AIforPharma.org

Introduction

⇒ FDA experience with 15 approved drug applications shows how manufacturing process models are assessed according to intended use, risk and impact, with important lessons for AI in GMP.

Artificial intelligence in pharmaceutical manufacturing is often discussed as something regulators will need to address in the future.

A new FDA-authored paper provides an important reminder that model-based manufacturing is already part of regulatory reality.

Published online on 28 July 2026 in the International Journal of Pharmaceutics, the paper FDA regulatory experience with drug manufacturing process models in approved applications reviews FDA experience with manufacturing models submitted as part of approved pharmaceutical applications between 2012 and 2025.

The findings provide unusually concrete insight into how FDA evaluates models that influence pharmaceutical manufacturing and control.

At Least 15 Approved Applications Used Manufacturing Process Models

According to the FDA authors, process models were successfully used in at least:

15 FDA-approved applications from 8 companies between 2012 and 2025.

The applications covered both drug substance and drug product manufacturing and included NDAs and BLAs, including biosimilars, original applications and supplements.

Eleven of the model-supported applications involved continuous manufacturing, where understanding residence-time distribution is important for tracking material through the process.

Models were used for activities including:

• establishment of design spaces;
• real-time process control;
• process monitoring;
• in-process control;
• diversion of non-conforming material;
• release-related decisions.

FDA encountered different types of models, including mechanistic models, empirical models such as NIR/Raman chemometric models, and hybrid approaches.

The Most Important Message: Model Risk Depends on What the Model Does

Perhaps the most useful GMP lesson from the paper is that FDA’s assessment is linked to the risk or impact of the model’s intended use.

The authors describe examples across different impact levels.

High impact:

• release decisions;
• parametric control.

Medium impact:

• in-process controls;
• diversion of non-conforming material.

Lower impact:

• definition of design space;
• investigation and monitoring.

The amount of information included in regulatory submissions was generally commensurate with the determined risk or impact of the model.

This principle has major implications for future AI applications in GMP.

The fundamental regulatory question may not be:

“Is the technology AI?”

but rather:

“What GMP decision does the model influence, and what happens if the model is wrong?”

That distinction is critical.

An AI model identifying unusual process patterns for investigation is not equivalent in risk to an AI model automatically determining whether material is acceptable for release.

The technology may be similar, but the required level of assurance should not necessarily be the same.

FDA Can Examine the Model Very Deeply

The paper also reveals an interesting aspect of regulatory review.

FDA modelling experts are frequently consulted when reviewing applicants’ modelling and control strategies.

In some cases, FDA experts have even developed their own internal models calibrated using experimental data submitted by the applicant.

This demonstrates that model-based regulatory submissions should not be viewed as a black box accompanied only by a headline performance figure.

A regulator may need to understand:

• model structure;
• assumptions;
• input variables;
• data used to establish the model;
• operating range;
• predictive performance;
• relationship to the control strategy;
• consequences of model failure.

For future AI/ML applications, explainability may therefore need to mean more than providing an attractive dashboard showing accuracy.

The organisation must be able to demonstrate why the model is appropriate for the specific manufacturing decision it supports.

Does Modelling Slow Regulatory Approval?

Interestingly, FDA’s experience does not suggest that the use of manufacturing models necessarily creates regulatory delay.

After excluding three submissions with issues unrelated to modelling, the model-supported submissions reviewed in the study were approved an average of 20.3 days before their regulatory goal dates, including several applications under accelerated review.

This observation should be interpreted carefully.

It does not prove that using models accelerated approval.

However, it provides useful evidence against the assumption that sophisticated manufacturing models automatically create regulatory obstacles.

When modelling is scientifically justified and properly integrated into a manufacturing and control strategy, regulators clearly have experience assessing and approving such approaches.

Is This an AI Paper?

Not exactly — and this distinction is important.

The FDA paper covers pharmaceutical manufacturing process models, including mechanistic, empirical and hybrid models. These should not all be described as artificial intelligence.

However, the paper is highly relevant to AI and machine learning because it provides practical regulatory precedent for the broader question of how models that influence GMP manufacturing decisions can be assessed.

AI does not eliminate the established regulatory principles used for modelling.

Instead, it makes several of them even more important:

context of use, model risk, data quality, predictive performance, control strategy and lifecycle management.

Lessons for AI/ML Used in GMP Manufacturing

1. What exactly is the intended use?

Does the model:

• monitor?
• detect anomalies?
• recommend action?
• control a process?
• divert material?
• contribute to release?

