Saturday, October 17, 2026

EMA Coordinates the Next Wave of Pharmaceutical AI Guidance


Introduction⇒ EMA has established an AI Guidance Coordination Group and is advancing horizontal machine-learning principles and dedicated clinical-development guidance, supported by international convergence and AI-ready regulatory data infrastructure.

The European medicines regulatory network is preparing a more coordinated framework for artificial intelligence across the medicines lifecycle.

Summary notes published by EMA on 14 October 2026 confirm several important developments:

  • a newly established AI Guidance Coordination Group;
  • planned horizontal guidance on good machine-learning practice;
  • dedicated AI guidance for clinical development;
  • continued EMA–FDA work on common AI terminology;
  • greater attention to AI-ready regulatory data infrastructure.

These developments are strategically important because pharmaceutical AI guidance has so far emerged through several separate initiatives.

The new direction is toward:

one coordinated regulatory architecture combining horizontal AI principles with domain-specific guidance.

What Is the AI Guidance Coordination Group?

The new AI Guidance Coordination Group has been established within the European medicines regulatory network.

Its purpose is to coordinate AI-related guidance activities across the medicines lifecycle.

The Group will:

  • maintain an overview of ongoing AI guidance initiatives;
  • help align their scope and planning;
  • identify overlaps and gaps;
  • support coordination with the European Commission;
  • promote a coherent regulatory approach.

The Group will not itself draft or approve guidance.

It will also not replace the responsibilities of existing scientific committees or working parties.

Its function is therefore coordination rather than regulatory decision-making.

Why Coordination Is Needed

AI can be used across many pharmaceutical functions, including:

  • drug discovery;
  • nonclinical modelling;
  • clinical development;
  • manufacturing;
  • pharmacovigilance;
  • regulatory assessment;
  • post-authorisation monitoring.

Different expert groups may need to develop guidance for these different domains.

Without coordination, several problems could arise:

  • duplicated requirements;
  • inconsistent terminology;
  • different interpretations of risk;
  • gaps between lifecycle stages;
  • conflicting expectations for the same technology.

The Coordination Group is intended to reduce these risks.

Horizontal Guidance on Good Machine-Learning Practice

The October meeting discussed future horizontal guidance on good machine-learning practice.

EMA’s summary notes indicate that work is progressing on a horizontal document covering general machine-learning principles applicable across the medicines lifecycle.

This could become an important regulatory foundation.

A horizontal document may address principles that apply broadly regardless of the specific pharmaceutical use case, such as:

  • Context of Use;
  • data quality and provenance;
  • model development;
  • performance evaluation;
  • robustness;
  • transparency;
  • human oversight;
  • change control;
  • lifecycle monitoring.

Domain-specific guidance could then explain how those principles apply in particular areas.

Horizontal and Domain-Specific Guidance Should Complement Each Other

A possible future structure may therefore look like:

Horizontal Machine-Learning Principles

↓

Clinical Development Guidance

Pharmacovigilance Guidance

GMP Annex 22

Other Domain-Specific Guidance

This structure could help avoid repeating the same principles in every regulatory document.

It could also create greater consistency across the pharmaceutical lifecycle.

Dedicated AI Guidance for Clinical Development

The European regulatory network is also preparing dedicated guidance on AI in clinical development.

EMA reported that a concept paper is currently being finalised and will be followed by public consultation.

The horizontal guidance and clinical-development guidance are intended to progress in parallel and complement each other.

This is significant because AI is increasingly used in clinical research for:

  • patient selection;
  • trial design;
  • external control arms;
  • digital endpoints;
  • biomarkers;
  • data analysis;
  • safety monitoring.

These applications can influence evidence submitted for regulatory decision-making and therefore require a coherent framework.

Industry Has Identified Priority Areas Requiring Clarification

Industry participants identified several areas where additional regulatory clarity would be particularly valuable:

  • risk categorisation and proportionality;
  • validation and evidence requirements;
  • third-party AI tools;
  • documentation and transparency;
  • lifecycle oversight of adaptive AI;
  • regulatory submission expectations.

These issues reflect practical implementation challenges faced by pharmaceutical companies.

