Manufacturers may think of AI as a future project. In reality, AI capabilities can appear through updates to ERP, analytics, productivity, planning and supplier platforms. Some uses will be low risk. Others could touch processes connected to product quality, patient safety or data integrity.

That is why the first question is not “which AI tool should we buy?” It is “where is AI already being used, and what does it touch?”

As of August 2026, EU GMP Annex 22 remained a consultation draft. It was not operative EU GMP and should not be presented as final law. Current Annex 11 remains the baseline for computerised systems used in GMP-regulated activities.

Even so, the draft Annex 22 is useful because it shows the direction of regulatory thinking and the level of control manufacturers may need to demonstrate around critical AI use.

The official draft applies to AI models used in critical GMP applications with a direct impact on patient safety, product quality or data integrity. Its scope is limited to static models with deterministic outputs.

The draft says that dynamic models which continuously learn during use, probabilistic-output models, generative AI and large language models should not be used in critical GMP applications within its scope. For non-critical uses of generative AI, qualified people should remain responsible for checking that outputs are suitable for their intended use.

A manufacturer cannot govern what it cannot see. If a new capability is enabled inside an existing platform without clear ownership, teams may not know which process it influences, which data it uses, or who is responsible for reviewing the result.

That creates practical questions for quality, operations, IT, data and security:

• What is the intended use?
• Could the output affect quality, safety or data integrity?
• Which data is used and where did it come from?
• Who approves the use case and monitors it?
• What human review is required?
• How are changes, incidents and performance recorded?

AI governance does not need to begin with a large programme. Start with an inventory of current and planned use. Classify use cases by risk and intended purpose. Define accountable owners. Set clear boundaries for data, access, human review and change. Then choose a small number of measurable use cases.

This work is useful even if the final Annex 22 changes. It gives the organisation visibility and a defensible basis for deciding where AI can be used responsibly.

Microsoft technologies can support the foundation across identity, security, collaboration, business applications, data, analytics, integration and AI. The value for regulated manufacturers comes from joining these capabilities around clear ownership and controls, not from enabling every feature available.

Nexer helps organisations understand where AI intersects with operations, data and regulated processes. We connect that governance work to the wider Microsoft platform and focus on practical adoption that creates measurable business value without weakening control.

Do not wait for AI adoption to become widespread before creating visibility and ownership. Governance needs to grow before use scales.

Is EU GMP Annex 22 final?
No. As of August 2026, the available text remained a consultation draft and was not operative EU GMP.

What is the current baseline for GMP computerised systems?
EU GMP Annex 11 remains the current baseline, supported by other applicable requirements and the organisation’s risk-based validation approach.

Does the draft support generative AI in critical GMP applications?
No. The consultation draft says generative AI and large language models should not be used in critical GMP applications within its scope.

What should manufacturers do now?
Create an inventory of AI use, assess intended use and GMP impact, define ownership and controls, and pilot carefully with appropriate human oversight.

• European Commission, official Annex 22 consultation draft
• Microsoft GxP compliance guidance
• Make UK, AI, Skills and the Future of the UK Manufacturing Sector