AIforPharma.org

Introduction

⇒ The MHRA-supported Digital CMC CERSI provides a practical regulatory lifecycle framework for AI and computational models in pharmaceutical CMC, including risk-based credibility assessment, lifecycle management, a regulatory sandbox and VERA, a source-grounded RAG regulatory assistant.

One of the main barriers to artificial intelligence in pharmaceutical manufacturing is no longer lack of technical capability.

It is regulatory readiness.

The MHRA-supported Digital CMC Centre for Excellence in Regulatory Science and Innovation (Digital CMC CERSI), led by the University of Strathclyde’s CMAC medicines manufacturing research centre, has developed a practical set of tools intended to bridge this gap.

The Digital CMC Centre for Excellence in Regulatory Science and Innovation (Digital CMC CERSI) is a UK regulatory-science initiative that brings together regulators, academia and industry to develop practical approaches for the use of digital technologies, modelling and AI in pharmaceutical Chemistry, Manufacturing and Controls (CMC).

The programme’s September 2026 summary highlights an important problem:

digital and AI-enabled models are being developed across pharmaceutical CMC, but relatively few progress into regulator-facing use.

Digital CMC CERSI has therefore focused not on creating another AI model, but on creating the regulatory-science infrastructure needed to evaluate models consistently.

Its main outputs include:

• the Digital CMC Regulatory Lifecycle (DCRL) Framework;
• a ten-stage DCRL Workflow;
• a Digital CMC Sandbox;
• regulatory case studies;
• training resources;
• VERA – an AI-enabled Virtual Expert for Regulatory Assistance.

For pharmaceutical companies trying to move AI from proof-of-concept into development, manufacturing, regulatory submissions or inspected GxP processes, this is potentially more useful than another high-level AI principle document.

From “Can the Model Work?” to “Is the Model Regulatory-Ready?”

The DCRL Framework makes an important distinction.

A technically successful computational model is not automatically ready for pharmaceutical use.

Regulatory confidence also depends on understanding:

• what question the model is intended to answer;
• where and how it will be used;
• what happens if the model is wrong;
• whether the underlying data are appropriate;
• how model credibility has been demonstrated;
• how uncertainty affects the final decision;
• how the model will be documented;
• how performance and changes will be controlled over time.

This can be summarized as:

Technical Performance → Credibility → Regulatory Readiness → Lifecycle Control

The value of the framework is that it translates these broad principles into an operational workflow.

The Ten-Stage DCRL Workflow

The Digital CMC Regulatory Lifecycle Workflow consists of ten connected stages.

These are:

• 1. Define the Question of Interest;
• 2. Define the Context of Use;
• 3. Select the Model Type;
• 4. Conduct Model Risk Assessment;
• 5. Plan Data Collection;
• 6. Develop the Model and perform initial credibility assessment;
• 7. Review Credibility and Fitness for Use;
• 8. Assess the Risk of Uncertainty in Decision-Making;
• 9. Document for Regulatory Use;
• 10. Perform Lifecycle Management.

This is particularly useful for pharmaceutical AI because it starts with the scientific and regulatory purpose rather than with the algorithm.

The first question is not:

“Which AI technology should we use?”

It is:

“What decision or question is this model intended to support?”

Context of Use Becomes the Anchor

The framework reinforces the importance of Context of Use.

An identical model could have very different regulatory significance depending on whether it is used to:

• explore development data;
• identify unusual process trends;
• recommend a manufacturing adjustment;
• support an in-process control;
• contribute to a regulatory submission.

The required level of evidence should therefore be related to the consequence of model failure.

A model used for exploratory analysis should not necessarily require the same assurance as a model influencing a critical quality or regulatory decision.

This supports a risk-proportionate approach:

Context of Use → Model Risk → Required Credibility Evidence

Uncertainty Is Treated as Part of the Decision

One particularly important feature of the DCRL Workflow is the explicit assessment of uncertainty.

The relevant question is not simply:

“How uncertain is the model?”

but:

“What could that uncertainty do to the pharmaceutical decision?”

This is an important distinction.

A certain level of prediction uncertainty may be acceptable where the model merely prioritises further investigation.

The same uncertainty could be unacceptable if the model controls a process condition or supports a critical quality decision.

