What Sponsors Must Know About Digital Systems And AI Compliance

By Jessica Cordes, Clinical Excellence GmbH

The regulatory environment for clinical development and pharmaceutical manufacturing is evolving. In July 2025, the European Commission initiated a public consultation on proposed changes to three critical components of Good Manufacturing Practice (GMP) guidance: Chapter 4 (Documentation), Annex 11 (Computerised Systems), and a brand-new Annex 22 covering the use of artificial intelligence (AI).

These updates mark a pivotal shift in how regulatory authorities view digital records, system oversight, and AI-enabled tools in the GxP environments. While initially focused on manufacturing, the implications reach into clinical operations, vendor management, and digital system validation, especially for small and midsize biotech companies preparing for or conducting clinical trials.

Why These Revisions Are So Significant

The EU GMP guidelines have long set the standard for manufacturing practices in the pharmaceutical industry. However, over the last decade, clinical trial conduct has become highly digitalized, shifting from static documentation to real-time system integration, remote monitoring, and AI-supported decision-making.

The Commission’s consultation addresses this gap. The proposed changes:

• reflect modern technology use, including AI and hybrid data systems;
• strengthen expectations for digital traceability and data life cycle management;
• establish clear compliance frameworks for new technologies used in regulated activities.

The consultation remains open until Oct. 7, 2025. Sponsors and service providers have a critical window to assess their practices and ensure future compliance.

Chapter 4: Expanding The Scope Of Documentation

The revised “Chapter 4 – Documentation” introduces a broader, risk-based approach to managing clinical and manufacturing documentation across all formats. This includes not just paper or PDFs but also audio files, videos, electronic signatures, and images.

The new documentation requirements extend compliance to all formats, ensuring that any media used to store or transmit GMP-relevant data, whether paper, digital, audio, or image, remains complete, retrievable, and secure. Sponsors must guarantee that documents are legible and verifiable throughout their entire life cycle, supported by robust version control and continuous monitoring from creation to archiving. A risk-based approach is now fundamental, with systems and records prioritized according to their criticality by applying quality risk management (QRM) principles.

To meet these requirements, sponsors should undertake a comprehensive review of their electronic document management systems (EDMS) and electronic trial master file (eTMF) platforms to ensure they align with updated GMP expectations. It is essential to confirm that any vendors involved in documentation management, such as CROs, laboratories, or clinical sites, are maintaining rigorous controls throughout the document life cycle. For organizations using hybrid systems, it is equally important to verify that paper-based backups are held to the same standards of integrity as their digital counterparts, ensuring consistency, completeness, and audit readiness across all media formats.

Annex 11: Elevating Expectations For Computerized Systems

The proposed update to “Annex 11 – Computerised Systems” reflects the growing dependence on digital platforms across drug development. These revisions will affect systems like data acquisition tools (e.g., CTMS, IVRS, ePRO) and any tool used to generate, analyze, or store clinical trial data.

Sponsors are required to oversee the entire life cycle of their systems, from procurement through decommissioning, ensuring that every stage is managed with diligence and according to regulatory expectations. Accountability extends to third-party organizations, such as CROs and vendors, who must be able to demonstrate that their system controls have been properly validated. Security and audit readiness are essential, with systems needing to incorporate active audit trails, robust data integrity checks, and stringent access control protocols. Furthermore, electronic approvals are expected to comply with validation requirements and support full traceability, maintaining the highest standards for e-signature compliance throughout the process.

To address the evolving regulatory landscape, sponsors should thoroughly audit their IT vendors to ensure full Annex 11 compliance across all clinical trial platforms, laboratories, and safety databases. Establishing robust standard operating procedures for computerized system validation and managing system changes are essential. Moreover, sponsors must assign clear responsibility for overseeing digital systems, even when operational tasks are delegated to external partners. These measures help safeguard the integrity of digital infrastructure and prepare sponsors for heightened scrutiny as regulatory expectations expand.

Annex 22: New Guidelines For AI Use In GMP Contexts

The introduction of “Annex 22 – Artificial Intelligence” marks a groundbreaking regulatory step. It establishes formal requirements for the design, validation, and oversight of AI/ML models used in drug development. While Annex 22 is written for manufacturing, it applies to any AI model used in GxP-relevant processes, which may include clinical trial site selection, patient recruitment algorithms, automated lab assessments, or image-based diagnostics.

A set of core principles now guides the governance of AI within GxP-relevant processes. First and foremost, each AI tool must have a clearly documented purpose outlining its intended use and expected outputs. Data governance takes center stage, requiring that the training data sets be of demonstrably high quality, transparent, and suitable for their specific applications. Where AI outputs influence critical decisions, human review is mandated to ensure oversight and accuracy. Any adaptive learning models are subject to rigorous change control, including formal versioning and validation procedures. Above all, the validation of AI systems must be grounded in a risk-based approach, with quality risk management principles applied to evaluate the potential impact of AI on product quality, safety, and regulatory compliance.

