AIforPharma.org

Introduction

⇒ An MHRA-backed survey finds pharmaceutical AI adoption remains exploratory, with regulatory uncertainty limiting AI use in cGMP, GDP and CMC submissions.

A new open-access industry survey provides one of the clearest recent pictures of how digital and AI-enabled technologies are actually being used in pharmaceutical development and manufacturing.

Published online in July 2026 in the International Journal of Pharmaceutics, the study was conducted by the Digital CMC Centre of Excellence in Regulatory Science and Innovation (CERSI), led by the University of Strathclyde and supported by the UK Medicines and Healthcare products Regulatory Agency (MHRA).

The results reveal an important gap between interest in AI and its actual deployment in regulated pharmaceutical environments.

While many respondents reported experience with AI-enabled tools, only 6% of responses indicated current AI use in cGMP/GDP environments. At the same time, 69% indicated that such use was being considered.

This suggests that pharma interest in AI is already substantial, but companies remain cautious about moving AI from development or exploratory applications into regulated manufacturing and quality operations.

Regulatory uncertainty appears to be a major barrier

One of the most interesting findings concerns regulation.

According to the study, 69% of respondents somewhat or strongly agreed that the current pharmaceutical regulatory environment represents a barrier to implementation of AI tools.

The authors identify several areas where uncertainty remains particularly important: explainability, validation, model drift, lifecycle management and the evidence regulators may expect during submissions or inspections.

The study also found a major difference between internal implementation and regulatory use: fewer than 15% of reported digital and AI-enabled tools had been included in regulatory submissions.

The authors appropriately caution that not every internally used digital tool would be expected to appear in a regulatory submission. Nevertheless, the difference indicates that translating useful internal models into regulator-facing applications remains difficult.

Why this matters for pharmaceutical companies

The findings challenge a common assumption that the main obstacle to pharmaceutical AI adoption is technology.

The models may already be capable of performing useful tasks. The bigger challenge may increasingly be demonstrating that they can operate within a controlled pharmaceutical lifecycle.

For an AI system influencing CMC or GMP activities, companies may need to demonstrate:

• a clearly defined intended use and context of use;
• data quality and data-governance controls;
• appropriate validation or qualification;
• performance acceptance criteria;
• explainability appropriate to the risk and intended use;
• management of model drift and performance deterioration;
• human oversight and accountability;
• change control for models, configuration and data;
• ongoing lifecycle monitoring;
• evidence suitable for regulatory submissions and inspections.

The study therefore supports an important distinction between AI that works and AI that is regulatory-ready.

A model may provide impressive technical performance and still be difficult to deploy in GMP if the company cannot demonstrate its validation status, data provenance, lifecycle controls and behaviour under foreseeable failure conditions.

Quality by Digital Design

The paper also discusses the emerging concept of Quality by Digital Design (QbDD), building on the established Quality by Design philosophy.

This may become an important direction for pharmaceutical digital transformation. Instead of adding digital tools or AI after a process has already been designed, digital models, data architecture and control strategies could increasingly become part of process and product development from the beginning.

Such an approach could make regulatory justification easier because model purpose, data requirements, risk controls and lifecycle expectations could be designed together with the pharmaceutical process rather than added retrospectively.

Practical takeaway

The survey suggests that pharma does not primarily lack interest in AI. It lacks sufficient regulatory certainty and practical implementation experience for higher-impact regulated applications.

For companies considering AI in manufacturing or quality systems, the most valuable next step may therefore not be another AI proof-of-concept.

It may be to take one well-defined use case and demonstrate the complete regulated lifecycle: intended use, risk assessment, data governance, challenge testing, qualification, implementation, monitoring, change control and requalification.

That experience may ultimately be more valuable than operating numerous disconnected AI pilots that never progress into regulated use.

Source

Cook G. et al. “Digital and AI-enabled models in pharmaceutical development and manufacturing: a regulatory-focused industry survey.” International Journal of Pharmaceutics, 2026. Open access.
https://www.scienced … ii/S0378517326006253

Introduction

⇒ MHRA sets expectations for AI-assisted GxP inspection responses, requiring accurate evidence, technical review, human approval and accountable CAPA development.

The UK Medicines and Healthcare products Regulatory Agency has published an important statement on the use of artificial intelligence when preparing responses following GxP inspections.

The MHRA confirmed that companies are already using AI tools to draft inspection responses. The regulator recognises that AI can help explain complex technical matters, improve consistency and accelerate routine drafting. However, it has also identified cases in which inappropriate AI use created real regulatory and patient-safety risks.