The answer determines the potential GMP impact.

2. What happens if the model is wrong?

A model can have impressive average accuracy and still create unacceptable risk if rare errors affect critical quality decisions.

Performance criteria therefore should reflect the consequences of different types of error rather than relying only on one overall accuracy figure.

3. What is the validated operating region?

A model should not automatically be assumed to remain reliable for data or manufacturing conditions substantially different from those used during development and validation.

The boundaries of reliable operation need to be understood.

4. Can the model and its decisions be reconstructed?

For regulated applications, companies should be capable of identifying:

• the model version;
• relevant input data;
• output or prediction;
• configuration;
• decision subsequently taken;
• applicable human review.

Traceability becomes increasingly important as models influence higher-risk decisions.

5. How will changes be controlled?

Changes to:

• algorithms;
• training data;
• process data;
• sensors;
• model parameters;
• software infrastructure;
• manufacturing processes

may affect model performance.

AI/ML therefore needs to be integrated into the Pharmaceutical Quality System rather than managed solely as a data-science project.

6. How will continued performance be demonstrated?

Initial validation shows that a model was suitable when tested.

Lifecycle monitoring needs to demonstrate that it remains suitable.

This becomes particularly important for data-driven models that may be sensitive to changes in raw materials, equipment, sensors, operating practices or process distributions.

A Useful Regulatory Principle for AI in GMP

The FDA experience suggests a practical principle for future AI implementation:

The level of model assurance should be proportional to the influence the model has on product quality and GMP decisions.

This is more useful than treating every AI application as equally risky.

For example:

AI for trend detection → AI for decision support → AI for process control → AI for release

represents increasing influence on the final GMP decision and therefore potentially increasing requirements for validation, transparency, monitoring and governance.

That is consistent with long-established Quality Risk Management principles and may provide one of the most practical foundations for integrating AI into pharmaceutical manufacturing.

The latest FDA experience demonstrates something important:

Regulators are not starting from zero when evaluating advanced models in pharmaceutical manufacturing.

A substantial regulatory foundation already exists.

The challenge for AI will be to extend those principles to models that may be more complex, data-dependent and probabilistic — without losing the fundamental GMP requirement that the process remains understood and controlled.

Source

Fisher AC, Chatterjee S, Madurawe R, Tian G, Tran R, Lee SL. FDA regulatory experience with drug manufacturing process models in approved applications. International Journal of Pharmaceutics. Available online 28 July 2026. Article 127249.

https://www.scienced … ii/S0378517326006976

Introduction

⇒ EU AI Act enforcement started on 2 August 2026. What pharmaceutical companies should know about AI transparency, GPAI oversight and integration with GxP governance.

The European Union has reached an important milestone in the regulation of artificial intelligence.

From 2 August 2026, the European Commission’s AI Office, together with national competent authorities, has begun enforcing relevant provisions of the EU Artificial Intelligence Act. At the same time, important new transparency requirements for certain AI systems have become applicable.

For pharmaceutical companies, this development deserves attention even though the AI Act is not a GMP regulation.

As artificial intelligence becomes increasingly embedded in pharmaceutical manufacturing, quality systems, regulatory affairs, medical information, pharmacovigilance and other business processes, companies may need to manage two parallel regulatory layers:
AI regulation and pharmaceutical/GxP regulation.

Compliance with one does not automatically demonstrate compliance with the other.

What Changed on 2 August 2026?

The European Commission confirmed that from 2 August the AI Office and national authorities started enforcement of the AI Act.

The same date also marked the application of transparency obligations under Article 50 of the Act. These requirements apply to defined categories of AI systems and are intended to make it clear when individuals interact with AI or encounter AI-generated or manipulated content.

For example, certain interactive AI systems such as chatbots must inform users that they are interacting with AI rather than a human.

The rules also introduce requirements concerning machine-readable marking of certain AI-generated or manipulated content and disclosure requirements for areas such as deepfakes and specified AI-generated content.

These obligations can be relevant to pharmaceutical companies operating public-facing AI applications, including potentially:

• patient or healthcare-professional chatbots;
• automated medical-information interfaces;
• AI-supported customer-service systems;
• externally published AI-generated material;
• interactive digital-health applications.

The precise obligation depends on the role of the company, the AI system and its intended use.

General-Purpose AI Is Also Entering a More Serious Enforcement Phase

There is another important change.

