AIforPharma.org

Introduction

⇒ FDA scientists propose “computable pharmacovigilance,” a framework for deciding which regulated pharmaceutical tasks can be automated by AI and which still require expert human judgment.

A new perspective paper published on 18 August 2026 in Frontiers in Drug Safety and Regulation provides an important new way of thinking about AI automation in regulated pharmaceutical processes.

The authors are scientists from the U.S. Food and Drug Administration, including the National Center for Toxicological Research and the Center for Drug Evaluation and Research.

The paper focuses specifically on pharmacovigilance, but the underlying concept may have much broader relevance for pharmaceutical Quality Systems and GMP applications.

The central question is not simply:

“Can AI perform this task?”

Instead, the authors propose asking:

“Can this task be translated into sufficiently explicit, auditable and verifiable computational steps?”

They call this concept “computable pharmacovigilance.”

Not Every Pharmaceutical Task Is Equally Suitable for AI Automation

The framework distinguishes between tasks that can be clearly formalised and tasks that depend heavily on professional judgment.

Examples of relatively computable activities include:

• checking whether required information is missing;
• detecting potentially duplicated safety reports;
• extracting predefined information from records;
• coding structured information;
• retrieving relevant information;
• performing defined rule-based checks.

Such activities have relatively clear:

inputs → processing rules → outputs → acceptance criteria

and can therefore be tested, benchmarked and audited.

Other activities are fundamentally more difficult.

The authors use case-level causality assessment as an important example.

Determining whether a medicine actually caused a particular adverse event can require integration of:

• temporality;
• alternative explanations;
• clinical context;
• pharmacological mechanisms;
• rechallenge information;
• professional medical judgment.

These activities cannot yet be reduced reliably to fully explicit computational rules.

The consequence is important:

AI suitability should be assessed task by task rather than system by system.

“Computability” Could Be a Useful Concept Beyond Pharmacovigilance

Although the paper concerns pharmacovigilance, the same reasoning could potentially be useful when evaluating AI use in GMP.

For example, some Quality System activities may be highly computable:

• checking whether required fields are completed;
• comparing a document against predefined requirements;
• identifying duplicate or recurring deviations;
• extracting equipment or batch information;
• checking dates, limits or predefined conditions;
• classifying documents against controlled taxonomies.

Other activities may remain much less computable:

• determining the true root cause of a complex deviation;
• assessing whether an unexplained event affects product quality;
• evaluating the adequacy of a CAPA strategy;
• making a final batch disposition decision;
• determining whether an unusual observation represents an unacceptable patient risk.

This suggests a potentially useful AI risk-assessment question for pharma:

How much of the intended task can actually be expressed as explicit, testable and auditable logic?

The less computable the task, the greater the likely need for expert oversight.

Large Language Models Are Not Automatically the Best Solution

Another important message from the paper concerns the current tendency to use large language models for almost every AI application.

The authors distinguish between:

• large models – general-purpose LLMs and foundation models;
• small models – task-specific machine-learning models;
• deterministic tools – rules, dictionaries, workflow logic and conventional software.

Large models offer flexibility and can work across multiple text-heavy tasks.

But they also introduce important disadvantages:

• hallucinations;
• variable outputs;
• prompt sensitivity;
• possible information loss;
• more difficult validation;
• more difficult auditability.

Smaller task-specific models can be easier to validate when the task has constrained inputs and clearly defined outputs.

The paper therefore argues that the future may not belong to one universal AI model.

Instead, the most practical architecture may be hybrid.

A Hybrid Architecture: LLM + Small Models + Deterministic Tools

One particularly interesting proposal is an architecture in which an LLM acts as an orchestrator but does not perform every regulated function itself.

The architecture could look like:

User / Reviewer

↓

LLM or AI Agent

↓

Controlled Tools / Retrieval / Rules / Small Models

↓

Structured Result

↓

Expert Review and Decision

The LLM can interpret the request and coordinate different tools.