According to the MHRA, some AI-assisted inspection responses included references to guidance that did not exist, citations of inappropriate regulatory frameworks and inaccurate information. In one case, a response exceeded 90 pages but still failed to address the identified deficiencies. In another case involving a serious patient-safety concern, inaccurate AI-generated information increased the regulator’s review time from approximately four hours to more than 20 hours.

This is an important development because it moves the risk of AI hallucination in GxP documentation from theory into documented regulatory experience.

MHRA is not prohibiting AI

The MHRA’s position is not that companies should stop using AI. Its concern is whether information submitted to the regulator is accurate, verifiable, technically reviewed and prepared under appropriate oversight.

The regulator states that all inspection responses and related submissions must be:

• factually accurate and verifiable;
• technically reviewed by appropriately experienced personnel;
• approved by a person with sufficient authority and accountability;
• supported by evidence for factual claims;
• appropriate to the specific regulatory and organisational context.

These expectations apply regardless of whether the document was prepared using AI, templates, consultants or conventional manual drafting.

Voluntary disclosure of AI use

The MHRA is also offering companies the option to disclose when AI has been used to support an inspection response. Disclosure is currently voluntary.

Where a company chooses to disclose AI use, the MHRA recommends:

• including a brief statement at the beginning of the response;
• identifying the sections in which AI assistance was used;
• confirming that the content was verified and approved by humans.

The MHRA indicates that transparent disclosure, combined with effective verification, may demonstrate a mature and open quality culture.

This does not mean that disclosure compensates for inaccurate information. Responsibility remains with the organisation and the accountable personnel approving the response.

What may indicate inadequate AI oversight?

The MHRA identifies several warning signs that may indicate weak verification or quality-system controls:

• incorrect statements or non-existent references;
• generic language that does not address the specific deficiency;
• lack of organisation-specific information;
• citations of regulations without explaining their relevance;
• inconsistent technical terminology;
• excessively long responses that fail to address the issue clearly.

Where inspection responses are inaccurate, incomplete or unnecessarily verbose, the MHRA may reject them or return them for revision.

Weak responses may also affect the regulator’s assessment of the company’s CAPA system and future inspection risk. Serious or repeated problems may be referred for further regulatory action.

Practical implications for pharmaceutical companies

Companies using AI to prepare responses to inspections, audits or regulatory deficiencies should establish a controlled review process.

At minimum, this should include:

• use of approved regulatory and company source documents;
• verification of every cited regulation, guidance document and factual claim;
• confirmation that the response addresses the specific observation;
• technical review by subject-matter experts;
• Quality Unit review and formal approval;
• removal of generic or unsupported AI-generated statements;
• retention of evidence supporting proposed CAPAs;
• clear accountability for the final submitted response.

AI may help organise information and improve drafting efficiency, but it cannot replace root-cause analysis, technical understanding or knowledge of the company’s processes.

A well-written response that does not address the actual cause of a deficiency is not an effective CAPA response.

Key takeaway

The MHRA’s message is pragmatic and important: regulators do not need to prohibit AI to control its risks.

The regulatory expectation remains focused on outcomes. Inspection responses must be accurate, evidence-based, organisation-specific and approved by accountable personnel.

For pharmaceutical companies, this means that AI-assisted regulatory writing should be treated as a controlled quality process—not as an informal administrative shortcut.

Source:
https://mhrainspecto … stifling-innovation/

Introduction

⇒ EMA’s Annex 22 AI workshop highlights a possible shift from prohibiting GenAI and LLMs in GMP toward risk-based control using guardrails, human oversight, traceability, validation, lifecycle monitoring and pharmaceutical quality system governance.

Following the EMA GMP multistakeholder workshop organised on 30 June and 1 July 2026 on expert contributions to the development of EU GMP Annex 22 on Artificial Intelligence, the pharmaceutical industry is still awaiting official feedback, conclusions or a post-workshop report from EMA.

The workshop was organised to support the development of Annex 22 and to collect expert input on the possible use of artificial intelligence in medicines manufacturing. The first day was available as a live broadcast and included expert opinions on the future use of generative AI, large language models and other probabilistic or adaptive AI models in GMP environments.

One important message emerging from the expert discussion was that a simple, general prohibition of GenAI or LLMs in pharmaceutical GMP environments may not be the most effective or future-proof regulatory approach. Such a prohibition could quickly become outdated, especially as AI models, control mechanisms, guardrails, validation methods and monitoring tools continue to improve.

At the same time, this does not mean that GenAI or LLMs should be freely accepted in critical GMP applications. The more balanced and practical direction appears to be a risk-based approach: AI should be considered according to its intended use, GMP impact, patient risk, level of human oversight, data quality, traceability, model behaviour, validation evidence and lifecycle controls.

This is particularly important because the original draft Annex 22 indicated that dynamic, adaptive and probabilistic models, including GenAI and LLMs, should not be used in critical GMP applications. However, stakeholder feedback showed support for potentially enabling these technologies in medicines manufacturing if adequate control and mitigation measures can be demonstrated.

For pharmaceutical companies, the practical message is clear: the discussion is moving from “AI should be prohibited” toward “under what conditions can AI be controlled well enough for GMP use?”

The key control areas are likely to include:

• clear definition of intended use;
• GMP impact and patient-risk assessment;
• approved and controlled source data;
• model/version control;
• guardrails and their verification;
• human oversight and accountability;
• traceability of AI outputs;
• detection of hallucinations or incorrect recommendations;
• incident escalation and prevention of GMP impact;
• performance monitoring and drift detection;
• supplier qualification and cloud-service oversight;
• change control for model updates, retraining and configuration changes;
• documented validation or qualification evidence.

One of the most important concepts discussed in the context of GenAI and LLMs in GMP is the use of “guardrails”. What could “guardrails” mean for AI in GMP?

In simple terms, guardrails are predefined controls built around an AI system to keep its use within safe, intended and acceptable boundaries.

In GMP language, guardrails can be understood as technical, procedural and human controls that prevent AI from being used in the wrong way, reduce the risk of incorrect or unsupported outputs, and stop AI-generated conclusions from becoming GMP decisions without appropriate human review.

Guardrails do not make AI perfect. They do not remove the need for validation, qualification, human oversight or quality risk management. Their purpose is to ensure that AI remains a controlled support tool, not an uncontrolled authority.
Guardrails are predefined technical, procedural and organizational controls that define what an AI system is allowed to do, what it must not do, how it should behave under uncertainty, and how its outputs are reviewed before they affect GMP activities, records or decisions.

Examples of AI guardrails in GMP

• Intended-use limitation – the AI system may only be used for defined and approved purposes. For example, an AI tool may summarize SOP content, but may not approve a deviation, assign final root cause or make a batch disposition decision.
• Source grounding – the AI must generate answers only from approved and controlled sources, such as current SOPs, specifications, batch records, validation reports, quality agreements or approved regulatory guidance.
• Refusal rules – the AI must not guess when evidence is missing. For example, the system should state: “Insufficient information is available to conclude product impact” instead of generating an unsupported conclusion.
• Output constraints – the AI output should be limited to predefined sections or fields, such as facts identified, source references, missing information, potential questions for review and recommended human follow-up. It should not create final GMP conclusions unless this is explicitly validated and approved for the intended use.
• Human review gate – AI-generated outputs should be reviewed by qualified personnel before they are used in GMP records or decisions. For example, QA should review an AI-generated deviation summary before it is entered into the official investigation record.
• Access control – only trained and authorized users should be able to use AI functions with potential GMP impact. For example, a batch review assistant should be available only to trained QA or manufacturing reviewers.
• Audit trail – the system should retain evidence of AI use, including prompt, output, source documents, model or knowledge-base version, reviewer edits and final approval.
• Change control – changes to the AI model, prompts, configuration, guardrails or knowledge base should be assessed for GMP impact. A new model version or major knowledge-base update may require impact assessment and requalification.
• Performance monitoring – AI performance should be monitored in routine use. Examples include tracking false citations, unsupported claims, reviewer corrections, repeated failure modes and cases where AI output was rejected by users.

Practical example: AI support for deviation investigations

For an AI tool supporting deviation investigations, guardrails could be defined as follows:

The AI may identify relevant facts, summarize the event chronology, list missing information, identify potentially similar historical deviations and suggest questions for the investigator to consider. The AI must use only approved QMS records and controlled source documents. It must not assign the final root cause, conclude product impact, determine CAPA effectiveness or recommend batch disposition. If the available information is insufficient, the AI must clearly state that no conclusion can be made. Any AI-generated text must be reviewed, corrected where needed and approved by the investigation owner and QA before inclusion in the GMP record.

This example illustrates the practical meaning of guardrails: the AI can support the process, but it cannot replace GMP responsibility. The final decision remains with qualified personnel and must be justified by evidence.

The final Annex 22 position is not yet known. However, the workshop confirms that regulators are actively considering how to balance innovation with GMP control. For industry, this is a strong signal to start preparing practical AI governance frameworks now, rather than waiting until the final Annex 22 text is published.

AI in GMP should not be treated as an informal tool or uncontrolled black box. If AI supports or influences regulated manufacturing, quality or compliance decisions, it should be governed within the pharmaceutical quality system.

Previous note on the planned EMA workshop:
https://www.aiforpha … ment-of-ai-annex-22/

EMA workshop page:
https://www.ema.euro … development-annex-22