AI validation in GxP doesn't have a settled playbook yet. Here's where regulators stand as of fall 2026.

Still true as of September 27, 2026. This area is moving, so check the dates before you rely on any of it.

If you are responsible for validating AI in a regulated pharma company, you have probably noticed that the AI-specific guidance is still taking shape. Existing GxP controls already apply to computerised systems, but the AI-specific layer is arriving document by document and several key pieces remain in draft. A Roche job posting seen in September 2026 described the work as a field with “no established playbook”. The documents support that view.

The most useful way I have found to read the current state of play is to sort every document into two piles: what is final and what is still draft. The final pile is smaller than people assume, and it is mostly principles and good-practice guidance. The draft pile is where the specific, binding-sounding requirements live, and some of them may still change. Knowing which pile a requirement comes from tells you how much weight to put on it.

What’s final

FDA and EMA Guiding Principles of Good AI Practice in Drug Development (January 14, 2026). This is a joint set of ten voluntary principles covering context of use, risk-based performance assessment, and managing a model over its life (FDA; EMA). Voluntary does not mean unimportant.

ISPE GAMP Guide: Artificial Intelligence (July 2025). A 290-page good-practice guide from ISPE (ISPE). It is industry guidance rather than regulation, but GAMP is a common working reference for CSV validation, so this is the most practical document in the pile.

EMA reflection paper on AI across the medicinal product lifecycle (EMA/CHMP/CVMP/83833/2023; published 30 September 2024). Published by EMA’s human and veterinary medicines committees (CHMP and CVMP) (EMA; full text, sec. 2.5.2). As the title says, it looks at AI across the whole medicinal product lifecycle rather than one function.

What’s still draft

FDA draft guidance on using AI to support regulatory decision-making for drugs (January 7, 2025). This proposes a 7-step, risk-based credibility framework built around each model’s specific use, its “context of use,” and how risky the model is. It asks for performance estimates with confidence intervals, and for evaluating the human and the AI together when a person reviews the output (FDA draft guidance, sec. IV.A.4.b). FDA’s guidance page currently labels it “Draft Level 1 Guidance. Not for implementation” (FDA). Even as a draft, the framework is a helpful way to organise evidence, and the two specific asks (confidence intervals and human-plus-AI evaluation) are worth building in now.

EU GMP Annex 22 on artificial intelligence. Public consultation ran from July 7 to October 7, 2025. The consultation draft said that dynamic or probabilistic models, such as generative AI, should not be used in critical GMP applications. EMA then held an expert workshop on June 30 and July 1, 2026 to reconsider generative AI and the safeguards around it (EMA). EMA’s GMDP Inspectors Working Group 2026-2028 work plan targets Q4 2026 for providing the Commission with final Annex 22 text (EMA work plan, p. 6). That is a planning target, not an applicability date. If your plan assumes generative AI is either banned or allowed in critical GMP use, that assumption could be wrong either way by next year.

Revised EU GMP Annex 11 (computerised systems) and Chapter 4 (documentation). Both went through the same 2025 public consultation and are still drafts (Commission consultation). EudraLex Volume 4 still lists the January 2011 version of Annex 11 as the current one (European Commission; Annex 11 full text). Until the revision takes effect, including any announced transition arrangements, the 2011 text is the one to work to.

A note on CSA

FDA’s Computer Software Assurance guidance comes up in almost every conversation about risk-based validation, so it is worth being precise about it. It was finalized on September 24, 2025 (Federal Register), and FDA replaced it on February 3, 2026 with a version aligned to the new quality management system regulation for devices (FDA).

Its official scope is production and quality system software for medical devices. It does not formally cover drug manufacturing. Some pharma companies borrow its approach anyway (that is my observation, not something FDA says): focus testing effort where the risk is, and use lighter, unscripted testing where it is low. That is a reasonable thing to borrow. It is worth saying plainly in your own procedures that you are adopting the approach, rather than implying the guidance applies to you.