Obligations for providers of general-purpose AI (GPAI) models have applied since August 2025. However, from 2 August 2026, the European Commission’s enforcement powers concerning these obligations became applicable, including the possibility of fines.

This primarily affects companies that provide general-purpose AI models rather than ordinary users of commercially available LLM services.

Nevertheless, pharmaceutical companies should understand where they sit in the AI value chain.

A company using a third-party foundation model will normally be in a very different regulatory position from the original model provider. However, sufficiently significant modifications of a model may affect whether an organisation itself becomes a provider under the AI Act.

This distinction may become increasingly relevant as pharmaceutical companies move from simply using commercial AI services toward fine-tuning, adapting or integrating models into proprietary systems.

Why This Matters for GMP

The EU AI Act and GMP answer different regulatory questions.

The AI Act primarily addresses risks associated with placing AI systems and models on the European market and using them in the EU.

GMP, by contrast, asks whether a system used in pharmaceutical operations is suitable and controlled for its intended GxP use and whether product quality, patient safety and data integrity are protected.

A pharmaceutical company could therefore theoretically have an AI system that meets applicable AI Act requirements but is still unsuitable for a critical GMP process.

The reverse is also possible: a technically well-validated internal GxP application may still need assessment against applicable AI Act obligations.

This creates a new governance challenge.

Instead of asking only:

“Is this AI validated?”

pharmaceutical companies increasingly need to ask:

“Which regulatory frameworks apply to this particular AI use case, and what evidence is required under each?”

One AI Inventory – Several Regulatory Assessments

A practical consequence is that pharmaceutical companies should avoid maintaining completely separate inventories for AI Act compliance, IT governance and GxP validation.

A single corporate AI inventory can identify, for every AI use case:

• intended use;
• system owner;
• provider and underlying model;
• users and affected persons;
• GxP relevance;
• potential impact on product quality and patient safety;
• company role under the AI Act;
• applicable transparency requirements;
• level of human oversight;
• model version and configuration;
• third-party dependencies;
• required validation or qualification;
• lifecycle monitoring and change-control requirements.

This provides a common starting point from which Legal, Quality, IT, Data Privacy, Cybersecurity and business functions can perform their respective assessments.

Supplier Governance May Become Even More Important

Most pharmaceutical companies will not build frontier AI models themselves. They will increasingly rely on external providers.

This makes supplier governance critical.

For GxP-relevant AI, pharmaceutical companies may need sufficient information to understand matters such as:

• which model and version are being used;
• when the model changes;
• known limitations;
• security controls;
• data handling;
• retention of prompts and outputs;
• auditability;
• availability of technical documentation;
• incident notification;
• mechanisms for monitoring performance.

The AI Act strengthens regulatory attention to transparency throughout the AI value chain. For pharmaceutical Quality organisations, this reinforces a familiar GMP principle:

An outsourced technology does not outsource the regulated company’s responsibility for its intended use.

Important: The AI Act Is Not Fully Applicable All at Once

The 2 August 2026 milestone should not be interpreted as meaning that every requirement of the AI Act suddenly became applicable to every AI system.

The Act follows a phased implementation timetable, and requirements depend on the type of system, the role of the organisation and the relevant provision.

Companies should therefore avoid simplistic statements such as:

“All AI systems must now comply with the full AI Act.”

Instead, each use case should be classified against the applicable provisions and implementation dates.

What Pharmaceutical Companies Should Do Now

For organisations already implementing AI, seven actions appear particularly useful:

• Maintain a controlled inventory of AI use cases.
• Determine the organisation’s regulatory role for each system.
• Identify whether Article 50 transparency requirements apply.
• Separately determine whether the use case is GxP-relevant.
• Define supplier, model-version and change-control requirements.
• Document human oversight and accountability.
• Maintain evidence demonstrating both regulatory classification and ongoing control.

The central lesson is that AI governance in pharma can no longer be treated solely as an IT or innovation activity.

As AI regulation matures alongside emerging pharmaceutical-specific guidance, companies will need an integrated governance model connecting:

AI regulation + GMP + data integrity + cybersecurity + privacy + supplier management + quality risk management.

For pharmaceutical organisations operating in Europe, 2 August 2026 is therefore more than another AI Act implementation date.

It marks the transition from preparation toward active regulatory enforcement.

