The expensive part of validation is moving
I've read a lot of "future of validation" posts this year. Most say AI will make CSV faster and that we should embrace risk-based thinking. I don't disagree with either point, but neither tells you what to do differently next quarter.
So I'm going to try something easier to argue with: five concrete bets, specific enough to be proven wrong.
1. Review becomes the bottleneck, and inspectors will look at it
For as long as I've worked in validation, the big cost has been writing. URS, FS, test scripts and trace matrices were all drafted by hand by people who bill by the day. That cost is falling fast. A decent model gets you a plausible first draft of most of these documents in minutes.
The trouble is that a plausible draft still has to be checked, and checking a document you didn't write is slow. You have to rebuild the reasoning the author never wrote down. A reviewer who used to see a few dozen pages a week can now be handed ten times that, all of it fluent and well formatted, with an occasional quiet error somewhere inside.
FDA has already shown where this goes. The April 2026 warning letter to Purolea Cosmetics Lab, widely described as the first to cite AI in pharmaceutical manufacturing, concerns specifications, procedures and master production records that the firm produced with AI agents and that the quality unit did not adequately review (21 CFR 211.22(c)). In that case the review was missing. FDA Warning Letter — Purolea Cosmetics Lab, 2 April 2026 (CDER); 21 CFR 211.22(c)
Regulators seem to be thinking along the same lines. At EMA's workshop on draft Annex 22 in mid-2026, the discussion on human oversight concluded that it has to be designed rather than assumed, and that a passive check doesn't count. EMA, report of the expert workshop on EU GMP Annex 22 (draft), mid-2026, published October 2026
My bet is that the next cases will be harder, because the review will exist on paper. Picture a long specification signed as reviewed a few minutes after it was generated. By 2028 I expect inspection findings to start questioning review that happened on paper but couldn't realistically have happened in practice. The evidence will be things nobody examines today: review timestamps, edit history, and whether the reviewer changed anything at all.
What I'd do now is make review leave a trace: what was accepted, changed or rejected, section by section, rather than one signature on the last page.
2. CSA saves effort that AI then spends again
FDA's Computer Software Assurance guidance was finalised in September 2025 and updated in February 2026 to align with the new QMSR. Strictly speaking it's a CDRH/CBER document for production and quality system software used by device manufacturers, but pharma has been borrowing its logic for years. The message is to put effort where the risk is and stop producing evidence nobody reads. FDA, Computer Software Assurance for Production and Quality Management System Software (final guidance, 3 February 2026; supersedes the 24 September 2025 version)
Many teams heard that as "less paper". AI pushes the other way. When a test script costs two days to write, nobody writes one for a low-risk report. When it costs two minutes, someone in QA will eventually ask why you didn't.
My bet is that AI-assisted programmes will end up with more test documentation per system than the same teams produced before, unless they can show what they chose not to test and why. That rationale becomes the most useful document in a CSA-style package. Without it, you end up with a pile of generated evidence that looks thorough and proves very little.
One practical point: write the risk rationale before you generate anything. If the rationale is written after the tests already exist, you're justifying the tests rather than deciding them.
3. Annex 22 will be argued over one word: "critical"
The draft of the new EU GMP Annex 22 was published in July 2025 and the consultation closed in October. As drafted, it allows only static, deterministic models in GMP-critical applications. Generative AI, LLMs and models that keep learning in production are excluded from critical use. For non-critical uses, the safeguard is a qualified human in the loop. EU GMP Annex 22 (draft, 7 July 2025), scope; public consultation closed 7 October 2025
That exclusion may not survive. EMA's report on its mid-2026 expert workshop, published in October 2026, says the drafting group has discussed opening the draft annex to probabilistic and generative models if they come with a documented, risk-based control strategy. No revised text has been published yet, and a revised draft is expected before any final one. EMA, report of the expert workshop on EU GMP Annex 22 (draft), mid-2026, published October 2026
Either way, everything still depends on what counts as "critical". Is an LLM that drafts a deviation investigation critical? A person signs the investigation, but that person mostly reads what the model chose to put in front of them. If the exclusion stays, "critical" decides whether you may use an LLM at all. If it goes, it decides how heavy the control strategy has to be, and for drafting tools the control everyone will point to is the human reviewer.
I expect that within a year of the final text, most companies will classify document-drafting AI as non-critical with human oversight. That's defensible, and it's also the position I've taken myself. It means the first serious enforcement here won't argue about the model. It will look at whether the human oversight was real, which takes us straight back to bet 1.
If the final text instead defines criticality by how the output is used rather than where the decision is made, or says human review alone isn't enough for drafting tools, a lot of products, including mine, will need rethinking.
4. The trace matrix stops being a document
Everyone knows the RTM goes stale the moment someone edits a requirement. We still deliver it as a frozen spreadsheet, mostly because that's what has always been asked for.
Once requirements, tests and results are stored as linked records rather than prose, the matrix is simply a query. It's always current and can be shown as of any baseline. A PDF of it is a snapshot of that query, nothing more.
By 2029, I think "show me the RTM" will mean showing the trace at a specific baseline, not handing over a file. The question that matters will be whether you can reproduce the trace exactly as it stood on the day you released.
To be honest, this is the bet I'm least sure of. Habits in this industry last a long time.
5. The real shortage will be judgment, not people
This is the one I'd most like to be wrong about, and it's closer to a hypothesis than a bet.
Senior validation engineers got good by writing a lot of mediocre URSs and slowly writing fewer of them. That repetition is how you learn which requirement can't be tested, which risk rating is suspiciously comfortable, and which "shall" is hiding three separate requirements.
If juniors start from AI drafts, they miss most of that. Yet bet 1 says this kind of judgment is exactly what the whole process now relies on.
My bet is that by 2030 the hardest people to find will be the ones who can tell when a well-written document is wrong. Their day rates will go up. Teams that still make juniors write some documents from a blank page will have reviewers in 2030, and teams that don't will have to hire them in.
What connects them
Taken together, these five bets make one point. Producing validation documents is getting cheap, but being accountable for them costs as much as it always did. The rules already say this: AI never approves anything, and a qualified human is responsible for what gets approved, whoever or whatever wrote the draft. What's changing is where the work goes. Less of it goes into producing documents, and more into showing that someone qualified actually examined them.
Teams that make their review visible and settle their risk reasoning before generating evidence will find that AI really does make validation cheaper. For everyone else it will only look cheaper until the next inspection.