But specific operations can be delegated to more deterministic components such as:

• validated rule engines;
• controlled terminology;
• structured retrieval;
• database queries;
• schema validation;
• task-specific ML models.

This architecture can reduce uncontrolled generative behaviour.

It can also improve auditability because intermediate actions and outputs can be recorded.

For regulated pharmaceutical applications, this may be a much more attractive architecture than asking one general-purpose LLM to perform the entire process.

An Interesting Finding: Bigger AI Was Not Always Better

The authors also report an illustrative comparison between a task-specific BioBERT model and a general-purpose Llama-4 model for extraction of safety-related information.

For the evaluated structured extraction tasks, the task-specific model performed better.

The authors do not present this as a universal comparison between the two technologies.

Instead, the example demonstrates a broader principle:

The most powerful general-purpose model is not necessarily the best model for a tightly defined regulated task.

For pharmaceutical companies, this is significant.

The correct question may therefore not be:

“Which is the best AI model?”

but:

“Which technical architecture provides the most reliable, verifiable and auditable performance for this particular task?”

“Trust but Verify”

The paper describes the boundary of AI automation using a “trust but verify” philosophy.

AI can increasingly perform routine, well-specified operations.

However, as the process moves from:

pattern recognition → interpretation → judgment → regulated decision

the requirement for structured verification and expert review becomes increasingly important.

The authors conclude that Generative AI does not currently mean the end of human pharmacovigilance.

Instead, the likely future is a:

Human–AI system

in which AI performs increasingly sophisticated operations while humans remain responsible for judgment-intensive decisions.

Why This Matters for GMP and Pharmaceutical Quality

This concept could be particularly useful when companies perform AI use-case assessments.

Instead of simply classifying an application as:

AI / non-AI

or:

GxP / non-GxP

an additional question could be introduced:

How computable is the task?

A possible assessment sequence could therefore become:

Intended Use → GxP Impact → Task Computability → AI Architecture → Verification Strategy → Human Oversight → Lifecycle Monitoring

This could help organisations determine whether a task should be performed using:

• deterministic software;
• a task-specific ML model;
• an LLM;
• a hybrid architecture;
• or primarily human expert judgment.

This may ultimately be more useful than assuming that Generative AI should replace existing software simply because it is more flexible.

Regulatory Status Note

The article was written by FDA scientists, but it is a scientific perspective paper and does not represent formal FDA guidance or FDA policy.

The authors explicitly state that the views expressed are their own and do not necessarily represent the official position of the U.S. Food and Drug Administration.

Nevertheless, the paper provides valuable insight into how regulatory scientists are thinking about AI automation, validation, auditability and human judgment in regulated pharmaceutical activities.

Source

Wu L., Xu J., Dang O., Ball R. – Does generative AI mean the “end of history” for pharmacovigilance automation? Towards a framework for the future of human-AI systems. Frontiers in Drug Safety and Regulation, 18 August 2026:

https://www.frontier … fr.2026.1846339/full

Introduction

⇒ PDA outlines how AI can strengthen pharmaceutical quality metrics and predictive oversight while remaining embedded within validated data, Quality Systems and human decision-making.

A new article published by the Parenteral Drug Association on 20 August 2026 provides a particularly practical view of how artificial intelligence could be integrated into pharmaceutical quality management.

The article, Using Artificial Intelligence and Metrics, was prepared as part of the PDA Quality Management Maturity Team’s series on metrics implementation. Its authors represent Bristol Myers Squibb, HarborView and Eli Lilly.

Rather than focusing on AI as a standalone technology, the article places AI inside an existing pharmaceutical Quality System.

This distinction is important.

AI as a Quality Intelligence Layer

The authors describe how increasingly contextualized and high-integrity data can allow AI to support more proactive quality and regulatory decision-making.

Potential applications include:

• real-time monitoring of quality metrics;
• earlier detection of deviations, trends and anomalies;
• predictive identification of potential quality problems;
• continuous process insights;
• dynamic prioritization of investigations based on emerging trends.