Sources

European Commission – Commission starts enforcing AI Act rules and new transparency requirements on 2 August:

https://digital-stra … equirements-2-august

European Commission – Guidelines on transparency obligations for providers and deployers of AI systems:

https://digital-stra … deployers-ai-systems

European Commission – Guidelines for providers of general-purpose AI models:

https://digital-stra … lines-gpai-providers

Introduction

⇒ FDA proposes a competency-based approach for evaluating Generative AI-enabled medical devices, including risk-based benchmarking, clinical confirmation, lifecycle monitoring, model drift control and re-evaluation after AI changes.

The U.S. FDA has opened an important regulatory discussion on how Generative AI-enabled medical devices could be evaluated when traditional software testing is no longer sufficient.

On 18 August 2026, FDA’s Center for Devices and Radiological Health (CDRH) released the discussion paper Considerations for the Regulation of Generative AI-Enabled Medical Devices. The Agency is requesting stakeholder feedback until 19 October 2026.

The document applies specifically to medical devices, not to pharmaceutical GMP systems. Nevertheless, several concepts discussed by FDA are highly relevant to the broader debate about how probabilistic and generative AI can be validated and controlled in regulated environments.

The most significant idea may be surprisingly simple:

For sufficiently complex GenAI systems, it may be unrealistic to test every possible input and output. Instead, regulators may need to assess whether the system can demonstrate defined competencies and continue to demonstrate them throughout its lifecycle.

Why Traditional Software Testing May Not Be Enough

FDA recognizes that GenAI-enabled devices differ fundamentally from traditional software and even from many conventional AI systems.

They may:

• accept open-ended inputs;
• generate variable outputs for similar inputs;
• perform multiple different subtasks;
• use third-party foundation models;
• change because of updates to models, prompts, retrieval mechanisms, guardrails or orchestration logic;
• operate with increasing levels of autonomy.

FDA also explicitly identifies risks such as confabulations or hallucinations, limited transparency into third-party foundation models and performance degradation over time.

This creates a fundamental validation challenge.

For conventional software with bounded inputs and predetermined outputs, extensive input-output testing can provide strong evidence that the system operates as intended.

For GenAI, the possible combination of inputs, conversations and outputs can become effectively unlimited. FDA therefore acknowledges that evaluating every conceivable situation may simply not be practical.

Risk Depends on Both Autonomy and Consequences

FDA proposes a possible two-axis framework for thinking about GenAI risk.

One dimension considers what the AI actually does — ranging from providing non-directive information through directing an action to taking an action autonomously.

The second dimension considers the consequence of relying on an incorrect output.

Risk therefore increases as AI becomes more autonomous and as the potential consequences of an incorrect output become more serious.

This is an important distinction because the same underlying AI technology could represent very different levels of regulatory risk depending on its intended use.

An AI system that provides general information is fundamentally different from one that recommends a specific clinical action — and different again from an agentic system capable of executing that action.

FDA also emphasizes that simply adding wording such as “talk to your doctor” or “I am not a medical professional” may not necessarily make an otherwise action-directing AI function less directive.

A Competency-Based Approach to GenAI Evaluation

Perhaps the most innovative part of the discussion paper is FDA’s consideration of a competency-based approach inspired, at a high level, by the way human clinicians are evaluated.

Doctors are not qualified by testing every possible clinical situation they could ever encounter. Instead, they demonstrate competencies through examinations, supervised practice and continuing assessment.

FDA is exploring whether a related concept could be adapted for GenAI-enabled medical devices.

The proposed approach consists of two major components:

1. Device benchmarking

The deployed or representative final system would be tested against predefined competencies.

2. Clinical confirmation

Evidence would then confirm that the device performs appropriately under real or clinically representative conditions.

Importantly, FDA proposes evaluating the final user-facing device as configured for deployment, rather than assessing only the underlying foundation model such as an LLM.

This distinction is critical.

The performance of an AI application does not depend only on the model. It may also depend on the system prompt, retrieval architecture, knowledge sources, guardrails, user interface, orchestration logic and other controls surrounding the model.

What Would Be Tested?

FDA identifies several possible areas of competency for benchmarking GenAI systems.

They include:

Safety

• recognition and escalation of safety-critical situations;
• maintaining the defined scope and operational boundaries;
• appropriate communication of uncertainty and deferral when the system cannot provide a reliable answer.

Clinical proficiency

• knowledge and task fidelity;
• information gathering and analysis;
• quantitative reasoning;
• quality and comprehensibility of communication.

