AI in the eQMS: What Artificial Intelligence May Do in GxP Quality Management and How Biotechs Can Use It Safely

Which AI features in an eQMS are worthwhile, and how risky are they?

The most useful AI features pre-sort large document volumes or make them searchable, with a person reviewing the result anyway: classification, metadata extraction and semantic search. The more directly an AI output feeds a GxP decision, such as the assessment of a deviation, the higher the risk and the stricter the control must be.

The yardstick comes from draft Annex 22 (consultation version, July 2025): critical applications are those with a direct impact on patient safety, product quality or data integrity. Where generative models are used in non-critical applications, the draft requires qualified staff to remain responsible for the suitability of every output (human in the loop). The EMA reflection paper (September 2024) and the ISPE GAMP Guide: Artificial Intelligence (July 2025) take the same line: risk-based, human-centred and governed by quality risk management across the lifecycle.

Inspection data show why document quality is not a side issue. In the EMA GCP Inspectors Working Group annual report for 2024 (adopted December 2025), 41 of the 335 critical and major findings from 67 inspections concerned “Essential Documents”, the largest single category. The 2023 report (EMA/INS/GCP/164938/2024) recorded 74 of a total of 720 findings (36 critical, 336 major, 348 minor) in the same category, again the highest.

There are, as yet, no robust independent figures on time saved in TMF filing or CAPA handling; published numbers come almost entirely from vendors and have not been independently verified. A study by Gray, Xu, Tong and Wu at the FDA National Center for Toxicological Research (Chemical Research in Toxicology, July 2023) on AI classification of regulatory text also shows how much accuracy depends on document type: 95% for standardised US labelling in a binary task, but only 68% for UK SmPCs in a multi-class task according to the abstract (0.67 in the model comparison table). Vendor accuracy claims should therefore always be tested on your own documents. For the technical side of text recognition, see OCR and intelligent document search.

Does an eQMS with AI fall under the EU AI Act?

Usually not as a high-risk system: AI features for document control, search or CAPA support are not listed in Annex III of the AI Act and are not a safety component of a product under Annex I. Obligations still apply, because an organisation using AI in its operations is a deployer and has been required since 2 February 2025 to promote AI literacy among its staff.

Regulation (EU) 2024/1689 entered into force on 1 August 2024. Prohibitions and the Article 4 AI literacy duty have applied since 2 February 2025, and obligations for providers of general-purpose AI models since 2 August 2025. The Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, moves the Annex III high-risk obligations to 2 December 2027 and those under Article 6(1) with Annex I to 2 August 2028. Article 4 has been recast as a duty of effort: providers and deployers must take measures to support AI literacy without having to guarantee any specific level.

The case against high-risk classification: Annex III covers areas such as employment, education, critical infrastructure and access to essential services, but not quality management. An eQMS is not a medical device, and Article 6(3) expressly excludes systems performing narrow procedural tasks.

The case for a closer look: if AI outputs are used to evaluate the performance or behaviour of staff, for example automatically scored training tests feeding qualification or HR decisions, Annex III point 4 (employment) may be engaged. Manufacturers of medical device software face separate rules for those products. In addition, Article 50 transparency obligations apply from 2 August 2026, chiefly to providers of generative systems.

Conclusion: for a Phase I/II biotech or a small CRO, an eQMS with AI is typically not a high-risk system. What is required is documented AI literacy measures, use in line with the provider’s instructions and a short, reasoned classification for each AI feature. The real compliance bar is set by GxP rules, not by the AI Act.

What does Annex 22 cover, and what changes with the new Annex 11?

Annex 22 “Artificial Intelligence” is a draft addition to the EU GMP Guide that was open for consultation from 7 July to 7 October 2025 and, as of November 2026, has not been adopted. It applies to AI models in critical GMP applications and admits only static, deterministic models there; dynamic, probabilistic and generative models, including LLMs, should not be used in critical applications.

The core requirements of draft Annex 22:

• Intended use: a detailed description of the task and the input sample space, including rare variations, owned by a process expert and approved before testing begins.
• Acceptance criteria: predefined metrics such as a confusion matrix, sensitivity, specificity, precision or F1 score; the model must perform at least as well as the process it replaces.
• Test data: representative, sufficiently large, correctly labelled and strictly independent of training and validation data, protected by access control and an audit trail.
• Explainability and confidence: recording the features that drove a decision, logging confidence scores and setting a threshold below which the model reports “undecided”.
• Operation: change and configuration control, performance monitoring and monitoring of input data for drift.
• Human in the loop: where testing effort is reduced on the strength of human review, the reviewer’s responsibility, training and performance must be described and monitored.

The scope may still change. According to the EMA report on the expert workshop of 30 June and 1 July 2026 (published October 2026), the drafting group has discussed admitting dynamic, probabilistic and generative models where a fully documented, risk-based control strategy is in place. No date for the final text has been confirmed.

The draft revision of Annex 11, consulted on in the same package (also a draft, July 2025), makes audit trails the norm for systems in which users create, modify or delete data, requires risk-based audit trail review by people not involved in the activity, governs service providers including cloud and SaaS vendors, and turns periodic review into a programme in its own right. GMP responsibility remains with the regulated company.

Neither annex is directly binding in the GCP setting. Both, however, describe what European inspectorates expect of AI in critical applications, which makes them a sensible reference for small biotechs too.

What do the EMA, ICH and FDA expect of AI in trials and quality systems?

The EMA, ICH and FDA consistently require a risk-based approach: computerised systems must be validated for their purpose, data must remain traceable through an audit trail, and the sponsor stays responsible for outsourced activities. AI-specific guidance adds context of use, model influence and lifecycle monitoring.

Regulatory framework at a glance (as of November 2026)

The EMA reflection paper, adopted by the CHMP and CVMP in September 2024, calls for risk-based, human-centred use of AI throughout the medicinal product lifecycle. In clinical trials, AI applications are subject to GCP, and where AI has a high impact on regulatory decisions the EMA recommends early dialogue with the agency.

The EMA guideline on computerised systems and electronic data in clinical trials (March 2023) requires a secure, computer-generated, time-stamped audit trail for the creation and modification of all electronic data, risk-based audit trail review and validation evidence that can be made available to inspectors. The tasks and responsibilities of service providers must be set out in contracts.

Section 4.3 of ICH E6(R3) requires computerised systems to be validated in proportion to risk, interfaces to be defined and validated, and systems to be reviewed periodically. The sponsor keeps a record of important systems and remains responsible for tasks transferred to service providers.

The FDA draft guidance of January 2025 sets out a seven-step credibility assessment: define the question and the context of use, derive model risk from model influence and decision consequence, then plan and document evidence in proportion to that risk. It targets AI that produces data for regulatory decisions on safety, effectiveness or quality, not efficiency support within a QMS. The logic still transfers: the greater the AI’s influence and the graver the consequence of an error, the more evidence is needed. The joint, non-binding FDA and EMA Guiding Principles of Good AI Practice (January 2026) follow the same line.

The final FDA guidance on Computer Software Assurance (24 September 2025) formally covers production and quality system software at medical device manufacturers. Its core nevertheless applies to any eQMS: establish the intended use, assess risk, scale testing accordingly and accept unscripted testing where appropriate.