ISO 42001 for GxP: AI Governance in Life Sciences

Does ISO 42001 satisfy GxP requirements for AI?

No. ISO/IEC 42001:2023 is a management system standard for organizations that develop, provide, or use AI systems. It tells you how to govern AI as an organizational activity: policy, roles, risk and impact assessment, lifecycle controls, supplier oversight, monitoring, and continual improvement. GxP regulations, on the other hand, tell you what a regulated product or record has to demonstrate: that a system is validated, that data are attributable and trustworthy, and that a qualified person can defend a decision to an inspector.

Those are different jobs. In my view, the most useful way to think about ISO 42001 in a GxP setting is as the governance layer that sits around your validation work, not as a replacement for it. An ISO 42001 certificate will not stop an inspector from asking for your validation evidence, and no one at FDA or in an EU inspectorate treats the certificate as a stand-in for 21 CFR Part 11 or EU GMP Annex 11 compliance.

I wrote this guide because the question comes up constantly from quality leaders in pharma, biotech, and medical devices who already run a mature quality system and are now being asked, usually by IT or the C-suite, "what do we do about AI?" The honest answer is that you probably already have two-thirds of the structure. The work is in the remaining third.

What is ISO 42001, in one paragraph?

ISO/IEC 42001:2023, published in December 2023, specifies requirements for an AI management system (AIMS). It uses the same high-level structure as ISO 9001:2015 and ISO 27001, so clauses 4 through 10 (context, leadership, planning, support, operation, performance evaluation, improvement) will look familiar. What is new is the AI-specific content: an AI risk assessment under clause 6.1.2, an AI system impact assessment under clause 6.1.4, and Annex A, which lists 38 controls grouped under nine control objectives, covering things like AI policies, data for AI systems, the AI system life cycle, third-party relationships, and use of AI systems. Annex B gives implementation guidance for those controls. If you hold ISO 9001, the overview of ISO 9001 fundamentals will help you see why the structure carries over so easily.

Where do GxP and ISO 42001 overlap?

The overlap is bigger than most people expect, because both come from the same instinct: define what the system is for, control how it changes, and keep evidence. The table below maps the main themes.

A quality unit that already runs CAPA, change control, supplier qualification, and management review has most of the machinery the standard asks for. The AI-specific additions are narrower than the marketing around AI suggests.

What does ISO 42001 add that GxP does not already cover?

Three things stand out to me.

1. A formal AI impact assessment. Clause 6.1.4 asks you to assess the consequences of AI systems for individuals, groups, and society. GxP risk assessment is usually framed around patient safety, product quality, and data integrity. Those are the right core concerns, but an impact assessment pushes you to ask about bias in training data, explainability to the people affected, and who is harmed when a model is wrong in a way that does not touch product quality directly, such as a model used to screen clinical trial participants or prioritize adverse event cases.

2. Explicit governance of AI-specific properties. Model drift, retraining, training/validation/test data separation, and performance monitoring over time are things classic computerised system validation (CSV) handles awkwardly, because CSV was built around software whose behavior is fixed at release. Annex A gives you named controls to attach to those concerns.

3. Organization-wide scope. GxP validation is typically scoped to systems that touch regulated records or product. Many companies are using AI in places that GxP does not reach, such as commercial analytics, HR, and customer service. ISO 42001 gives you one framework across both, so you are not running a rigorous program for one AI use case and nothing at all for the next.

What does GxP require that ISO 42001 does not?

This is the part that gets skipped in vendor decks, so I will be direct about it.

• Validation evidence for the specific system. 21 CFR 11.10(a) requires validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. EU GMP Annex 11 asks for the same, with a risk-based approach to the extent of validation. ISO 42001 does not specify test protocols, acceptance criteria, or traceability from requirements to testing.
• Electronic records and signatures controls. Audit trails, access controls, and signature manifestations under Part 11 subparts B and C are not part of ISO 42001.
• Data integrity at the record level. ISO 42001 talks about data quality and provenance for AI. It does not replace ALCOA+ expectations for the GxP record itself.
• Qualified person or quality unit decision authority. Under 21 CFR 211.22 the quality unit has responsibility and authority for approving or rejecting. An AI output informs that decision. It does not move the accountability.
• Regulatory submissions. If AI supports a regulatory decision about a drug or biologic, FDA's January 2025 draft guidance, "Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products," describes a risk-based credibility assessment framework with seven steps, anchored on a defined context of use. ISO 42001 has no equivalent.

