GxP AI Validation: The Vendor's Package Covers Its Use, Not Yours

If you are buying an AI tool for a GMP-critical step, the vendor's validation package shows the model works for the use the vendor tested, and the inspector will ask about the use you run. The binding EU text, Annex 11 from 2011, already requires formal agreements with suppliers and says documentation supplied with off-the-shelf products "should be reviewed by regulated users to check that user requirements are fulfilled." The draft revision of Annex 11 is blunter: relying on a vendor's qualification "does not change the requirements," and "the regulated user remains fully responsible." The two AI-specific texts everyone quotes, the draft EU GMP Annex 22 and the FDA's draft AI credibility guidance, were both still drafts when this was checked on October 13, 2026.

So buy against what binds today: Annex 11 (2011), your data integrity procedures and GAMP 5. Use draft Annex 22 as the acceptance-test specification, because at six pages it is the most concrete text available. Write the context of use in the FDA's seven-step shape so one file serves both agencies. Keep the EU AI Act in a separate workstream; for most manufacturing models it is the wrong frame. Any vendor claiming "Annex 22 compliance" today is describing a draft that its own drafting group is rewriting.

Framework	Status on Oct 13, 2026	Binding?	What it makes you produce	Lead with it when	Do not lead with it when
EU GMP Annex 11 (2011)	In operation since 30 June 2011	Yes, for EU GMP	Supplier agreements, risk-based validation, change control, periodic evaluation	Always; it is the floor	Never skip it, but it says nothing about test data independence
Draft EU GMP Annex 22	Consultation closed 7 Oct 2025; scope under revision	No	Intended use, acceptance criteria, independent test data, explainability, drift monitoring	You run a static, deterministic model in a critical step	Your tool is an LLM in a critical step; the draft excludes it
FDA AI credibility framework (draft)	"Draft Level 1 Guidance. Not for implementation."	No	A seven-step credibility assessment scoped to one context of use	You ship to the US or file data the model produced	You want a test protocol; it gives structure, not acceptance criteria
ISPE GAMP AI Guide	Published July 2025; $540 member / $1,125 non-member	No (industry guidance)	A lifecycle and a split of supplier versus user duties	You have several AI systems and need one method across them	You have one static vision model; draft Annex 22 covers it in six pages
EU AI Act	High-risk dates moved to 2 Dec 2027 and 2 Aug 2028	Yes, where in scope	Provider technical documentation and conformity, deployer duties	The model is a safety component of a regulated product	It is an internal manufacturing model; most are not high-risk

The comparison below uses one reference purchase so the five texts are measured against the same thing: a static image classifier that accepts or rejects filled vials on one fill-finish line at an EU site that also ships to the US, bought as part of a vendor's inspection system and replacing manual visual inspection. Where a second case helps, it is a hosted LLM that drafts deviation investigation summaries for a QA reviewer to sign.

---

What Is Binding on October 13, 2026, and What Is Still a Draft?

Only Annex 11 (2011) and the general GMP rules around it bind you today; every AI-specific text is a draft, voluntary, or industry guidance. The European Commission's consultation on Chapter 4, Annex 11 and the new Annex 22 opened on 7 July 2025 and closed on 7 October 2025. None of the three has been adopted since. PharmTech reported in August 2026 that EMA's working group was targeting Q4 2026 for a final text to the Commission. EMA's own pages give no date.

The FDA side is in the same state. The draft guidance on AI that supports regulatory decisions for drugs and biologics was issued in January 2025 under docket FDA-2024-D-4689, and its page still reads "Not for implementation. Contains non-binding recommendations." The joint FDA and EMA guiding principles published on 14 January 2026 list ten principles, including "Clear context of use" and "Life cycle management," and describe them as principles industry "can consider." They point the direction without creating an obligation.

The US enforcement record is short and instructive. In Warning Letter 320-26-58, dated April 2, 2026, FDA cited Purolea Cosmetics Lab under a heading titled "Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing." The firm had used AI agents to create specifications, procedures and master production records. When told it had skipped process validation, it replied that the AI agent "never told you it was required." FDA cited 21 CFR 211.22(c), a long-standing quality unit rule, and wrote that any AI output "must be reviewed and cleared by an authorized human representative of your firm's QU." The first AI enforcement action in drug GMP used an existing rule, and your AI purchase will be inspected the same way.

Static or Adaptive: Which Models Can Go in a GMP-Critical Step?

Under the July 2025 draft, only static, deterministic models belong in a critical GMP application. A static model is one whose parameters are frozen, so it does not adapt its performance during use by incorporating new data. A deterministic model returns identical outputs for identical inputs. Draft Annex 22 §1 says dynamic models that "continuously and automatically learn" and probabilistic models "should not be used in critical GMP applications," and it says the same of generative AI and LLMs. In non-critical applications, qualified personnel must take responsibility for whether each output is suitable, which the draft calls human-in-the-loop.

