The European Medicines Agency has opened a public consultation on a new draft chapter of the Data Quality Framework for EU medicines regulation.
Published on 19 October 2026, the document addresses the collection, management and submission of adverse drug-reaction reports for both human and veterinary medicines.
The consultation remains open until:
14 December 2026.
Although the document is primarily about pharmacovigilance data quality, it contains an unusually clear regulatory statement about the use of artificial intelligence in safety-data management.
EMA recognises that AI may support activities such as:
- data entry;
- adverse-reaction coding;
- diagnosis checking;
- assessment of disease severity;
- assessment of seriousness;
- identification and correction of data-quality problems.
But the draft also establishes a clear boundary:
AI outputs should remain suggestions, while humans should make the final decisions.
AI Performance Remains the Responsibility of the Regulated Organisation
The draft states that the Marketing Authorisation Holder, National Competent Authority or clinical-trial sponsor remains responsible for:
- validating the AI model;
- monitoring model performance;
- documenting model performance;
- regularly reviewing AI operations within the pharmacovigilance system;
- mitigating risks associated with the algorithms and models used.
This is an important regulatory message.
Using an external AI platform, automated coding tool or vendor-provided safety application does not transfer accountability away from the regulated organisation.
The practical control chain remains:
AI Tool → Qualified Human Review → Pharmacovigilance Decision → Organisational Accountability
The Draft Goes Beyond One-Time Validation
The reference to monitoring, documentation and regular operational review is particularly significant.
EMA is not describing AI assurance as a single validation exercise completed before deployment.
The model must remain appropriately controlled during routine operation.
For an AI-supported pharmacovigilance process, this may require consideration of:
- model and configuration version;
- performance acceptance criteria;
- classification accuracy;
- false-positive and false-negative rates;
- human correction or override rates;
- changes in incoming case characteristics;
- model drift;
- supplier updates;
- revalidation or reassessment triggers.
The emerging model therefore resembles:
Initial Validation → Controlled Deployment → Performance Monitoring → Periodic Review → Change Assessment → Revalidation Where Necessary
This is consistent with the broader concept of maintaining AI in a demonstrable state of control.
AI Must Operate on Reliable Pharmacovigilance Data
The draft framework is also important because it connects AI control with the quality of the underlying safety data.
The document defines five dimensions of data quality:
- Reliability – do the data faithfully represent what they are intended to represent?
- Extensiveness – are the data sufficiently complete?
- Coherence – can the data be analysed consistently as a whole?
- Timeliness – are the data available when needed?
- Relevance – are the data appropriate for the regulatory question?
These dimensions are highly relevant to AI.
A model trained or operated using incomplete, inconsistent or delayed adverse-event data may produce technically plausible but misleading results.
This supports a fundamental principle:
Trustworthy AI in pharmacovigilance requires trustworthy data throughout the entire ADR reporting pipeline.
The Complete ADR Data Lifecycle Matters
The framework applies data-quality principles across the complete lifecycle of an adverse drug-reaction report.
This includes:
- definition of data requirements;
- data collection or generation;
- data management and processing;
- data submission;
- data procurement and aggregation;
- testing and acceptance;
- delivery for regulatory analysis and other use.
AI can potentially operate at several points in this chain.
For example, it may help:
- extract information from source narratives;
- code events using controlled terminology;
- identify missing information;
- detect possible duplicate cases;
- support seriousness assessment;
- prioritise records for follow-up.
The regulatory challenge is therefore not simply to validate one AI model.
It is to understand how the AI affects the quality and traceability of data throughout the full pharmacovigilance process.
Automated Data Validation Should Begin Early
EMA recommends integrating automated data-validation processes as early as possible.
Examples include automated checks for:
- impossible ages or dates;
- missing required information;
- incomplete key data elements;
- inconsistent data fields;
- incorrect or non-standard terminology.
This is a sensible use of automation because many such checks can be defined using deterministic business rules.
A mature pharmacovigilance system may therefore use a combination of:
Deterministic Validation Rules
+
AI-Supported Classification or Review
+
Qualified Human Decision-Making
This hybrid architecture may be more reliable and auditable than asking one general-purpose AI system to perform the complete process.
AI Should Assist Data Correction, Not Rewrite the Regulatory Record Invisibly
The draft discusses AI as a possible mechanism for helping identify and correct data-quality issues.
However, corrections need to remain controlled.
The document places strong emphasis on:
- data lineage;
- traceability;
- feedback between stakeholders;
- version management;
- immutability;
- audit trails.
