AI by risk tier: assist is not a GMP decision
On the floor, the failure mode is rarely "someone used AI". It is quieter: a generative suggestion for a deviation narrative, a cleaning hold, or a critical process parameter is treated as if it were already a GMP decision. The shift closes. The batch record moves. The qualified person sees a polished text, not the gap between assist and decide.
Using AI in the plant is not the same as one risk tier for everything. Confusing a chatbot that drafts language with a model that gates release, cleaning status, or holding time is the silent failure. The risk tier defines which gate fits each use.
Assist is not decide
In practice, generative models are useful where language and retrieval help a person work faster: drafting a deviation description from recorded facts, suggesting similar CAPA language, summarizing a long audit trail for review. They propose. A qualified person still owns the decision.
Where the decision is critical — release disposition, cleaning verification against acceptance criteria, holding-time expiry, a hard limit on a critical process parameter — the safer pattern tends to be static and deterministic: rules and models that do not learn in operation and where the same input produces the same output. Generative output can sit beside that path as context. It should not be the gate.
That distinction keeps accountability visible when something goes wrong on the shift.
What drafts and guides already imply
The draft Annex 22 of EU GMP (Artificial Intelligence) was in public consultation from July to October 2025. The working-group plan aims to deliver a final text to the Commission in late 2026. There is no in-force date announced. The draft, as consulted, already pushes toward clarity on intended use, human oversight where needed, and caution on dynamic learning in critical GMP applications. Treat it as a draft: the wording can still change.
The July 2025 draft scoped critical GMP applications to deterministic-output models only and explicitly excluded generative AI — i.e.: the most-cited AI-in-GMP regulatory text left out exactly this article's case. On 30 June and 1 July 2026, EMA held a multistakeholder workshop to shape a risk-based approach for generative AI; the public readout indicates the exclusion should be removed, Annex 22 will cover LLMs, and consensus points to risk-based control principles rather than technique-specific guardrails. Risk tier by use — not by technology — remains valid after that change.
Annex 22 is to be published together with the revision of Annex 11 and Chapter 4 of EU GMP — not an isolated change.
The FDA draft guidance on AI to support regulatory decision-making for drugs and biologicals (January 2025) and related manufacturing discussion papers keep returning to context of use and evidence commensurate with risk. The EMA–FDA guiding principles of good AI practice (January 2026) and the ISPE GAMP Guide: Artificial Intelligence (July 2025) point in the same direction: define the use, match controls to impact, and keep change control when the model, data, or prompt that affects GxP output changes.
In Brazil, ANVISA has no specific AI-in-GMP guide; what applies is RDC 658/2022 (computerized systems) and ANVISA's Computerized Systems Validation Guide. Until there is a dedicated text, Annex 22 tends to become the de facto reference — as already happens with Annex 11.
None of this waits for a final regulation to become useful. None of these documents invent a plant procedure for you. They do imply that "we have AI somewhere" is not a control strategy.
Preconditions that remain valid through a model swap
Before production use, a few mechanisms matter more than the brand of the model.
Intended use, written. What decision does this use support or make? Which recipe steps, which exception types, which reviews? If that sentence is missing, risk tier cannot be assigned and validation scope becomes unclear.
Mandatory human review for non-critical generative use. Drafts, summaries, and suggestions stay drafts until a named role accepts, edits, or rejects them. The acceptance is part of the record — not a verbal agreement.
Deterministic logic on critical paths. Where patient safety, product quality, or data integrity hinge on the outcome, prefer qualified static and deterministic rules and models. Generative assist can feed the person who decides; it should not silently replace the gate.
Completeness and "undecided". LLMs do not produce calibrated confidence; for generative use, the equivalent control is validating input completeness, validating structured output against a schema, and mandatory abstention when source data is missing. "Undecided"/escalate is the honest output; a fluent answer on an incomplete basis is how the exception disappears from the record.
Audit trail and change control. Prompt, model version, training or reference data that affect GxP-relevant output, and configuration that changes behaviour: treat them like other GxP software. A model swap that "stays validated without retest" is not a governance success. Governance exists so documented re-test and re-evaluation are possible — and expected — when the thing that generates or gates output changes.
Model-agnostic design helps here. Plants do not need an in-house LLM to govern AI. Differentiation sits in the layer around the model: intended use, human approval, audit trail, and change control. That layer should still make sense if the underlying model is replaced under a controlled change.
A claim that data "never leaves the company" only holds if the concrete deployment confirms it. Topology and contracts vary — overclaiming becomes a finding of its own.
Silent failures worth catching early
Three patterns are common.
One risk tier for all AI. A plant chatbot, a retrieval aid for SOPs, and a model touching release or cleaning are not the same tier. If IT and QA share one generic "AI policy" with no use-case map, operations will create their own shortcuts.
Generative on critical release, cleaning, or holding. Fluent text next to a critical parameter is persuasive. Without a hard gate elsewhere, people treat persuasion as evidence. That is when the exception never opens. With caution: in an April 2026 letter [ref. 1] to a finished pharmaceuticals manufacturer, FDA cites overreliance on artificial intelligence — the firm used AI agents to generate specifications, procedures, and master production records without adequate quality-unit review.
"Validated forever" after a swap. Providers update models. Prompts are changed. Reference data grows. If change control does not fire, the original validation story describes a system that no longer exists.
A related article walks through what draft Annex 22 already allows you to organize without waiting for the final text: draft Annex 22 — what you can already do with AI in GMP.
Questions before production use, for floor, QA, and IT
Worth asking before the first generative assist touches a live batch record or exception queue:
- For this use, is the model assisting a person or making (or gating) a decision?
- What is the written intended use, and which critical process parameters or release steps sit outside generative control?
- Who must approve before the suggestion becomes part of the batch record, deviation, or cleaning documentation — and where is that approval recorded?
- What happens when inputs are incomplete or the output fails schema validation: block, escalate, or "undecided"?
- If the model, prompt, or reference data change next quarter, which change-control path and re-evaluation evidence do we already have?
Where electronic batch records, weighing and dispensing, and related GxP workflows already live in a system of record with audit trail and change control — for example NEO EBR as the execution and review layer — the governance layer for AI should reuse those same mechanisms rather than invent a parallel paperwork track.
What to take to the next shift meeting
Draft Annex 22 is still a draft (consultation July–October 2025; final text expected toward the Commission late 2026; no in-force date). FDA, EMA–FDA principles, and GAMP AI materials are also evolving. The floor question that does not wait is simpler:
For each AI use on our site, can we point to the risk tier, the human who still owns the decision, and the change-control path when the model moves?
If any of those three is missing, the failure mode is not "we lack AI". It is that assist and decide have already blurred — and the batch record will not tell you until an auditor or a deviation forces the question.
References
Practical writing on GxP, MES, data integrity and shop-floor systems. A few times a month, no noise.
