AI governance in pharma has two layers: ISO/IEC 42001 for the organisation, EU GMP Annex 22 for the use case. You need both.