The practical consequence: an AI system can sit inside a certified AIMS and still fail a GxP inspection, and a perfectly validated AI tool can sit in an organization with no AI governance at all. You want both.

What are regulators actually saying about AI in GxP?

The regulatory picture is moving, so here is what I can point to with some confidence as of this writing.

EU GMP Annex 22 (draft). In July 2025, the European Commission, with EMA and PIC/S involvement, released a draft of a new Annex 22 on artificial intelligence alongside a proposed revision of Annex 11 and a rewritten Chapter 4, for public consultation. As I read the draft, it is deliberately narrow: it addresses AI models used in critical GMP applications that affect patient safety, product quality, or data integrity, and it expects static, deterministic models. Dynamic models that keep learning in use and probabilistic outputs such as those from generative AI and large language models are not expected to be used in critical applications, though they may be used in non-critical roles with a human in the loop. Check the current status of the text before you rely on this, because drafts change through consultation.

FDA computer software assurance. FDA finalized its guidance "Computer Software Assurance for Production and Quality System Software" in September 2025. It encourages a risk-based, critical-thinking approach to assurance of software used in production and quality systems for devices, and it is a helpful companion for AI tools in device manufacturing. Remember also that the Quality Management System Regulation (QMSR), which amends 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, took effect on February 2, 2026.

ISPE GAMP guidance. GAMP 5 Second Edition (2022) is the working reference for risk-based computerised system assurance across the industry, and ISPE has published a dedicated GAMP guide on artificial intelligence. Both fit comfortably with ISO 42001 because they share the risk-based philosophy.

Certification itself. ISO/IEC 42006:2025 sets requirements for bodies that audit and certify AI management systems, which matters if you plan to pursue third-party certification, since it raises the bar on auditor competence. I would still treat certification as optional for most GxP organizations. The framework gives you the benefit whether or not you pay for a certificate.

How do you integrate ISO 42001 with an existing GxP quality system?

Here is the approach I recommend, in the order I would do it.

Step 1: Build an AI inventory first

You cannot govern what you have not listed. Walk through every function and ask where machine learning or generative AI is in use, including features embedded in vendor software that someone switched on without a change control. For each one, record the intended use, the data it touches, the vendor, and whether outputs feed a GxP record or decision. This inventory is the backbone of clause 4.1 (context) and clause 6.1.2 (risk assessment), and it is usually where the first surprises appear.

Step 2: Classify by GxP impact and AI behavior

Sort each use into tiers. I use two questions: does the output affect patient safety, product quality, or data integrity, and does the model behave deterministically or does it learn and generate? A static classifier that flags visual defects on a packaging line is a very different animal from a generative assistant that drafts deviation summaries. The first needs full validation. The second may need strict procedural controls and mandatory human review before anything lands in a record.

Step 3: Fold AI into the controls you already have

Do not build a parallel bureaucracy. Add AI-specific fields to your change control form (was the model retrained, was the training data changed). Add AI criteria to your supplier qualification questionnaire (what data trained the model, how are updates communicated, can the vendor tell you when the model changes). Add model performance metrics to periodic review. This is exactly where a company with a working quality system has an advantage. The risk-based thinking approach under ISO 9001 is the same discipline you will apply to AI risk, just with different hazards.

Step 4: Write the AI-specific procedures that are actually missing

In most organizations I see, the gaps cluster in a handful of places: an AI acceptable use policy, a procedure for AI impact assessment, rules for training and test data management, a defined process for monitoring drift and triggering revalidation, and clear human oversight requirements. Annex A of ISO 42001 gives you headings for each. Keep the documents short. Inspectors and auditors both prefer a procedure people follow over a thick one they do not.