This moves AI validation toward Quality Risk Management rather than generic machine-learning benchmarking.

The Framework Is Not Limited to AI

Another strength is that the DCRL Framework does not treat AI as an isolated technology category.

It is intended to support:

• knowledge-driven models;
• data-driven models, including AI;
• empirical models;
• hybrid models.

That may be important for pharmaceutical regulation.

The relevant regulatory question is often not whether the model qualifies technically as “AI”.

The more useful questions are:

What does the model do?

How does it affect product quality or regulatory decision-making?

How credible must it therefore be?

Five Regulatory Principles Support the Framework

Digital CMC CERSI identifies five broad principles adapted to pharmaceutical CMC:

• safety, security and robustness;
• transparency and explainability;
• fairness and avoidance of bias;
• accountability and governance;
• contestability, human oversight and redress.

Not every principle will have equal relevance to every manufacturing model.

For example, fairness may be much more important for a patient-facing clinical model than for a model predicting tablet compression behaviour.

This again supports proportionality rather than applying an identical AI checklist to every system.

VERA: A Regulatory AI Assistant Built Around Controlled Sources

Perhaps the most interesting practical output is VERA – the Virtual Expert for Regulatory Assistance.

VERA is an AI-enabled assistant designed to help users navigate regulatory expectations for digital CMC tools.

Importantly, it does not operate like an unrestricted general-purpose chatbot.

According to Digital CMC CERSI, VERA uses an OpenAI large language model connected to a curated Retrieval-Augmented Generation database.

The knowledge base contains more than:

300 regulatory guidance documents, standards and scientific best-practice resources.

These include regulatory guidance, international standards, scientific literature and CERSI materials.

The Model Is Constrained to the Curated Knowledge Base

The architecture addresses one of the central problems with Generative AI in regulated environments: hallucination.

Digital CMC CERSI states that VERA is constrained to generate responses from information contained in its curated RAG database.

If relevant information is not available, the system is intended to say so rather than construct an unsupported answer.

Responses also include supporting references and source information.

The concept is therefore:

Natural-Language Question

↓

LLM

↓

Curated Regulatory RAG Database

↓

Source-Grounded Response

↓

References and Traceability

This is significantly different from relying on the general training knowledge of an LLM.

This May Be a Better Architecture for GxP Regulatory Intelligence

For regulated applications, an AI system does not necessarily need to know everything.

In fact, limiting what it is allowed to know may sometimes be a control.

For regulatory intelligence, a stronger architecture may be:

small controlled knowledge domain + authoritative sources + traceability

rather than:

maximum model knowledge + unrestricted generation.

This principle could be relevant beyond CMC.

Similar architectures could potentially support:

• GMP regulatory intelligence;
• SOP interpretation;
• inspection preparation;
• quality investigations;
• regulatory impact assessment;
• controlled knowledge management.

RAG Does Not Automatically Make AI Validated

There is, however, an important limitation.

Connecting an LLM to authoritative documents does not by itself establish that the resulting system is reliable for every regulated use.

A pharmaceutical company would still need to consider:

• completeness of the knowledge base;
• document version control;
• retrieval performance;
• correct interpretation of retrieved passages;
• handling of conflicting requirements;
• model and platform changes;
• acceptance criteria;
• human verification;
• intended-use boundaries.

RAG can reduce one source of risk.

It does not eliminate the need for system-level assurance.

The Regulatory Sandbox Adds Another Important Element

Digital CMC CERSI also developed a Digital CMC Sandbox.

This creates a structured environment for testing digital tools, generating evidence and exploring model credibility before progressing toward regulatory use.

Together, the components create something close to an end-to-end regulatory-development environment:

Question of Interest

↓

Context of Use and Risk

↓

Model Development

↓

Credibility Evidence

↓

Sandbox Evaluation

↓

Regulatory Documentation

↓

Deployment and Lifecycle Management

Why This Matters for GMP and Pharmaceutical Quality

Much of the current debate asks:

“How do we validate AI?”

The DCRL approach suggests a more useful question:

“What evidence is necessary to establish sufficient credibility for this model’s specific pharmaceutical use?”

That is a subtle but important shift.

