AIforPharma.org

Introduction

⇒ The proposed European Biotech Act could make AI a formal part of pharmaceutical regulatory infrastructure through EMA lifecycle guidance, trusted AI testing environments and data-quality accelerators supporting model training, validation and testing.

Artificial intelligence may soon become more deeply embedded in the European pharmaceutical regulatory framework.

The proposed European Biotech Act contains a dedicated chapter on artificial intelligence and data as biotechnology enablers.

Its significance goes beyond another set of general responsible-AI principles.

The proposal foresees three concrete elements with direct relevance to pharmaceutical companies:

[]EMA guidance on AI across the medicinal-product lifecycle;
[]trusted testing environments for AI-enabled biotechnology;
• data-quality accelerators supporting AI training, testing and validation.

The proposal is still moving through the EU legislative process and is not yet final law.

However, discussions continued within the Council Working Party on Pharmaceuticals and Medical Devices in September 2026, while EMA reported on 1 October that preparations for implementation of the Biotech Act are already influencing its future regulatory infrastructure.

For pharmaceutical companies, this is an important signal:

AI governance in Europe may evolve from individual guidance documents toward a coordinated regulatory and technical infrastructure for developing, validating and using AI across the medicines lifecycle.

EMA Could Receive a Broader AI Guidance Role

The proposed legislation would require EMA to develop and publish guidance, in cooperation with the European Commission and national competent authorities, on the deployment and use of advanced technologies including artificial intelligence.

The intended scope is broad.

It covers AI across areas such as:

[]medicinal-product development;
[]manufacturing;
[]clinical trials;
[]regulatory evaluation and authorisation;
• post-authorisation activities.

This is important because current pharmaceutical AI guidance remains distributed across multiple documents and regulatory initiatives.

Examples include:

[]the EMA reflection paper on AI in the medicinal-product lifecycle;
[]FDA/EMA Guiding Principles of Good AI Practice;
[]draft EU GMP Annex 22;
[]planned AI guidance for pharmacovigilance;
• digital technology qualification guidance.

The Biotech Act could provide a legal framework for bringing these activities into a more coherent lifecycle approach.

AI Guidance Would Not Be Limited to One Technology

The proposal refers not only to conventional machine-learning systems but also to:

AI systems and general-purpose AI models.

This distinction is increasingly important.

Pharmaceutical companies are moving beyond narrowly trained predictive models toward:

[]foundation models;
[]large language models;
[]Generative AI;
[]multimodal systems;
[]AI agents;
[]hybrid AI architectures.

A future EMA guidance framework may therefore need to address very different technological characteristics and risk profiles.

The regulatory question becomes less:

“Is this an AI system?”

and more:

“What does this AI do, what decision does it influence, and what level of assurance is required for that Context of Use?”

Trusted AI Testing Environments Could Be More Important Than Another Guidance Document

One of the most interesting elements of the proposed Biotech Act is the concept of trusted testing environments for advanced biotechnology innovations.

These environments would support technologies that are enabled or significantly enhanced by AI or advanced computational methods.

Their purpose would be to provide controlled environments where organisations can develop, test and validate innovations while operating under applicable regulatory requirements.

Potential applications identified in the proposal include advanced biotechnology areas such as:

[]immunology;
[]ATMP and gene-therapy development;
[]advanced computational methods;
[]New Approach Methodologies;
• AI-supported biotechnology and biomanufacturing.

This creates a potentially important model:

Develop → Experiment → Validate → Generate Evidence → Inform Standards and Regulation

under controlled conditions.

For pharmaceutical AI, this could be particularly valuable because many current barriers are not purely technical.

Companies also need to understand what evidence regulators will consider sufficiently credible.

A Possible Bridge Between Innovation and Regulatory Acceptance

AI development often moves faster than formal pharmaceutical guidance.

This creates a familiar problem.

A company may develop a technically successful AI system but still face uncertainty regarding:

[]regulatory acceptability;
[]validation expectations;
[]documentation requirements;
[]acceptable performance criteria;
[]change management;
[]human oversight;
• data requirements.

Trusted testing environments could create a more structured way of addressing these questions before large-scale regulatory deployment.