The vial classifier passes this test if the vendor freezes the weights and pins the version. A hosted LLM fails it on two counts. Horace He and colleagues at Thinking Machines sampled 1,000 completions at temperature 0 from Qwen3-235B and got 80 unique outputs, because the GPU kernels were not batch-invariant and batch size depended on server load. On Anthropic's API, setting temperature to a non-default value returns a 400 error on Claude 4.7 and later models, so the usual determinism setting is no longer available to you. Your deviation-summary LLM stays in a non-critical step with a signing reviewer, which is where the current draft puts it.

That line is moving. EMA ran a two-day workshop on 30 June and 1 July 2026, and its report, published 2 October 2026, says consultation comments supported allowing LLMs in GMP applications "whether critical or non-critical." It says the drafting group "has therefore discussed the scope of Annex 22 to allow dynamic or adaptive models, probabilistic models, and Generative AI/LLMs in GMP applications," provided they meet the annex and sit under a documented, risk-based control strategy. The report's next steps carry no date and no commitment. The industry position recorded there also concedes that "a valid QRM outcome may still be 'do not use'" where uncertainty cannot be controlled.

Plan for the static rule and treat the wider scope as an option you may get later. A purchase that only works if the final annex admits LLMs into critical steps is a bet on a text nobody has seen.

Why Is Context of Use the Unit of Validation?

Context of use is the specific question a model answers, the decision it feeds, and the conditions under which it runs, and every credibility claim is scoped to it. The FDA's draft builds its seven-step assessment on it: define the question, define the context of use, assess model risk, plan the credibility activities, execute them, document results and deviations, then decide whether the model is adequate for that context. Change the context and you are back at step two.

Draft Annex 22 reaches the same place from the GMP side, and its clauses explain why a vendor's package rarely transfers:

1. Your sample space differs. §3.1 requires a characterisation of the input data "and all common and rare variations," and §3.2 lets you split it into subgroups by "geographical site or equipment." The vendor tested on its lines, its glass, its lighting. Your line is a subgroup it never saw.
2. You hold the baseline. §4.3, "No decrease," sets acceptance criteria "at least as high as the performance of the process it replaces," which means you must know how well your own inspectors perform today. No vendor holds that number.
3. Test data must be independent of the people who trained the model. §6.2 says staff involved in development and training must "never have had access to the test data," protected by access control and audit trail. A vendor's internal test set may satisfy that for the vendor. You cannot verify it unless the contract lets you see how it was held out.
4. Your SME owns the description. §3.1 and §4.2 make a process subject matter expert responsible for the intended use and the acceptance criteria, approved before acceptance testing starts. §2.2 says documentation must be "available and reviewed by the regulated user" even when a supplier trained and tested the model.

Treat the vendor package as useful input. GAMP 5 tells you to "maximize supplier involvement to leverage knowledge, experience, and documentation where possible", and the draft Annex 11 §7.2 lets you leverage a supplier's work after an audit or a thorough assessment. What it cannot do is replace your intended-use description, your baseline, and a test on data from your own line.

---

Each Framework, Judged on the Vial Classifier

EU GMP Annex 11 (2011) is the one you are inspected against today, and it is short enough to read in an hour. §3 requires formal supplier agreements with "clear statements of the responsibilities of the third party," a risk-based decision on audit, and supplier quality information "made available to inspectors on request." §10 puts every change, including configuration, under a defined procedure, and §11 requires periodic evaluation that covers "upgrade history" and performance. It was written before learned models were common, so it says nothing about holding out test data, drift in the input space, or confidence thresholds. Every buyer starts here, and for a learned model it is not enough on its own.

Draft EU GMP Annex 22 is the best test specification available and a weak basis for a compliance claim, because it is not final. Sections 3 through 10 map onto a validation plan almost line by line: intended use, metrics and acceptance criteria, test data selection and labelling, independence, a pre-approved test plan, feature attribution with tools like SHAP or LIME (§8.1), confidence logging with an "undecided" output when confidence is low (§9.2), then change control, configuration control and monitoring in operation (§10). Build your acceptance test to it now and you will have done most of what any final version asks. Do not lead with it if your tool is generative or adaptive and you need it in a critical step: the current text excludes you, and the replacement text does not exist yet.

