PharmTech AI Pulse Check: AI Policies Become Regulators' Inspection Yardstick

As AI tools move into pharmaceutical manufacturing, quality, and regulatory workflows, the compliance question is shifting from what regulators will require to whether companies can show they follow their own rules. That was the focus of the latest PharmTech AI Pulse Check. Christopher Cole moderates Richard Jaenisch, Florin Muraru, and Gourav Pandey in a conversation built around a point Jaenisch brought back from the International Society for Pharmaceutical Engineering Annual Meeting. That regulators plan to assess pharma companies against their own internal AI policies, which puts the burden of building safe, defensible practices on the organizations themselves.

What Makes an AI Policy That Holds Up in an Inspection?

Jaenisch says the approach makes sense because it mirrors how inspections already work: companies are always judged against their own procedures. Regulators can ask a company to show its hand during an audit, and the company can't ask the same of them. What inspectors will examine, he says, is how a company's AI policy is carried out in practice: whether it is applied consistently and whether it lines up with existing standards such as computer systems validation. The hard part is that few companies know exactly how they use AI until they run into a specific use case. That makes vagueness risky. "If your internal AI policy is really, really vague, that could help you, but it also could harm you," he says, because a division working well outside a loosely written policy can become an inspection finding. He also notes that a policy doesn't stand alone. It must connect to a company's other documents and to regulatory guidance, and multinational companies face a harder version of that problem than companies operating only in the US. Some relief may be coming, Jaenisch says a playbook is expected in December to help companies understand what inspectors will look for.

Muraru adds that regulators are not reading a company's playbook so much as testing it. They want to know who owns each process and whether that ownership can be verified, and he points to an FDA letter issued in April as an early example of this approach. Pandey says companies don't need a perfect enterprise AI policy, a fully validated model, or a fully transparent architecture on day one. "You need something you can explain, you have evidence, and you can actually follow," he says, which makes AI literacy training a central part of how teams put those policies into practice.

What Is a Realistic, Defensible Starting Point?

Pandey says many teams stall because they try to start with something fully autonomous and high impact. His advice is to set the bar lower and map AI onto workflows that are already written into SOPs and have held up in past audits. He uses regulatory writing as an example. Pulling specific test values and specifications out of 600-page batch records, certificates of analysis, and scanned PDFs is slow work. AI can speed it up, while the existing Veeva review and QA approval steps stay in place to control the outcome.

Muraru recommends starting even smaller. First, take an inventory of where AI is already in use, including personal accounts, because "shadow AI is usually the biggest risk." Then pick low-risk tasks where a person already checks every output, and document the model used and who signs off. That answers the 2 questions regulators usually ask: what is the tool for, and who is accountable? In Europe, he adds, the AI Act sets a legal floor that requires companies to take measures for staff AI literacy, so training is not optional.

Jaenisch agrees that literacy is the obvious first step, starting with terminology and moving to context of use. Generic training can cover what not to do, he says, but what teams should do has to be developed inside each organization, using the subject matter experts it already employs. Without that grounding, he warns, AI-drafted deviations are a mixed blessing, since the same tools that speed up writing "could write bad deviations faster."

The panel's message is that defensible AI adoption in GMP environments depends less on ambitious platforms than on clear ownership, documented use, and training tailored to how each company actually works. Watch the full conversation for the panel's take on inspection readiness, shadow AI, and where to start.