It allows companies to avoid two extremes:

• treating every AI application as equally critical;
• treating technically impressive AI performance as sufficient proof of suitability.

Instead, assurance becomes proportionate to the model’s influence on pharmaceutical decisions.

A Practical Model for Pharma

For a pharmaceutical company considering an AI-enabled CMC application, the DCRL concept can be simplified into:

Question

↓

Context of Use

↓

Risk

↓

Data

↓

Model

↓

Credibility Evidence

↓

Decision Uncertainty

↓

Regulatory Documentation

↓

Lifecycle Monitoring

This is much closer to established pharmaceutical Quality Risk Management than to traditional technology-first AI deployment.

Regulatory Status Note

The Digital CMC Regulatory Lifecycle Framework and associated tools are regulatory-science resources developed through the Digital CMC CERSI.

The programme has been funded and supported by the UK Medicines and Healthcare products Regulatory Agency, the Office for Life Sciences and UK public research and innovation organisations.

The framework is not itself MHRA legislation or binding GMP guidance.

Its importance lies in providing a practical, regulator-informed approach for applying existing and emerging regulatory principles to digital and AI-enabled CMC models.

Sources

CMAC – Digital CMC CERSI: Closing the gap between digital innovation and regulatory readiness:

https://www.cmac.ac. … se/digital-cmc-cersi

Digital CMC Regulatory Lifecycle Framework:

https://www.cmac.ac.uk/dcrl-framework

Digital CMC Regulatory Lifecycle Workflow:

https://www.cmac.ac.uk/dcrl-workflow

Virtual Expert for Regulatory Assistance – VERA:

https://www.cmac.ac.uk/vera

New MHRA-backed survey: pharma is exploring AI in CMC, but regulated adoption remains limited:

https://www.aiforpha … ion-remains-limited/

Introduction

⇒ An October 2026 pharmaceutical-quality study shows that reliable AI classification of subvisible particles in parenteral products depends strongly on representative training libraries, challenging particle morphologies and explainable model behaviour.

Artificial intelligence is moving into an area where pharmaceutical quality decisions depend heavily on images: identification and classification of subvisible particles in parenteral products.

A study published in the International Journal of Pharmaceutics in October 2026 evaluated convolutional neural network (CNN) models for classification of pharmaceutically relevant particles using microscopy images.

The study provides an important lesson for regulated AI that extends far beyond particle analysis:

A sophisticated model cannot compensate for an incomplete or unrepresentative training dataset.

Why Subvisible Particle Classification Is Difficult

Particle characterization in parenteral products can involve visually very different materials.

The researchers developed a pharmaceutical particle image library containing representative examples including:

• protein aggregates;
• silicone oil droplets;
• rubber particles;
• glass lamellae.

Glass lamellae were particularly important because different morphologies were deliberately represented in the training library.

Some particles are relatively distinctive.

Others are transparent, low contrast or visually similar to another particle type.

That makes automated classification considerably more difficult than recognizing highly differentiated objects in conventional computer-vision applications.

The Training Library Determined Model Robustness

The researchers compared CNN models trained with comprehensive particle libraries with models trained using more limited categories or incomplete morphological representation.

The result was clear.

Models trained on comprehensive and representative libraries showed high and stable classification performance across complex mixtures.

When important particle morphologies were missing from the training data, robustness decreased and misclassification increased.

The effect was particularly visible for transparent and low-contrast particles.

This is an important pharmaceutical AI principle:

Model performance is conditional on what the model has been allowed to learn.

A validation dataset may demonstrate excellent accuracy while still failing to reveal an important weakness if both training and validation datasets contain the same limited representation of the real process.

The GMP Question Is Therefore Bigger Than Accuracy

In a regulated application it is tempting to ask:

“What is the model accuracy?”

That is necessary, but insufficient.

For a pharmaceutical-quality application, additional questions should include:

• Which particle classes were represented during training?
• Were different morphologies within each class represented?
• Were difficult or ambiguous examples deliberately included?
• Are the data representative of routine manufacturing conditions?
• Are rare but quality-relevant particle types represented?
• Was performance challenged using realistic multi-particle mixtures?
• How does the model behave when it encounters something outside its training distribution?

This moves validation from a simple model-performance exercise toward a scientifically justified assessment of the entire data-model relationship.