For example, a company may use a third-party AI platform without full visibility into:

  • training data;
  • model architecture;
  • provider updates;
  • model-change notifications;
  • performance limitations.

Regulatory guidance will need to consider how a regulated company can remain accountable when important parts of the AI technology are externally controlled.

Validation Should Be Proportionate to Context of Use

The meeting also reinforced the importance of clearly defining use cases and Context of Use.

Evidentiary expectations may differ depending on the intended regulatory purpose.

For example, AI used to identify possible literature for human review does not necessarily require the same assurance as AI used to:

  • define a clinical endpoint;
  • generate an external control;
  • support a benefit-risk conclusion;
  • influence a critical product-quality decision.

A risk-based framework could therefore follow:

Context of Use → Decision Impact → Model Risk → Evidence Requirement

Synthetic Data, Digital Twins and AI-Derived Endpoints

The October meeting also considered emerging applications such as:

  • synthetic and simulated data;
  • external controls;
  • digital twins;
  • AI-derived endpoints;
  • AI-derived biomarkers;
  • AI-supported signal detection.

These technologies can potentially accelerate development and reduce dependence on conventional evidence-generation methods.

However, they also raise difficult regulatory questions.

For example:

  • How should synthetic data be validated?
  • How should uncertainty be quantified?
  • When is a digital twin sufficiently credible?
  • How should an AI-derived endpoint be qualified?
  • How should bias and representativeness be assessed?

EMA noted that terminology, use cases and Contexts of Use need to be clearly defined.

AI-Ready Regulatory Data Infrastructure

Another major topic was data interoperability.

Industry participants emphasised that responsible AI depends on public regulatory information being:

  • accessible;
  • machine-readable;
  • interoperable;
  • reusable.

Examples discussed included information from:

  • the Clinical Trials Information System;
  • European Public Assessment Reports;
  • product information;
  • pharmacovigilance systems.

This is important because AI performance depends not only on the model but on the quality and structure of the information available to it.

Confidentiality and Sponsor Data Remain Important

The discussion also considered governance of sponsor-submitted data.

Making regulatory data more AI-ready must not mean that confidential or proprietary information can be reused without appropriate safeguards.

Relevant controls may need to address:

  • confidentiality;
  • authorised use;
  • transparency;
  • data ownership;
  • protection of proprietary information.

This illustrates a recurring tension in pharmaceutical AI:

greater data accessibility can enable innovation, but regulated and confidential information still requires strong governance.

International Convergence Is a Major Priority

Industry participants strongly supported greater international cooperation.

Priority areas for convergence include:

  • AI principles;
  • terminology;
  • risk assessment;
  • validation in GxP environments;
  • regulatory submission expectations.

EMA reported continued collaboration with FDA, including:

  • development of a joint AI glossary;
  • follow-up work related to the joint Guiding Principles of Good AI Practice;
  • future discussions involving the European Commission, EMA and FDA.

International discussions are also taking place through the International Coalition of Medicines Regulatory Authorities.

Why a Joint AI Glossary Matters

Terminology may appear less important than validation, but inconsistent terminology can create real regulatory problems.

Terms such as:

  • adaptive AI;
  • dynamic model;
  • synthetic data;
  • digital twin;
  • foundation model;
  • human oversight

may be interpreted differently by companies and regulators.

A common glossary can therefore support:

  • more consistent submissions;
  • clearer guidance;
  • better international alignment;
  • reduced ambiguity during regulatory review.

Implications for Pharmaceutical Companies

The emerging EMA structure suggests that companies should avoid building separate AI governance approaches for every function.

A common enterprise framework can establish shared principles for:

  • AI inventory;
  • intended use;
  • Context of Use;
  • risk classification;
  • data governance;
  • model evaluation;
  • human oversight;
  • change management;
  • performance monitoring.

Individual functions can then add requirements appropriate to clinical development, manufacturing, pharmacovigilance or other regulated areas.

What to Watch Next

Several future milestones will be important:

  • publication of the clinical-development concept paper;
  • opening of the public consultation;
  • development of horizontal machine-learning guidance;
  • progress on the EMA–FDA AI glossary;
  • clarification of expectations for third-party and adaptive AI;
  • alignment with draft GMP Annex 22.

The next meeting of the HMA–EMA AI industry-stakeholder group is scheduled for February 2027.

Why This Development Matters

The October meeting shows that European AI regulation for medicines is moving into a more structured phase.

The earlier phase focused largely on:

principles → reflection papers → individual guidance initiatives.

The next phase increasingly looks like:

Horizontal Guidance → Domain-Specific Guidance → International Convergence → AI-Ready Regulatory Infrastructure.

For pharmaceutical companies, this creates a clearer direction but also a broader governance challenge.

AI assurance will increasingly need to operate across the entire medicines lifecycle rather than within isolated technology projects.

Regulatory Status Note

The October meeting summary does not establish new legally binding requirements.

The horizontal machine-learning document and clinical-development guidance remain under development.

The clinical-development concept paper has not yet entered public consultation, and draft GMP Annex 22 remains a separate ongoing initiative.

The meeting should therefore be understood as an important regulatory-development signal rather than a current compliance standard.

Sources

EMA – Meeting of the HMA–EMA group focused on AI with industry stakeholders, October 2026:

https://www.ema.euro … holders-october-2026

EMA – Summary notes of the October 2026 meeting:

https://www.ema.euro … -october-2026_en.pdf

MHRA Strategy 2030: AI Moves into the Core of Medicines Regulation and Safety


Introduction⇒ MHRA Strategy 2030 places AI at the centre of medicines regulation through an AI clinical-trial protocol checker, a 2027 AI Medicines Development Action Plan, real-time safety analytics and a new Centre for AI and Digital Health.

The UK Medicines and Healthcare products Regulatory Agency has placed artificial intelligence at the centre of its five-year regulatory strategy.

Published on 14 October 2026, the MHRA Strategy 2030 describes how the Agency intends to modernise medicines and medical-device regulation in response to rapid advances in artificial intelligence, data science, personalised medicines and advanced therapies.

The significance of the strategy is not simply that MHRA supports innovation.

It contains several concrete AI commitments, including:

  • development of an AI-enabled Clinical Trial Protocol Checker;
  • publication of an AI Medicines Development Action Plan in 2027;
  • establishment of an MHRA Centre for AI and Digital Health;
  • use of AI and real-world data to identify safety issues earlier;
  • movement toward continuous, real-time safety assurance.

For pharmaceutical companies, this is an important regulatory signal:

AI is moving from isolated pilot projects into the core infrastructure of medicines development, regulatory assessment and post-market oversight.

AI Challenges Traditional Regulatory Models

MHRA states that artificial intelligence is transforming both regulated products and the way organisations operate.

The Agency also recognises that these developments challenge traditional regulatory models and require new approaches to:

  • evidence generation;
  • clinical research design;
  • manufacturing oversight;
  • post-market safety;
  • surveillance.

This is particularly important for pharmaceutical companies.

AI is no longer relevant only where it is incorporated into a digital medical device.

It can also affect:

  • drug discovery;
  • nonclinical modelling;
  • clinical-trial design;
  • regulatory submissions;
  • manufacturing and quality systems;
  • pharmacovigilance;
  • regulatory review.

The same organisation may therefore use AI in several regulated contexts, each requiring a different level of assurance.

A New AI Medicines Development Action Plan Is Coming in 2027

One of the most important commitments is the planned publication of an:

AI Medicines Development Action Plan in 2027.

The strategy announcement states that the plan will explain how AI will be used to transform medicines development.

This could become an important UK regulatory reference for pharmaceutical companies.

Key questions that the future Action Plan may need to address include:

  • how AI Context of Use should be defined;
  • what evidence is required to demonstrate model credibility;
  • how training and validation data should be governed;
  • how AI-supported evidence should be documented;
  • how model changes should be controlled;
  • what level of human oversight is expected;
  • how performance should be monitored throughout the lifecycle.

The Action Plan has not yet been published, and its detailed scope remains to be seen.

Nevertheless, committing to a dedicated medicines-development plan shows that MHRA intends to move beyond broad responsible-AI principles toward application-specific regulatory expectations.

An AI-Enabled Clinical Trial Protocol Checker

MHRA also plans to develop an AI-enabled Clinical Trial Protocol Checker.