The concept therefore goes beyond using AI simply to summarize documents or automate administrative work.

AI could become an analytical layer over established quality data, helping Quality organisations identify signals earlier and potentially move from retrospective review toward predictive oversight.

But AI Cannot Compensate for Weak Data

One of the strongest messages in the PDA article is that AI-driven metrics depend on structured and reliable data.

The authors emphasize the importance of structured, validated data models so that metrics remain standardized, traceable and auditable.

This is particularly relevant in GMP environments.

An advanced algorithm applied to inconsistent, poorly contextualized or unreliable data does not create a mature quality system. It can instead accelerate incorrect conclusions.

For pharmaceutical companies, this suggests that AI implementation should often start not with selecting an AI model, but with evaluating:

• data quality;
• data structure;
• data ownership;
• metric definitions;
• traceability;
• data integration between systems;
• reliability of the underlying quality indicators.

AI Should Reinforce Existing Metrics, Not Replace Them

The PDA authors propose that AI-generated insights should be linked to existing quality metrics rather than creating an independent decision framework.

They highlight several important control principles:

• AI models should be validated as decision-support tools under defined conditions;
• outputs should be sufficiently explainable for quality and regulatory review;
• inputs, processing and outcomes should remain traceable;
• appropriate audit trails and system controls should be maintained;
• AI should be integrated into existing governance and management processes.

This creates an important boundary:

AI should complement the Pharmaceutical Quality System rather than become a parallel Quality System.

An Interesting Warning: Do Not Optimize the Wrong Metric

One particularly important part of the article concerns the risk of relying on a narrow set of metrics.

AI systems are very effective at optimizing measurable objectives.

But if an organisation measures the wrong thing – or relies too heavily on one indicator – optimisation can produce unintended behaviour.

For example, reducing investigation closure time could appear positive.

However, if the metric becomes dominant, it could unintentionally encourage faster but less thorough investigations.

Similarly, reducing deviations is not necessarily evidence of improved process performance if problems are being classified or reported differently.

The authors therefore recommend a multi-metric, context-aware approach, with metrics periodically reassessed and stress-tested against possible gaming or unintended effects.

This concept is particularly important for AI because algorithms may amplify the consequences of poorly designed performance indicators.

What This Means for Pharmaceutical Quality Systems

The article suggests a potentially important direction for AI implementation in pharma:

AI should not replace established Quality Management Review – it should make it more intelligent.

A future AI-supported Quality System could continuously analyze:

• deviations;
• CAPAs;
• complaints;
• OOS and OOT results;
• process capability;
• environmental monitoring;
• audit observations;
• supplier performance;
• training effectiveness;
• change controls;
• recurring quality signals.

Instead of reviewing each metric independently, AI could identify relationships between them and detect weak signals that are difficult to see during conventional periodic review.

But such a system would still require validated data, appropriate model controls, human oversight and clear accountability.

Why This Publication Is Important

Much of the current discussion around pharmaceutical AI focuses on validating algorithms.

The PDA article points toward another important dimension:

AI effectiveness may depend as much on the maturity of the surrounding Quality System and data architecture as on the performance of the AI model itself.

This is consistent with an emerging view that pharmaceutical AI should not be implemented as an isolated technology project.

Instead, it should become part of:

Data Governance → Quality Metrics → AI Analytics → Human Review → Management Decision → Continuous Improvement

The AI model is only one component of that chain.

Regulatory Perspective

The PDA publication is an industry article and does not establish a new regulatory requirement.

However, its recommendations align with several themes increasingly visible in regulatory discussions: defined context of use, trustworthy data, validation, traceability, explainability, human oversight and lifecycle governance.

For pharmaceutical companies considering AI in Quality Systems, the article provides a useful practical bridge between AI technology and established ICH Q10-style quality management principles.

