Critical or non-critical: the central distinction

The core of Annex 22 is the differentiation between critical use and non-critical use of AI and GMP systems. This classification determines the required validation effort.

When is AI classified as critical?

This is a key weakness of Annex 22: the guideline does not provide a precise definition of critical applications. This vagueness leads to room for interpretation and uncertainty in practice.

The draft only mentions general criteria, but these leave plenty of room for different interpretations:

• Direct influence on product quality or patient safety
• Automated decisions without sufficient human control
• Lack of traceability or reversibility
• GMP-relevant process control

Important: This vagueness does not mean that all AI applications should automatically be considered critical! Rather, it requires a well thought-out, risk-based assessment of each individual case.

Possible approaches for criticality assessment:

Approach 1: Depth of intervention

• Does the AI only make recommendations (non-critical)?
• Does it make autonomous decisions (potentially critical)?
• Does it interfere directly with GMP processes (critical)?

Approach 2: Default risk

• What happens if the AI results are wrong?
• Are the consequences reversible?
• Are there safety nets and control mechanisms in place?

Approach 3: Regulatory relevance

• Does AI influence GMP-documented processes?
• Does it affect validated systems?
• Does it influence batch records or release decisions?

Examples for orientation:

• Probably critical: Automatic batch release, AI-controlled analysis result evaluation
• Probably non-critical: literature research, training support, maintenance planning
• Gray area: trend analyses with recommendations for action, automated report generation

The lack of clear demarcation requires a careful, documented GxP risk assessment for each use case - ideally in coordination with quality assurance and regulatory experts.

‍

Non-critical AI: More flexibility in everyday laboratory work

However, most AI applications in laboratories fall into the category of AI that does not require validation. These supporting systems can be operated with reduced requirements:

• Document-based AI for information searches
• LLMs for training purposes and knowledge transfer
• Data analysis tools for trend identification
• Automated reports without direct GMP relevance

The decisive factor: the final decision always remains with the person, and all actions are documented in a traceable manner.

AI validation: what is really needed?

Non-critical applications must also meet certain standards. Annex 22 defines clear control mechanisms:

Technical requirements:

• Audit trail: Complete logging of all inputs and outputs
• Model fixation: Use of defined, tested versions
• Access control: Restriction to authorized users
• Human-in-the-loop: human monitoring and decision-making authority

Organizational measures:

• Documented risk assessment for each application
• Clear responsibilities and escalation paths
• Regular review of AI performance
• User training

Practical example: How Thunder AI meets the requirements

Modern AI in GMP-regulated laboratories such as Thunder AI show how the balance between innovation and compliance can be achieved. Such systems offer:

• Document-based answers with traceable sources
• Strict data separation and access control
• Complete audit logs for all interactions
• Human-in-the-loop principle for all recommendations

This allows laboratories to benefit from AI support without violating regulatory requirements.

Strategic recommendations for laboratory managers

1. carry out an inventory

Record all currently used AI tools and evaluate them according to the criteria of Annex 22. Not every use of ChatGPT for research purposes is automatically critical.

2. implement risk assessment

Develop a systematic approach to GxP risk assessment of new AI applications. This creates legal certainty and enables well-founded decisions.

3. document processes

Create clear SOPs for the use of AI, define responsibilities and establish audit mechanisms.

4. train employees

Sensitize your teams to the regulatory requirements and create awareness for the correct use of AI tools.

The future: AI as an opportunity, not a risk

Annex 22 does not signal the end of AI innovation in laboratories, but rather its professionalization. Companies that act proactively now can secure important advantages:

• Innovative edge through rule-compliant AI integration
• Efficiency gains with simultaneous compliance
• Competitive advantages through structured digitalization
• Future-proof for upcoming regulatory developments

‍

FAQ: The most important questions about Annex 22 and AI in the lab

1. do I have to remove all AI tools from my lab now?

No, definitely not. Annex 22 does not prohibit AI, but regulates its use. Most supporting AI applications can continue to be used with appropriate control measures. The distinction between critical and non-critical applications is crucial.

2 What is the difference between Annex 11 and Annex 22?

Annex 11 regulates traditional computer-aided systems, while Annex 22 is specifically geared towards AI and machine learning systems. Annex 22 supplements Annex 11 and takes into account the special characteristics of learning systems such as non-determinism and changing model parameters.

3. how do I know if my AI application is subject to validation?

The validation requirement depends on the criticality of the application. Ask yourself: Does AI have a direct impact on product quality or patient safety? Does it make automated decisions without human control? Is it relevant to GMP? If yes, full validation is required.

4. what documentation do I need for non-critical AI applications?

Non-critical applications also require a documented risk assessment, clear usage guidelines and a functioning audit trail. However, the requirements are significantly lower than for critical systems.

5 How do I prepare my laboratory for the final version of Annex 22?

Start with an inventory of all AI applications, implement a systematic GxP risk assessment and establish the recommended control mechanisms now. This way, you will be prepared when the final version comes into force.

Conclusion

The new Annex 22 is an opportunity for the systematic and compliant integration of artificial intelligence in the laboratory. Companies that act now can successfully combine AI innovation with GMP compliance and secure important competitive advantages.