Instead of waiting until a marketing application, manufacturing change or regulatory submission is ready, developers could potentially generate regulatory learning earlier.

Conceptually, this creates a bridge between:

innovation experimentation

and

regulated pharmaceutical implementation.

Data Quality Accelerators Are the Third Pillar

The proposal also recognises a problem that is becoming increasingly obvious:

AI performance depends fundamentally on the quality of the data used to train, test and operate the system.

The proposed biotechnology data-quality accelerators would support the development of datasets that are:

[]high quality;
[]appropriately annotated;
[]standardised;
[]curated;
[]provenance verified;
[]suitable for AI training, validation and testing.

This may become particularly important in pharmaceutical environments where data are distributed across:

[]laboratory systems;
[]clinical systems;
[]manufacturing systems;
[]Quality Management Systems;
[]regulatory repositories;
[]real-world data sources.

The challenge is often not lack of data.

The challenge is whether those data are sufficiently structured, controlled and contextualised to support a regulated AI application.

Data Provenance Could Become Part of AI Validation

Traditional computerized-system validation often focuses strongly on application functionality.

AI adds another layer.

The credibility of the output can depend on the entire data chain:

Source Data

↓

Curation and Transformation

↓

Training / Validation Dataset

↓

AI Model

↓

AI Output

↓

Regulated Decision

This means that validation of an AI-enabled pharmaceutical process may increasingly require evidence not only about the model, but also about:

[]where the data originated;
[]how the data were transformed;
[]which version was used;
[]whether important populations or conditions were represented;
• whether data quality remains suitable during operation.

The proposed emphasis on provenance-verified datasets is therefore particularly relevant for GxP environments.

The Biotech Act Could Help Connect the AI Act with Pharmaceutical Regulation

Another important aspect is the relationship with the EU AI Act.

The Biotech Act proposal foresees interaction between pharmaceutical AI testing environments and AI testing or regulatory mechanisms established under Regulation (EU) 2024/1689.

This is strategically important.

Pharmaceutical companies may need to manage two regulatory dimensions simultaneously:

horizontal AI regulation

and

sector-specific pharmaceutical regulation.

These frameworks ask different questions.

The AI Act focuses on the governance and risks of AI systems.

Pharmaceutical regulation focuses on:

[]patient safety;
[]product quality;
[]clinical evidence;
[]manufacturing control;
• regulatory decision-making.

The challenge will be to avoid creating two disconnected assurance systems for the same AI application.

Relevance to GMP Manufacturing

The proposal explicitly includes manufacturing within the future lifecycle AI-guidance framework.

For GMP organisations, this is particularly important.

AI applications may increasingly support:

[]process monitoring;
[]predictive process modelling;
[]deviation analysis;
[]maintenance;
[]Quality System analytics;
[]advanced process control;
• manufacturing knowledge management.

Draft Annex 22 is currently the most visible European GMP-specific AI initiative.

The Biotech Act suggests that Annex 22 may eventually sit inside a broader European AI regulatory architecture rather than functioning as an isolated GMP document.

The Regulatory Model Is Becoming Multi-Layered

A future European pharmaceutical AI framework could increasingly consist of several layers:

EU AI Act

↓

European Biotech Act

↓

EMA Lifecycle AI Guidance

↓

Domain-Specific Guidance such as GMP Annex 22

↓

Testing Environments and Regulatory Sandboxes

↓

Company AI Governance and Validation

For global pharmaceutical companies, understanding how these layers interact may become as important as understanding each document individually.

Current Regulatory Status

The European Biotech Act remains a legislative proposal.

It is currently being considered by the European Parliament and Council and its final wording may change.

Council working-party discussions on the proposal continued during September 2026.

EMA has also confirmed that it is preparing for potential implementation of the legislation while progressing its broader data and artificial-intelligence activities.

Therefore, pharmaceutical companies should not treat the proposed AI provisions as current binding requirements.

They should instead be viewed as a strong indication of the future direction of European pharmaceutical AI regulation.

Why This Matters

Most pharmaceutical AI regulation to date has focused on principles and guidance.

The Biotech Act introduces something different:

regulatory infrastructure.

The emerging model is not only:

write guidance → ask industry to comply.