Source

PDA – Using Artificial Intelligence and Metrics, published 20 August 2026:

https://pda.org/pda- … lligence-and-metrics

FDA Draft Guidance – Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products:

https://www.fda.gov/ … -drug-and-biological

Introduction

⇒ Six different concepts of AI control in GMP and pharma: CSV/GAMP validation, context of use, algorithmic state of control, guardrails, competency-based evaluation and AI governance.

Several clearly different concepts of AI control can be distinguished in the GMP/pharma environment. They share a common foundation, but [b]they are not the same approach

They differ mainly in what they consider to be the primary object of control: the computerized system, the model, the model output, AI behaviour, or the entire system of “AI + guardrails + human + process”.

In my view, we can currently distinguish at least six approaches:

• Traditional CSV / GAMP lifecycle – control of system functions; classical validation
• Context-of-Use / Model Credibility – credibility of the model for a specific application; risk-based
• Performance / State of Control – maintaining model performance over time; lifecycle monitoring
• Guardrails + Human Oversight – control of risky GenAI behaviours
• Competency-Based Evaluation – assessment of AI’s ability to perform defined classes of tasks
• Enterprise AI Governance – control of the entire AI ecosystem and organisational accountability

1. Traditional CSV/GAMP Approach: “AI as a Computerized System”

This is the most conservative approach.

The starting point is:

Intended Use → Requirements → Risk Assessment → Specification → Verification/Validation → Change Control → Periodic Review

A large part of traditional CSV principles still applies: security, access control, audit trail, data integrity, interfaces, backup, configuration management, etc.

The ISPE GAMP approach to machine learning also emphasizes that much of the traditional lifecycle for computerized systems remains applicable to ML. At the same time, some ML applications require validation to be extended to include performance metrics, an appropriate validation dataset, version control and monitoring.

This approach can be summarized as:

Prove that the system is fit for intended use.

The problem appears with GenAI: how do we verify all possible responses if the output is probabilistic and practically unlimited?

Source:

https://ispe.org/pha … pts-machine-learning

2. FDA Context-of-Use / Model Credibility: “Do Not Ask Whether AI Is Good – Ask Whether It Is Sufficiently Credible for a Specific Decision”

This is already a different philosophy.

FDA, in its 2025 draft guidance, proposes a risk-based credibility assessment framework.

The most important element is Context of Use (COU).

The same AI model may require a completely different level of evidence if:

• in one application it only helps search for information;
• in another it influences a quality assessment;
• in a third it provides information used in regulatory decision-making.

FDA indicates that the stringency of credibility assessment, acceptance criteria, oversight and documentation should be proportional to model risk and the specific COU.

This approach can be summarized as:

Prove that the model output is sufficiently credible for this particular decision.

This is subtly different from classical system validation.

Source:

https://www.fda.gov/ … -drug-and-biological

3. “AI State of Control”: Validation Is Not Enough – We Need to Demonstrate That AI Continues to Perform Properly

This is a concept that, in my view, will become increasingly important.

Traditional validation answers:

Was the system operating correctly at the time of validation?

For AI, a more important question becomes:

Is it still operating correctly after 3, 6 or 12 months?

This introduces:

• model drift;
• data drift;
• performance degradation;
• override rate;
• false positives;
• false negatives;
• uncertainty;
• anomalous outputs;
• retraining triggers.

ISPE already points to the need to update verification and validation when ML changes and to use change management, version control and monitoring.

This approach can be described as:

Validate once + continuously demonstrate maintained performance.

In traditional GMP, the analogy would be Continued Process Verification.

This is where a very attractive concept emerges:

Algorithmic State of Control.

4. EMA Annex 22: Guardrails + Human Oversight

This is another way of thinking, particularly important for GenAI and LLMs.

In the Annex 22 workshop, EMA did not ask only:

Does the model provide correct answers?

but also:

What happens when the model provides an incorrect answer?

