A major revision of European guidance covering documentation, computerized systems, and artificial intelligence is expected to be in effect shortly. While originally developed for manufacturing oversight, these changes signal broader expectations for digital infrastructure across the pharmaceutical lifecycle, including clinical development. This first article of a new Ethical series explores the forthcoming updates and the rationale behind the changes.
Digital technologies are rapidly reshaping how pharmaceutical organizations manage data, systems, and decision-making processes. Regulators are adapting accordingly. European regulators are currently revising several important guidelines governing documentation, computerized systems, and the use of artificial intelligence in pharmaceutical environments.
From 7 July 2025 to 7 October 2025, the European Commission opened a public consultation inviting feedback from stakeholders on proposed updates to Chapter 4 (Documentation) including revising Annex 11 (Computerised Systems), and introducing a new Annex 22 dedicated to Artificial Intelligence. The consultation has now closed, and the finalized guidance is expected to be released in mid-2026.
The previous version of these rules dates back to 2011. Since then, digital technologies have transformed pharmaceutical operations, from automated manufacturing processes to increasingly sophisticated systems used throughout drug development. The current revision therefore reflects a broader effort to modernize regulatory expectations in response to these technological changes.
According to the European Commission, the objective of this update is to support innovation in pharmaceutical operations while promoting greater consistency in regulatory oversight.
A broader framework for digital systems
Chapter 4 forms part of a wider international framework governing regulated digital environments. Comparable standards include FDA 21 CFR Part 11, the World Health Organization guidance on data integrity, and ISO 27001 for information security management.
Together, these guidances establish the foundations for how regulated organizations manage electronic records, computerized systems, and digital infrastructure.
The revised documents were prepared by the EMA GMDP Inspectors Working Group, working in collaboration with the Pharmaceutical Inspection Co-operation Scheme (PIC/S). The updated guidance addresses a wide range of operational topics, including:
- pharmaceutical quality systems
- risk management
- training and competency
- user requirement specifications
- supplier and service provider oversight
- system qualification and validation
- data management practices
- identity and access control
- audit trails and electronic signatures
- periodic system reviews
- security safeguards
- backup and archiving procedures
Many of these topics were already present in earlier guidance. However, the new framework introduces a more dynamic and risk-based approach that takes into account the increasing complexity of modern digital environments.
A stronger focus on risk and data integrity
One notable aspect of the revised framework is the emphasis placed on risk management.
Organizations are expected to consider not only the presence of digital systems but also the level of automation, the complexity of processes, and the potential impact on product quality, patient safety, and data integrity.
The updated guidance also reinforces established industry standards for computerized systems development and validation. These include GAMP5, ICH Q9 on Quality Risk Management, and ICH Q10 on Pharmaceutical Quality Systems.
At the core of this approach is a risk-based quality framework emphasizing controlled access, traceability of actions, and reliable management of data throughout its lifecycle. These principles align with the ALCOA+ model, which defines key attributes of trustworthy data such as accuracy, consistency, and traceability.
Artificial intelligence enters the regulatory framework
Another significant development is the introduction of Annex 22, a new regulatory framework dedicated to the growing use of artificial intelligence within pharmaceutical operations.
The new annex highlights three core principles:
- The development and use of AI systems must involve appropriately qualified personnel, including process subject matter experts, QA, data scientists, IT professionals.
- Documentation related to AI models must be available and reviewed by qualified individuals “irrespective of whether a model is trained, validated and tested in-house or whether it is provided by a supplier or service provider”.
- Organizations must apply quality risk management to evaluate how AI systems may affect patient safety, product quality, and data integrity.
The guidance also outlines the approach that should be taken in reference to the intended use of AI, the criteria for accepting AI systems, the testing methodology including explainability and confidence and finally the operational model for AI systems.
Implications beyond manufacturing
Although these regulatory updates are formally linked to manufacturing practices, the principles they introduce influence expectations across the broader pharmaceutical lifecycle, including areas governed by GCP.
As digital systems become central to regulated activities, organizations must ensure that the platforms supporting their operations meet evolving expectations around data governance, system accountability, and transparency.
What comes next
This article opens a series examining the forthcoming EU regulations updates and the implications for clinical development activities. Our next article will explore what these regulatory changes mean for the digital infrastructure supporting clinical development programs. The third and final article will take a closer look at the new Annex 22 dedicated to artificial intelligence and what clinical development teams should anticipate as these technologies become more widely used in their environment.
If you would like to discuss how these developments may influence the digital platforms used in clinical development activities, the team at Ethical would be pleased to exchange perspectives.
Please feel free to contact us through the form below.