It increasingly looks like:

Guidance → Trusted Testing → High-Quality Data → Regulatory Learning → Validation → Deployment.

If implemented, this could significantly influence how pharmaceutical companies develop and validate AI systems in Europe.

It also reinforces a broader message:

Trustworthy pharmaceutical AI will depend not only on the algorithm, but on the regulatory, data and testing infrastructure surrounding it.

Sources

European Commission – European Biotech Act:

https://health.ec.eu … opean-biotech-act_en

EUR-Lex – Proposal for the European Biotech Act:

https://eur-lex.euro … ri=CELEX:52025PC1022

Council of the European Union – Working Party on Pharmaceuticals and Medical Devices, 16 September 2026:

https://www.consiliu … evices-%28369737%29/

EMA – Management Board highlights, September 2026 meeting:

https://www.ema.euro … ptember-2026-meeting

Introduction

⇒ WHO is calling for stronger ethics oversight of AI-related health research, highlighting risks involving bias, transparency, privacy, accountability and data governance across the entire research lifecycle.

The World Health Organization is calling for stronger oversight of artificial intelligence used in health-related research.

On 21 September 2026, WHO highlighted and formally launched its report:

Artificial Intelligence-related Health Research: Ethics Review and Oversight.

The report addresses an increasingly important problem.

Artificial intelligence is already being used to analyse health data, support research, generate hypotheses and develop new technologies.

However, traditional research-ethics frameworks were largely created before modern AI systems became widespread.

WHO warns that existing oversight mechanisms may therefore not fully address risks associated with:

• bias;
• lack of transparency;
• privacy;
• fairness;
• accountability;
• rapid deployment of AI tools.

For pharmaceutical companies, this is highly relevant wherever AI is used in clinical research, health-data analysis or development of evidence that may ultimately support regulatory decisions.

WHO Identifies Three Types of AI-Related Health Research

The report distinguishes three broad categories:

• health-related data science using AI;
• research conducted with AI tools and technologies;
• health-related research on AI tools and technologies.

This distinction is useful because the ethical risks differ depending on how AI is used.

For example, there is a difference between:

using AI to analyse an existing clinical dataset

and

conducting research to evaluate a new AI system that may later affect patient care.

The governance approach should therefore reflect the actual role of AI in the research.

Research Ethics Committees May Need New Capabilities

WHO emphasises that Research Ethics Committees remain central to protecting research participants.

However, AI creates technical and governance questions that conventional ethics committees may not always be equipped to evaluate.

These can include:

• how the model was developed;
• which data were used;
• whether the data are representative;
• how bias is assessed;
• whether outputs are explainable;
• how privacy is protected;
• how model changes are managed.

WHO therefore identifies the need for additional expertise, training and resources.

This is an important message for pharmaceutical sponsors.

An AI-enabled research protocol may require a different level of technical explanation than a conventional protocol.

Ethical Risk Should Be Addressed Early

Another important principle is that ethical review should not become a final administrative check performed after the AI system has already been designed.

Researchers should identify AI-specific risks early.

This may include considering:

• data provenance;
• informed consent;
• privacy;
• population representativeness;
• bias;
• possible downstream harms;
• transparency;
• limitations of the model.

This creates a useful lifecycle sequence:

Research Question → Data Strategy → AI Design → Ethical Risk Assessment → Study Execution → Monitoring → Publication / Implementation

Ethical considerations therefore become part of AI design rather than an external review performed only at the end.

Data Governance Is Central

For pharmaceutical research, one of the most important implications concerns data governance.

AI may depend on very large datasets.

These datasets may come from:

• clinical trials;
• electronic health records;
• registries;
• real-world data;
• biobanks;
• genomic databases.

The fact that data are technically accessible does not automatically mean that every AI use is ethically appropriate.

Relevant questions include:

• Was the original consent compatible with the new use?
• Can individuals or groups be re-identified?
• Are some populations under-represented?
• Could the model create systematic disadvantage?
• Who benefits from the resulting AI system?

For pharmaceutical companies, these questions increasingly intersect with data protection, clinical governance and regulatory evidence generation.

Bias Is Not Only a Technical Performance Problem

Bias is often discussed as an AI-performance issue.

WHO treats it also as an ethical issue.

A model can appear accurate overall while performing poorly for particular groups.

This may occur because:

• training data are unbalanced;
• certain populations are under-represented;
• historical data contain structural bias;
• the model is deployed outside its original Context of Use.

For pharmaceutical development, this can be particularly important where AI influences:

• patient selection;
• risk stratification;
• endpoint analysis;
• safety assessment;
• evidence generation.

A single average performance metric may therefore be insufficient.

Oversight Cannot Be Left to the Ethics Committee Alone

WHO also makes clear that responsible AI research requires more than Research Ethics Committees.

Other important actors include:

• research funders;
• data-access bodies;
• scientific journals;
• professional societies;
• regulatory agencies.

This is significant because some AI risks are systemic.

They cannot be solved by reviewing each individual study independently.

For example, common problems involving data access, model transparency or reproducibility may require broader institutional or regulatory solutions.

Why This Matters for Pharmaceutical R&D

The report is not pharmaceutical GMP guidance.

However, it is directly relevant to pharmaceutical R&D organisations increasingly using AI in:

• clinical-development analytics;
• real-world evidence;
• biomarker research;
• patient stratification;
• safety analysis;
• computational biology.

As AI-generated analysis becomes more important to evidence generation, companies will need to demonstrate not only that models perform technically, but also that their use is ethically justified and appropriately governed.

The assurance model therefore becomes broader:

Scientific Validity + Data Governance + Ethical Oversight + Transparency + Human Accountability

From Technical Validation to Responsible Research Governance

The WHO report reinforces a wider trend in AI regulation.

AI assurance is moving beyond technical validation alone.

A model may be technically accurate but still create problems if:

• the data were obtained or reused inappropriately;
• important groups are under-represented;
• the model’s limitations are hidden;
• responsibility for decisions is unclear;
• participants are exposed to risks they did not reasonably anticipate.

Responsible AI therefore requires a broader governance system.

Why This Development Is Important

Pharmaceutical companies are investing heavily in AI-enabled research.

The WHO report provides an important reminder that faster analysis does not reduce ethical responsibility.

As AI becomes more deeply integrated into health research, the governance question is shifting from:

“Can AI perform this analysis?”

towards:

“Is this AI-supported research scientifically valid, ethically acceptable, transparent and appropriately governed?”

That distinction is likely to become increasingly important as AI-generated evidence moves closer to regulatory and clinical decision-making.

Regulatory Status Note

The WHO report is guidance on ethics review and oversight of AI-related health research.

It is not GMP guidance and does not create new legally binding pharmaceutical requirements.

Its relevance to pharmaceutical companies is primarily in clinical research, health-data science, AI-supported evidence generation and research governance.

WHO describes the publication as a starting point for strengthening future standards, guidance and governance approaches in AI-related health research.

Sources

WHO – New report calls for stronger ethics oversight of AI-related health research, 21 September 2026:

https://www.who.int/ … ated-health-research

WHO – Artificial Intelligence-related Health Research: Ethics Review and Oversight:

https://www.who.int/ … i/item/9789240124073

Introduction

⇒ HMA and EMA will hold a multistakeholder AI and Data Forum in November 2026 focused on building trustworthy AI through strong data foundations, governance, quality and interoperability across the medicines lifecycle.

The European medicines regulatory network is putting data quality and governance at the centre of its artificial intelligence strategy.

On 12–13 November 2026, the Heads of Medicines Agencies (HMA) and European Medicines Agency (EMA) will hold a new multistakeholder AI and Data Forum titled:

Build trustworthy AI on strong data foundations.

The event (with the public live stream) will bring together regulators and stakeholders to discuss the use of artificial intelligence and data across the medicines lifecycle.

The title itself sends an important message.

The regulatory discussion around pharmaceutical AI is increasingly moving beyond the question:

“Is the AI model sufficiently accurate?”

towards a broader question:

“Are the data, governance and infrastructure surrounding the AI sufficiently trustworthy to support regulated use?”

AI and Data Are Being Treated as One Regulatory Problem

EMA describes data and AI as increasingly interdependent.

High-quality data provide the foundation for scalable and trustworthy AI, while AI can in turn help organisations obtain more value from increasingly large and complex regulatory and health datasets.

