2026 Is Not a Routine Update Year
Quality teams are staring down one of the heaviest regulatory calendars the EU pharma industry has seen in a decade. The European Commission, EMA, and PIC/S have moved on multiple fronts at once and none of it is incremental.
N-nitrosamine oversight is no longer a fire-fighting exercise. It is now baked into the inspection framework as a permanent governance expectation. ATMP GMP rules are being rewritten for the first time since 2017. The documentation and computerised systems framework has been overhauled root and branch with a brand-new annex on AI thrown in for good measure. And EMA’s inspection approach has quietly but fundamentally shifted toward intelligence-led, risk-prioritised oversight.
Each of these is significant on its own. Together, they demand a response that goes well beyond a document review.
1. N-Nitrosamines: The Risk Assessment Gap Is Where Inspectors Are Looking
The sartan contamination crisis of 2018 is old news. What is not old news is the enforcement posture it created.
By 2026, around 25–30% of major quality observations in EU chemical drug inspections trace back to nitrosamine risk assessment problems not failed analytics, but failures of reasoning, documentation, and governance. EMA’s Appendix 1 does not tell manufacturers what limits to set. It tells inspectors what questions to ask. The four they will ask at your site:
- Have you identified all plausible nitrosamine formation pathways, not just the obvious ones?
- For pathways you dismissed, is the scientific justification actually defensible?
- Is your risk assessment a live document tied to change management, or a one-off exercise filed and forgotten?
- Does your documentation tell the same story across sites, products, and departments?
A spotless HPLC method does not answer any of those questions.
Annex 15 goes mandatory for API manufacturers. The revision tied directly to EMA’s June 2020 post-sartan “lessons learnt” report proposes making Annex 15 mandatory for active substance manufacturers. The public consultation closed April 9, 2026. Adoption is expected before year-end. API sites that have treated Annex 15 as optional should treat the consultation closure as their starting gun, not their finish line.
2. ATMP GMP: Part IV Is Getting Its First Real Rewrite
Part IV of EudraLex Volume 4 has sat largely untouched since November 2017. In a field where cell therapy, gene therapy, and tissue-engineered products have changed beyond recognition in eight years, that gap shows. EMA released the concept paper on May 8, 2025. GMDP IWG has targeted Q4 2026 for formal review.
The revision is not cosmetic:
Area | What Is Actually Changing |
Contamination Control Strategy | Must now be built into ATMP manufacturing environments, consistent with revised Annex 1 (in force since August 2023) |
Quality Risk Management | ICH Q9 and Q10 principles are moving from implied to explicit requirements |
Cleanroom & Barrier Systems | Clearer expectations on isolators and RABS; biosafety cabinets retained where individualized batch handling requires it |
Starting Materials of Human Origin | Definitions updated to align with new EU regulations on substances of human origin |
For developers whose quality systems were built around the 2017 framework, this is not a gap-closure exercise. It is a structural review. The contamination control strategy requirement alone reaches into facility design, process flow, and gowning practices that most ATMP sites have never had to justify in the same terms sterile manufacturers do.
EMA also updated its Q&A on out-of-specification batches of cell- and tissue-based ATMPs in 2026, a practically important update for anyone managing individualized therapy batches where a failed spec is not always a straightforward reject.
3. The Digital Triad: Chapter 4, Annex 11, and the New Annex 22
On July 7, 2025, the European Commission published three documents that represent the most substantial rework of EU GMP digital compliance in 14 years.
Chapter 4 (Documentation) now explicitly covers audio, video, and image records as GMP documentation. If your manufacturing environment produces real-time visual monitoring feeds, video training records, or image-based inspection outputs, those are now in scope. ALCOA++ data integrity principles are woven throughout.
Annex 11 (Computerised Systems) has grown from a 5-page guideline to a 19-page standard. Cloud computing and SaaS are explicitly within scope. So is AI/ML. Supplier oversight, the area where industry practice has historically been weakest now has its own regulatory teeth.
Annex 22 (AI-Based Systems) is genuinely new ground. It applies to static, deterministic AI models. Adaptive and generative models are explicitly excluded from GMP-critical decisions a boundary with immediate implications for any manufacturer using machine learning in PAT, yield prediction, or quality release. Traceability of training data, human oversight protocols, and lifecycle management for AI tools are all required.
Industry self-assessment data tells an uncomfortable story: AI governance readiness sits below 25% against Annex 22 expectations. Cloud and SaaS supplier oversight readiness is around 34%. These are not comfortable numbers when enforcement is six to twelve months away.
4. EMA's Inspection Model Has Changed
Between 2020 and 2022, 59 EMA-coordinated inspections were conducted remotely, and 443 distant assessments were carried out by EU national regulators. Remote inspection was born of necessity. It is now policy.
The GMDP IWG Inspection Reliance Pilot formalised what was already happening in practice: the EU inspection network trusts PIC/S-aligned authorities and allocates its own inspection capacity by risk, not by schedule. A site in a well-regarded PIC/S member jurisdiction with a clean inspection history will be treated differently from one where the record is thin or mixed. That is not arbitrary. It is structured intelligence.
What inspectors are actually looking for in 2026 is harder to game than a document audit. They want to see that a company understands its own processes, the risks, the reasoning behind control decisions, the lifecycle story. A thick binder with the right SOPs will not substitute for that. The GMDP IWG’s 2024–2026 work plan covers ten GMP documents for revision or new publication, with improved EudraGMDP database records enabling richer cross-border intelligence sharing between competent authorities.
Key Dates in EU GMP Annex
Date | What Happened |
July 2018 | NDMA found in sartans. The reform cascade begins. |
June 2020 | EMA “Lessons Learnt” report frames the Annex 15 revision scope. |
August 2023 | Revised Annex 1 enters force. Contamination control strategy becomes non-negotiable. |
May 8, 2025 | ATMP Part IV concept paper released. Consultation closes July 8, 2025. |
July 7, 2025 | Chapter 4 revised, Annex 11 revised, and new Annex 22 released for consultation. |
Feb 9 – Apr 9, 2026 | Annex 15 consultation closes. Mandatory scope for API manufacturers. |
Q4 2026 | GMDP IWG formal review of ATMP Part IV. |
Conclusion
Every one of the 2026 updates points at the same underlying expectation: EMA wants manufacturers to own their risk story, document it honestly, and be able to defend it across the entire product lifecycle.
That is a harder ask than it sounds. Risk assessment documentation that was written once and filed is not the same as risk governance. A quality system built for the 2017 ATMP framework is not the same as one built for Annex 1 contamination control strategy. A computerised system validated before SaaS and cloud were in scope is not the same as one that satisfies the revised Annex 11.
Six to twelve months is the typical window between guideline finalisation and enforcement. For manufacturers with complex portfolios, multi-site operations, or ATMP programmes, that window is shorter than it looks.
Why DDReg?
DDReg has worked with pharmaceutical manufacturers across the EU, US, and global markets on exactly the kind of challenges that 2026 is presenting. Not as a regulatory affairs consultancy that hands over a gap report and moves on, but as a team that has sat in the same rooms as the regulators, understands how inspectors think, and knows where the real risks are in your documentation before an inspector finds them.