One of the main barriers to artificial intelligence in pharmaceutical manufacturing is no longer lack of technical capability.
It is regulatory readiness.
The MHRA-supported Digital CMC Centre for Excellence in Regulatory Science and Innovation (Digital CMC CERSI), led by the University of Strathclyde’s CMAC medicines manufacturing research centre, has developed a practical set of tools intended to bridge this gap.
The Digital CMC Centre for Excellence in Regulatory Science and Innovation (Digital CMC CERSI) is a UK regulatory-science initiative that brings together regulators, academia and industry to develop practical approaches for the use of digital technologies, modelling and AI in pharmaceutical Chemistry, Manufacturing and Controls (CMC).
The programme’s September 2026 summary highlights an important problem:
digital and AI-enabled models are being developed across pharmaceutical CMC, but relatively few progress into regulator-facing use.
Digital CMC CERSI has therefore focused not on creating another AI model, but on creating the regulatory-science infrastructure needed to evaluate models consistently.
Its main outputs include:
- the Digital CMC Regulatory Lifecycle (DCRL) Framework;
- a ten-stage DCRL Workflow;
- a Digital CMC Sandbox;
- regulatory case studies;
- training resources;
- VERA – an AI-enabled Virtual Expert for Regulatory Assistance.
For pharmaceutical companies trying to move AI from proof-of-concept into development, manufacturing, regulatory submissions or inspected GxP processes, this is potentially more useful than another high-level AI principle document.
From “Can the Model Work?” to “Is the Model Regulatory-Ready?”
The DCRL Framework makes an important distinction.
A technically successful computational model is not automatically ready for pharmaceutical use.
Regulatory confidence also depends on understanding:
- what question the model is intended to answer;
- where and how it will be used;
- what happens if the model is wrong;
- whether the underlying data are appropriate;
- how model credibility has been demonstrated;
- how uncertainty affects the final decision;
- how the model will be documented;
- how performance and changes will be controlled over time.
This can be summarized as:
Technical Performance → Credibility → Regulatory Readiness → Lifecycle Control
The value of the framework is that it translates these broad principles into an operational workflow.
The Ten-Stage DCRL Workflow
The Digital CMC Regulatory Lifecycle Workflow consists of ten connected stages.
These are:
- 1. Define the Question of Interest;
- 2. Define the Context of Use;
- 3. Select the Model Type;
- 4. Conduct Model Risk Assessment;
- 5. Plan Data Collection;
- 6. Develop the Model and perform initial credibility assessment;
- 7. Review Credibility and Fitness for Use;
- 8. Assess the Risk of Uncertainty in Decision-Making;
- 9. Document for Regulatory Use;
- 10. Perform Lifecycle Management.
This is particularly useful for pharmaceutical AI because it starts with the scientific and regulatory purpose rather than with the algorithm.
The first question is not:
“Which AI technology should we use?”
It is:
“What decision or question is this model intended to support?”
Context of Use Becomes the Anchor
The framework reinforces the importance of Context of Use.
An identical model could have very different regulatory significance depending on whether it is used to:
- explore development data;
- identify unusual process trends;
- recommend a manufacturing adjustment;
- support an in-process control;
- contribute to a regulatory submission.
The required level of evidence should therefore be related to the consequence of model failure.
A model used for exploratory analysis should not necessarily require the same assurance as a model influencing a critical quality or regulatory decision.
This supports a risk-proportionate approach:
Context of Use → Model Risk → Required Credibility Evidence
Uncertainty Is Treated as Part of the Decision
One particularly important feature of the DCRL Workflow is the explicit assessment of uncertainty.
The relevant question is not simply:
“How uncertain is the model?”
but:
“What could that uncertainty do to the pharmaceutical decision?”
This is an important distinction.
A certain level of prediction uncertainty may be acceptable where the model merely prioritises further investigation.
The same uncertainty could be unacceptable if the model controls a process condition or supports a critical quality decision.
This moves AI validation toward Quality Risk Management rather than generic machine-learning benchmarking.
The Framework Is Not Limited to AI
Another strength is that the DCRL Framework does not treat AI as an isolated technology category.
It is intended to support:
- knowledge-driven models;
- data-driven models, including AI;
- empirical models;
- hybrid models.
That may be important for pharmaceutical regulation.
The relevant regulatory question is often not whether the model qualifies technically as “AI”.
The more useful questions are:
What does the model do?
How does it affect product quality or regulatory decision-making?
How credible must it therefore be?
Five Regulatory Principles Support the Framework
Digital CMC CERSI identifies five broad principles adapted to pharmaceutical CMC:
- safety, security and robustness;
- transparency and explainability;
- fairness and avoidance of bias;
- accountability and governance;
- contestability, human oversight and redress.
Not every principle will have equal relevance to every manufacturing model.
For example, fairness may be much more important for a patient-facing clinical model than for a model predicting tablet compression behaviour.