Its intended purpose is to provide sponsors with greater regulatory certainty and support faster, higher-quality clinical-trial applications.

This is a significant example of AI operating on the regulator side of the regulatory interface.

A protocol checker could potentially help identify:

  • missing information;
  • internal inconsistencies;
  • common application deficiencies;
  • potential regulatory issues;
  • areas requiring clarification before submission.

The objective would not necessarily be to replace regulatory assessment.

Instead, AI could help sponsors improve submission quality before formal review.

AI Will Increasingly Operate on Both Sides of the Submission

Pharmaceutical companies are already considering AI for:

  • protocol drafting;
  • regulatory writing;
  • data analysis;
  • quality control of submissions;
  • regulatory intelligence.

At the same time, regulators are adopting AI to support:

  • application triage;
  • protocol assessment;
  • information retrieval;
  • evidence analysis;
  • safety surveillance.

This creates a new regulatory environment:

Sponsor AI → Regulatory Submission → Regulator AI → Human Regulatory Decision

As AI becomes more common on both sides, the quality and traceability of the underlying information may become increasingly important.

Regulatory submissions may need to become more:

  • structured;
  • machine-readable;
  • internally consistent;
  • traceable to authoritative sources;
  • suitable for automated analysis.

A New MHRA Centre for AI and Digital Health

The strategy also commits MHRA to establishing a:

Centre for AI and Digital Health.

The Centre is intended to clarify regulatory expectations for developers of digital and AI-driven medical devices and medicines.

This could help address a recurring industry problem.

Organisations often understand the high-level AI principles but remain uncertain about practical implementation.

Questions may include:

  • Which regulatory framework applies?
  • What validation evidence is expected?
  • How should adaptive AI be controlled?
  • How should third-party foundation models be governed?
  • What information should be included in a regulatory submission?
  • How should post-deployment performance be monitored?

A dedicated centre could provide a more coherent regulatory interface for these questions.

From Periodic Safety Review to Continuous Safety Assurance

Another major commitment concerns post-market surveillance.

MHRA intends to move toward:

continuous, real-time safety assurance using data, analytics and AI.

The Agency plans to:

  • improve access to hospital and genomic data;
  • use AI to analyse real-world data;
  • identify potential safety issues earlier;
  • work with the Health Data Research Service;
  • strengthen real-time safety-signal detection;
  • simplify Yellow Card adverse-event reporting.

This reflects a broader shift in pharmacovigilance.

The traditional model relies heavily on periodic reporting and retrospective analysis.

AI-supported surveillance could increasingly provide:

  • earlier signal identification;
  • automated case clustering;
  • trend detection;
  • analysis across multiple data sources;
  • continuous reassessment of product safety.

AI Does Not Remove the Need for Scientific Oversight

More continuous surveillance does not mean that every statistical or algorithmic signal represents a genuine safety problem.

AI may identify correlations, unusual patterns or clusters that require further evaluation.

Qualified experts must still determine:

  • whether the signal is scientifically plausible;
  • whether alternative explanations exist;
  • whether data quality is sufficient;
  • whether regulatory action is necessary.

A mature safety architecture therefore remains:

AI Signal Detection → Scientific Assessment → Human Decision → Regulatory Action

Implications for Manufacturing and GMP

MHRA Strategy 2030 is not a new GMP guideline.

However, it explicitly states that technological developments require innovative approaches to manufacturing oversight.

This matters because AI is increasingly being considered for:

  • process monitoring;
  • predictive maintenance;
  • deviation analysis;
  • quality trending;
  • laboratory analytics;
  • advanced process control;
  • manufacturing knowledge management.

The strategy does not yet specify how MHRA will evaluate these individual use cases.

Nevertheless, it suggests that manufacturing oversight will need to evolve as digital and AI-enabled systems become more common.

For pharmaceutical manufacturers, this supports the need to establish AI governance before specific inspection expectations become fully developed.

The Regulator Is Also Becoming an AI Organisation

The strategy is not only about regulating AI products.

It is also about using AI to modernise MHRA’s own operations.

This distinction is important.

The Agency is simultaneously becoming:

  • a regulator of AI;
  • a user of AI;
  • a producer of AI-supported regulatory analysis.

This may influence how regulatory information is submitted, reviewed and monitored.

It may also create new expectations for data quality, consistency and digital interoperability across the medicines lifecycle.

What Pharmaceutical Companies Should Do Now

The publication of the strategy does not create an immediate new compliance obligation.

However, companies can begin preparing for the regulatory direction it describes.

Useful actions include:

  • maintaining an inventory of AI use cases;
  • defining intended use and Context of Use;
  • classifying GxP and regulatory impact;
  • documenting data provenance;
  • establishing human-accountability requirements;
  • controlling models, configurations and suppliers;
  • monitoring operational performance;
  • following development of the 2027 AI Medicines Development Action Plan.

Companies operating in the UK should also consider how AI-supported regulatory submissions may interact with future MHRA tools such as the Clinical Trial Protocol Checker.

Why This Strategy Matters

MHRA Strategy 2030 represents more than a general statement that artificial intelligence is important.

It establishes several concrete deliverables:

AI Protocol Checker → AI Medicines Development Action Plan → AI Centre → AI-Enabled Safety Surveillance

Together, these commitments show that AI is becoming part of the regulator’s long-term operating model.

The relevant question for pharmaceutical companies is therefore shifting from:

“Will regulators eventually address AI?”

toward:

“How should our systems, data, governance and workforce prepare for an AI-enabled regulatory environment?”

Regulatory Status Note

MHRA Strategy 2030 is a strategic policy document.

It does not itself establish new legally binding GMP requirements or detailed validation expectations for pharmaceutical AI.

The AI Medicines Development Action Plan is planned for 2027, and the Clinical Trial Protocol Checker and Centre for AI and Digital Health remain future commitments.

The strategy should therefore be understood as a strong regulatory-direction signal rather than a current AI compliance standard.

Sources

MHRA – MHRA Strategy 2030:

https://www.gov.uk/g … s/mhra-strategy-2030

MHRA – Strategy 2030 executive summary:

https://www.gov.uk/g … 30-executive-summary

MHRA – Strategy 2030 announcement:

https://www.gov.uk/g … rsonalised-medicines

Tuesday, October 13, 2026

Digital CMC CERSI Moves from AI Principles to a Practical Regulatory Lifecycle Framework


Introduction⇒ The MHRA-supported Digital CMC CERSI provides a practical regulatory lifecycle framework for AI and computational models in pharmaceutical CMC, including risk-based credibility assessment, lifecycle management, a regulatory sandbox and VERA, a source-grounded RAG regulatory assistant.

One of the main barriers to artificial intelligence in pharmaceutical manufacturing is no longer lack of technical capability.

It is regulatory readiness.

The MHRA-supported Digital CMC Centre for Excellence in Regulatory Science and Innovation (Digital CMC CERSI), led by the University of Strathclyde’s CMAC medicines manufacturing research centre, has developed a practical set of tools intended to bridge this gap.

The Digital CMC Centre for Excellence in Regulatory Science and Innovation (Digital CMC CERSI) is a UK regulatory-science initiative that brings together regulators, academia and industry to develop practical approaches for the use of digital technologies, modelling and AI in pharmaceutical Chemistry, Manufacturing and Controls (CMC).

The programme’s September 2026 summary highlights an important problem:

digital and AI-enabled models are being developed across pharmaceutical CMC, but relatively few progress into regulator-facing use.

Digital CMC CERSI has therefore focused not on creating another AI model, but on creating the regulatory-science infrastructure needed to evaluate models consistently.

Its main outputs include:

  • the Digital CMC Regulatory Lifecycle (DCRL) Framework;
  • a ten-stage DCRL Workflow;
  • a Digital CMC Sandbox;
  • regulatory case studies;
  • training resources;
  • VERA – an AI-enabled Virtual Expert for Regulatory Assistance.

For pharmaceutical companies trying to move AI from proof-of-concept into development, manufacturing, regulatory submissions or inspected GxP processes, this is potentially more useful than another high-level AI principle document.

From “Can the Model Work?” to “Is the Model Regulatory-Ready?”

The DCRL Framework makes an important distinction.

A technically successful computational model is not automatically ready for pharmaceutical use.

Regulatory confidence also depends on understanding:

  • what question the model is intended to answer;
  • where and how it will be used;
  • what happens if the model is wrong;
  • whether the underlying data are appropriate;
  • how model credibility has been demonstrated;
  • how uncertainty affects the final decision;
  • how the model will be documented;
  • how performance and changes will be controlled over time.

This can be summarized as:

Technical Performance → Credibility → Regulatory Readiness → Lifecycle Control

The value of the framework is that it translates these broad principles into an operational workflow.

The Ten-Stage DCRL Workflow

The Digital CMC Regulatory Lifecycle Workflow consists of ten connected stages.

These are:

  • 1. Define the Question of Interest;
  • 2. Define the Context of Use;
  • 3. Select the Model Type;
  • 4. Conduct Model Risk Assessment;
  • 5. Plan Data Collection;
  • 6. Develop the Model and perform initial credibility assessment;
  • 7. Review Credibility and Fitness for Use;
  • 8. Assess the Risk of Uncertainty in Decision-Making;
  • 9. Document for Regulatory Use;
  • 10. Perform Lifecycle Management.

This is particularly useful for pharmaceutical AI because it starts with the scientific and regulatory purpose rather than with the algorithm.

The first question is not:

“Which AI technology should we use?”

It is:

“What decision or question is this model intended to support?”

Context of Use Becomes the Anchor

The framework reinforces the importance of Context of Use.

An identical model could have very different regulatory significance depending on whether it is used to:

  • explore development data;
  • identify unusual process trends;
  • recommend a manufacturing adjustment;
  • support an in-process control;
  • contribute to a regulatory submission.

The required level of evidence should therefore be related to the consequence of model failure.

A model used for exploratory analysis should not necessarily require the same assurance as a model influencing a critical quality or regulatory decision.

This supports a risk-proportionate approach:

Context of Use → Model Risk → Required Credibility Evidence

Uncertainty Is Treated as Part of the Decision

One particularly important feature of the DCRL Workflow is the explicit assessment of uncertainty.

The relevant question is not simply:

“How uncertain is the model?”

but:

“What could that uncertainty do to the pharmaceutical decision?”

This is an important distinction.

A certain level of prediction uncertainty may be acceptable where the model merely prioritises further investigation.

The same uncertainty could be unacceptable if the model controls a process condition or supports a critical quality decision.

This moves AI validation toward Quality Risk Management rather than generic machine-learning benchmarking.

The Framework Is Not Limited to AI

Another strength is that the DCRL Framework does not treat AI as an isolated technology category.

It is intended to support:

  • knowledge-driven models;
  • data-driven models, including AI;
  • empirical models;
  • hybrid models.

That may be important for pharmaceutical regulation.

The relevant regulatory question is often not whether the model qualifies technically as “AI”.

The more useful questions are:

What does the model do?

How does it affect product quality or regulatory decision-making?

How credible must it therefore be?

Five Regulatory Principles Support the Framework

Digital CMC CERSI identifies five broad principles adapted to pharmaceutical CMC:

  • safety, security and robustness;
  • transparency and explainability;
  • fairness and avoidance of bias;
  • accountability and governance;
  • contestability, human oversight and redress.

Not every principle will have equal relevance to every manufacturing model.

For example, fairness may be much more important for a patient-facing clinical model than for a model predicting tablet compression behaviour.

This again supports proportionality rather than applying an identical AI checklist to every system.

VERA: A Regulatory AI Assistant Built Around Controlled Sources

Perhaps the most interesting practical output is VERA – the Virtual Expert for Regulatory Assistance.

VERA is an AI-enabled assistant designed to help users navigate regulatory expectations for digital CMC tools.

Importantly, it does not operate like an unrestricted general-purpose chatbot.

According to Digital CMC CERSI, VERA uses an OpenAI large language model connected to a curated Retrieval-Augmented Generation database.

The knowledge base contains more than:

300 regulatory guidance documents, standards and scientific best-practice resources.

These include regulatory guidance, international standards, scientific literature and CERSI materials.

The Model Is Constrained to the Curated Knowledge Base

The architecture addresses one of the central problems with Generative AI in regulated environments: hallucination.