AI should therefore not silently overwrite the original adverse-event information.
A controlled process should preserve:
- the original data;
- the proposed AI correction;
- the reason for the correction;
- the person approving the correction;
- the revised version of the case.
This is directly analogous to established data-integrity principles.
The fact that AI proposes the change does not reduce the need to reconstruct what happened.
Immutability and Version Management Are Central
EMA defines data immutability as the principle that recorded data should not simply be deleted or modified without retaining knowledge of the previous state.
New or corrected information may update the regulatory understanding of a case.
But the previous data state and the relationship between versions should remain visible.
For AI-supported safety systems, this means that the organisation should be able to reconstruct:
Original Case → AI Suggestion → Human Review → Corrected Case → Submitted Version
Without this traceability, it may be difficult to determine whether a change originated from:
- new source information;
- manual review;
- an automated rule;
- an AI recommendation;
- a model or configuration change.
Duplicate Detection Remains a Major Data-Quality Problem
The draft also emphasises routine duplicate detection.
Duplicate reports can distort statistical analyses and safety-signal evaluation.
EMA recommends that relevant databases be routinely screened and that stakeholders collaborate across the adverse-reaction reporting pipeline.
AI and machine learning may eventually improve duplicate detection by comparing multiple case characteristics, narratives and reporting patterns.
However, duplicate management needs to remain controlled because two reports that appear similar may represent:
- the same case reported through different channels;
- follow-up information;
- two genuinely different patients;
- related but distinct events.
AI can support identification.
The final case-management decision still requires appropriate pharmacovigilance assessment.
The AI Act Is Explicitly Relevant
The EMA draft also states that organisations using AI in pharmacovigilance or other health-data activities should ensure compliance with Regulation (EU) 2024/1689, the EU Artificial Intelligence Act.
This creates two parallel layers of control:
Pharmacovigilance and Medicines Regulation
and
Horizontal EU AI Regulation
Compliance with one framework does not automatically demonstrate compliance with the other.
A pharmaceutical company may therefore need to assess:
- the role it holds under the AI Act;
- the intended purpose of the AI system;
- applicable transparency and governance obligations;
- pharmacovigilance validation and quality-system requirements;
- data-protection and confidentiality requirements.
The Draft Connects EMA and CIOMS Thinking
EMA specifically refers to the CIOMS Working Group XIV report on Artificial Intelligence in Pharmacovigilance.
The CIOMS principles cover areas including:
- risk-based control;
- human oversight;
- validity and robustness;
- transparency;
- privacy;
- fairness;
- governance and accountability.
The new EMA draft translates some of these broader principles into the practical context of adverse-reaction data quality.
This is important because the regulatory discussion is moving from:
“What principles should responsible AI follow?”
towards:
“How should AI be controlled inside an actual pharmacovigilance process?”
What Pharmaceutical Companies Should Review
Marketing Authorisation Holders and sponsors using AI in pharmacovigilance should consider reviewing:
- their inventory of AI-supported PV activities;
- the intended use and limits of each model;
- validation and performance acceptance criteria;
- human-review requirements;
- supplier and service-provider responsibilities;
- model and configuration change controls;
- audit trails and case-version management;
- periodic review of AI performance;
- business continuity if AI becomes unavailable;
- AI Act applicability.
Organisations should also review whether their pharmacovigilance datasets are sufficiently:
- reliable;
- complete;
- coherent;
- timely;
- relevant
for the decisions the AI is expected to support.
Why This Draft Matters
The draft is important because it connects three subjects that are often managed separately:
Pharmacovigilance Data Quality
↓
AI Model Control
↓
Human and Organisational Accountability
It sends a clear message:
AI may support safety-data management, but it must remain within a validated, monitored, documented and human-controlled pharmacovigilance system.
This is a much more operational regulatory position than a general statement supporting responsible AI.
Regulatory Status Note
The document is a draft chapter of the EMA Data Quality Framework and is open for public consultation until 14 December 2026.
It is descriptive rather than prescriptive, does not replace existing pharmacovigilance legislation or guidance, and states that it does not create additional requirements.
Its AI-related content should therefore be treated as an important regulatory-development signal rather than a final binding standard.
Sources
EMA – Data Quality Framework for medicines regulation:
https://www.ema.euro … medicines-regulation
EMA – Draft Data Quality Framework: application to the collection, management and submission of Adverse Drug Reaction reports:
https://www.ema.euro … ction-reports_en.pdf
CIOMS – Artificial Intelligence in Pharmacovigilance: