AI-assisted manufacturing does not replace CGMP data integrity expectations; it expands the scope of what must be controlled, documented, and defensible.
ALCOA+ principles increasingly apply not only to human-entered records and instrument outputs but also to model inputs, outputs, versions, configurations, training data, and automated decision logs.
Draft EU Annex 22 signals that regulators are beginning to translate AI governance concepts into GMP-specific expectations for intended use, test data, explainability, confidence, and ongoing operation.
Manufacturers remain accountable for the integrity of records, raw data, and documents produced or processed by AI, even when automated systems generate or support decisions.
Trustworthy AI in GMP manufacturing will depend on traceable data, validated systems, meaningful human oversight, and the ability to reconstruct and defend AI-supported quality decisions.
Why AI Changes the Data Integrity Conversation
Artificial intelligence (AI) is beginning to move from experimental digital transformation projects into the operational language of pharmaceutical manufacturing. The U.S. Food and Drug Administration (FDA) has identified AI as a potentially significant tool for monitoring and controlling advanced manufacturing processes, and it has also recognized growing use of AI and machine learning (ML) across the drug product life cycle, including manufacturing.1,2 Modern manufacturing already depends on electronic records, automated systems, process models, analytical platforms, and computerized controls, giving AI a regulated foundation rather than a blank slate.
For manufacturers, the data integrity question becomes broader than whether a record was captured accurately at a single point in time. AI-assisted systems may help identify process deviations, recommend control actions, classify quality events, detect trends, or support investigations. In each case, the value of the output depends on the trustworthiness of the underlying data, the suitability of the model for its intended use, and the ability of the organization to reconstruct how a decision was generated, reviewed, and applied.
That does not place AI outside current good manufacturing practice (CGMP) expectations. It places AI within the same regulated environment that already governs records, computerized systems, and quality decisions. The relevant question is not simply whether AI can make manufacturing faster, more predictive, or more responsive. It is whether the data, models, records, and decisions it produces can be trusted, reconstructed, and defended within a CGMP framework.
ALCOA+ Still Applies, But the Object of Control Expands
The rise of AI-assisted manufacturing does not weaken established data integrity expectations. The FDA’s data integrity guidance clarifies the role of data integrity in CGMP for drugs, while the International Society for Pharmaceutical Engineering’s (ISPE) records and data integrity guidance frames GxP-regulated records and data as needing to remain complete, consistent, secure, accurate, and available across the data life cycle.3 Those expectations remain the baseline. What changes is the range of objects, systems, and decisions to which they must be applied.
In a more traditional manufacturing environment, data integrity questions often focus on whether a human-entered record, instrument output, batch record entry, laboratory result, or audit trail can be trusted. In an AI-assisted environment, the same logic must extend further upstream and downstream. The relevant record may include not only a result but the data set used to generate it, the model that processed it, the model version, the configuration in place at the time, the source and suitability of training or test data, the user or system action that triggered the output, and the decision made in response.
That expansion is where ALCOA+ becomes more operationally complex. Attributable data must be connected not only to an individual or instrument, but also to the model, system, and version that produced or transformed it. Contemporaneous records must capture not only when data were generated but also when an automated output was created, reviewed, accepted, rejected, or overridden. Original data may need to include raw inputs, intermediate outputs, metadata, and system-generated records. Accuracy depends not only on transcription or calculation controls but on whether the model is operating under controlled conditions and within the limits of its intended use.
For manufacturers and their partners, AI-assisted systems therefore require a broader control strategy for records and evidence. The practical questions are straightforward, even when the technical answers are not: Who or what created the data? What model processed it? Which version was active? What evidence supported its use? What decision followed? Was the output reviewed, overridden or accepted? Without those answers, an AI-supported decision may be difficult to defend, even if the system appears to perform well.
The EU Draft Annex 22 Signals Where GMP Expectations May Be Heading
The EU’s draft Annex 22 is an important signal because it brings AI into explicitly GMP-focused language. The European Commission consultation covers proposed revisions to GMP Chapter 4 and Annex 11, along with a dedicated new Annex 22 on AI, with the stated aim of supporting innovation in medicines manufacturing and regulatory harmonization.4 Because Annex 22 remains in draft and consultation form, it should not be treated as final guidance. Even so, it offers a useful view of the issues regulators are likely to consider when AI-enabled computerized systems are used in medicinal product manufacturing.
Draft Annex 22 applies to computerized systems used in the manufacturing of medicinal products and includes sections on scope, principles, intended use, acceptance criteria, test data, independence of test data, test execution, explainability, confidence, and operation.5 This structure translates broad AI governance concepts into manufacturing-relevant controls. Rather than treating AI as a general digital capability, the draft frames it around questions that fit the GMP environment: what the system is intended to do, what evidence supports its performance, how it is tested, how its outputs can be understood, and how confidence is maintained during operation.
