The EU GMP Guide Is Being Rewritten: Every Annex and Chapter Changing Through 2028

The EU GMP Guide Is About to Change Eight Times in One Year

For most of the past decade, the EU Guide to Good Manufacturing Practice changed slowly, one annex at a time. That era is over. In March 2026 the European Medicines Agency published a three-year work plan for its GMP and GDP Inspectors Working Group that puts most of the Guide under active revision at once. Eight core chapters and annexes are targeted for finalisation by the end of 2026, and a second wave of chapters and annexes follows through 2028. The headline is a first-ever annex on artificial intelligence, but the deeper story is a coordinated reset of the pharmaceutical quality system, documentation, data integrity and validation.

This article maps the whole roadmap in two dated tables, explains what each change means in practice, and sets out what quality leaders, sponsors and Canadian cannabis exporters chasing EU-GMP certification should do now, well before any final text is adopted.

What the EMA 2026 to 2028 GMP Work Plan Is

What it is: The three-year work plan is a published schedule of the GMP and GDP guidance that the European Union inspectorates plan to develop, review or finalise between January 2026 and December 2028. It is produced by the GMP/GDP Inspectors Working Group (the GMDP IWG), a group of senior inspectors from every European Economic Area member state, with the European Commission, EDQM, WHO and PIC/S involved. The plan itself is not legislation. It is a statement of priorities that is reviewed and updated as work progresses.

Why it matters: When a chapter or annex is finalised, it changes what inspectors expect to see on site. Because the current plan touches the foundations of the quality system, documentation and validation all at once, the changes will arrive as a connected package rather than isolated edits. Waiting for each final text before acting leaves very little time to remediate.

What to do: Treat the work plan as an early-warning system. Build a simple register of every item below, assign an owner, and begin closing the gaps that the revisions clearly point toward: quality risk management, data integrity and computerised-system oversight. A structured EU-GMP readiness gap assessment is the fastest way to turn this roadmap into a prioritised plan.

The Near-Term Wave: Eight Changes Targeted for the End of 2026

The work plan lists eight items with a target date of the fourth quarter of 2026, when the Inspectors Working Group intends to hand a final text to the European Commission. These are the changes that will reshape everyday GMP first. The table below is drawn directly from the published work plan.

Annex 22 on Artificial Intelligence: the first AI annex in the EU GMP Guide

What it is: Annex 22 is a brand-new annex that, for the first time, addresses artificial intelligence directly inside the EU GMP Guide. It was drafted by the EMA Inspectors Working Group together with PIC/S and released for a three-month public consultation that ran from 7 July to 7 October 2025, alongside heavily revised drafts of Annex 11 and Chapter 4. The work plan targets a final text for the European Commission in the fourth quarter of 2026.

Annex 22 is intended to complement Annex 11 and Chapter 4, not replace them. Its focus is the features that make AI different from conventional software: models that learn, change over time, and can be difficult to explain. Based on the draft and published commentary, it emphasises a clear definition of intended use, governance and accountability, risk-based validation and assurance, lifecycle management with ongoing performance monitoring, and human oversight of critical GMP decisions. To help shape a risk-based approach to generative AI, the Working Group held a two-day expert workshop on 30 June and 1 July 2026.

What to do: Inventory where AI or machine learning already touches GMP activities, from deviation triage to visual inspection. Define intended use, decide where a human must stay in the loop, and align assurance to risk. Our guide on using AI in GMP documentation without triggering a compliance failure walks through the practical controls.

Annex 15 now extends to active pharmaceutical ingredients

What it is: A concept paper published in February 2026, with consultation open until 9 April 2026, confirms that Annex 15 (Qualification and Validation) will be revised to extend its scope to active substance (API) manufacturers, to reflect new technology in facilities, products and processes, and to take account of the revised ICH Q9(R1) on quality risk management. The target for a final text is the fourth quarter of 2026.

Why it matters: Historically Annex 15 was read as a finished-dosage-form document. Bringing active substance manufacturing inside its scope means API sites should expect qualification and validation expectations to be applied more explicitly to their processes. For a deeper look, see our analysis of the Annex 15 revision and what it means for API manufacturers.

