Can you use GitHub Copilot, Codex or Claude Code for GxP code?
In my reading, usually yes. Code for non-GxP apps that is reviewed before release is ordinary work. Code in a validated system is validated for that use.
Regulatory status checked October 8, 2026. Annex 22 and the revised Annex 11 are drafts, and FDA’s AI guidance for drug manufacturing is announced but not published. Check the dates before you rely on any of it. The cards are my reading of current rules, not official guidance.
For documents and records written with chat assistants, see Can You Use ChatGPT, Claude or Copilot for GxP Work?.
In my reading, usually yes. What decides it is the context of use: what the output is used for and who relies on it, not the brand of the tool. Most use is not GxP work at all: email, summaries of public papers, and code for non-GxP apps that is reviewed before release. Once AI output becomes a GxP record, goes into an SOP or specification, or is code in a validated system, a qualified person reviews and approves it and the system is validated for that use, the same as for work a person did.
GitHub Copilot
What it does: Code suggestions, chat, code review and agents in the editor and on GitHub. Where the output lands: Code and pull requests.
OpenAI Codex
What it does: OpenAI’s coding agent in the terminal, editor, desktop app and cloud. OpenAI: “Codex is an AI agent that helps you write, review, and ship code.” Where the output lands: Code changes, commands.
Claude Code
What it does: Anthropic’s coding agent in the terminal and editor. Where the output lands: Code changes, commands.
Microsoft 365 Copilot
Microsoft 365 Copilot writes documents and email.
GitHub Copilot, Codex and Claude Code write code. Same question for all of them: what will the output be used for?
Context of use, in plain words
Context of use is what the AI output is used for, who relies on it, and how much a GxP record or decision depends on it.
One tool, several rows
One tool can have several contexts of use. CSA says “software may have one or more intended uses depending on the individual features, functions, and operations of that software.” Say a developer uses Claude Code in the morning on an internal dashboard with no GxP data, and in the afternoon on a change to a validated LIMS report. Same tool, two rows.
A caveat, in my reading. FDA’s AI draft is about AI that produces information for regulatory decisions, and it “does not address” AI used “for operational efficiencies”. CSA is written for medical device manufacturers. I borrow their words, not their scope.
The short answer, by context of use
These cards are my reading of current rules, not official guidance. Each row is a context of use: what the output is used for, who relies on it, and its GxP impact. One tool can have several contexts of use, so the same tool can land on different rows. Your quality unit decides how your company applies this.
Row 6 GxP impact: none Code for a non-GxP app
Say the code is an internal dashboard on non-GxP data, a website, or a personal productivity script.
- Who relies on it The app’s users
- GxP impact None
- What’s usually needed Normal code review and release practice. The enterprise or business plan for the coding tool. Keep the tool away from GxP data and production GxP credentials
- Anchor in the sources Vendor terms; GitHub: “always carefully review and test code generated by Copilot”
Row 7 GxP impact: indirect GxP-adjacent tooling
Say the work is scripts that generate test data, migrate or check data, automated test scripts used as validation evidence, build and deployment pipelines for a validated system, or a read-only report on GxP data.
- Who relies on it The validation team and QA who rely on the evidence, data or report
- GxP impact Indirect. It can change validation evidence or data
- What’s usually needed Code review. A person checks that tests test the requirement and that migration checks are real. A documented, risk-based assessment that the tool or script is adequate before anyone relies on its output. Version control
- Anchor in the sources Annex 11 4.7 and 4.8; CSA “development tools” as supporting software (device scope, borrowed)
Row 8 GxP impact: direct Code in a validated system
Say it is a change to a validated LIMS or MES configuration or script, an in-house GxP application, or a validated report.
- Who relies on it The validated system, its users, and the GxP decisions it supports
- GxP impact Direct
- What’s usually needed The same as code a person wrote: a change request and requirements, code review by a qualified developer, testing under the validation approach, change control and release approval. What is validated is the system and the change, not the coding assistant. Agents get no write access to production; changes arrive only through change control
- Anchor in the sources Annex 11 4.5, 4.7, 10 and 12.1; 21 CFR 11.10(a) and 11.10(k)(2), read with FDA’s 2003 enforcement-discretion guidance; 21 CFR 211.68(b)
For anything in rows 3, 4, 7 or 8, the classification worksheet helps set how much evidence you need.
Rows 1 to 5 are in Can You Use ChatGPT, Claude or Copilot for GxP Work?.