For manufacturers, that emphasis reinforces the shift from static validation toward continuing control. Intended use anchors the evidence needed. Acceptance criteria define successful performance before the system is relied on. Test data and test–data independence help demonstrate that performance has been assessed with appropriate rigor. Explainability and confidence become part of the documented basis for trusting AI-supported outputs, particularly when those outputs may influence process monitoring, quality decisions, or operational responses.
Even before finalization, Annex 22 provides a practical map of the questions manufacturers should be prepared to answer as AI moves closer to regulated manufacturing decisions.
Accountability Cannot Be Delegated to the Algorithm
One of the clearest implications of the emerging AI guidance landscape is that accountability remains with the regulated organization. Draft Chapter 4 states that accountability for the integrity of documents, records, or raw data produced or processed with AI or other automatic means rests with the regulated user.6 This prevents AI from becoming a black box to which responsibility can be transferred.
AI may generate, classify, analyze, or recommend, but it does not become the accountable party. In a GMP setting, the organization using the system must be able to explain why the system was selected, what it was intended to do, how it was configured, who had access, how outputs were reviewed, and what controls governed any decision made from those outputs. When AI contributes to a quality decision, the record must support not only the outcome but the path by which that outcome was reached.
This accountability extends across the operational life of the system. If a model is updated, re-trained, or reconfigured, the organization must understand the impact of that change. If an output is overridden, the reason should be documented. If an output is accepted, the basis for acceptance should be clear. If the system supports deviation handling, process monitoring, or other quality-relevant activities, then the evidence must show that the organization remained in control of both the system and the decision.
AI can support more efficient or consistent decision-making, but it cannot replace defined ownership, review procedures, escalation pathways, or quality oversight. The more consequential the AI-supported decision, the more important it becomes to show that the organization retained control over the data, the system, and the final action.
Explainability and Confidence Become Data Integrity Issues
As AI becomes more closely connected to manufacturing decisions, explainability becomes more than a technical design goal. Draft Annex 22 explicitly includes explainability and confidence among the topics addressed in the proposed GMP AI annex, placing both concepts within the emerging regulatory conversation around computerized systems used in medicinal product manufacturing.5 A manufacturing decision must be more than correct in retrospect. It must be understandable, reviewable, and supported by a documented rationale.
In conventional automation, the logic behind a system output may be relatively easy to reconstruct because the system follows predefined rules or calculations. AI-enabled systems can make that reconstruction more difficult, particularly when outputs depend on complex relationships in data, model parameters, or learned patterns that are not immediately transparent to the user. For a low-risk operational use, limited explainability may be less consequential. For a system that supports process control, deviation triage, quality investigations, or batch-related decisions, the ability to understand why an output was generated becomes part of the evidence needed to trust the decision.
Confidence is closely related. The issue is not simply whether a model can produce an answer but whether the organization has sufficient evidence to rely on that answer for the specific decision being made. A model may perform well for one use and be inappropriate for another. A trend-detection tool, for example, may support early investigation without directly determining a quality outcome, while a system influencing process adjustments would require a more demanding control strategy. The level of confidence expected should follow the risk and consequence of the decision.
The European Medicine Agency (EMA) emphasizes a human-centric approach and states that AI use in the medicinal product life cycle should comply with existing legal requirements and consider ethics and fundamental rights.7 In manufacturing, that human-centric framing should translate into meaningful oversight rather than passive acceptance of system outputs. Personnel need enough visibility into the system’s basis, limitations, and performance to challenge, escalate, or reject an output when appropriate.
AI Does Not Replace Trust, It Must Be Made Trustworthy
AI-assisted manufacturing may support more responsive, data-rich operations, particularly as manufacturers look for better ways to monitor and control advanced processes. The FDA recognizes the potential role of AI in advanced manufacturing monitoring and control, while the good AI practice principles elaborated by both the FDA and the EMA point to the need for human-centric design, clear context of use, data governance, documentation, risk-based performance assessment, and life cycle management. Those principles do not lower the bar for regulated manufacturing; they clarify what must be shown before AI-supported outputs can be trusted.
The draft EU GMP materials reinforce the same direction. Draft Annex 22 places attention on intended use, acceptance criteria, test data, explainability, confidence, and operation, while Draft Chapter 4 states that accountability for the integrity of documents, records, or raw data produced or processed with AI or other automatic means remains with the regulated user. AI can support manufacturing intelligence, but it cannot absorb regulatory responsibility.
The future of AI-assisted manufacturing will depend less on whether models can generate useful outputs and more on whether organizations can defend those outputs as part of a complete quality record. Trustworthy AI in GMP settings will require the same disciplines that already underpin pharmaceutical quality: clear ownership, validated systems, reliable data, documented decisions, life cycle control, and meaningful human oversight.
