LLMs in GMP production: what the draft Annex 22 allows, with a human in the loop

Where LLMs may help in a GMP plant

Under the draft Annex 22 that the European Commission put to consultation in 2025, large language models may support GMP production only in non-critical applications, which have no direct impact on patient safety, product quality or data integrity, and qualified personnel stay responsible for every output. Searching SOPs, drafting the description in a deviation report from an investigator's notes and finding earlier maintenance cases are uses of this kind. A local AI server keeps batch data and procedures inside the company and gives the quality unit a system it can qualify like any other.

This guide is for heads of quality assurance, production managers and qualified persons at manufacturers of medicinal products and active substances, including contract manufacturers, and for the IT team that would run the server. It reads the draft from the production floor: which tasks it leaves open, what a human in the loop means in daily work, and what the platform needs under the current Annex 11. Our guide to GPU servers for pharma and life sciences covers research workloads and has a full Annex 11 table, and our page on an AI server for pharmaco­vigilance covers drug safety.

This is general information on EU GMP guidance as of October 2026, not regulatory advice. Your quality unit and your qualified person decide what is critical and how a system is validated, and your legal counsel confirms questions of law.

Status of the draft as of October 2026

The Commission's consultation page lists three documents of EudraLex Volume 4 that were open for comment from 7 July 2025 to 7 October 2025: a revised Chapter 4 on documentation, a revised Annex 11 on computerised systems and a new Annex 22 on artificial intelligence. The page states that the response period has ended. On 25 October 2026 the Commission's EudraLex Volume 4 page listed no Annex 22, and it still showed Annex 11 in its revision of January 2011 and Chapter 4 of January 2011.

So the text quoted below is a draft. The final annex may word things differently, and until it is adopted the binding texts for a computerised system in a GMP plant remain the current Annex 11 and the chapters of Part I. We plan with the principles of the draft, because they show the direction, and keep the exact wording for the day the final text appears.

What the draft says about generative AI and LLMs

Section 1 of the draft sets its scope narrowly. It applies to computerised systems used in the manufacture of medicinal products and active substances where AI models are "used in critical applications with direct impact on patient safety, product quality or data integrity". It covers machine-learning models of two kinds only: static models, which "do not adapt their performance during use", and models "with a deterministic output which, when given identical inputs, provide identical outputs". Dynamic models that keep learning, and models with a probabilistic output, are excluded and should not be used in critical GMP applications.

On language models the draft is direct: "the document does not apply to Generative AI and Large Language Models (LLM), and such models should not be used in critical GMP applications." The next sentence opens the door for other uses. If used in non-critical GMP applications, which do not have a direct impact on patient safety, product quality or data integrity, "personnel with adequate qualification and training should always be responsible for ensuring that the outputs from such models are suitable for the intended use", in other words a human in the loop, and the principles of the annex "may be considered where applicable".

Draft Annex 22 "Artificial Intelligence", section 1, Commission consultation document (July 2025), read 25 October 2026; the last column is our summary.

Language models land on the probabilistic side in practice. They generate text by sampling one token after another, and the serving software adds its own variation. vLLM's documentation, in the version of 7 October 2026, says that it does not make results reproducible by default, "for the sake of performance", and that it provides reproducibility only "when it runs on the same hardware and the same vLLM version". A quality unit cannot treat such a system like a validated calculation, which is the reason the draft keeps it away from critical decisions.

Critical or non-critical: sorting production tasks

Which uses count as critical is not listed in the draft. The regulated company decides it through its quality risk management, and the same task can be critical in one process and not in another. The table gives our reading of common production tasks as a starting point for that discussion.

Our reading for discussion with your quality unit, not a classification; draft Annex 22 section 1 defines critical as a direct impact on patient safety, product quality or data integrity.

Deviations show where the line runs. Chapter 1 of the EU GMP Guide, in operation since 31 January 2013, asks that an appropriate level of "root cause analysis should be applied during the investigation of deviations" and that corrective and preventive actions be identified and their effectiveness monitored (clause 1.4(xiv)). A model can turn an investigator's notes into readable text and list earlier deviations on the same equipment. The root cause, the impact assessment and the CAPA remain the investigator's work, signed by people. The same chapter asks for a product quality review that includes "a review of all significant deviations or non-conformances" (1.10), where a model can compile a first list from the records for the reviewer to check.

Batch release is the clearest case on the other side. Annex 16, in operation since 15 April 2016, states that "Certification can only be performed by a QP of the manufacturer and/or importer", and that the QP will need to rely on the pharmaceutical quality system with ongoing assurance that this reliance is well founded. A tool that pre-reviews executed batch records feeds that reliance. Whether it may do so, and with which checks, is a decision for your quality unit and your QP, and many will treat it as critical.

What a human in the loop means in daily work

The draft's own sections on the human in the loop apply to models within its scope, but they describe a pattern that fits language models in non-critical work as well. Section 3.3 says that where a model gives an input to a decision made by a human operator and the effort to test the model has been reduced, "the description of the intended use should include the responsibility of the operator", and that the operator's training and consistent performance "should be monitored like any other manual process". Section 10.5 adds, for the same case, that "records should be kept from this process", which, depending on criticality, may mean a review of every output according to a procedure.

