same result.
What the draft says should not be used in critical applications
- Dynamic models that keep learning in use.
- Models with probabilistic output.
- Generative AI and large language models.
For non-critical uses the draft leaves responsibility with adequately qualified and trained people, who check that the output is fit for its intended purpose. In short: a person decides, and the model's output is one input. Whether a use is critical has to be assessed case by case.
What it asks of a critical AI model
| Area | In short |
|---|---|
| Intended use | Written and approved by subject matter experts before testing. |
| Acceptance criteria | Defined in advance, and at least as good as the process the model replaces. |
| Test data | Representative and correctly labelled, and never used for training. |
| Test execution | An approved plan; deviations investigated and justified. |
| Explainability | Record which features drove a result. |
| Confidence | Log the confidence score where applicable. If it is very low, consider flagging the result as "undecided". |
| Operation | Change control, performance monitoring and records of human review. |
What this means for AI on your documents
Our view, not the regulation's: using a language model to find gaps between SOPs, forms and specifications can be run as a non-critical support task, as long as a qualified person checks every finding against its source and makes the decision, and the risk of a missed issue has been assessed with QA before use. The model must not release a batch, close a deviation or approve a document.
Even in non-critical use we apply the same habits the draft asks for critical models: a written intended use, a test set with an answer key, a record of what was found, missed and invented, and a record of the human decision. That is how we check.
Five things to do now
- List where AI is already used, including staff using public chat tools.
- Mark each use as critical or non-critical, with a reason.
- Write the intended use for each non-critical use, and who checks the output.
- Test the tool on a set where you know the answers before you rely on it.
- Train the people who use it, and record the training. Our courses →
Sources
European Commission, EudraLex Volume 4: stakeholder consultation on draft Annex 22 "Artificial Intelligence", revised Annex 11 and revised Chapter 4, 7 July to 7 October 2025. health.ec.europa.eu