Step 5: Validate the system, not just the vendor

Supplier documentation is evidence you can leverage, in line with GAMP 5 and CSA thinking, but it does not remove your responsibility to confirm the system works for your intended use with your data. For machine learning, that means defining the context of use, setting acceptance criteria before testing, using test data that was kept separate from training data, and documenting performance against those criteria. For third-party models you cannot inspect, that may mean testing the behavior at the boundary and restricting use to tasks where a human can verify the output.

Step 6: Decide on certification deliberately

Ask what the certificate would be for. Customers and partners may ask for it in procurement, and it is a credible external signal of governance maturity. But it will not appear in a Form 483 response as a defense, and it does not change what an inspector will ask. If your reason is a customer requirement, pursue it. If your reason is "to be compliant with GxP," the certificate is the wrong tool.

What are the common mistakes?

Treating the standard as a validation protocol. Teams pick up ISO 42001, see the controls, and assume that implementing them equals validation. It does not.

Scoping the AIMS too narrowly or too broadly. Scoping only to GxP-regulated systems misses the AI use cases that still carry regulatory, reputational, or privacy risk. Scoping to the entire enterprise on day one often stalls. Start with a defined scope and expand.

Ignoring embedded AI. The AI tools nobody bought on purpose, the ones that arrived in a software update, are usually the biggest governance hole. Your supplier controls and change control need to catch them.

Letting the model change silently. In a GxP environment an unnoticed change in a model is an uncontrolled change. If your vendor can update a model without telling you, that belongs in your risk assessment and your quality agreement.

Skipping the human. Where output feeds a GxP decision, define who reviews it, what they are expected to check, and how you will show the review was meaningful and not a rubber stamp. Regulators are reasonably skeptical of "human in the loop" claims that amount to clicking approve.

How does this connect to ISO 9001, ISO 13485, and other standards?

If you already operate an ISO 9001 or ISO 13485 system, ISO 42001 is mostly an extension. The shared structure means one integrated management review, one internal audit program, one document control system. For device manufacturers the QMSR's incorporation of ISO 13485 means your quality system backbone is already aligned with an ISO-style framework, which makes adding an AIMS far less disruptive than it would be to a company starting from scratch. For the audit side, see the internal audit approach on this site for how to combine audit scopes without multiplying the workload.

A final thought

I have come to think that AI governance in regulated industries is mostly a test of whether your quality system is alive or just filed. Companies where change control, supplier management, and risk assessment are practiced as real decisions adapt to AI with modest effort. Companies where those processes are paperwork find that AI exposes them quickly, because the model changes faster than the paperwork can.

So before you buy anything, ask a simple question: if a model in your plant changed behavior next Tuesday, which of your procedures would notice?

If you want a second pair of eyes on a gap assessment across ISO 42001, GAMP 5, and your current validation approach, you can find me through Certify Consulting.

Last updated: 2026-10-18

Frequently Asked Questions

Is ISO 42001 required for GxP compliance?

No. No GxP regulation requires ISO/IEC 42001 certification. FDA, EMA, and other regulators assess compliance against regulations such as 21 CFR Part 11, 21 CFR 211, and EU GMP Annex 11. ISO 42001 is a voluntary management system standard that can support AI governance.

Can ISO 42001 replace computer system validation for AI?

No. ISO 42001 does not define validation protocols, acceptance criteria, or test evidence. You still need to validate AI systems for their intended use under 21 CFR 11.10(a), EU GMP Annex 11, or GAMP 5 principles. ISO 42001 governs the surrounding program.

How many Annex A controls does ISO 42001 have?

Annex A of ISO/IEC 42001:2023 lists 38 controls organized under nine control objectives, including AI policies, the AI system life cycle, data for AI systems, and third-party relationships. Annex B provides implementation guidance.

What is draft EU GMP Annex 22?

Annex 22 is a draft EU GMP annex on artificial intelligence released for public consultation in July 2025 alongside a revised Annex 11. It focuses on AI in critical GMP applications and expects static, deterministic models there. Check the current status before relying on it.

Should a pharma or device company get ISO 42001 certified?

Only if there is a clear reason, such as customer or partner requirements or a wish for independent assurance of governance. Certification does not substitute for validation or satisfy inspectors. Many organizations get most of the value by implementing the framework without certifying.