Sponsor considerations now include the need to audit whether any vendors use AI tools for site selection, eligibility screening, or endpoint analysis. It is essential to require documented evidence detailing model training and performance validation, as well as the implementation of human review checkpoints. Additionally, all AI usage should be tracked in a central register. This is important even when such tools are embedded as features within larger systems such as CTMS.

Beyond creating a register of AI tools and requiring documented validation, sponsors should establish clear protocols for ongoing monitoring of AI model performance. This involves not only initial validation but also periodic reevaluation. Adaptive models, in particular, may evolve and require special attention. Sponsors ought to require vendors to report any significant changes to underlying algorithms or data sets. This ensures that updated models continue to meet regulatory standards and do not introduce unforeseen risks.

Another essential consideration is the transparency of AI decision-making processes. Sponsors should seek assurance that models employed by vendors offer explainable outputs. This is especially important when these tools are used in critical-path activities such as patient eligibility assessments or endpoint adjudication. Transparency supports both internal oversight and readiness for regulatory inspection.

Furthermore, it is prudent to incorporate AI-related controls into broader vendor management frameworks. This could include adding AI governance to routine vendor audits and requesting specific documentation on data provenance and model training. It also involves ensuring that contractual agreements address responsibilities for compliance, incident reporting, and remediation.

Lastly, as the regulatory landscape continues to evolve, sponsors should remain engaged in industry forums and regulatory consultations. Staying informed about developments in AI-related GMP guidelines enables organizations to anticipate future requirements. It also helps them adapt their compliance strategies proactively. This ongoing vigilance and adaptability will be key to maintaining both the integrity of trial data and a competitive edge in an increasingly digital environment.

How Sponsors Can Prepare

While large sponsors may have internal quality and digital compliance teams, smaller companies often rely on external support. That’s why preparation must start now, before the guidelines become binding.

5 Steps Sponsors Can Take Now

1. Conduct a system and documentation gap assessment. Review your current documentation formats, system inventory, and digital processes against the new GMP expectations. Identify systems lacking audit trails, controls, or QRM documentation.
2. Strengthen vendor oversight practices. Update your qualification and auditing templates to include Annex 11 and Annex 22 criteria. Ask vendors to declare any AI usage and provide validation documentation.
3. Update and train on SOPs. Ensure your SOPs reflect life cycle documentation, hybrid record management, and AI governance. Train relevant team members — including clinical, QA, and digital operations staff.
4. Incorporate AI into risk management plans. If you're using AI in feasibility, enrollment prediction, or image analysis, document the intended use, performance checks, and review process. Be prepared to show oversight during inspections.
5. Submit input to the Commission. The Commission is accepting feedback until Oct. 7, 2025. Join through a national biotech association or professional body, or submit directly via the EU Health Portal.

A Strategic Compliance Opportunity

The shifting landscape of the EU's GMP requirements, especially as they pertain to digital systems and AI, presents a unique window for sponsors to comply and to distinguish themselves within the clinical research ecosystem. Organizations that move early to align their processes with anticipated regulatory expectations gain a reputation for reliability and forward-thinking, which can foster stronger collaborations with partners, regulators, and investors.

Proactive compliance can lead to several tangible benefits. For instance, by systematically mapping digital workflows and integrating robust audit trails, sponsors can respond swiftly and confidently during inspections, reducing both the administrative burden and the risk of findings that might delay trials. Enhanced vendor oversight — particularly in ensuring AI tools are validated and transparently managed — can also mitigate supply chain risks and ensure data integrity, both of which are essential for successful trial outcomes and eventual product approvals.

Furthermore, companies that use this period to update their training programs instill a culture of continuous quality improvement, and documenting their AI governance frameworks is not just preparing for regulatory scrutiny; it’s building resilient foundations that can adapt to future innovations. Submitting feedback to the Commission’s consultation process can also provide sponsors with a voice in shaping practical, science-based regulations that support both patient safety and technological progress.

Ultimately, organizations that see regulatory change as an opportunity — not just an obligation — will be best equipped to navigate the digital transformation of clinical research, ensuring both compliance and a sustained competitive advantage in the marketplace.

About The Author:

Jessica Cordes started her clinical operations career in 2009, working at various companies, including Big Pharma and several small to midsize biotech companies. She gained extensive experience on different levels from country study management to global study management and, since 2018, leadership in clinical operations. During her time at Medigene and Immatics, she structured the clinical operations department, built cohesive global teams, and implemented GCP and ATMP-compliant processes. For more than 12 years, she has been working in oncology clinical trials (including hemato-oncology as well as solid tumors) and with ATMPs since 2018. Since 2023, she has been working as an independent consultant and trainer, supporting small companies in building their clinical operations group and setting up their clinical trials for success. She provides a GCP refresher course via her Clinical Excellence Training Academy.