AI governance where the EU AI Act and medicines regulation may both apply. Structure AI assessments across regulatory classification, GxP context, computerised systems, validation, supplier oversight and evidence.
AI can enter the medicines lifecycle at many points: discovery, clinical development, manufacturing, regulatory activities and pharmacovigilance.
EMA's reflection paper on AI in the medicinal product lifecycle (adopted by CHMP and CVMP in September 2024) sets out considerations for AI/ML use from development to post-authorisation. In January 2026, EMA and FDA published ten guiding principles of good AI practice in drug development. Reflection papers and guiding principles are not binding requirements.
Existing EU GMP guidance already addresses computerised systems and their qualification and validation, for example Annex 11 (Computerised Systems) and Annex 15 (Qualification and Validation). AI governance adds questions on intended use, data, performance, supplier oversight, change control and human oversight.
A new Annex 22 on Artificial Intelligence for EU GMP was published as a consultation draft in July 2025, alongside revised drafts of Chapter 4 and Annex 11, prepared by EMA and PIC/S working groups. The consultation closed on 7 October 2025. Until a final text is published, it remains a draft and does not create binding requirements.
What AI system or service is being introduced?
What role, use case and regulatory considerations are relevant?
What risks arise from the system, provider, data and intended use?
What evidence, controls and decisions should be recorded?
What should be reviewed as the system, provider or regulatory context changes?
In March 2025, EMA's CHMP issued its first Qualification Opinion on an AI-based development methodology (AIM-NASH, for liver-biopsy assessment in MASH clinical trials), showing that AI-assisted evidence is already being considered in regulatory assessment.
Venactis provides downloadable Excel and PowerPoint frameworks for structured AI governance assessment. No Venactis-hosted platform is required to use the files. The frameworks support internal assessment and documentation workflows; they do not replace an organisation's own quality, regulatory, validation or legal processes, and are not legal or regulatory advice.
Last reviewed: 28 September 2026.