AI Pulse Check: Owned AI Models Ease Validation

On this episode of PharmTech's AI Pulse Check, the panel examines a signal Richard Jaenisch brought back from the International Society for Pharmaceutical Engineering Annual Meeting: regulators will assess pharmaceutical companies against their own internal AI policies. That scrutiny is already taking shape. In April 2026, the FDA issued its first cGMP warning letter with a dedicated section on inappropriate AI use.¹ Earlier that year, the FDA and EMA released 10 joint guiding principles for AI in drug development.² The EU's draft GMP Annex 22 on AI remains unfinalized,³ and in October the UK accepted all 44 recommendations of its National Commission into the Regulation of AI in Health care.⁴ Jaenisch, Florin Muraru, and Gourav Pandey discuss how companies can build defensible AI practices, from inventories of shadow AI to proportionate validation and clear accountability.

Watch Part 1 of the panel about how regulators will audit pharma against its own AI policies and ways QA and regulatory teams can build defensible, inspection-ready AI practices

Watch Part 2 of the panel on why MHRA and FDA oversight of pharma AI continues past go-live, and who validates the regulators' own AI.

Watch Part 3 of the panel about the December AI playbook, EMA/MHRA moves, PCCP accountability gaps, and MCP-ready regulatory guidance.

What Separates an Internal AI Policy That Holds Up in An Inspection From One That Only Looks Good on Paper?

Jaenisch: Regulators can say, “show me your hand,” because they're auditing you. They'll examine how your policy is executed, whether it lines up with current standards, and whether you're consistent. A very vague policy can actually help you, but if a whole division operates outside its boundaries because the policy doesn't address that use, that's an issue. Nothing is in a vacuum: your policy must link up with other regulatory guidance.

Muraru: Regulators don't read your playbook. They test it and look at who owns a process. FDA's April letter was the first such test, and more will follow.

Pandey: You don't need a perfect policy or a fully validated model on day one. You need something you can explain, have evidence for, and follow.

What Is a Realistic Starting Point for Teams Stuck on AI Implementation?

Pandey: Teams get stuck starting fully autonomous and high impact. Set the bar lower. Map workflows already approved in your standard operating procedures that have proven defensible in audits, then find where AI makes you faster. In regulatory writing, AI can dig through a 600-page batch record to pull a specification or test value, while the existing review workflow drives decisions.

How Should Companies Build From There?

Muraru: Inventory where AI is used, including personal accounts, because shadow AI is usually the biggest risk. Pick low-risk uses where a person already checks every output, and document the model and who signs. That answers regulators' 2 main questions: “What is this for?” and “Who is accountable?” In Europe, the AI Act makes staff AI literacy training not optional.

Jaenisch: Your company's AI use requires a different kind of AI literacy than another company's. Universal training covers what not to do; what you need to do should be honed internally with your own experts. Everyone is busting out deviations, but AI could also write bad deviations faster.

What Does the MHRA's Approach Signal About Where Inspectors Will Look Next?

Muraru: The UK is moving from approving AI once to watching it through its life, as FDA's generative AI paper did. A policy can't stop at go-live approval; it must show how you monitor the system, control changes, and decide when an update needs a fresh look. Regulators use AI themselves, too, so who validates the regulators' AI?

Why Aren't Some Organizations Slowed Down?

Jaenisch: They're throwing money at the problem, buying chips and systems for almost on-premises deployments. It takes years to understand what an investment that big can do.

Pandey: Whoever owns the model has better control, and it's easier to validate and defend than relying on frontier models that change weekly.

What Should the Expected December AI Playbook Clarify?

Muraru: Proportionality: which uses need full validation and which can live with lighter controls. Large companies will map the parallel documents; smaller companies will have issues knowing which to apply.

Pandey: Clarity on predetermined change control plans: when a change, from a provider's model or your own harness, is substantial enough to notify, stop, and revalidate. And accountability: own your model, stack, and architecture.

Jaenisch: Authorship at a granular level: what is AI authorship vs human authorship? And a Model Context Protocol backend so people can plug a playbook into the tools they already use.

References

1. FDA. Purolea Cosmetics Lab—722591—04/02/2026. April 2, 2026. Updated April 14, 2026. Accessed November 10, 2026. View source

2. FDA. Guiding principles of good AI practice in drug development. Updated January 14, 2026. Accessed November 10, 2026. View source

3. European Commission, Directorate-General for Health and Food Safety. Stakeholders' consultation on EudraLex volume 4 - good manufacturing practice guidelines: chapter 4, annex 11 and new annex 22. Accessed November 10, 2026. View source

4. Medicines and Healthcare products regulatory agency. National Commission into the Regulation of AI in Healthcare: recommendations for a future regulatory framework. September 10, 2026. Accessed November 10, 2026. View source