EU GMP Annex 22 是否会对遗留人工智能系统设“祖父条款”？来自 21 CFR Part 11 的经验

What happens to AI systems that are already in operation before the regulation becomes enforceable?

This is not a new regulatory challenge. Similar questions arose when 21 CFR Part 11 introduced requirements for electronic records and electronic signatures. While Annex 22 has not yet been finalized, the implementation of Part 11 provides useful insight into how regulators may approach legacy AI systems.

Looking Back: What Happened with 21 CFR Part 11?

When the US Food and Drug Administration (US FDA) introduced 21 CFR Part 11, the pharmaceutical industry had already deployed thousands of computerized systems supporting manufacturing, laboratory operations, quality management, and clinical research.

Recognizing the operational complexity of immediate compliance, the US FDA adopted a practical implementation approach. Rather than requiring organizations to replace existing systems, companies were expected to assess their systems, identify compliance gaps, and implement appropriate controls over time.

Typical activities included:

Assessing existing computerized systems against new regulatory expectations
Remediating identified compliance gaps
Revalidating systems where necessary
Applying Part 11 controls during upgrades and significant system changes

This risk-based strategy enabled organizations to maintain business continuity while progressively improving compliance.

Could Annex 22 Take a Similar Approach?

Although the final version of EU GMP Annex 22 has not yet been published, many regulatory professionals anticipate that its implementation may follow a similarly pragmatic transition strategy.

Replacing every AI-enabled system currently supporting pharmaceutical manufacturing, quality operations, laboratories, supply chain activities, and clinical processes would present significant operational and financial challenges. As a result, regulators may consider providing a transition period—or some form of grandfathering—for legacy AI systems.

However, grandfathering should not be interpreted as a permanent exemption from compliance. Based on previous regulatory experience, it is more likely to represent additional time for organizations to achieve compliance through structured remediation and governance.

What Might Grandfathering Mean for Legacy AI Systems?

If Annex 22 includes transition provisions, organizations should still expect to demonstrate that existing AI systems are appropriately controlled throughout their lifecycle.

Potential regulatory expectations may include:

Maintaining a comprehensive inventory of AI-enabled systems
Classifying AI applications according to intended use and GxP impact
Performing documented risk assessments
Maintaining documentation describing model purpose, training data, assumptions, and known limitations
Establishing human oversight and clearly defined accountability
Monitoring model performance throughout the operational lifecycle
Managing model updates through formal change control
Qualifying and overseeing third-party AI vendors and suppliers

Rather than exempting legacy systems, grandfathering would likely provide organizations with a structured pathway to progressively align existing deployments with Annex 22 expectations.

AI Requires Continuous Lifecycle Management

Unlike conventional software applications, AI systems introduce dynamic risks that evolve over time.

Examples include:

Model drift
Data drift
Algorithmic bias
Reduced explainability
Performance degradation as operating conditions change

These characteristics distinguish AI from traditional computerized systems and reinforce the need for continuous governance rather than one-time validation. Consequently, Annex 22 is expected to place greater emphasis on lifecycle management, ongoing monitoring, and periodic reassessment.

Organizations that have already implemented AI solutions should begin documenting governance processes now rather than waiting for the regulation to become mandatory.

Preparing for Annex 22 Today

Regardless of the final transition provisions, organizations can take several practical steps to strengthen AI governance and improve future regulatory readiness:

Develop a complete inventory of AI-enabled systems.
Categorize AI applications based on GxP impact and patient risk.
Establish an AI governance framework with defined roles and responsibilities.
Implement lifecycle management procedures covering monitoring, review, and change control.
Define human oversight requirements for AI-supported decisions.
Prioritize remediation activities for higher-risk legacy AI systems.

These activities align with established quality risk management principles and will help organizations prepare for future Annex 22 expectations, irrespective of the specific implementation timeline.

Conclusion

The implementation of 21 CFR Part 11 demonstrated that regulators recognize the practical realities of introducing significant regulatory changes across complex pharmaceutical environments. Rather than requiring immediate replacement of legacy systems, compliance was achieved through phased assessment, remediation, and risk-based implementation.

A similar philosophy may emerge with EU GMP Annex 22, although the final regulatory requirements remain under development. If grandfathering provisions are included, they are likely to provide organizations with time to transition—not a permanent exemption from compliance.

Organizations that proactively establish AI inventories, governance frameworks, lifecycle management practices, and risk-based remediation plans will be better positioned to demonstrate compliance and maintain inspection readiness when Annex 22 becomes enforceable.

Disclaimer

Regulatory Considerations: This blog post reflects current regulatory expectations and industry perspectives based on the draft Annex 22 and historical implementation of 21 CFR Part 11. Organizations should monitor official European regulatory publications for final requirements and implementation guidance.