PharmTech AI Pulse Check: Why Pharma's AI Compliance Doesn't End at Go-Live

Regulators are shifting from approving pharma AI once to supervising it across its lifecycle, and the latest PharmTech AI Pulse Check examines what that means for company policy. The conversation picks up where the panel's discussion of AI policies as an inspection yardstick left off.

Are Regulators Moving Faster Than Industry on AI?

Muraru argues that regulators are moving quite fast, sometimes faster than industry. The UK's MHRA is moving from approving AI once to watching it through its life, a direction he says mirrors FDA's generative AI paper. For companies, Muraru explains, "an internal AI policy can't stop at approval on go live." Policies must show how teams monitor systems, control changes, and decide when an update needs a fresh look, a theme PharmTech has explored in coverage of change control for AI model updates.

Guidance is already arriving. MHRA has promised draft guidance on AI device updates by December, the EU has a concept paper on AI in clinical development, and GMP Annex 22 for manufacturing is expected early next year. Muraru says small companies should look to these documents for how much validation is proportionate to their AI use.

Who Validates the Regulators' AI?

Muraru notes that agencies are also using AI to review trial protocols and spot safety signals, and he asks who validates that AI and how a sponsor learns why it flagged something. Pandey observes that regulators using AI in their workflow should be held responsible for the questions and requests they send, but adds that industry sits on the forefront of the audit. Either way, he says, "if we are using, we are responsible."

International harmonization remains a distant prospect. The closest example so far, the 10 principles from FDA and EMA, amount to "guiding stars" that keep people at the center without cementing anything. The open question is whether future harmonization stays non-binding or becomes far more specific, given that AI companies "can produce incredibly specific guidance."

What Are the Biggest Players Doing Differently?

Jaenisch observes that "the biggest thing I've seen is people throwing money at the problem." Large companies are buying chips and systems and signing agreements that resemble on-prem deployments. After seeing Lilly's future-facing buildings at the ISPE Annual Meeting, he cautions that it will take a few years to understand what an investment that large can do. He also points to workforce pipeline bets, such as the Ivy Tech partnership, as a good lane, and notes that Lilly has six or seven strategies on deck, with Sanofi pursuing a similar approach.

Jaenisch also sees foundation-model companies acquiring AI-native drug discovery firms and aligning them with pharma companies that hold the actual data, a shift from the "chimpanzees writing Shakespeare" approach of throwing compute at a problem.

Why Does Owning the Model Matter for Validation?

Pandey closes with a compliance point: whoever owns the model has better control over the stack and architecture, both for internal use and for patient-facing devices. That applies to SaaS providers becoming AI-native, too. Owned model features are easier to validate and defend than reliance on front-end models that change weekly.

For quality, regulatory, and manufacturing leaders, the takeaway is to write AI policies that cover the full lifecycle, because inspectors are heading there next.