This creates an important relationship:

Data Quality → Data Governance → Interoperability → AI Performance → Regulatory Trust

For pharmaceutical companies, this means that AI governance cannot be separated from data governance.

A technically advanced model may still be unsuitable for a regulated use if the underlying data are:

• incomplete;
• poorly structured;
• inconsistently defined;
• not sufficiently traceable;
• not representative of the intended use;
• difficult to exchange between systems;
• of uncertain provenance.

In other words:

better AI cannot compensate automatically for weak data foundations.

What the HMA/EMA Forum Will Address

According to EMA, the forum has several objectives.

It will:

• showcase current AI and data applications across the medicines lifecycle;
• discuss the evolving European regulatory landscape for AI and data;
• examine data foundations, governance, quality and interoperability;
• strengthen collaboration between regulators and stakeholders;
• provide input to the Network Data Steering Group workplan and the European medicines network strategy to 2028.

This is broader than a conventional AI workshop.

The focus is not only on algorithms.

It includes the regulatory data infrastructure required to make AI reliable, scalable and useful.

The Forum Is Part of a Larger HMA/EMA AI Strategy

The event is coordinated by the HMA/EMA Network Data Steering Group (NDSG), together with the CHMP Methodology Working Party and the Accelerating Clinical Trials in the EU initiative.

The NDSG workplan for 2026–2028 is particularly important background.

The workplan defines how the European medicines regulatory network intends to expand the use of data and AI in medicines regulation.

Planned activities include:

• development of data analytics and data standardisation frameworks;
• further development of real-world evidence infrastructure;
• implementation of the European Health Data Space;
• expansion of access to regulatory data assets;
• development of AI guidance for clinical development and pharmacovigilance;
• regulatory experimentation and capability building.

AI is therefore becoming part of a broader European regulatory data strategy rather than remaining a standalone technology initiative.

Why Data Standardisation Matters for AI

Artificial intelligence performs best when information is consistently structured and interpretable.

Pharmaceutical organisations, however, often operate complex data environments involving:

• laboratory systems;
• manufacturing systems;
• quality-management systems;
• clinical databases;
• regulatory repositories;
• pharmacovigilance systems;
• master-data platforms;
• unstructured documents.

The same concept may be represented differently across sites, systems or countries.

For example, products, processes, deviations, equipment, substances or regulatory events may use different terminology and metadata structures.

For conventional reporting this already creates difficulties.

For AI it becomes even more important.

An AI model can analyse large volumes of information, but if the underlying information does not have consistent meaning, the model may connect data incorrectly or generate misleading conclusions.

This is why interoperability and standardisation are increasingly becoming AI topics.

Data Provenance May Become as Important as Model Performance

For regulated pharmaceutical AI, it may not be enough to know that a model generated a particular result.

The organisation may also need to understand:

• where the underlying data originated;
• which version of the data was used;
• how the data were transformed;
• whether the source was controlled;
• whether important information was excluded;
• whether the data remain representative of the intended use.

This can be described as data provenance.

For some AI applications, confidence in the output will depend directly on confidence in this data lineage.

A useful assurance chain may therefore become:

Source Data

↓

Controlled Transformation

↓

Verified Dataset

↓

AI Model

↓

AI Output

↓

Human / Regulatory Decision

Each layer can affect the credibility of the final result.

Trustworthy AI Is Not Only a Model Validation Question

Much of the pharmaceutical AI discussion has focused on validation of the model.

Important questions include:

• Is the model sufficiently accurate?
• How should independent test data be selected?
• How should robustness be demonstrated?
• How should drift be monitored?
• When should revalidation occur?

These questions remain important.

But the HMA/EMA forum highlights another dimension.

Even a well-performing model depends on a broader control environment.

A mature AI assurance framework therefore needs to consider:

Data → Model → System → User → Process → Decision

rather than validating the algorithm in isolation.

Data Governance Becomes Part of AI Governance

For pharmaceutical companies, data governance may increasingly become one of the main components of AI governance.

Relevant controls can include:

• data ownership;
• defined data sources;
• data-quality criteria;
• metadata standards;
• master-data governance;
• data lineage;
• access control;
• retention;
• security;
• change management;
• interoperability standards.

This is especially important when AI applications combine information from multiple systems.

For example, an AI system supporting Quality Management could potentially analyse:

• deviations;
• CAPAs;
• complaints;
• audit findings;
• laboratory results;
• manufacturing trends;
• supplier information.

The value of the AI may depend less on the sophistication of the language model and more on whether these sources can be connected reliably.

AI Regulatory Strategy Is Moving Toward Infrastructure

This forum also illustrates an important evolution in regulatory thinking.

Earlier AI discussions frequently concentrated on broad principles such as:

• transparency;
• fairness;
• explainability;
• human oversight;
• accountability.

Those principles remain important.

However, regulators are increasingly moving toward practical implementation questions:

• Which data should AI use?
• How should those data be governed?
• How should data quality be demonstrated?
• How can different systems exchange information reliably?
• How can AI operate consistently across a regulatory network?

This is a transition from:

AI principles

towards:

AI infrastructure and regulatory implementation.

A Strong Message for Pharmaceutical Companies

For companies developing AI strategies, the practical implication is straightforward.

The AI programme should not start only with:

“Which AI model should we buy?”

It should also ask:

• Do we know which data the AI will use?
• Are those data sufficiently controlled?
• Are definitions consistent across systems?
• Can the source of every important data element be reconstructed?
• Are data-quality problems visible?
• Can information be exchanged between systems without losing context?
• Who owns the data?

This can lead to a more realistic implementation sequence:

Intended Use

↓

Data Requirements

↓

Data Quality and Governance

↓

AI Model and Architecture

↓

Validation / Credibility Assessment

↓

Controlled Deployment

↓

Lifecycle Monitoring

Relevance to GMP

The November forum is not specifically a GMP workshop and should not be interpreted as new GMP guidance.

However, its central message is highly relevant to GMP applications of AI.

Existing GMP expectations already place strong emphasis on:

• data integrity;
• traceability;
• controlled records;
• validated systems;
• defined responsibilities;
• change control.

AI does not reduce the importance of these principles.

It can increase it.

When an AI system derives conclusions from thousands or millions of data points, understanding whether those data are reliable becomes fundamental to understanding whether the AI output can be trusted.

For GMP AI, one useful principle may therefore be:

The validated state of an AI-enabled process depends not only on the model, but also on the continued state of control of its data.

What to Watch During the November Forum

Several areas will be particularly worth following:

• how EMA and HMA define trustworthy AI in practical terms;
• expectations for data quality supporting AI;
• approaches to data interoperability and standardisation;
• examples of AI use across the medicines lifecycle;
• the relationship between AI governance and the evolving EU regulatory framework;
• future NDSG workplan priorities;
• possible new AI guidance or regulatory initiatives.

The forum may therefore provide an important indication of the next phase of European pharmaceutical AI regulation.

The first phase focused heavily on AI principles.

The next phase may increasingly focus on:

data foundations → practical governance → implementation → regulatory evidence.

Participation

The HMA/EMA Multistakeholder AI and Data Forum will take place on:

12–13 November 2026.

It will be held at the European Medicines Agency in Amsterdam and online.

EMA states that online participation is available through Webex registration.

In-person participation is by invitation through official stakeholder groups.

The event will also be broadcast live.

Regulatory Status Note

The HMA/EMA AI and Data Forum is a multistakeholder regulatory workshop and does not itself establish new regulatory requirements.

Its discussions and presentations should not be interpreted as formal EMA guidance unless subsequently incorporated into official regulatory documents.

However, the forum is directly linked to the HMA/EMA Network Data Steering Group and its 2026–2028 workplan, making it an important indicator of the future direction of European medicines regulation in data and artificial intelligence.

Sources

European Medicines Agency – HMA / EMA multistakeholder AI and Data forum: Build trustworthy AI on strong data foundations:

https://www.ema.euro … ong-data-foundations

EMA – Network Data Steering Group:

https://www.ema.euro … -steering-group-ndsg

EMA – NDSG Workplan 2026–2028: Data and Artificial Intelligence in Medicines Regulation:

https://www.ema.euro … es-regulation_en.pdf

EMA – Artificial Intelligence:

https://www.ema.euro … ificial-intelligence