Data integrity: Chapter 4 and Annex 11 move together

What it is: Chapter 4 (Documentation) and Annex 11 (Computerised Systems) are being revised in parallel, both to assure data integrity in a GMP context. The focus is expected to move beyond record format to the full lifecycle of GMP data, its creation, review, retention and retrieval, and to align validation expectations with cloud-hosted platforms, software as a service and complex system integrations. Annex 22 sits alongside this pair.

What to do: Audit-trail review remains one of the most common data integrity weak points. Confirm that audit trails are switched on, reviewed on a defined schedule, and that the review is documented. Our article on audit trail review as the data integrity battleground sets out how to close the gap before inspectors do.

The Second Wave: Chapters and Annexes Targeted for 2028

The work plan also schedules a second group of revisions with a target date of the fourth quarter of 2028. These are broader state-of-the-art reviews rather than the data integrity and validation reset of the 2026 wave, but they still matter for planning. Do not assume these dates are the 2026 wave; the work plan places all of the items below in 2028.

One structural change underpins the whole plan. From 16 July 2026, GMP for veterinary medicines is governed by separate implementing acts, so every revision above applies to GMP for human medicines. Chapters 3, 5, 7 and 9 will also consider whether the veterinary implementing acts need a future update.

Why This Matters Outside the EU, Including for Canadian Manufacturers

Direct answer: EU GMP expectations are relied on well beyond Europe through mutual recognition agreements, third-country inspection programmes and international supply chains. Canada and the EU operate a GMP mutual recognition arrangement under the Comprehensive Economic and Trade Agreement (CETA) GMP Protocol, which the work plan explicitly commits to maintaining. Updates to EU GMP frequently shape inspection focus in PIC/S jurisdictions and among other regulators, particularly on data integrity, computerised systems and quality risk management.

For Canadian cannabis producers who export to the European Union, the stakes are direct. EU-GMP certification is the gateway to the EU medical cannabis market, and it is assessed against exactly the Guide being rewritten here. A producer preparing an EU-GMP file in 2027 will be aiming at revised expectations for the quality system, documentation and validation, not the versions in force today. Our comparison of EU-GMP and GPP standards explains where the two frameworks diverge and why the gap is widening.

How to Prepare Before the Final Texts Land

What to do: Most of the anticipated changes reinforce principles a mature quality system should already meet. You do not need the final texts to begin. The firms that struggle during inspection are rarely those without procedures; they are those who cannot show how their quality system drives real decisions. Focus preparation on four areas.

• Quality risk management: apply ICH Q9(R1) consistently so risks are identified, escalated and managed across the product and system lifecycle, with visible senior-management oversight.
• Data integrity by design: treat data integrity as a core attribute of the quality system, not a documentation exercise. Review audit trails on a schedule and govern metadata across paper, electronic and hybrid records.
• Computerised-system and AI governance: define intended use early, right-size validation to risk, and embed governance into system selection rather than retrofitting controls after go-live.
• Supplier and outsourcing oversight: as data processing and AI capabilities are outsourced, tighten qualification, quality agreements and ongoing oversight proportionate to the impact on product quality and data integrity.

EU GMP Revision Readiness Checklist

Use this checklist to convert the work plan into a live programme of work.

• Build a register of all fifteen work-plan items with owner, target quarter and internal readiness status.
• Map your pharmaceutical quality system against ICH Q9(R1) and record where risk decisions are actually documented.
• Confirm audit trails are enabled and reviewed on a defined schedule for every GMP-critical computerised system.
• Inventory every AI or machine-learning tool touching GMP activities and define its intended use and human-oversight points.
• If you manufacture active substances, review qualification and validation against the coming Annex 15 API scope.
• Refresh your validation master plan so it references the revised lifecycle and data integrity expectations.
• Update supplier qualification and quality agreements to cover outsourced digital and data-driven services.
• For EU-GMP cannabis exporters, benchmark your current file against the revised Guide, not the version in force today.

Common Mistakes to Avoid

• Waiting for final texts. By the time an annex is adopted, the implementation window is short. The direction is already clear enough to act on.
• Reading the changes as isolated edits. Chapter 1, Chapter 4, Annex 11, Annex 15 and Annex 22 are a connected package built around risk and data integrity.
• Confusing the 2026 and 2028 waves. Annexes 3, 6 and 14 and Chapters 3, 5, 7 and 9 target 2028, not 2026. Planning to the wrong year wastes effort.
• Treating Annex 22 as an IT project. AI governance is a quality-system responsibility. Intended use, validation and human oversight sit with quality, not only with IT.
• Assuming the work plan is binding law. It is a planning document. Final texts are adopted by the European Commission and can shift, so track the source, not just summaries.

