GxP and AI in 2026: what is validated

This paper reflects the state of GxP guidance on AI as of 25 July 2026. Two of the frameworks discussed here, ISPE’s AI guide and EU GMP Annex 22, are less than a year old or not yet finalized. Treat any claim of full GxP-validated AI compliance with matching scrutiny.

Executive summary

Good Practice (GxP) quality frameworks were written for computerized systems whose behaviour is fixed at validation and stays fixed. Adaptive, learning AI systems change after sign-off, and the standards bodies are still working out how to validate them. GAMP 5, the sector’s core validation framework, predates the problem. ISPE only published a dedicated AI guide in July 2025. Annex 22, the GMP annex on AI, closed its public consultation in October 2025 and has not been adopted.

AI can still be used in a GxP environment today. Your quality function needs to know which parts are validated against a settled standard and which against a standard still being written. A vendor should be able to draw that line for you quickly and specifically.

Part 1: a framework older than the problem

GAMP 5, formally the ISPE GAMP 5 Guide, has been the industry standard for computerized-system validation since 2008, with a second edition in July 2022.¹ It assumes that a validated system’s behaviour is fixed, and that any change goes through controlled change management before it ships.

Adaptive AI breaks that assumption. A learning model’s behaviour can shift when it is fine-tuned, when the retrieval sources it draws on are updated, or, in some architectures, as it learns from live use. GAMP 5 has no native concept of validating a system whose behaviour is expected to move. The risk sits in validating an adaptive AI system as though it were a conventional computerized system.

Part 2: what has been published, and when

ISPE’s GAMP AI Guide, published July 2025. It extends GxP validation thinking to AI-enabled computerized systems across their lifecycle and is meant to be used alongside GAMP 5.² Seventeen years passed between GAMP 5’s first publication and this guide. A vendor citing “GAMP 5 compliance” for an AI system should also cite this guide, or explain how their validation handles adaptive behaviour.

EU GMP Annex 22, consultation closed October 2025, not yet adopted. Annex 22 is a new annex to EudraLex Volume 4, the EU’s GMP guidelines, that addresses AI and machine learning in Good Manufacturing Practice directly.³ Its public consultation ran from 7 July to 7 October 2025. The European Commission and EMA working group is reviewing the consultation comments. Final adoption is expected by the end of 2026, so the final annex does not exist yet. With that many comments, the adopted version could differ from the current draft in important ways.

Part 3: what is validated versus what vendors claim

“GAMP 5 compliant” is not the same claim as “validated for adaptive AI behaviour.” GAMP 5 compliance is a meaningful claim about a system’s development and validation process. It does not mean the vendor has solved adaptive behaviour, which GAMP 5 was not written to address. Ask the vendor to separate the two claims.

“Annex 22 ready” is a claim about a document that does not yet exist in final form. A system claimed as validated against, or compliant with, EU GMP Annex 22 is being measured against a draft. Preparing for it is still useful. The claim should read “ready for a draft standard, subject to revision”.

A validation approach must describe how it handles model drift. The gap GAMP 5 does not cover is a system whose behaviour changes after validation. A serious answer says how the vendor detects and controls drift between validation events: what is monitored, what triggers re-validation, and what evidence is kept. “We follow GAMP 5” is correct but incomplete.

Part 4: where AI is landing in GxP-adjacent work today

The AI projects that get funded fastest in this sector stay away from therapeutic decisions and validated manufacturing processes. They work on the paperwork and the physical count around the product.⁴ One example is reconciling a returned kit against its manifest, with an audit trail and a confidence score on every uncertain read. Another is catching a cold-chain temperature excursion before it becomes a batch write-off. Both sit beside the validated process, so they can be audited and evaluated against a baseline before any GxP validation conversation.

The same applies to data handling. An architecture that keeps patient or clinician data away from a third-party model removes a category of risk before validation starts. The sensitive data never reaches the system being validated.⁵ GxP validation of the AI system itself is still required, but it has less to cover.

Part 5: questions to ask a vendor

Ask these in order.

“Walk me through what happens between validation events.” Asking “is it GAMP 5 compliant” invites a rehearsed yes. Ask what is monitored between validations, what triggers an unscheduled re-validation, and what auditable evidence is kept. A good answer names signals such as drift metrics, retrieval source changes and fine-tuning events, each with a threshold or process. A weak answer describes a general commitment to quality.

“Show me the evaluation set, not the demo.” The same discipline keeps an AI system trustworthy at launch and between validations: a defined, adversarial evaluation set it must keep passing.⁶ Look for a concrete evaluation set, a stated pass-rate bar, and a process for when a case regresses. A success story alone is an anecdote.

“Which specific claim are you making, GAMP 5, the ISPE AI Guide, or Annex 22 readiness, and against which version?” Two of these documents are less than a year old and the third is not final. The answer should name the document and, ideally, its date or version. Press hardest on an answer that stays at “full GxP compliance”.

These questions target what conventional guidance does not cover: behaviour that changes after validation.

What is still unsettled

• ISPE’s GAMP AI Guide (July 2025) has a limited track record in real inspections and audits.
• EU GMP Annex 22 has not been adopted. The consultation comments are still being worked through, and the version adopted, expected by the end of 2026, could differ from the draft that closed in October 2025.
• No guidance yet answers “how do you validate a system whose behaviour can change after validation” with the specificity a GAMP 5-style framework normally provides.
• FADP obligations and GxP validation are separate conversations with separate stakeholders. A system that meets one and misses the other tends to surface the gap during an audit, where fixing it costs most.

Where this fits

Which parts of an AI system’s lifecycle need GxP validation, and which framework covers each part, is a question for the first stage of an engagement, before the build decision.⁷ The wider regulatory picture for pharma and life sciences, including revFADP, is on AI regulation in Switzerland. The pharma sector page covers where a first AI project in this sector tends to hold up.

Footnotes

1. ISPE, GAMP 5 Guide, Second Edition (July 2022; GAMP 5 first published 2008), the pharmaceutical industry’s standard framework for computerized-system validation. Global. https://ispe.org/publications/guidance-documents/gamp-5-guide-2nd-edition ↩

2. ISPE, “ISPE GAMP(R) Guide: Artificial Intelligence,” published July 2025, designed to be used alongside GAMP 5 (Second Edition) to extend GxP validation thinking to AI-enabled computerized systems across their lifecycle. Global. https://ispe.org/publications/guidance-documents/gamp-guide-artificial-intelligence/ ↩

3. European Commission / European Medicines Agency, “Stakeholders’ Consultation on EudraLex Volume 4 - Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and New Annex 22,” public consultation open 7 July 2025 to 7 October 2025, covering a new Annex 22 setting requirements for AI and machine learning in the manufacture of medicinal products and active substances. As of this writing, no final version has been published; the working group is reviewing the comments received during consultation, with final adoption expected by the end of 2026. EU. https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en ↩

4. See a cold-chain command centre and the pharma sector page for how these projects are scoped. ↩

5. See anonymize before inference and how we handle your data for the architectural pattern referenced here. ↩

6. See an adversarial evaluation harness for allergen safety and evaluation before you build for what this discipline looks like in a different regulated domain. ↩

7. See the KARPINITY method for the full six-stage structure, including how a regulatory applicability note is produced as part of stage 01. ↩