Coding agents: GitHub Copilot, Codex and Claude Code
The coding agents discussed here can edit code, and some can run commands or open pull requests, depending on the product and configuration. The context of use is where the code runs and what it touches (rows 6 to 8). Code for a non-GxP app is ordinary software work.
GxP-adjacent tooling is where people slip. Test scripts, migration code and build pipelines do not run the GxP process, but they shape the evidence and the data. Annex 11 4.7 says “Automated testing tools and test environments should have documented assessments for their adequacy”, and 4.8 asks for “checks that data are not altered in value and/or meaning during this migration process.” In my reading, if an agent writes test scripts or migration code that produces validation evidence, a person should check that the tests test the requirement and that the migration checks are real.
Code in a validated system. In my reading, AI-written code goes through the same requirements, code review, testing and change control as code a person wrote. What gets validated is the system and the change, not the coding assistant.
I found no regulator text on AI-written code specifically, so this rests on the general rules:
FDA’s 2003 guidance says it intends to exercise enforcement discretion for the specific Part 11 validation requirement in 11.10(a) and the specific audit trail requirements in 11.10(e) and 11.10(k)(2), while applicable predicate-rule requirements still apply.
Annex 11 4.5
“The regulated user should take all reasonable steps, to ensure that the system has been developed in accordance with an appropriate quality management system.”
Annex 11 4.7
“Evidence of appropriate test methods and test scenarios should be demonstrated.”
Annex 11 section 10
“Any changes to a computerised system including system configurations should only be made in a controlled manner in accordance with a defined procedure.”
Part 11’s text at 11.10(k)(2), read with FDA’s enforcement-discretion policy described above: “Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation.”
The vendors say the same. GitHub: “You should always carefully review and test code generated by Copilot.” Anthropic’s commercial terms: “It is Customer’s responsibility to evaluate whether Outputs are appropriate for Customer’s use case, including where human review is appropriate”.
GitHub says its cloud agent’s “commits are authored by Copilot, with the human who started the task marked as the co-author.” That helps if your SOP asks you to record AI assistance. I know of no rule that requires it.
In my reading of Annex 11 12.1, which asks for controls “to restrict access to computerised system to authorised persons,” and of 211.68(b), agents that run commands stay away from production GxP systems, production credentials and live GxP data, and changes reach a validated system only through its change control. More in security is now a GMP requirement. An agent that acts inside a GxP system through tool calls is a different context of use.
What regulators have and haven’t said (as of October 2026)
FDA
No rules or guidance written specifically for AI assistants or coding agents.
What the vendors actually promise
All pages below were read on October 8, 2026.
- What it says (exact) “Codex usage, including local clients such as the CLI and IDE extension as well as web or cloud-delegated usage, is available in the Compliance API.”; “Local workflows run on your device; cloud tasks run in OpenAI-managed environments.”
- What it does not say No GxP statement
- What stays with you Review, testing and change control of the code; which plan developers sign in with
- What it says (exact) “Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms, unless the customer has chosen to provide their data to us for model improvement”
- What it does not say No GxP statement
- What stays with you Developers use the company’s commercial plan, not a personal one
- What it says (exact) “GitHub does not use either Copilot Business or Enterprise data to train its models.”
- What it does not say No GxP statement
- What stays with you Plan choice; code review
GitHub, Application card: Copilot Agents
- What it says (exact) “Customers need to evaluate potential specific legal and regulatory obligations when using any AI platforms and solutions”
- What it does not say No GxP statement
- What stays with you Review, testing, change control, regulatory assessment
Sources
Read on October 8, 2026 unless noted.
- FDA, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products, draft, January 2025.
- FDA, Computer Software Assurance for Production and Quality Management System Software, February 3, 2026.
- FDA, Part 11, Electronic Records; Electronic Signatures, Scope and Application, 2003.
- eCFR, 21 CFR Part 11 and 21 CFR Part 211.
- European Commission, EU GMP Annex 22, Artificial Intelligence, consultation draft, 2025.
- European Commission, EU GMP Annex 11, Computerised Systems, 2011, and EudraLex Volume 4.
- Vendor pages: as linked in what the vendors actually promise.
I work with Quality and AI leaders on questions about using GenAI and agents in GxP workflows defensibly. If you are working out which of your AI uses sit on which row, get in touch. You can also set rules for coding agents on GxP code.