.png)
Executive overview
The European Medicines Agency (EMA) is preparing significant updates to the GMP framework, with formal adoption expected in 2026. The changes span documentation requirements, computerized system control, and the introduction of specific AI guidance for GMP.
What is changing in 2026
The white paper highlights three specific updates:
- Chapter 4: Documentation (revised)
- Annex 11: Computerized Systems (revised)
- Annex 22: Artificial Intelligence (new)
- White Paper - Preparing for EMA…
Change 1: Chapter 4 - Documentation (revised)
Chapter 4 expands documentation requirements to cover digital, hybrid, and hosted systems, shifting focus away from traditional recordkeeping and toward lifecycle-controlled governance. It places stronger emphasis on data governance, traceable and secure electronic signatures, and ensuring documentation practices align with ALCOA++ expectations across all document types and formats.
White Paper - Preparing for EMA…
Change 2: Annex 11 - Computerized Systems (revised)
The revised Annex 11 raises the bar for how computerized systems are validated and controlled in GMP settings. The approach is more holistic and lifecycle-based, with expectations for:
- end-to-end lifecycle qualification and validation
- strong audit trail requirements (secure, tamper-protected, and reviewable)
- clearly defined User Requirements Specifications (URS)
- periodic reviews and documented follow-up
- explicit supplier and outsourcing oversight, including cloud/SaaS environments
- documentation being accessible from the regulated user’s site, not only from vendors
- White Paper - Preparing for EMA…
Change 3: Annex 22 - Artificial Intelligence (new)
Annex 22 introduces the first EMA guidance focused specifically on the use of AI/ML in regulated GMP environments. It applies to static, deterministic AI models, while adaptive and generative models are explicitly prohibited in GMP-critical decisions. Key requirements include:
- clearly defined intended use
- validation through test metrics and pre-defined acceptance criteria
- explainability and decision logic transparency
- ongoing performance monitoring and change control
- human-in-the-loop accountability for final decisions
- White Paper - Preparing for EMA…
Strategic readiness: what organizations should do now
The white paper recommends acting early during EMA’s typical 6-12 month grace period after publication. Practical next steps include mapping system landscapes, conducting gap assessments against revised Chapter 4 and Annex 11 expectations, updating data governance models, aligning stakeholders across QA/IT/data science, and piloting compliant AI/ML use cases in non-critical settings to build capability and inspection readiness.
White Paper - Preparing for EMA…
Why this matters
Overall, the changes reflect a broader shift from procedural compliance to governed innovation, where digital and AI capabilities must be controlled, traceable, and inspection-ready. Organisations that invest early in governance, supplier oversight, and cross-functional capability-building will be best positioned to combine compliance with agility