Insights
The rules are being rewritten. Here is what they mean on a live system.
Plain-English analysis of the draft EU GMP Annex 11, the new Annex 22 on artificial intelligence, and how 21 CFR Part 11 and FDA guidance apply to the same questions.
Status as at 9 October 2026.
Annex 11, rewritten: what the draft asks of every computerised system
The 2011 annex fitted on four pages. The 2025 consultation draft runs to roughly nineteen, and most of the new text turns expectations that inspectors already held into written requirements.
Read · 8 min →EU GMP Annex 22 · AIAnnex 22: validating an AI model before it touches a GMP decision
The first GMP text written specifically for artificial intelligence is narrow on purpose. It tells you which models can be used in critical applications, and exactly what evidence you need before one goes live.
Read · 9 min →21 CFR Part 11 · FDAPart 11 meets machine learning: what the US rules say about AI
There is no new Part 11 for artificial intelligence. There is a 1997 regulation that already applies, a credibility framework for AI models, and a final guidance on software assurance. Together they tell you most of what you need.
Read · 8 min →Data integrityAudit trail review that finds things
The draft Annex 11 makes audit trail review mandatory and expects it before batch release. That only helps if the review is designed to find the entries that matter.
Read · 6 min →Security · Annex 11Identity, access and the remote engineer
Multi-factor authentication, least privilege and periodic access review move from good practice to written requirement in the draft Annex 11. Here is how to get there without stopping the plant.
Read · 6 min →Cloud · SaaSYour cloud supplier is part of your validated state
The draft Annex 11 names service providers explicitly. When the system is software as a service, the evidence you need lives partly in someone else's data centre.
Read · 6 min →Requirements · TeamsOne record, many languages: requirements for international teams
When the site team, the integrator and the supplier each work in a different first language, requirements drift. Traceability is how you keep them honest.
Read · 5 min →