For a language model in a GMP plant we recommend five rules built on this pattern:

1. Intended use in writing. One page per use: what the model may do, which documents it reads, who checks its output and what it must never do, such as writing into a batch record.
2. No direct write access. The model produces drafts. A trained person reads them, corrects them and copies them into the eQMS or the document system, where the person's own signature applies.
3. Sources shown. Every answer cites the SOP or record and its version, so the reader checks against the original instead of trusting the text.
4. Records kept. The query log holds who asked what, which model version answered and what the person did with the answer; the quality unit sets its retention.
5. Periodic check. QA samples drafts against the final documents, in the way Annex 11 asks for a periodic evaluation of computerised systems.

We supply the server and, under our Private AI/ML service, set up the model, the search over your procedures and the query log; send us the uses your quality unit has in mind, and our team replies with a configuration and a note on how each use would be set up.

Annex 11 still governs the platform

Until a revised annex is adopted, the server and the software on it fall under the current Annex 11 when they are used in a GMP-regulated activity. Its principle reads: "The application should be validated; IT infrastructure should be qualified." Clause 1 asks that risk management "be applied throughout the lifecycle of the computerised system", clause 3.1 asks for formal agreements with third parties such as suppliers and service providers, clause 4.1 says that validation documentation "should cover the relevant steps of the life cycle", clause 7.2 asks for regular back-ups, clause 9 asks that audit trails be available and regularly reviewed, clause 11 asks for periodic evaluation and clause 12.1 for controls that restrict access.

A language model adds configuration items that an ordinary application does not have. We record them as part of the system description:

• the model weights, identified by checksum, not only by name;
• the serving engine and its version, since vLLM ties reproducibility to the same version and hardware;
• the prompt templates and the settings such as temperature;
• the retrieval index: which SOP versions it contains and when it was rebuilt;
• the driver branch, CUDA version and container images by digest.

A change to any of these goes through change control. For a model in its scope, section 10 of the draft Annex 22 asks for change and configuration control with an assessment of retesting, a useful model for the non-critical case too. Our guide to LLM evaluation before model upgrades describes a regression test set built from your own questions.

Server options for a production site

The tasks above need a model that works in the languages of your SOPs and cites its sources, and they do not need a very large one; test any candidate on your own procedures before you choose. gpt-oss-120b, under the Apache 2.0 licence with 117 billion parameters of which 5.1 billion are active per token, is our usual example. Its weights take about 65 GB (60.8 GiB), as listed on the Hugging Face files page. By our users-per-card rule, which takes 90 per cent of the 95.6 GiB the driver reports, less 3 GiB per card and less the weights, one RTX PRO 6000 Server Edition holds 19 conversations of 32K tokens with a 16-bit cache.

Users-per-card rule: one card (83.04 − 60.8) / 1.125 GiB per 32K = 19; pair (166.08 − 60.8) / 1.125 = 93; cache per 32K from the gpt-oss-120b config.json (18 full-attention layers, 8 KV heads, head dimension 64). Power by our estimate (cards, two processors and 15 per cent for the rest), confirmed by a measurement on the delivered system.

A conversation here is one request being answered at the same moment. With the example values of our guide to private ChatGPT servers by company size, 500 staff produce about 20 such requests at the busiest moment, so one card serves the QA, production and engineering staff of a typical site. The entry server has two RTX PRO 6000 Server Edition cards, two AMD EPYC processors, 384 GB of DDR5 ECC and two NVMe drives. Four cards give a tensor-parallel pair, one model spread over two cards, for several sites on one server. A second, smaller test server lets the quality unit try a new model version or a rebuilt index without touching the released system, which makes change control easier to evidence.

Notes for the IT team

1. Network zone. Put the AI server in its own zone, apart from the production network and its control systems. Connectors read exports of the document system and the eQMS with read-only rights; nothing on the server writes to GMP records.
2. Pinned software. Fix the driver branch (R580 is supported to June 2028, as our guide to NVIDIA driver branches and CUDA versions sets out), the container images by digest, the vLLM version and the model checksum.
3. Repeatable runs. vLLM's documentation states that its default seeding keeps results consistent across runs of the same vLLM setup, even with temperature above zero, and that in online serving the only option for more is its batch-invariance mode, again on the same hardware and the same vLLM version. Record which mode you run.
4. Access and logs. Sign-in through the company directory, roles per use, and a query log whose retention the quality unit sets. Our guide to an LLM gateway with keys and logging shows one way to build it.
5. Offline operation. A plant often wants no internet access on such a server; our guide to an air-gapped LLM server with offline installation lists what to mirror.
6. Qualification. The server arrives on request with the operating system, the NVIDIA driver, CUDA and a container runtime installed. Your own acceptance test belongs in the qualification record, and our guide to GPU server acceptance testing gives a procedure.

What we supply

You can buy this system from us: our team sizes the configuration to your workload and budget and replies within one business day. We build AI servers to order with two, four or eight RTX PRO 6000 Server Edition cards, assembled and tested before delivery, delivered anywhere in the EU on one EU contract and invoice, with manufacturer warranty on every component handled through us; quantities and lead time are confirmed in writing with the quote. Our Private AI/ML service, with our engineering partner Vixen.UNO, sets up the model, the search over your procedures, access control and the query log. Qualification of the infrastructure and validation of each use stay with your quality unit. Describe your site and the documents involved, and we propose the server and the software stack together.

FAQ