Pharma regulatory and quality teams are being asked to figure out AI policy at the same time regulators are still writing theirs. That's not a comfortable position, but it's not as open-ended as it feels. The emerging guidance is converging on a more useful question than "AI or no AI": which kind of AI, doing what, with how much human oversight.
What Regulators Have Said So Far
The regulatory picture moved quickly through 2025 and 2026. FDA published a draft guidance in January 2025, "Considerations for the Use of Artificial Intelligence to Support Regulatory Decision Making for Drug and Biological Products," followed in January 2026 by "Guiding Principles of Good AI Practice in Drug Development," issued jointly with EMA. In the EU, the draft Annex 22 to the GMP guidelines, published for consultation in July 2025 alongside the draft revision of Annex 11, addresses AI in pharmaceutical manufacturing directly.
None of these are final, binding rules for AI yet. The consultation on Annex 22 closed in October 2025, and as of late summer 2026 the final text still hadn't been adopted.
But enforcement isn't waiting for final guidance. In April 2026, FDA issued a warning letter that treated inappropriate use of AI as its own issue, after AI-generated specifications and production records were put into use without adequate review by the quality unit. The citation was 21 CFR 211.22(c), a long-standing cGMP requirement. The message is clear: existing rules on quality oversight already apply to AI.
The Distinction That Matters: Deterministic vs. Generative
The draft Annex 22 draws a specific line: static, deterministic models can be used in critical GMP processes, while dynamic, continuously learning models and generative AI are restricted to non-critical applications with documented human oversight.
That line is still being debated. In mid-2026, EMA held an expert workshop on whether dynamic, probabilistic, and generative AI could be allowed in more GMP applications under the right controls, so the final text may be less restrictive than the draft. But the principle behind the line isn't going away: for a GMP-critical decision, you need to be able to reproduce and explain the result.
A deterministic system, one where the same input reliably produces the same output and the logic behind it can be inspected, is a fundamentally different regulatory object from a generative one, where the same prompt can produce different outputs on different runs and explaining exactly why is often not possible. For a GxP process where a reproducible, defensible outcome is the whole point, such as a batch release decision, a label verification, or a data integrity check, that difference isn't a technical footnote. It decides how much validation and oversight a tool needs, and whether it can sit inside a validated process at all.
This matters because "AI" has become one word doing a lot of different work. A rules-based comparison that checks a label character by character against its approved master is doing something categorically different from a generative model drafting promotional copy or summarizing a clinical dataset. Both can end up described as "AI." Only one behaves the way a critical GMP process requires.
What This Means for Compliance Tooling
The temptation for any software vendor right now is to describe everything as "AI-powered," because the term signals sophistication. For tools that support GxP decisions, including artwork and label verification, that instinct works against the distinction regulators are drawing.
A comparison tool that verifies text, graphics, barcodes, or symbols against an approved master deterministically produces the same result for the same document every time, and that result can be traced, documented, and validated. A tool that uses a generative model to produce or "improve" content, whether that's rewriting a label description, generating a summary of what changed, or inferring the intent behind a discrepancy, is doing something different, with real validation and oversight implications.
Neither use is inherently wrong. But blurring them, or marketing a compliance tool's AI features without being clear about which parts are deterministic and which aren't, creates exactly the kind of ambiguity an inspector will ask about. The April 2026 warning letter shows what happens when AI output goes into GMP records without adequate review. For the records and signatures side, see 21 CFR Part 11: The Compliance Assumptions Pharma Teams Make.
The Practical Takeaway for Pharma Quality Teams
The organizations that navigate this well won't be the ones avoiding AI or adopting it indiscriminately. They'll be the ones who can say, for any AI-related capability in their quality systems, which category it falls into, what oversight applies, and why.
That's a documentation and governance exercise as much as a technology one, and it's achievable now, ahead of final guidance:
- Inventory AI use across your quality systems, including features inside vendor tools.
- Classify each use as deterministic or generative, and as critical or non-critical.
- Define human oversight for anything generative, and make sure AI output never goes into a GMP record without quality unit review.
- Ask vendors directly which parts of their tools are deterministic.
In short, apply the same rigor you already apply to any GxP-relevant system: know what the tool does, know how it produces its output, and be able to explain it to an inspector without hedging.
Content Compare's comparison engine is deterministic by design: the same document produces the same verified result, every time, with a documented, traceable audit trail. See what to ask any artwork verification vendor, or book a demo to see how it fits a validated GxP process.
