Computer System Validation: Two New Standards, One 12-Week Window

The revised Annex 11 is in final consultation. Annex 22 sits alongside it in draft: the EU's first dedicated guidance on AI in GMP manufacturing. Read them side by side and the message is the same. The bar for trusting a computerised system, and now an AI-assisted one, is moving up.

Most sites are not ready for either.

I keep coming back to one case. A mid-size manufacturer walked out of an FDA inspection facing Warning Letter risk: audit trails disabled on three lab systems, LIMS and MES changes pushed without impact assessment, no GxP inventory worth the name. The kind of finding that ends careers.

Twelve weeks. That was the remediation window. Full GAMP 5 classification, retrospective and prospective validation across LIMS, CDS, MES and QMS, audit trails switched on and reviewed, change control that actually controls. The follow-up inspection closed with zero data integrity observations.

Not luck. A risk-based programme, run by people who had done it before.

What Annex 22 Changes

Annex 22 redraws what "validated" means for AI. The draft is strict on adaptive models that keep learning in production environments where decisions are GxP-critical. A model that shifts its behaviour through continued training after go-live is not the same system that was validated at release. Change control, performance monitoring, and data governance for training datasets become part of the validated state, not afterthoughts.

The sites that already treat data integrity as design rather than paperwork will absorb this shift without breaking stride. The logic is the same: prove the system does what it is supposed to do, document what it does over time, and control what changes. Annex 22 applies this requirement to systems where the answer can change without a code release.

What This Means in Practice

The parallel between the two standards is not coincidental. Both are responses to the same observation: regulators have increased scrutiny of computerised systems, and the documentation practices that held up a decade ago no longer hold up today.

For most sites, the preparedness question is not "are we ready for Annex 22?" but "do we have a validation programme that would survive a focused inspection of our existing GxP systems?" If the answer is uncertain, the next inspection cycle will resolve it.