Frequently Asked Questions

Which EU GMP annexes are being revised in 2026 and 2027?

The 2026 wave revises Annex 11 (Computerised Systems), Annex 15 (Qualification and Validation) and introduces the new Annex 22 (Artificial Intelligence), alongside Chapter 1 and Chapter 4. Annexes 3 (radiopharmaceuticals), 6 (medicinal gases) and 14 (blood and plasma products) are targeted for the fourth quarter of 2028. The work plan is reviewed regularly, so dates can move.

What is EU GMP Annex 22 on artificial intelligence?

Annex 22 is a proposed new annex to the EU GMP Guide that sets expectations for using artificial intelligence in GMP-regulated activities. Drafted by the EMA Inspectors Working Group with PIC/S, it went to public consultation from 7 July to 7 October 2025 and targets a final text for the European Commission in the fourth quarter of 2026. It complements, and does not replace, Annex 11 and Chapter 4.

Does Annex 15 now apply to active pharmaceutical ingredients?

Yes. The February 2026 concept paper confirms that the revised Annex 15 will extend its scope to active substance (API) manufacturers, in addition to reflecting new technology and the revised ICH Q9(R1). A final text is targeted for the fourth quarter of 2026. API sites should plan for qualification and validation expectations to apply more explicitly to their processes.

Is the EMA GMP work plan legally binding?

No. The work plan is a planning and transparency document, not legislation. It signals the guideline updates and inspection priorities that EU inspectors are developing. The binding text is the revised chapter or annex once adopted and published by the European Commission. In practice, however, waiting for adoption before acting leaves little room to remediate.

When will the new EU GMP texts take effect?

The work plan gives target dates for delivering final texts to the European Commission: the fourth quarter of 2026 for the first wave and the fourth quarter of 2028 for the second. The date a revised annex is adopted, and any transition period before it comes into operation, is set separately when the text is published, as happened with the revised Annex 1 and Annex 19.

How does this affect Canadian cannabis exporters seeking EU-GMP?

EU-GMP certification is assessed against the same Guide being rewritten. A Canadian producer preparing a file in 2027 should design its quality system, documentation and validation to the revised expectations for quality risk management, data integrity and computerised systems, not to the versions in force today. Building to the coming standard avoids costly rework at inspection.

How MFLRC Can Help

MF License and Regulatory Consultants helps pharmaceutical manufacturers, active substance producers and EU-GMP cannabis exporters turn a shifting rulebook into a controlled plan. Our senior-led team runs EU-GMP readiness gap assessments against the revised Guide, remediates data integrity and computerised-system validation gaps, updates validation master plans and qualification protocols for the Annex 15 API scope, and builds AI-governance frameworks aligned with the emerging Annex 22. We also support quality management system design, SOP development, supplier qualification, audits and QAP oversight across the full lifecycle.

The EU GMP Guide will change many times before 2028. Get ahead of every revision rather than reacting to each one.

Conclusion

The 2026 to 2028 work plan is the most significant coordinated update to the EU GMP Guide in years. The new Annex 22 on artificial intelligence will draw the headlines, but the real work for most sites is the connected reset of the quality system, documentation, data integrity and validation targeted for the end of 2026, followed by the broader chapter reviews through 2028. None of it is law yet, and none of it needs to be before you start. Manufacturers that build to the coming standard now, especially on quality risk management and data integrity, will meet the revised Guide as a routine upgrade rather than a scramble.

Sources and References

• EMA, GMP/GDP Inspectors Working Group (governance, concept papers and the 3-year work plan)
• EMA, The 3-year work plan for the Inspectors Working Group (January 2026 to December 2028)
• EMA, Multistakeholder workshop on AI guidance development (Annex 22), 30 June to 1 July 2026
• EMA, Concept paper on the revision of Annex 15 (Qualification and Validation), extending scope to active substances
• EMA, Good manufacturing practice overview (EudraLex Volume 4 and current annexes)