Representative Data Become Part of the Control Strategy

For conventional computerized systems, requirements normally define what the software needs to do.

Machine-learning systems introduce another critical element:

the data used to establish the required behaviour.

For image-based pharmaceutical AI, the assurance chain could therefore look like:

Intended Use

↓

Particle Taxonomy

↓

Representative Image Library

↓

Data Curation and Provenance

↓

Model Training

↓

Independent Performance Testing

↓

Routine Performance Monitoring

A weakness at the image-library stage can propagate through every subsequent stage.

A Random Train-Test Split May Not Be Enough

This study also illustrates a broader AI-validation issue.

Randomly dividing a dataset into training and testing subsets can produce reassuring performance statistics.

But if both datasets originate from the same narrow image population, they may share the same blind spots.

For pharmaceutical applications, validation may therefore need deliberate challenge sets.

These could include:

• uncommon morphologies;
• low-contrast images;
• borderline classifications;
• complex particle mixtures;
• variation in imaging conditions;
• examples obtained independently from the original training population.

The objective should not simply be to prove that the model performs well on familiar data.

The more important question is:

Where does the model stop being reliable?

Explainability Was Also Investigated

The work did not rely only on classification accuracy.

The researchers also investigated feature importance and model behaviour using approaches including principal component analysis, decision trees and Gradient-weighted Class Activation Mapping (Grad-CAM).

Grad-CAM can show which regions of an image contribute most strongly to a CNN classification.

For pharmaceutical applications, this type of analysis can help determine whether a model is using scientifically plausible visual characteristics rather than irrelevant image artefacts.

Explainability should not, however, be confused with validation.

An attractive heat map does not prove that a model is fit for GMP use.

Its value is different:

it can provide additional scientific evidence that model behaviour is understandable and consistent with the intended analytical problem.

A Useful Lesson for AI Validation Beyond Microscopy

The same principle applies to many other pharmaceutical AI applications.

Consider models used for:

• visual inspection;
• environmental-monitoring trend analysis;
• deviation classification;
• predictive maintenance;
• spectroscopic analysis;
• process prediction.

In every case, model performance depends on whether the development data adequately represent the situations the model will encounter during actual use.

A model trained predominantly on normal operation may perform poorly when faced with the rare abnormal conditions that are most important to Quality.

Edge Cases May Be More Important Than Average Performance

For pharmaceutical Quality Assurance, average accuracy is often not the most relevant performance measure.

A model could classify 99% of routine images correctly while systematically misclassifying a rare but important defect.

From a patient-risk perspective, that could be less acceptable than a model with slightly lower overall accuracy but more reliable identification of critical abnormalities.

AI performance criteria should therefore be connected to:

quality risk and intended use

rather than selected only because they generate impressive statistical results.

Training Data Should Be Treated as a Controlled Asset

This also has implications for data governance.

For a GxP-relevant ML application, an image library should not simply be regarded as a collection of files used by the data-science team.

Depending on the application and risk, controls may need to address:

• data provenance;
• classification and annotation;
• expert review;
• version control;
• addition and removal of images;
• traceability to training runs;
• representativeness assessments;
• change control.

This is especially important when the model is retrained.

If the training dataset changes, the model changes - even when the software code remains identical.

A Better Definition of AI Validation

The study supports a broader interpretation of pharmaceutical AI validation.

Instead of:

Model + Accuracy Test = Validated AI

a more appropriate structure is:

Intended Use + Representative Data + Appropriate Model + Independent Challenge Testing + Explainability + Lifecycle Control

This closely aligns AI assurance with established pharmaceutical principles of scientific understanding and risk-based control.

Why This Matters for Pharmaceutical Companies

AI-based image analysis has significant potential in pharmaceutical Quality Control.

It can process much larger image populations than manual classification and may improve consistency and speed.

But the major lesson from this study is not that CNN technology is ready to replace pharmaceutical scientists.

It is that:

the quality of an AI decision cannot be separated from the quality and representativeness of the data used to develop the model.

For regulated pharmaceutical AI, the training dataset may therefore become as important to validation as the algorithm itself.

Regulatory Status Note

This is a peer-reviewed scientific publication and does not constitute FDA, EMA, pharmacopoeial or other regulatory guidance.

