GMP in transformation: what do the new drafts of Chapter 4, Annex 11, and Annex 22 tell us?

In recent months, the pharmaceutical regulated sector has witnessed an unprecedented process of regulatory update. The draft versions of Chapter 4, Annex 11, and the recently published Annex 22 of the GMP represent a significant evolution of the European regulatory framework, with direct implications for how we understand documentation, computerized systems, and data verification in GMP environments. 

Beyond specific changes, these documents point toward a fundamental transformation:  

Below, we review the main axes of this regulatory evolution and their potential impact on the industry. 

Chapter 4: From documentation to critical information control 

The revision of Chapter 4 of the GMP focuses on data integrity as a cross-cutting pillar. While it traditionally focused on documentation control, the new draft incorporates key concepts such as:

• Critical data: Introduces the need to identify which data are critical to ensuring product quality and decision-making.
  
  
• Definition of ALCOA+: The chapter reinforces the need for data to be attributable, legible, contemporaneous, original, and accurate, adding traceability, durability, and availability.
  
  
• Responsible digitalization: Although it does not promote or mandate digitalization, it recognizes its use and requests ensuring version control, traceability, and the security of electronic records.

Overall, the new Chapter 4 elevates responsibility regarding how relevant data is managed and verified, opening the door to closer collaboration between Quality, IT, and Operations.

Annex 11: Beyond validation. Security, traceability, and operating in the cloud

The new draft of Annex 11 is currently under revision, and its final publication is expected during the first quarter of 2026. This update does not include references to artificial intelligence, but it does represent a profound update across several key aspects:

• Cloud systems (cloud): Reforces the focus on the validation and control of cloud solutions, emphasizing shared responsibility between the manufacturer and the service provider.
  
  
• Security and cybersecurity: Introduction of stricter controls on access, risk management, and protection against IT threats.
  
  
• Audit trail and technical traceability: Aligned with Chapter 4, control over records generated by computerized systems and traceability within the data lifecycle are reinforced.

This revision positions validation as part of a broader computerized system control model, where lifecycle oversight, supplier management, and technical data integrity gain prominence.

Annex 22: Artificial Intelligence in regulated environments and end-to-end traceability

Annex 22 is a new regulatory document currently in the public consultation phase (July 2025), marking an important milestone in the digitalization of the regulated sector. Its content focuses exclusively on establishing requirements for the use of artificial intelligence (AI) models in critical GMP applications, such as data classification or prediction with an impact on product quality or patient safety.

The text expressly prohibits the use of generative models (such as LLMs or generative AI) in critical processes and limits its application to static and deterministic models—meaning those that do not learn or change once "trained," i.e., after their development and tuning phase.

Among the key regulated aspects are:

• Clear definition of intended use and input data:
  Because the model must be used only within the context for which it was designed and validated. Any use outside this framework could generate unreliable results. Furthermore, input data must be well-characterized to ensure the model can process them correctly and provide valid results.
  
  
• Acceptance criteria and model validation: 
  Because a model without defined acceptance criteria cannot be considered reliable. It is mandatory to establish clear metrics that validate that the model functions correctly and complies with regulatory requirements before being used in a GMP environment.
  
  
• Independence of test data: 
  Because if the data used to validate the model were already part of the "training," it will not be possible to evaluate whether the model generalizes correctly. Independence ensures robust and reliable validation, minimizing the risk of bias or overfitting.
  
  
• Review of explainability features such as SHAP or LIME:
  • SHAP (SHapley Additive exPlanations): Based on game theory, it calculates the weight of each variable in the prediction. It is highly accurate and robust.
  • LIME (Local Interpretable Model-agnostic Explanations): Simplifies the model around a specific point to see how the prediction varies if inputs are slightly changed.
    
    
  These are required because if an AI model is to be used in a critical GMP process, it is mandatory to justify how and why the model arrived at a conclusion.
  
  
• Performance monitoring and maintenance under change control: Because models can degrade over time or cease to be valid if input data, usage context, or the operating environment change. Monitoring performance and applying change control guarantees that the model remains valid, traceable, and suitable for its regulated purpose.

This Annex represents a pioneering step toward explicit AI regulation in the pharmaceutical field, establishing a technical and quality foundation that will very likely influence future global regulations. 

Where are we headed?

A detailed analysis of the proposed changes reveals that the EMA (European Medicines Agency) is proposing a significant paradigm shift regarding technology use. While current regulations define what must be complied with, the new updates go into detail about how compliance must be achieved. This is a step forward that will undoubtedly shape the future of technologies used in GMP environments.

The updates to Chapter 4, Annex 11, and Annex 22 reflect a clear intention to:

• Align regulatory expectations with an increasingly digitalized environment.
• Reinforce data traceability and integrity across all processes.
• Promote a risk-based control culture, collaboration, and evidence.
• All with the ultimate purpose of ensuring product quality and, especially, patient safety.

This paradigm shift demands preparation, technical knowledge, and adaptability. Companies must review their procedures, redefine their approach to the data lifecycle, and, above all, rely on appropriate guidance to translate these new requirements into sustainable and auditable practices.

Regulatory changes summary table

How to prepare?

At Ambit Iberia, we guide our clients through the interpretation and practical application of new regulatory frameworks, combining technical, regulatory, and operational perspectives. If you need support adapting your quality system or reviewing your data and integrity strategy, we would be delighted to help you. Contact us by clicking here.

We have been experts for over 20 years in developing IT strategies and solutions. We help the pharmaceutical, medical device, and IVD (in vitro diagnosis) medical device sectors comply with regulations throughout the product lifecycle. We design and implement innovative infrastructures thanks to a comprehensive service offering acting as a key enabler for digital transformation.