EMA 2026–2028 GMP Work Plan

What’s coming for PQS, documentation and validation

The European Medicines Agency (EMA) has published its three‑year GMP work plan for the Good Manufacturing and Distribution Practice (GMDP) Inspectors Working Group covering January 2026 to December 2028. While the document itself is not legislation, it provides one of the clearest forward‑looking signals of how EU Good Manufacturing Practice (GMP) expectations and inspection focus are expected to evolve over the next several years.

For quality leaders, sponsors and manufacturers, the implications are significant. Core elements of the Pharmaceutical Quality System (PQS), documentation and data integrity frameworks, validation practices, and computerised system governance are all under active review. In parallel, the EMA has signalled the introduction of a completely new Annex 22 on Artificial Intelligence (AI), marking the first time AI has been addressed directly within the EU GMP Guide.

This blog unpacks what is changing, why it matters beyond Europe, and how organisations can begin preparing now, well before final texts are published.

What the EMA GMP work plan is, and why it matters outside the EU

The GMDP Inspectors Working Group GMP work plan sets out the regulatory priorities and guideline updates that European inspectors will develop, review or finalise over a defined three‑year period. For the 2026–2028 cycle, the plan confirms substantial revisions to foundational GMP chapters and annexes, with several final texts targeted for delivery to the European Commission by the end of 2026.

Although developed within the European regulatory framework, the impact of EU GMP changes is rarely confined to Europe alone. EU GMP expectations are relied upon globally through mutual recognition agreements, third‑country inspection programmes and international manufacturing and supply chains.

In practice, updates to EU GMP frequently influence inspection expectations applied by other regulators and PIC/S authorities, particularly in areas such as data integrity, computerised systems and quality risk management. For organisations supplying into, operating within, or aligning to EU GMP, the EMA GMP work plan functions as an early warning system and planning tool.

Near‑term changes targeted by end‑2026

Industry summaries of the EMA GMP work plan confirm that eight core GMP chapters and annexes are scheduled to be finalised by the end of 2026. Importantly, these updates are not isolated; they are designed to operate as a coherent package reinforcing lifecycle management, data integrity and risk‑based decision‑making.

Chapter 1 Pharmaceutical Quality System (PQS)

The planned update to Chapter 1 is expected to further embed Quality Risk Management principles, incorporating elements of ICH Q9 (R1). The move is towards a PQS that actively drives decisions, rather than one that exists primarily as documentation.

Inspectors are likely to place increasing emphasis on how risks are identified, escalated and managed across the product and system lifecycle, and how senior management oversight is demonstrated in practice.

Chapter 4 Documentation

Chapter 4 is being revised in parallel with Annex 11 to strengthen data integrity controls across paper, electronic and hybrid records. The focus is expected to move beyond record format to consider the full lifecycle of GMP data, including creation, review, retention and retrieval.

Greater clarity is anticipated around governance of digital documentation, management of metadata, and traceability of changes over time, particularly in increasingly paper‑light environments.

Annex 11 Computerised Systems

Updates to Annex 11 are intended to align validation and lifecycle expectations with modern digital technologies such as cloud‑hosted platforms, Software‑as‑a‑Service solutions and complex system integrations.

The regulatory focus continues to shift from one‑time validation events to ongoing system oversight, performance monitoring and change control throughout the system lifecycle.

Annex 15 Qualification and Validation

Annex 15 is being updated to reflect new technologies, expanded application to active pharmaceutical ingredients, and closer integration with risk‑based approaches to qualification and validation.

For many organisations, this reinforces the need to right‑size validation activities based on actual risk to patient safety and product quality, rather than applying uniform approaches across all systems and processes.

Annex 22 on Artificial Intelligence: a new regulatory frontier

The introduction of Annex 22 on Artificial Intelligence represents one of the most significant developments in the 2026–2028 work plan. For the first time, the EU GMP Guide will contain a dedicated annex addressing the governance of AI‑enabled systems used in GMP‑relevant activities.

Annex 22 is intended to complement existing requirements in Annex 11 and Chapter 4, not replace them. Its focus is on the unique characteristics of AI systems (particularly machine learning models) that introduce new risks around transparency, explainability and change over time.

Based on draft guidance and published commentary, Annex 22 is expected to emphasise clear definition of intended use, appropriate governance and accountability, risk‑based validation and assurance, lifecycle management including performance monitoring, and human oversight for critical GMP decisions.

Advanced Therapy Medicinal Products (ATMP) GMP Guidelines

The EMA GMP work plan includes a review of the GMP Guidelines for Advanced Therapy Medicinal Products (ATMPs), in collaboration with the Committee for Advanced Therapies and the European Commission. This review will update legal references and definitions following new regulation on substances of human origin and assess alignment with the revised Annex 1 on sterile manufacture. ATMP manufacturers should expect clearer expectations around risk‑based application of sterile and contamination control principles.

ICH Q12: Lifecycle management and PQS effectiveness

The EMA also plans to agree an EU approach to documenting and communicating the effectiveness of a manufacturing site’s Pharmaceutical Quality System, aligned with ICH Q12. This signals increasing focus on demonstrating how PQS processes function across the product lifecycle, not just how they are described. Inspectors are likely to look for evidence‑based links between risk management, change control, continual improvement and management oversight.

Good Distribution Practice (GDP): verification of authenticity

In the GDP space, the EMA will develop a Q&A to guide Wholesale Distribution Authorisation holders on risk assessments for verifying the authenticity of medicinal products at risk of falsification. This reflects ongoing emphasis on supply‑chain.

How to future‑proof your Pharmaceutical Quality System now

Although final texts are still pending, organisations do not need to wait to begin preparation. Many of the anticipated changes reinforce principles already expected of a mature Pharmaceutical Quality System.

In practice, future‑proofing the PQS means strengthening quality risk management so that it is consistently applied, ensuring lifecycle oversight of products and systems, and embedding data integrity as a core PQS attribute rather than treating it as a documentation‑only issue.

Organisations that encounter difficulty during inspections are often not those lacking procedures, but those unable to demonstrate how their PQS informs real‑world decisions.

Implications for supplier oversight and outsourced activities

As digital platforms, data processing services and AI capabilities are increasingly outsourced, supplier oversight becomes more complex and more critical. Updates to Chapter 1, Chapter 4 and Annex 11 are expected to heighten expectations around visibility and control across the extended enterprise.

This includes clear understanding of supplier roles, risk‑based qualification and audit strategies, and ongoing oversight proportionate to the impact of the outsourced activity on product quality and data integrity.

Readiness by design: integrating AI into CSV and CSA approaches

For organisations transitioning from traditional Computer System Validation to Computer Software Assurance, Annex 22 reinforces the importance of designing compliance into systems from the outset.

Readiness by design involves defining intended use early, aligning assurance activities with risk, and embedding governance into system selection and deployment rather than retrofitting controls once systems are operational.

PharmOut Services & Training

PharmOut supports organisations globally to prepare for evolving GMP expectations through practical, risk‑based consulting and training services. Typical support includes:

• PQS uplift and maturity assessments aligned with lifecycle and risk‑based principles
• Data integrity remediation and documentation framework reviews
• CSV and CSA readiness assessments for modern digital systems
• AI governance frameworks aligned with emerging Annex 22 expectations
• Supplier oversight models for outsourced digital and data‑driven services

Explore elearning and public courses via onlinegmptraining.com, or contact us via the website or via email to tailor workshops to your needs.

Frequently Asked Questions (FAQ)