The study demonstrates technical and scientific approaches to machine-learning-based particle classification. It does not establish regulatory acceptance of CNN classification as a replacement for any required compendial or validated analytical procedure.

The GMP observations above represent an interpretation of the study’s findings in the context of pharmaceutical AI lifecycle control.

Sources

Mohan S. et al. - Developing machine learning models with pharmaceutically relevant microscopy images to improve classification of multi particulate systems for parenteral delivery. International Journal of Pharmaceutics. Volume 703, 5 October 2026, Article 127313.

https://pubmed.ncbi. … lm.nih.gov/42603574/

DOI:

https://www.scienced … 326007611?via%3Dihub

Introduction

⇒ Six different concepts of AI control in GMP and pharma: CSV/GAMP validation, context of use, algorithmic state of control, guardrails, competency-based evaluation and AI governance.

Several clearly different concepts of AI control can be distinguished in the GMP/pharma environment. They share a common foundation, but [b]they are not the same approach

They differ mainly in what they consider to be the primary object of control: the computerized system, the model, the model output, AI behaviour, or the entire system of “AI + guardrails + human + process”.

In my view, we can currently distinguish at least six approaches:

• Traditional CSV / GAMP lifecycle – control of system functions; classical validation
• Context-of-Use / Model Credibility – credibility of the model for a specific application; risk-based
• Performance / State of Control – maintaining model performance over time; lifecycle monitoring
• Guardrails + Human Oversight – control of risky GenAI behaviours
• Competency-Based Evaluation – assessment of AI’s ability to perform defined classes of tasks
• Enterprise AI Governance – control of the entire AI ecosystem and organisational accountability

1. Traditional CSV/GAMP Approach: “AI as a Computerized System”

This is the most conservative approach.

The starting point is:

Intended Use → Requirements → Risk Assessment → Specification → Verification/Validation → Change Control → Periodic Review

A large part of traditional CSV principles still applies: security, access control, audit trail, data integrity, interfaces, backup, configuration management, etc.

The ISPE GAMP approach to machine learning also emphasizes that much of the traditional lifecycle for computerized systems remains applicable to ML. At the same time, some ML applications require validation to be extended to include performance metrics, an appropriate validation dataset, version control and monitoring.

This approach can be summarized as:

Prove that the system is fit for intended use.

The problem appears with GenAI: how do we verify all possible responses if the output is probabilistic and practically unlimited?

Source:

https://ispe.org/pha … pts-machine-learning

2. FDA Context-of-Use / Model Credibility: “Do Not Ask Whether AI Is Good – Ask Whether It Is Sufficiently Credible for a Specific Decision”

This is already a different philosophy.

FDA, in its 2025 draft guidance, proposes a risk-based credibility assessment framework.

The most important element is Context of Use (COU).

The same AI model may require a completely different level of evidence if:

• in one application it only helps search for information;
• in another it influences a quality assessment;
• in a third it provides information used in regulatory decision-making.

FDA indicates that the stringency of credibility assessment, acceptance criteria, oversight and documentation should be proportional to model risk and the specific COU.

This approach can be summarized as:

Prove that the model output is sufficiently credible for this particular decision.

This is subtly different from classical system validation.

Source:

https://www.fda.gov/ … -drug-and-biological

3. “AI State of Control”: Validation Is Not Enough – We Need to Demonstrate That AI Continues to Perform Properly

This is a concept that, in my view, will become increasingly important.

Traditional validation answers:

Was the system operating correctly at the time of validation?

For AI, a more important question becomes:

Is it still operating correctly after 3, 6 or 12 months?

This introduces:

• model drift;
• data drift;
• performance degradation;
• override rate;
• false positives;
• false negatives;
• uncertainty;
• anomalous outputs;
• retraining triggers.

ISPE already points to the need to update verification and validation when ML changes and to use change management, version control and monitoring.

This approach can be described as:

Validate once + continuously demonstrate maintained performance.

In traditional GMP, the analogy would be Continued Process Verification.

This is where a very attractive concept emerges:

Algorithmic State of Control.

4. EMA Annex 22: Guardrails + Human Oversight

This is another way of thinking, particularly important for GenAI and LLMs.