The FDA AI credibility framework gives you the document structure that works for both agencies. Its strength is that it forces you to write down the question and the context of use before anyone tests anything. Its weakness for a GMP buyer is that it is a framework for credibility evidence, with no acceptance criteria or test-data rules of its own, and it is still marked "not for implementation." An EU-only site gains structure from it and no obligation. A site that ships to the US should use it as the cover document over the Annex 22-style test.

The ISPE GAMP AI Guide is the most complete method and the only one you pay for: $540 for ISPE members and $1,125 for non-members, digital, per ISPE's publication page checked on October 13, 2026. It runs 290 pages, was published in July 2025, follows the system lifecycle, defines responsibilities for regulated companies and suppliers, and is meant to be used with GAMP 5 (Second Edition), which costs the same. Buy it if you run several AI systems and need one method across quality, IT and the vendors. Skip it if you have one static vision model; the six-page draft annex and GAMP 5 cover that case. A vendor citing alignment with the guide is describing its own process, which you still have to test against your line.

The EU AI Act is the loser for this purchase, and the reason is scope. Its high-risk obligations attach to systems in Annex III or to AI that is part of a product under EU product safety law, and the AI Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, moved those dates to 2 December 2027 and 2 August 2028. Sidley's analysis of AI in drug manufacturing concluded that "far from all applications, if any, will be considered high-risk", and that GMP and other GxP standards do the work instead. The Act also places most of its documentation on the provider, while GMP places accountability on you as the regulated user. Run the classification once with counsel, record the answer, and keep the GMP validation file out of the AI Act workstream. The exception is a model that is a safety component of equipment covered by EU product legislation; check that case specifically, because both regimes would then apply and their documents differ.

The Supplier Clauses to Negotiate Before You Sign

Draft Annex 11 §7.5 is the best contract checklist available, because it lists what an inspector will expect your agreement to contain. Among its nine items are conditions for supplier audits, support during regulatory inspections, an exit strategy "by which the regulated user may retain control of system data," and "the process for release of new system versions and on the regulated user's possibility to test these prior to release." §7.4 adds that documentation must be "accessible and can be explained from their facility," meaning at your site. Translate those into AI-specific terms before procurement closes:

• Model documentation at the level draft Annex 22 expects: intended use as the vendor tested it, metrics, acceptance criteria, test-data characterisation, and how test data was held out from training.
• Training-data provenance: what the model learned from, at what sites and on what equipment, so your SME can judge whether your line is inside that sample space.
• Version pinning: a named model version that does not change under you, and a written statement of what counts as a new version (weights, preprocessing, thresholds, runtime).
• Change notification ahead of any retraining or replacement, with enough lead time for your impact assessment, retest and QA approval, plus the right to test the new version before it reaches production.
• Audit and inspection rights: on-site or remote audit of the vendor's AI development process, and a named contact who will answer an inspector's questions with you.
• Exit: your test data, labels, results and audit trails returned in a usable format if you leave.

Hosted models make the version clause the hardest one to win. Microsoft's Foundry lifecycle policy retires a GA model 18 months after launch, or 12 months for Anthropic, DeepSeek, Fireworks and Mistral models, with at least 60 days' notice. Standard deployments are auto-upgraded at retirement: when gpt-4o version 2024-05-13 retires on 2026-12-09, those deployments move to gpt-5.6-sol. You can set NoAutoUpgrade, in which case the deployment stops working at retirement, and Microsoft reserves an emergency retirement "with shortened notice." Anthropic gives "at least 60 days' notice" and notified Claude Sonnet 4.5 users on September 30, 2026 of a November 30, 2026 retirement. If your validated step depends on a hosted model, those dates belong in your change control calendar, and the vendor's SaaS contract has to say what happens when its upstream provider retires the model.

The EMA workshop report states the consequence plainly: "If a third-party model or Application Programming Interface (API) cannot provide necessary outputs, rationale, logs or evidence needed for control, the manufacturer cannot measure and justify the system adequately."

After Go-Live: Drift, Retest Triggers and the Vendor's Release Cadence

Validation of an AI model is a lifecycle activity, and the change-control process has to be designed for the vendor's release rhythm before the first release arrives. Draft Annex 22 §10.1 puts the model, the system it runs in, and "the whole process it is automating or assisting" under change control, including "any change to physical objects the model is using as input." A new vial supplier, a lamp replacement or a camera firmware update is a change to the model's inputs. Any decision not to retest "should be fully justified."

Monitoring has two parts. §10.3 asks you to watch the model's own metrics for deterioration, with "change of a lighting condition" as the draft's own example. §10.4 asks you to watch whether input data is still "within the model sample space," with defined drift metrics. Annex 11 (2011) §11 then folds both into periodic evaluation alongside incidents, deviations and upgrade history.

