EU GMP Annex 22: when a model reviews the batch record, whose signature releases the product?

A model reviews four thousand batch record entries and surfaces twelve exceptions. A human accepts its disposition. The eQMS records an approval. Nothing records which model version produced that disposition, what the human was shown, whether they overrode anything, or that they were present at all.

Part of Pharma and GxP identity

What is actually changing

EU GMP annexes are the operative detail beneath the GMP principles. Annex 11 governs computerised systems. A new annex addressing artificial intelligence brings model-assisted decisions in GMP operations — visual inspection, deviation triage, batch record review — into that same perimeter, with the validation and oversight expectations that follow.

At time of writing the text is not final, so this article designs to the obligations that will not change regardless of drafting: attribution, human oversight, audit trail, and the ability to reconstruct a decision. Those four are stable across every AI governance instrument published to date, including Articles 12 and 14 of the EU AI Act.

The integration pattern that creates the gap

AI is almost never integrated as a new workflow. It is integrated as a pre-processing layer feeding an existing approval workflow, because that is the cheapest path through change control.

batch_records → [model v2.3.1] → exceptions[] → eQMS approval task → user clicks Approve
                                                            ↓
                                              audit_trail: user_id, timestamp, APPROVED

The eQMS data model predates the model. It captures who was assigned the task, who completed it, and when. It does not capture the model identifier, the input set, the output set, the exceptions surfaced, which exceptions the human examined, or whether any disposition was overridden — because nothing in the workflow engine has a field for any of that.

The unfalsifiability problem

Consider two sites. At site A, a reviewer examines every exception, agrees with the model, and approves. At site B, a reviewer approves without opening the exception list. Their audit trails are byte-identical.

This cuts both ways, and that is the point worth making to an inspector. Site A cannot demonstrate diligence. Site B cannot be distinguished from site A. An oversight claim that cannot be falsified also cannot be evidenced, and a regulator faced with an unevidenced oversight claim on a novel technology will do the conservative thing.

If the record looks the same whether the human reviewed or not, the record is not evidence of review.

The GMP AI Oversight Receipt

A canonical statement, signed at the moment of disposition by the reviewing human's hardware credential. Six fields, each discharging a specific obligation.

The statement is canonicalised under RFC 8785 and signed with user verification required, then countersigned by the issuer so it verifies offline. An inspector can check it without access to your eQMS and without trusting your administrators.

Override delta as a governance metric

The override delta is the field that does the most work after deployment. Track its rate per reviewer per month and you get a signal that no other instrumentation provides.

• A sustained zero override rate across all reviewers is not evidence that the model is perfect. It is a prompt to check whether review is occurring.
• A reviewer whose override rate diverges sharply from peers is either catching something or misunderstanding the model. Both are worth knowing.
• A step change in override rate following a model version bump is your earliest signal of drift, arriving well before a batch-level outcome does.

None of that is available today, because the disposition and the override are not recorded as distinct events.

Mapping to the obligations you already have

Deploy it before the annex lands, not after

The commercial argument is simple and worth stating plainly to the people who fund this. The first thing a regulator does when it doubts an AI-assisted process is require reversion to the prior manual process. That reversion destroys the entire business case for the deployment, which is usually a cycle-time saving measured in weeks per batch.

Building the evidence layer now protects the investment. Building it after an inspection finding is remediation, and remediation is always more expensive than design.

Three GMP applications, one missing artefact

Objections and honest limits

“The annex is not final, so it is early to build.” Recording what a reviewer was shown costs nothing to add and cannot be created retrospectively. Building it now is cheaper than validating a change under a deadline later.

“Our validation covers the model.” Validation establishes the model performs as intended. Oversight is a different requirement about what a human did with its output, and it needs a different artefact.

Preparing for an AI annex

1. Inventory where AI already touches GMP decisions. Most sites find more than they expected.
2. Record what the human was shown. A digest of the rendered output, per decision.
3. Capture agreement and disagreement separately. Override rates are the evidence oversight is real.
4. Bind the release signature to both. The record and the oversight decision.

Terms used here

Annex

A section of the EU GMP guidelines addressing a specific area, which the AI annex will join.

Human oversight

A person's meaningful involvement in a decision — the requirement, as distinct from validation of the system.

Deviation triage

Classifying deviations by significance, increasingly assisted by automated systems.

Frequently asked questions

Is Annex 22 final? No. At the time of writing it is in development, which is why this article designs to the stable obligations — attribution, oversight, audit trail, reconstruction — rather than to draft wording that may change.

Does the receipt contain batch data? No. It carries one-way hashes of the record set and the model output, plus a structured diff of the human override. The underlying data never leaves the site.

What if we use AI only for visual inspection? The same structure applies. The input hash covers the image set, the output hash covers the classification set, and the override delta records images the human reclassified.

Does this make us compliant with Annex 22? No artefact makes anyone compliant. This produces evidence for an oversight claim you will have to make either way, in a form an inspector can verify independently.

Does model validation satisfy an oversight requirement? No. Validation shows the system performs as intended. Oversight is about what a human did with its output.

What is the cheapest thing to build now? A digest of what the reviewer was shown, captured per decision. It cannot be created retrospectively.

Why do override rates matter? Because a review process with no disagreements is evidence that the oversight is nominal.

Sources and further reading

• EudraLex Volume 4 — EU GMP guidelines
• Regulation (EU) 2024/1689 (AI Act) — consolidated text
• ICH Q9(R1) — Quality Risk Management.
• RFC 8785 — JSON Canonicalization Scheme