Generalizability

• robustness, reliability and reproducibility;
• performance across relevant subgroups.

Agentic capabilities

• additional competencies where AI can autonomously plan, use tools or execute multi-step actions.

FDA also discusses testing boundary adherence using techniques such as adversarial prompting, prompt injection and multi-turn conversations that gradually move outside the intended scope of the system.

This illustrates an important change in thinking about AI validation:

Validation is not only about whether AI produces correct answers. It is also about whether it behaves safely when it does not know the answer, when it is challenged, and when a user attempts to push it beyond its intended use.

Acceptance Criteria Still Matter

The competency-based approach does not mean abandoning predefined validation requirements.

Quite the opposite.

FDA considers that manufacturers should define the scope of testing based on intended use and risk, prespecify evaluation methods, justify scoring methods and establish acceptance criteria before testing.

Where human expert assessment is needed, FDA also discusses the use of appropriately qualified and structurally independent adjudicators.

This could become particularly important for GenAI because many outputs cannot simply be classified as mathematically “correct” or “incorrect.” Evaluation may require structured expert judgement supported by predefined scoring criteria.

Validation Does Not End at Deployment

FDA places substantial emphasis on postmarket performance monitoring.

Possible approaches include:

• periodic re-benchmarking against predefined performance thresholds;
• periodic review of real-world AI outputs by qualified independent clinicians;
• monitoring for model or data drift and other forms of performance degradation.

Reassessment could occur periodically and following defined triggering events, including changes to the underlying model or other components of the AI architecture.

FDA even asks whether, under appropriate circumstances, greater uncertainty could be accepted before market authorization if it were compensated by stronger postmarket monitoring.

That is a potentially important regulatory concept.

It shifts the emphasis from demonstrating that an AI system was acceptable at one point in time toward demonstrating that it remains acceptable throughout operation.

What Happens When the Foundation Model Changes?

Another difficult issue addressed by FDA concerns applications built on third-party foundation models.

A medical-device manufacturer may build a validated application using an external foundation model, but the model provider may subsequently change that model.

The device manufacturer may therefore face a GMP-like change-control problem even though the change originated outside its own organization.

FDA discusses mechanisms ranging from documentation within the manufacturer’s Quality Management System to regulatory authorization and the use of Predetermined Change Control Plans (PCCPs). Re-benchmarking against the original competency criteria could provide evidence that the modified system continues to perform acceptably.

FDA is also considering the concept of voluntary Foundation Model Device Master Files, through which foundation-model developers could provide FDA with information about model architecture, training-data provenance, known limitations, failure modes, performance, guardrails, model updates and audit-log availability.

Agentic AI Raises the Risk Further

FDA specifically addresses agentic AI — systems capable of autonomously planning and executing multi-step tasks, using external tools and taking actions.

The Agency asks how increased autonomy and the reduced opportunity for human review should influence acceptance criteria and regulatory oversight.

This could become increasingly important as AI moves from:

providing information → recommending decisions → executing decisions.

The regulatory significance of AI therefore may increasingly depend not simply on the sophistication of the model, but on how much authority the system is given to act.

Why This Matters Beyond Medical Devices

The FDA discussion paper is not GMP guidance and does not establish requirements for AI used in pharmaceutical manufacturing or Pharmaceutical Quality Systems. FDA explicitly states that the document is for discussion only and does not represent draft or final guidance or proposed regulatory expectations.

Nevertheless, the regulatory thinking behind the paper deserves attention from pharmaceutical companies.

Several concepts could be highly relevant to future approaches for GenAI used in GxP environments:

Intended use → Risk classification → Defined competencies → Predefined acceptance criteria → Qualification/benchmarking → Human confirmation → Continuous monitoring → Re-benchmarking after change

This may ultimately prove more suitable for probabilistic AI than attempting to force GenAI into a traditional deterministic software-validation model.

The particularly important message is that probabilistic output does not necessarily mean that an AI system cannot be controlled.

Instead, control may need to be demonstrated differently: through risk-based performance requirements, validated boundaries and guardrails, representative challenge testing, human oversight, predefined acceptance criteria and continuous lifecycle monitoring.

In this sense, the FDA paper may represent another important step toward a regulatory model based not on demanding that AI behave like deterministic software, but on demonstrating that its performance remains acceptably controlled for its intended use.

Source

U.S. Food and Drug Administration, Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback, 18 August 2026.
https://www.fda.gov/ … on-paper-and-request