Write the retest triggers down at go-live so nobody argues about them during a deviation:

• A new model version, threshold, or preprocessing step from the vendor.
• A change to equipment, materials, lighting or site that alters the input sample space.
• Drift metrics crossing the limits set at validation.
• A rise in "undecided" outputs or human overrides beyond the validated rate.
• Any deviation where the model's output contributed to the root cause.

For the human-in-the-loop LLM, §3.3 and §10.5 of the draft say the operator's training and consistent performance "should be monitored like any other manual process," and that review may mean checking every output. The workshop report goes further: human oversight "cannot compensate for inadequate validation." If reviewers sign off on the deviation summaries at a rate that suggests they are not reading them, the control has failed, and the Purolea letter shows how FDA writes that up.

The Honest Gap: Buy Against What Binds, Register the Rest

Two of the anchor texts are drafts, and the most consequential one is being rewritten in public. A vendor selling Annex 22 compliance is selling a forecast of a document whose scope the drafting group has reopened. The useful response is a gap register: one row per draft clause you rely on, with its current status, what you do today under the binding rules, and the event that makes you revisit it.

Typical rows for the vial classifier: draft Annex 22 §6 test-data independence (status: draft; today: implemented as part of Annex 11 §4 validation; revisit: final Annex 22 published). Draft Annex 11 §7.5 ix vendor release testing (status: draft; today: written into the contract anyway; revisit: final Annex 11). FDA seven-step credibility file (status: draft guidance; today: cover document for the US-bound product; revisit: FDA final guidance). EU AI Act classification (status: law, dates deferred; today: recorded as not high-risk with reasons; revisit: equipment change or 2 August 2028).

An inspector reading that register sees a manufacturer that knows which texts bind it and has a dated plan for the ones that do not yet.

---

The Decision: What Predicts Regret

Four questions predict whether this purchase goes badly. The vendor's headline accuracy figure answers none of them.

1. Can you see how the test data was built? If the vendor will not show how its test set was held out from training and what sites and equipment it covers, you cannot judge transfer, and you will be rebuilding the test from scratch after signing.
2. Who controls the version? If the model can change without your approval, or depends on a hosted model that retires on someone else's 60-day clock, your validated state has an expiry date you do not set.
3. Do you know your current performance? Draft Annex 22 §4.3 needs your manual inspectors' sensitivity and specificity as the bar. Sites that never measured it spend the first quarter of the project measuring it.
4. Is the step critical? If it is, and the tool is generative, today's draft says no. Buy something static for that step or move the LLM to a non-critical position with a signing reviewer.

What changes the answer: a final Annex 22 that admits probabilistic models with a defined control strategy would open the critical step to LLMs, and you would then need the guardrail and monitoring evidence the workshop described. A final FDA guidance would make the seven-step file an expectation for US submissions. Neither has happened as of October 13, 2026.

What to Do

This Week:

1. List every AI tool touching a GMP step and mark each critical or non-critical under the draft Annex 22 §1 definition. Flag any generative tool in a critical step.
2. Ask each vendor for its intended-use statement, test-data characterisation and the method used to keep test data out of training. Note who refuses.

This Month:

1. Measure the current performance of the manual process each model replaces, by subgroup, so the §4.3 bar exists before acceptance testing.
2. Send the six supplier clauses above to procurement and legal for every open AI contract, with draft Annex 11 §7.5 attached as the reason.
3. Record the EU AI Act classification for each system with counsel, once, with the reasoning.

Before the Final Annex 22 Lands:

1. Build the gap register and put it under document control.
2. Put every hosted-model retirement date your vendors depend on into the change control calendar, and require 60 days' written notice in the contract at minimum.
3. Write the acceptance test for your highest-risk model to draft Annex 22 §§3 to 10 and run it on data from your own line.

The Bottom Line

The computerised systems rules settled this question once before. Annex 11 §3.3, in operation since 2011, already makes the regulated user review supplier documentation against its own requirements. The AI drafts repeat that position for learned models, and the EMA workshop report repeats it again for third-party APIs. Buy the tool whose vendor will open its test data, pin its versions and accept your audit, then validate it on your own line before the final annexes arrive.

Continue Reading

• 4 Instruments, 8 Hours. The Weeks Were Your Change Control.
• Best MLOps for Regulated AI: Domino, Then a Sign-Off Layer
• DeepSeek Swapped the Model. Your Eval Didn't Notice.
• Human-in-the-Loop for AI Agents: Most Approval Gates Rubber-Stamp
• Training Data Provenance: Indemnity Stops at Your Fine-Tuning Data
• EU AI Act Deadline Shifted 16 Months. Don't Celebrate Yet.
• Agent Audit Logging: Platform Logs Miss the Decision You Must Prove