AI in the pharmaceutical industry: Annex 22 & EU AI Act – current obligations and practical implementation
The use of artificial intelligence (AI) is rapidly gaining importance in the pharmaceutical industry – from increasing efficiency in everyday office work to complex applications in GMP-relevant processes. At the same time, regulatory requirements are increasing significantly. The EU AI Act and the planned Annex 22 to the EU GMP guidelines will provide a clear regulatory framework for the use of AI in regulated environments for the first time.
This article summarizes the key content of the Experts Talk “AI in the pharmaceutical industry – Annex 22 & EU AI Act as a framework for quality and efficiency”, which took place on 27 November 2025. The discussion focused on what these regulatory developments mean in concrete terms for pharmaceutical companies, what obligations already apply today and how the path from risk analysis to regulatory compliance can be successful.
Why the EU AI Act and Annex 22 are relevant now
The EU AI Act is the first comprehensive European regulation for the use of AI. It takes a risk-based approach and differentiates between AI applications according to their potential impact on people, safety and fundamental rights. The AI Act is particularly relevant for pharmaceutical companies, as many AI applications can be classified as high-risk.
At the same time, the planned Annex 22 specifies the authorities’ expectations for the use of AI in the GMP environment. Even though Annex 22 had not yet been finally adopted at the time of the Experts Talk, it was clear from the exchange with the speakers that the regulatory direction is clear – and companies should prepare now.
Annex 22 & EU AI Act at a glance: Which regulations apply to which AI use cases – from office chatbots to AI in the GMP process?
A central topic of the Experts Talk was the clear demarcation of the various regulations and their areas of application. This is because not every AI application is subject to the same requirements. The decisive factors are the context of use, risk potential and impact on product quality, patient safety and human rights.
Two sets of rules – two perspectives
- EU AI Act: The EU AI Act is a horizontal, cross-sector regulation that addresses the use of AI throughout the entire company. It applies not only to GMP processes, but also to AI applications in HR, IT, office areas and management. The aim is to protect fundamental rights, safety and health and to create trust in AI systems.
- Annex 22 (Draft): Annex 22 is a vertical, GMP-specific supplement to the EU GMP guideline. It focuses exclusively on AI applications in the regulated manufacturing environment and particularly addresses systems with an impact on product quality, patient safety and data integrity. The annex is strongly oriented towards GAMP 5 principles and supplements existing regulations such as Annex 11 and Chapter 4.
Typical AI use cases and their regulatory classification
1. office and support applications (low to minimal risk)
Examples:
- Office chatbots for text creation or translation
- Spelling and formulation aids
- AI-supported ticket or document sorting
These applications generally have no direct influence on GMP decisions or patient safety. Nevertheless, there are already requirements arising from the EU AI Act, particularly with regard to:
- Transparency about the use of AI
- Employee training (AI literacy)
- Clear internal rules on the use and handling of data
2. decision-supporting AI systems (limited to high risk)
Examples:
- AI-based decision support in QA or production
- Forecast models for maintenance, deviations or capacity planning
Regulatory requirements are increasing significantly here. Relevant factors include
- Structured risk assessment and classification
- Documentation of models, data basis and decision logics
- Clear governance structures and responsibilities
- Concepts for human control (human-in-the-loop)
The more decisions are automated or prepared, the closer these systems come to the high-risk area of the EU AI Act.
3. AI in the GMP core process (high risk / Annex 22 relevant)
Examples:
- AI-supported process monitoring
- Automated quality assessments
- AI systems with influence on approval decisions
These applications are clearly the focus of Annex 22, as the draft makes clear:
- Critical AI systems must be deterministic, validatable and explainable (XAI)
- Dynamic learning systems and generative AI are not currently intended for critical GMP applications
- Human-in-the-loop is absolutely essential
- Data quality, traceability and life cycle documentation are key success factors
The Experts Talk clearly showed that the EU AI Act and Annex 22 are not alternatives, but complement each other. Companies must consider both perspectives in order to use AI in a compliant and sustainable manner.
What pharmaceutical companies already have to consider today
A key conclusion of the Experts Talk: waiting is not an option. Even without the final adoption of Annex 22, there are already specific requirements from existing GMP regulations, the EU AI Act and general quality assurance principles.
It was particularly emphasized that companies must obtain a structured overview of all AI applications used or planned. Regardless of whether these are used in the GMP core process, in supporting areas or in everyday office work.
The key requirements include in particular
- Transparency and traceability of AI systems
- Risk assessment and classification of AI use cases
- Documentation and governance over the entire life cycle
- Training and qualification of employees
Shadow AI poses a particular risk here – i.e. the uncontrolled use of generic AI tools such as ChatGPT in day-to-day work. Without clear rules, approvals, training and documentation, this can quickly lead to deviations and compliance risks.
Implementing AI governance in practice: Tool to support regulatory requirements
It became clear that regulatory requirements such as the EU AI Act, Annex 22 (Draft) and ISO/IEC 42001 can only be implemented effectively if they are translated into clear, practicable structures.
This is where an AI governance solution from Goodly Technologies comes in, which is currently being developed specifically for regulated industries. The tool supports companies in managing AI systems in a structured and traceable manner throughout their entire life cycle: from planning and deployment to continuous monitoring.
Among other things, the focus is on:
- Systematic recording and classification of AI applications
- Documentation of responsibilities, risks and controls
- Illustration of key requirements from Annex 22
- Integration of SOPs, training and proof of audit and inspection capability
The aim is not to limit AI, but to make it usable in a controlled manner as a basis for innovation and regulatory security. If you have any questions about the tool, please contact Robert Hoffmeister: robert.hoffmeister@goodly-technologies.com
Conclusion: Set the course for compliant AI now
The Experts Talk on November 27, 2025 made it clear that the EU AI Act and the planned Annex 22 are not abstract future topics, but are already having a concrete impact on the day-to-day work of pharmaceutical companies.
Companies that already use AI or are planning to use it should act early:
- Identify AI use cases
- Assess risks
- Clarify responsibilities
- Define processes
- Train employees
Structured preparation makes it possible to use regulatory requirements not as a brake, but as a foundation for the safe, efficient and sustainable use of AI.
How the Experts Institute can support you
The Experts Institute supports pharmaceutical companies in the classification of regulatory requirements, the practical implementation of AI governance as well as training courses and workshops on the EU AI Act, Annex 22 and AI in the GMP environment. Get ahead and in touch with us: info@expertsinstitut.de
The Experts Talk series will also be continued. The next Experts Talk will take place on January 22 at 10:30 a.m. on the topic of “Pharmaceutical-grade use of generative AI”. To register for the event:
https://academy.experts-institut.de/ExpertsTalkmitChristophKthRobertSpariPharmatauglicherEinsatzvongenerativerKI
You can find more articles in our newsroom:
https://experts-institut.de/newsroom/
And feel free to follow us on LinkedIn to make sure you don’t miss any more Experts Talks:
https://de.linkedin.com/company/expertsinstitut