Therefore, the object of control becomes the entire protective system:

AI → guardrail → uncertainty detection → escalation → human review → final GMP decision

EMA has explicitly raised questions concerning:

• the ability to detect hallucinations and fabricated information;
• effectiveness of guardrails;
• human-in-the-loop oversight;
• escalation;
• stress testing;
• failure analysis;
• drift;
• behaviour of guardrails after model updates;
• situations in which even guardrails + human oversight may be insufficient.

This can be summarized as:

Do not rely solely on making AI perfect. Build a controlled environment around imperfect AI.

This is a very important philosophical difference.

We are not trying to prove that GenAI will never make a mistake.

We are trying to prove that:

the error will be detected, stopped or corrected sufficiently often before it creates a GMP impact.

Source:

https://www.ema.euro … development-annex-22

5. Competency-Based Evaluation: Probably the Most Radically Different Approach

This is a new FDA concept from August 2026 concerning GenAI-enabled medical devices.

It is not GMP guidance, but conceptually it is very interesting for pharma.

FDA identifies the problem: for GenAI, it may be unrealistic to test all possible input-output combinations.

It therefore considers:

Device Benchmarking → Clinical Confirmation → Postmarket Monitoring

and assessment of AI “competencies”, such as:

• knowledge/task fidelity;
• safety behaviour;
• quantitative reasoning;
• communication;
• generalizability;
• appropriate deferral;
• adherence to operational boundaries.

At a high level, FDA compares this idea with the way we assess the competence of physicians – we do not test every possible situation that may occur during the next 30 years of clinical practice.

A similar concept could potentially be adapted for GenAI.

This can be summarized as:

Do not validate every possible answer; demonstrate that the AI possesses and maintains the required competencies.

This is very different from traditional CSV.

And, in my view, potentially very interesting for GMP as well.

Source:

https://www.fda.gov/ … on-paper-and-request

6. Governance / PQS Approach: We Control Not Only the AI, but the Organisation Using AI

Another perspective says that validating the model itself is insufficient.

We need to control:

AI inventory → classification → ownership → supplier → data → intended use → risk → validation → access → human accountability → change → monitoring → incidents → CAPA → retirement

In other words, AI becomes part of the Pharmaceutical Quality System.

In this approach, we are focusing not if the model have eg. 95% accuracy but if the the organisation have a system ensuring that AI is used only where it has been approved, by the right people, for the right purpose, under appropriate controls and with clear accountability?

This fits very well with both QRM/PQS and the direction of Annex 22, where EMA discusses lifecycle QRM, accountability, supplier qualification, change-control visibility and outsourced/cloud AI.

Are These Concepts Competing With Each Other?

Probably not. They overlap and complement each other.

They can actually be arranged as layers:

Governance

↓

Intended Use / Context of Use / Risk

↓

System Validation

↓

Model Performance / Competency

↓

Guardrails

↓

Human Oversight

↓

Operational Monitoring / State of Control

This may represent the most mature model of AI control in GMP.

Not simply:

“Validate AI”

but:

“Establish a multi-layered control system ensuring that AI remains appropriate for a specific intended use and that its potential errors do not lead to unacceptable GMP impact.”

The Common Denominator of All Approaches

Despite different names, practically all contemporary concepts converge around several principles:

Intended Use → Risk → Data → Performance → Controls → Human Accountability → Change Control → Continuous Monitoring

They differ mainly in where they place the centre of gravity.

The industry may therefore gradually move away from the question:

“How do we validate AI?”

towards:

“How do we keep AI in a demonstrable state of control?”

That is a much broader and potentially more appropriate concept for AI used in pharmaceutical GMP environments.

Regulatory Status Note

The concepts described above originate from sources with different regulatory status. Some are based on established GxP and GAMP principles, while others originate from draft guidance, regulatory workshops or discussion papers. In particular, the FDA competency-based evaluation concept relates to GenAI-enabled medical devices and does not constitute a GMP requirement. These concepts should therefore be considered as different approaches and emerging regulatory thinking rather than as one harmonised regulatory framework for AI in GMP.