Viewpoint Abin Thomas, Head of MES Center of Excellence, North America at Amaris Consulting
A validation lead at a mid-sized biologics site got a question during a routine audit last year that stumped her whole team: which of your MES-connected tools use a model that updates itself, and which ones stay fixed once deployed? She knew the system inside out. This particular question was new the first time anyone had framed it that way.
That question is about to become standard.
What is the regulatory shift?
A Manufacturing Execution System, or MES, is the software layer that sits between a life sciences site’s business systems and its shop floor. It tracks batch records, work instructions, equipment status, and material genealogy in real time. Increasingly, it also makes automated calls: which recipe parameters to load, when to flag an out-of-spec reading, which sensor data feeds into a batch release decision.
For years, MES governance meant validating a fixed system: same logic in, same logic out, documented once and revalidated on a schedule. That assumption is now exactly what regulators are re-examining, because a growing share of MES-connected tools behaves differently.
Three regulatory developments, one underlying story
Three developments landed in close succession over the past year, and together they mark the most significant rewrite of GMP expectations for computerized systems in over a decade. In July 2025, the European Commission and PIC/S released draft revisions to Annex 11 (Computerised Systems) and Chapter 4 (Documentation), alongside an entirely new annex, Annex 22, dedicated to artificial intelligence in GMP environments. In the US, the FDA finalized its Computer Software Assurance (CSA) guidance in September 2025 and updated it again in February 2026. In January 2026, the FDA and EMA jointly published ten guiding principles for AI use across the medicine’s lifecycle a first-of-its-kind formal alignment between the two agencies on artificial intelligence specifically.
It would be easy to read all of this as an AI story. Look closer, and it’s an MES governance story. AI is just the part that finally got everyone’s attention.
Why this is a structured compliance approach
Most coverage of Annex 22 misses one thing: it formalizes questions that well-run MES environments should already be able to answer, rather than creating new requirements from scratch. What does this system do. What data feeds it. Who’s accountable when it’s wrong.
Annex 22, as drafted, applies to models with direct GMP impact on patient safety, product quality, or data integrity prediction and classification are the examples the draft itself uses, and its current scope is deliberately narrow. Only static, deterministic models, ones whose parameters don’t change during use, are permitted in critical GMP applications. Models that keep learning after deployment, along with probabilistic and generative models including LLMs, are excluded from that scope entirely under the current draft and, as written, should not be used in critical GMP applications at all.
That boundary remains open, too. Following consultation feedback, EMA held a workshop at the end of June 2026 specifically to gather expert input on whether and how adaptive or probabilistic models might eventually be accommodated, with guardrails. The draft text stays the same, for now. But the line is actively being worked.
For manufacturers, the practical question this raises goes beyond whether a system “uses AI.” It’s what kind of model it is, whether its output is deterministic, and what decision it’s being asked to influence. A site that already sorts its connected systems along those lines walks into an inspection with an answer ready. That map completes one of the foundational governance steps the draft is asking manufacturers to formalize a real head start, though only a first step.
FDA’s CSA guidance points in a similar direction, though it’s worth being precise about where it applies. Finalized in September 2025 and updated again in February 2026, CSA governs software used in medical device production and quality management systems under 21 CFR 820, not pharmaceutical GMP manufacturing directly. The February update explicitly extends its risk-based approach to AI/ML tools, automation, and analytics platforms used for production or quality purposes. Its underlying philosophy, assurance effort proportional to risk rather than documentation volume, is the same discipline Annex 22 is asking for on the EU side, and it signals where US thinking is headed for adjacent software categories.
The line the FDA just drew
In April 2026, the FDA issued what appears to be its first cGMP warning letter with a section explicitly titled “Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing.” A contract manufacturer had used AI agents to draft specifications, procedures, and master production records, and released them without proper Quality Unit review. When investigators asked why process validation hadn’t been performed, the answer, more or less, was that the AI never flagged it as required.
The FDA’s response reached for an existing rule instead of a new restriction on AI: 21 CFR 211.22(c), the same rule that has governed document review since long before anyone was talking about machine learning. The message was narrower, and more useful than a ban would have been: AI can assist, but the Quality Unit keeps its responsibility to review and approve, model or no model. That responsibility stays with people, however capable the model is.
It’s a governance failure. The technology behaved exactly as built. The breakdown happened around it, in exactly the kind of gap that a mature MES environment, with clear ownership, audit trails, and change control already built in, is structurally positioned to close.
What good MES governance already looks like
None of this depends on a company having deployed AI yet. It requires a few fundamentals to already be in shape:
A validation approach built on risk. Systems and functions earn their level of scrutiny from what happens if they fail impact is the standard, over a checklist demanding a test script for every field.
Clean data lineage and audit trails, with a clear record of what’s native system evidence versus manually assembled documentation.
A defined ownership model for every connected tool. Someone can say, without checking, what a given system does, what data it touches, and who signs off on its outputs.
Change control that already treats vendor updates and model changes as events worth documenting, whether or not “AI” is the label on the change.
Sites that have this in place start from a real foundation as Annex 22 and its companion documents move toward finalization they’re extending a discipline that already exists. Sites that still need to build it are likely to spend the rest of 2026 doing that foundational work under tighter timelines, and closer scrutiny, than they would have otherwise.
Where hands-on MES experience makes the difference
Building this kind of inventory, and the governance discipline behind it, is the work Amaris Consulting’s MES Center of Excellence does with life sciences manufacturers across North America.
That distinction matters. Reading the regulation is one thing. Having already mapped a live, connected MES environment against exactly these questions, on a real production site, is what determines how fast a company can move once the final text lands.
Getting ahead of it
A useful starting point is small: an honest inventory of what’s connected to the MES today, what’s static and what adapts, where the data comes from, and who owns each piece. Most sites can build that picture in weeks, not quarters, and it holds its value regardless of exactly how or when the final Annex 22 text lands.
The organizations that treat this as one continuous story, where validation discipline, documentation rigor, and AI readiness all flow from the same governance maturity, are the ones that will move fastest once the rules are settled. Everyone else will be reading the final text for the first time in the middle of an audit.
You can learn more about Amaris Consulting here.
Abin Thomas, Head of MES Center of Excellence, North America at Amaris Consulting, where his team supports life sciences manufacturers on MES strategy, validation, and digital manufacturing transformation. He is currently MES Project Lead on a large-scale brownfield PAS-X implementation at a major life sciences manufacturing campus in the Toronto area, and holds CBAP and PMP certifications.