The EU AI Act: where it fits in a GMP context

Regulation (EU) 2026/1744, published July 24, 2026, postpones the principal high-risk obligations to December 2, 2027 for Annex III systems, and to August 2, 2028 for systems classified as high-risk under Article 6(1) and Annex I, including AI embedded in certain regulated products such as medical devices. These delays apply to specific high-risk categories, not to every provision of the Act (EUR-Lex, CELEX:32026R1744; European Commission). My view is that for a GMP use case, the right place to start the compliance analysis is the applicable GxP requirements. AI Act obligations depend on the system’s classification and the company’s role, and are worth assessing separately.

AI is already inside validated software

This is not a future problem. AI is already running in regulated work, and some of it arrives through software you have already validated.

In October 2025, Veeva announced planned AI-agent availability for Vault Safety and Quality from April 2026, and for clinical operations, regulatory, and medical from August 2026 (Veeva, Oct 14, 2025). If your company runs those applications, check actual release and enablement status in your own environment, and account for any changes through supplier oversight and change control.

Pharma companies are also publicly describing their own uses. Merck & Co. uses generative AI to write first drafts of clinical study reports, and reports that time to a fully human-reviewed draft fell from 180 hours to 80, with 50% fewer errors (Merck & Co., Jun 25, 2025). As reported by DataIQ, Vertex built a tool that drafts informed consent forms, cutting preparation time by 90% across more than 10 trials (DataIQ, 2025). As reported by ArisGlobal, Boehringer Ingelheim deployed generative AI for adverse-event case intake, achieving up to 90% data-extraction accuracy (ArisGlobal, Jul 8, 2025).

Companies are staffing for it, too. A Roche job posting seen in September 2026 for “Validation Lead – RDT Artificial Intelligence” listed large language models, retrieval-augmented generation, and AI agents. A Pfizer job posting for “Senior Manager CSSV AI Compliance Lead”, dated February 6, 2026 on Legal.io, has since expired (Legal.io, archived March 5, 2026).

A practical checklist

The list below is my interpretation, not a regulator’s list. It is what I think the final and draft documents above add up to in practice, and no single document lays it out this way.

Step	Detail
1. Keep an inventory of AI use cases	Classify each one as GxP-regulated or not. This includes AI features that arrive inside vendor software.
2. Assess each model’s intended use and risk	The context of use drives everything after it.
3. Write a risk-based validation or credibility plan	Scale the rigour to the risk, in the spirit of ICH Q9(R1) (EMA).
4. Test on data kept separate from the training data	Performance on data the model has already seen tells you very little.
5. Report measured performance with confidence intervals	A single accuracy number without a range is hard to defend.
6. Design how humans oversee the output	Test the human and the AI together where a person reviews the result.
7. Define what counts as a change or drift that triggers revalidation	Including model version changes pushed by a supplier.
8. Review performance periodically	Across the system’s life.
9. Assess suppliers whose software has AI built in	Ask what the model is, how it is changed, and what evidence they can give you.

One small note on security. The access controls, logging, and change records around an AI system are often the same records that show it stayed in a validated state, so it is worth designing them with both audiences in mind.

Anchor to what already applies

Annex 22 may still change its stance on generative AI, and FDA’s AI credibility guidance is still a draft. The foundation for your procedures should be the GxP requirements that already apply: EU GMP Annex 11 (full text) on computerised systems, and 21 CFR 211.68 (eCFR) on computerised records for US drug manufacturing (EudraLex). The FDA and EMA Guiding Principles of Good AI Practice, the ISPE GAMP Guide: Artificial Intelligence, and ICH Q9(R1) (EMA), the international guideline on quality risk management, are the right tools for deciding how to meet those requirements for AI. They shape the how, not the whether. Then track the drafts, and plan to adjust when they are finalized rather than rebuilding from scratch.

That approach will not give you certainty, because the field is still developing. It will give you a validation approach grounded in rules that already apply, and one you can extend when the AI-specific requirements settle.

Related reading: is FDA using AI to pick inspections and what MHRA Strategy 2030 commits to on AI.

---

Want to talk through your GxP AI validation plan? That is the work I do.