Where does AI genuinely help in the document-heavy processes of a pharmaceutical operation? In searching, summarising and drafting: pulling similar deviations out of the archive, structuring the first draft of a description, keeping a supplier qualification dossier complete. It does not replace the quality decision or the validated system, and that line is exactly where projects either work or drown in validation effort.
Status: 2026-09-12
The mountain of documents in question
Manufacturing under GMP is document work. A single deviation produces a description, immediate measures, root cause analysis, risk assessment, CAPA and an effectiveness check. A supplier qualification produces questionnaires, certificates, audit reports, agreements and requalifications with deadlines. Add SOPs and specifications in several versions and often several languages. None of it is intellectually hard, but all of it is searching, cross-checking and writing under time pressure, and those three activities are precisely what language models are good at.
What actually works today
Four uses have proven themselves in practice, all following the same pattern: the AI prepares, a human reviews and decides.
Searching past cases. The most valuable question for any new deviation is: has this happened before? A local model with access to closed deviations answers it in seconds instead of an afternoon in the archive, including the measures decided back then and how effective they were. That changes root cause analysis, because recurring patterns become visible where case-by-case handling loses them.
First drafts. Turning a shift leader's notes into a structured draft description, shaping a CAPA proposal from the root cause analysis, extracting the requalification summary from an audit report. The draft never carries a signature; it saves the blank page.
Keeping the qualification dossier current. Comparing questionnaire answers against last year's and flagging the changes, alerting on expiring certificates and overdue requalifications, maintaining the gap list per supplier. A large part of this process is exactly that completeness control, and it can be automated because it remains rule-checkable.
Translation and language versions. The supplier answers in Spanish, the parent company reads German, the auditor English. A local model translates the working version without a quality document passing through an external service. The approved version is still reviewed by a person with subject knowledge.
Where the line runs
The line is called validation. Computerised systems in a GMP environment fall under Annex 11 of the EU GMP guidelines, and an AI whose output takes a quality decision or replaces a validated system would need to be validated itself. For generative models that is not defensible today: their outputs are not deterministic, and the same question can produce different answers.
Regulation is now drawing this line itself. With the draft of a new Annex 22 to the EU GMP guidelines, which went into consultation in July 2025, the EU formulates dedicated rules for AI in manufacturing for the first time. The draft distinguishes clearly: static, deterministic models can be qualified for critical applications; generative models such as language models are not foreseen there. Their place is support outside the critical applications, with documented human review. That matches practice: use AI as the groundworker and keep the decision human, and you stay on the safe side of the line, today and foreseeably under the coming annex as well.
For your role under the EU AI Act the same applies as in other industries: whoever operates a finished model in-house without rebuilding it is a deployer, not a provider.
Why this should run locally
Deviations contain formulation components and process parameters. Qualification dossiers contain supplier terms and audit findings. These are trade secrets, sometimes personal data too, and they have no business sitting in someone else's cloud account. A locally operated model keeps the documents in the building: no transfer to third parties, no data processing agreement for the core process, and in the customer audit a simple piece of evidence instead of a chain of contracts. It is the same reason many companies now treat data sovereignty as an architecture question rather than a contract question.
Where we know this from
The Freshlab team comes out of 30 years of pharmaceutical contract manufacturing and ERP projects, with roots in Bavaria and support in German, Spanish and English. Deviation records, qualification dossiers and the question of what an auditor wants to see are things we know from running the operation, not from training slides. Which is why we do not promise the validated miracle AI, but the setup you can defend today.
This reflects our understanding of the current regulatory framework and is not regulatory advice for your specific case. If you want to check which of your document processes can take the groundwork of a local AI without touching the validation boundary, talk to us about a pilot project.
Frequently asked questions
Can AI be used in a GMP environment at all?
Yes, but not everywhere equally. As support with human review, for example searching past cases, preparing first drafts and translating, it is workable today. For critical applications subject to validation, the draft of the new Annex 22 to the EU GMP guidelines does not foresee generative models.
Can AI assess and close a deviation on its own?
No. Assessing a deviation is a quality decision and stays with the designated person. What AI contributes is the groundwork: finding similar past cases, structuring the draft description, checking completeness and deadlines. The decision itself is taken and documented by a human.
What does AI concretely deliver in supplier qualification?
It keeps the dossier current: comparing questionnaires against previous answers, flagging expiring certificates, summarising audit reports and maintaining the gap list per supplier. That removes the searching and cross-checking this process largely consists of, without taking over the supplier assessment.
Why should this AI run locally rather than in the cloud?
Because these documents contain formulations, batch data and supplier terms, in other words trade secrets. With a locally operated model they never leave the building, which greatly simplifies the evidence you present in customer audits and data protection reviews.