Understanding how AI models behave, why the differences matter for GMP validation, and what the evolving Annex 22 discussion may tell us.
In a previous post, I explored the differences between Artificial Intelligence, Machine Learning, Deep Learning and Generative AI. But understanding how AI learns is only part of the picture. A model may learn during development but remain unchanged afterwards. Another may continue learning during use, while others may produce different answers to exactly the same question without learning anything new. For GMP, these distinctions matter because we are used to working with systems that must be validated, controlled and maintained in a defined state. So what are the differences?
Static, adaptive, probabilistic and deterministic models
These terms may sound like different technologies, but they actually describe different characteristics of an AI system.
Let’s start with some everyday examples.
| Model | Everyday example | What makes it different? |
| Static | A student studies for an exam, then takes it using what they have already learned. | The model does not learn from new information during use. |
| Adaptive | A music app learns which songs you like and improves its recommendations. | The model changes by learning from new information. |
| Probabilistic | A weather forecast predicts an 80% chance of rain. | The model represents uncertainty through probabilities. |
| Deterministic | A calculator always gives 25 when you enter 5 × 5. | Identical inputs under the same conditions produce identical outputs. |
| Non-deterministic | An AI chatbot gives slightly different answers to the same question. | Outputs can vary even when the inputs remain unchanged. |
There is an important distinction here.
Static and adaptive describe whether a model changes through learning. Probabilistic describes how uncertainty is represented, while deterministic and non-deterministic describe whether outputs are reproducible.
These characteristics can coexist. A model can be static, probabilistic and deterministic at the same time.
And what about dynamic? It is a broader term, but draft Annex 22 uses it for models that continuously and automatically learn and adapt during operation.
A simple example from pharmaceutical manufacturing
Imagine an AI model trained using 10,000 historical manufacturing deviations. Its task is to suggest whether a new deviation should be classified as minor, major or critical.
For one deviation, it calculates:
- Minor: 10%
- Major: 80%
- Critical: 10%
These are estimated probabilities, not evidence that the classification is correct. The model is probabilistic because it estimates the likelihood of different classifications. If it remains unchanged after training, it is also static. And if identical inputs always produce the same percentages under the same conditions, it is deterministic.
Interestingly, Annex 22 does not applies to odels with a probabilistic output which, when given identical inputs, might not provide identical and should not be used in critical GMP applications. This happen for example when after analysing the deviation, this model might assign different probabilities to possible explanations:
- Equipment malfunction: 50%
- Operator intervention: 30%
- Incorrect machine settings: 20%
Instead of always choosing the highest-probability continuation, a model configured to use random sampling may sometimes select another possibility. As another example we can imagine an LLM used to draft a deviation investigation. The first time, it highlights operator error as a possible contributing factor. The second time, using exactly the same information, it places more emphasis on equipment malfunction. The model has not necessarily learned anything new. Its parameters may remain unchanged, yet its answers differ. Rephrasing the same conclusion is one thing. Suggesting different contributing factors from the same evidence is something else, particularly if investigators rely on those suggestions.
For GMP, this creates two challenges: controlling a model that continues changing, and controlling one that remains unchanged but produces variable outputs.
And there is another complication.
Even when a model consistently produces the same answer, that does not mean the answer is correct. An AI trained on poor-quality investigations could repeatedly suggest incorrect conclusions. Equally, a static model may become less reliable if manufacturing conditions or the data it receives change. So reproducibility, accuracy and reliability are not necessarily the same thing.
What does draft Annex 22 say? The original draft Annex 22 of EudraLex Volume 4 proposes additional GMP guidance for computerised systems containing AI models. These are proposals within a draft, not requirements established by a final Annex 22. For critical GMP applications, it focuses on static models producing deterministic outputs. As said, dynamic model, and Generative AI or LLMs are outside its proposed scope and, according to the draft, should not be used in critical GMP applications.
In a way, the original approach brings AI towards something familiar to the pharmaceutical industry: a defined, controlled and validated state. A continuously learning model could change its performance without conventional change control. But freezing a model does not automatically guarantee its reliability. Weaknesses in training data, incorrect historical decisions or changes in operating conditions can still affect its performance. A static model may be easier to control, but that does not necessarily make it safer.
But the regulatory discussion is evolving;
Something interesting emerged from the EMA Multistakeholder Workshop on AI guidance development, held on 30 June and 1 July 2026.
Following consultation feedback, the Annex 22 drafting group discussed potentially expanding the scope to include dynamic, adaptive, probabilistic and generative AI models. Industry representatives argued that acceptability should depend not only on the technology, but also on intended use, associated risks and the effectiveness of the controls.
For example, using an LLM to prepare a first draft of a Product Quality Review is very different from allowing AI to independently determine whether a batch can be released. The technology might be similar, but the consequences of an error are not. The workshop explored controls such as independent testing, performance monitoring, human oversight and technical safeguards, often called guardrails.
But these controls have limitations. A safeguard may fail to detect an unexpected error. A model may become less reliable as manufacturing conditions change. And a human reviewer may approve an AI recommendation without properly challenging it. In GMP, a signature alone does not demonstrate an effective review. The person must be capable of assessing the evidence and recognising unsupported conclusions.
Importantly, the workshop did not establish new regulatory requirements. It provided input for the ongoing development of Annex 22. Whether these controls can provide sufficient assurance for critical GMP applications remains unresolved.
What does maintaining a validated state mean for AI?
This is probably the point I find most interesting. In GMP, validation demonstrates that a system is suitable for its intended purpose and performs according to defined requirements. But AI may require us to reconsider how we demonstrate and maintain that assurance.
For a static model, we can test performance, establish acceptance criteria, control changes and monitor continued suitability.
For an adaptive model, we may also need to establish how its behaviour is permitted to change, how those changes are assessed and when intervention or revalidation is necessary.
For a non-deterministic model, validation may need to evaluate a range of possible outputs, including their accuracy, consistency and potential consequences, rather than expecting identical answers every time.
Quality Risk Management, validation, change control and human oversight remain essential. But applying them to AI may require different approaches and additional controls. The workshop suggests that regulators are considering whether a more risk-based approach could accommodate technologies currently excluded by the draft. Whether this can provide sufficient assurance remains an open question. And perhaps this is where the discussion should focus: not simply on whether a technology is static or adaptive, but on whether we can demonstrate that its risks remain adequately controlled throughout its use.
If we can demonstrate that an AI system performs reliably and its risks remain adequately controlled, should the inability to predict every individual output prevent its use in critical GMP applications, or do we need to reconsider how we demonstrate and maintain a validated state?
- Draft EU GMP Annex 22 — Artificial Intelligence (2025 consultation)
- EMA Multistakeholder Workshop on AI Guidance Development — 30 June–1 July 2026
- EMA Workshop Report — published 2 October 2026
Leave a Reply