In the Annex 22 workshop, EMA did not ask only:

Does the model provide correct answers?

but also:

What happens when the model provides an incorrect answer?

Therefore, the object of control becomes the entire protective system:

AI → guardrail → uncertainty detection → escalation → human review → final GMP decision

EMA has explicitly raised questions concerning:

• the ability to detect hallucinations and fabricated information;
• effectiveness of guardrails;
• human-in-the-loop oversight;
• escalation;
• stress testing;
• failure analysis;
• drift;
• behaviour of guardrails after model updates;
• situations in which even guardrails + human oversight may be insufficient.

This can be summarized as:

Do not rely solely on making AI perfect. Build a controlled environment around imperfect AI.

This is a very important philosophical difference.

We are not trying to prove that GenAI will never make a mistake.

We are trying to prove that:

the error will be detected, stopped or corrected sufficiently often before it creates a GMP impact.

Source:

https://www.ema.euro … development-annex-22

5. Competency-Based Evaluation: Probably the Most Radically Different Approach

This is a new FDA concept from August 2026 concerning GenAI-enabled medical devices.

It is not GMP guidance, but conceptually it is very interesting for pharma.

FDA identifies the problem: for GenAI, it may be unrealistic to test all possible input-output combinations.

It therefore considers:

Device Benchmarking → Clinical Confirmation → Postmarket Monitoring

and assessment of AI “competencies”, such as:

• knowledge/task fidelity;
• safety behaviour;
• quantitative reasoning;
• communication;
• generalizability;
• appropriate deferral;
• adherence to operational boundaries.

At a high level, FDA compares this idea with the way we assess the competence of physicians – we do not test every possible situation that may occur during the next 30 years of clinical practice.

A similar concept could potentially be adapted for GenAI.

This can be summarized as:

Do not validate every possible answer; demonstrate that the AI possesses and maintains the required competencies.

This is very different from traditional CSV.

And, in my view, potentially very interesting for GMP as well.

Source:

https://www.fda.gov/ … on-paper-and-request

6. Governance / PQS Approach: We Control Not Only the AI, but the Organisation Using AI

Another perspective says that validating the model itself is insufficient.

We need to control:

AI inventory → classification → ownership → supplier → data → intended use → risk → validation → access → human accountability → change → monitoring → incidents → CAPA → retirement

In other words, AI becomes part of the Pharmaceutical Quality System.

In this approach, we are focusing not if the model have eg. 95% accuracy but if the the organisation have a system ensuring that AI is used only where it has been approved, by the right people, for the right purpose, under appropriate controls and with clear accountability?

This fits very well with both QRM/PQS and the direction of Annex 22, where EMA discusses lifecycle QRM, accountability, supplier qualification, change-control visibility and outsourced/cloud AI.

Are These Concepts Competing With Each Other?

Probably not. They overlap and complement each other.

They can actually be arranged as layers:

Governance

↓

Intended Use / Context of Use / Risk

↓

System Validation

↓

Model Performance / Competency

↓

Guardrails

↓

Human Oversight

↓

Operational Monitoring / State of Control

This may represent the most mature model of AI control in GMP.

Not simply:

“Validate AI”

but:

“Establish a multi-layered control system ensuring that AI remains appropriate for a specific intended use and that its potential errors do not lead to unacceptable GMP impact.”

The Common Denominator of All Approaches

Despite different names, practically all contemporary concepts converge around several principles:

Intended Use → Risk → Data → Performance → Controls → Human Accountability → Change Control → Continuous Monitoring

They differ mainly in where they place the centre of gravity.

The industry may therefore gradually move away from the question:

“How do we validate AI?”

towards:

“How do we keep AI in a demonstrable state of control?”

That is a much broader and potentially more appropriate concept for AI used in pharmaceutical GMP environments.

Regulatory Status Note

The concepts described above originate from sources with different regulatory status. Some are based on established GxP and GAMP principles, while others originate from draft guidance, regulatory workshops or discussion papers. In particular, the FDA competency-based evaluation concept relates to GenAI-enabled medical devices and does not constitute a GMP requirement. These concepts should therefore be considered as different approaches and emerging regulatory thinking rather than as one harmonised regulatory framework for AI in GMP.