Digital CMC CERSI states that VERA is constrained to generate responses from information contained in its curated RAG database.

If relevant information is not available, the system is intended to say so rather than construct an unsupported answer.

Responses also include supporting references and source information.

The concept is therefore:

Natural-Language Question

↓

LLM

↓

Curated Regulatory RAG Database

↓

Source-Grounded Response

↓

References and Traceability

This is significantly different from relying on the general training knowledge of an LLM.

This May Be a Better Architecture for GxP Regulatory Intelligence

For regulated applications, an AI system does not necessarily need to know everything.

In fact, limiting what it is allowed to know may sometimes be a control.

For regulatory intelligence, a stronger architecture may be:

small controlled knowledge domain + authoritative sources + traceability

rather than:

maximum model knowledge + unrestricted generation.

This principle could be relevant beyond CMC.

Similar architectures could potentially support:

  • GMP regulatory intelligence;
  • SOP interpretation;
  • inspection preparation;
  • quality investigations;
  • regulatory impact assessment;
  • controlled knowledge management.

RAG Does Not Automatically Make AI Validated

There is, however, an important limitation.

Connecting an LLM to authoritative documents does not by itself establish that the resulting system is reliable for every regulated use.

A pharmaceutical company would still need to consider:

  • completeness of the knowledge base;
  • document version control;
  • retrieval performance;
  • correct interpretation of retrieved passages;
  • handling of conflicting requirements;
  • model and platform changes;
  • acceptance criteria;
  • human verification;
  • intended-use boundaries.

RAG can reduce one source of risk.

It does not eliminate the need for system-level assurance.

The Regulatory Sandbox Adds Another Important Element

Digital CMC CERSI also developed a Digital CMC Sandbox.

This creates a structured environment for testing digital tools, generating evidence and exploring model credibility before progressing toward regulatory use.

Together, the components create something close to an end-to-end regulatory-development environment:

Question of Interest

↓

Context of Use and Risk

↓

Model Development

↓

Credibility Evidence

↓

Sandbox Evaluation

↓

Regulatory Documentation

↓

Deployment and Lifecycle Management

Why This Matters for GMP and Pharmaceutical Quality

Much of the current debate asks:

“How do we validate AI?”

The DCRL approach suggests a more useful question:

“What evidence is necessary to establish sufficient credibility for this model’s specific pharmaceutical use?”

That is a subtle but important shift.

It allows companies to avoid two extremes:

  • treating every AI application as equally critical;
  • treating technically impressive AI performance as sufficient proof of suitability.

Instead, assurance becomes proportionate to the model’s influence on pharmaceutical decisions.

A Practical Model for Pharma

For a pharmaceutical company considering an AI-enabled CMC application, the DCRL concept can be simplified into:

Question

↓

Context of Use

↓

Risk

↓

Data

↓

Model

↓

Credibility Evidence

↓

Decision Uncertainty

↓

Regulatory Documentation

↓

Lifecycle Monitoring

This is much closer to established pharmaceutical Quality Risk Management than to traditional technology-first AI deployment.

Regulatory Status Note

The Digital CMC Regulatory Lifecycle Framework and associated tools are regulatory-science resources developed through the Digital CMC CERSI.

The programme has been funded and supported by the UK Medicines and Healthcare products Regulatory Agency, the Office for Life Sciences and UK public research and innovation organisations.

The framework is not itself MHRA legislation or binding GMP guidance.

Its importance lies in providing a practical, regulator-informed approach for applying existing and emerging regulatory principles to digital and AI-enabled CMC models.

Sources

CMAC – Digital CMC CERSI: Closing the gap between digital innovation and regulatory readiness:

https://www.cmac.ac. … se/digital-cmc-cersi

Digital CMC Regulatory Lifecycle Framework:

https://www.cmac.ac.uk/dcrl-framework

Digital CMC Regulatory Lifecycle Workflow:

https://www.cmac.ac.uk/dcrl-workflow

Virtual Expert for Regulatory Assistance – VERA:

https://www.cmac.ac.uk/vera

New MHRA-backed survey: pharma is exploring AI in CMC, but regulated adoption remains limited:

https://www.aiforpha … ion-remains-limited/