This again supports proportionality rather than applying an identical AI checklist to every system.
VERA: A Regulatory AI Assistant Built Around Controlled Sources
Perhaps the most interesting practical output is VERA – the Virtual Expert for Regulatory Assistance.
VERA is an AI-enabled assistant designed to help users navigate regulatory expectations for digital CMC tools.
Importantly, it does not operate like an unrestricted general-purpose chatbot.
According to Digital CMC CERSI, VERA uses an OpenAI large language model connected to a curated Retrieval-Augmented Generation database.
The knowledge base contains more than:
300 regulatory guidance documents, standards and scientific best-practice resources.
These include regulatory guidance, international standards, scientific literature and CERSI materials.
The Model Is Constrained to the Curated Knowledge Base
The architecture addresses one of the central problems with Generative AI in regulated environments: hallucination.
Digital CMC CERSI states that VERA is constrained to generate responses from information contained in its curated RAG database.
If relevant information is not available, the system is intended to say so rather than construct an unsupported answer.
Responses also include supporting references and source information.
The concept is therefore:
Natural-Language Question
↓
LLM
↓
Curated Regulatory RAG Database
↓
Source-Grounded Response
↓
References and Traceability
This is significantly different from relying on the general training knowledge of an LLM.
This May Be a Better Architecture for GxP Regulatory Intelligence
For regulated applications, an AI system does not necessarily need to know everything.
In fact, limiting what it is allowed to know may sometimes be a control.
For regulatory intelligence, a stronger architecture may be:
small controlled knowledge domain + authoritative sources + traceability
rather than:
maximum model knowledge + unrestricted generation.
This principle could be relevant beyond CMC.
Similar architectures could potentially support:
- GMP regulatory intelligence;
- SOP interpretation;
- inspection preparation;
- quality investigations;
- regulatory impact assessment;
- controlled knowledge management.
RAG Does Not Automatically Make AI Validated
There is, however, an important limitation.
Connecting an LLM to authoritative documents does not by itself establish that the resulting system is reliable for every regulated use.
A pharmaceutical company would still need to consider:
- completeness of the knowledge base;
- document version control;
- retrieval performance;
- correct interpretation of retrieved passages;
- handling of conflicting requirements;
- model and platform changes;
- acceptance criteria;
- human verification;
- intended-use boundaries.
RAG can reduce one source of risk.
It does not eliminate the need for system-level assurance.
The Regulatory Sandbox Adds Another Important Element
Digital CMC CERSI also developed a Digital CMC Sandbox.
This creates a structured environment for testing digital tools, generating evidence and exploring model credibility before progressing toward regulatory use.
Together, the components create something close to an end-to-end regulatory-development environment:
Question of Interest
↓
Context of Use and Risk
↓
Model Development
↓
Credibility Evidence
↓
Sandbox Evaluation
↓
Regulatory Documentation
↓
Deployment and Lifecycle Management
Why This Matters for GMP and Pharmaceutical Quality
Much of the current debate asks:
“How do we validate AI?”
The DCRL approach suggests a more useful question:
“What evidence is necessary to establish sufficient credibility for this model’s specific pharmaceutical use?”
That is a subtle but important shift.
It allows companies to avoid two extremes:
- treating every AI application as equally critical;
- treating technically impressive AI performance as sufficient proof of suitability.
Instead, assurance becomes proportionate to the model’s influence on pharmaceutical decisions.
A Practical Model for Pharma
For a pharmaceutical company considering an AI-enabled CMC application, the DCRL concept can be simplified into:
Question
↓
Context of Use
↓
Risk
↓
Data
↓
Model
↓
Credibility Evidence
↓
Decision Uncertainty
↓
Regulatory Documentation
↓
Lifecycle Monitoring
This is much closer to established pharmaceutical Quality Risk Management than to traditional technology-first AI deployment.
Regulatory Status Note
The Digital CMC Regulatory Lifecycle Framework and associated tools are regulatory-science resources developed through the Digital CMC CERSI.
The programme has been funded and supported by the UK Medicines and Healthcare products Regulatory Agency, the Office for Life Sciences and UK public research and innovation organisations.
The framework is not itself MHRA legislation or binding GMP guidance.
Its importance lies in providing a practical, regulator-informed approach for applying existing and emerging regulatory principles to digital and AI-enabled CMC models.
Sources
CMAC – Digital CMC CERSI: Closing the gap between digital innovation and regulatory readiness:
https://www.cmac.ac. … se/digital-cmc-cersi
Digital CMC Regulatory Lifecycle Framework:
https://www.cmac.ac.uk/dcrl-framework
Digital CMC Regulatory Lifecycle Workflow:
https://www.cmac.ac.uk/dcrl-workflow
Virtual Expert for Regulatory Assistance – VERA:
New MHRA-backed survey: pharma is exploring AI in CMC, but regulated adoption remains limited: