The new EU GMP Annex 22 doesn't ask whether you use AI. It asks whether you understand the risk of your use case. Classify first, then scale the control.