“If your AI roadmap ignores GxP, it’s already dead.”
Artificial intelligence is transforming life sciences, from pharmacovigilance and clinical operations to manufacturing analytics. But in regulated environments, AI success depends on something many organisations underestimate: governance and validation built on GxP from the start.
👉 Exploring AI in regulated environments?
Learn how organisations are designing GxP-compliant AI governance frameworks that regulators will accept.
That comment came from a call Paolo Morelli had with a senior QA leader at a biotech investing heavily in AI capabilities. During the conversation, one sentence in particular stayed with me: “Innovation without compliance is just a demo.”
In a few words, it captured exactly how I feel whenever I read the latest AI guidance. There is no doubt the industry is facing a moment of fundamental change. Yet despite the scale of that transformation, there is also a distinct sense of déjà vu.
If I cast my mind back to 2024, my interactions with AI were largely limited to the frustrating chatbots I complained to when a parcel failed to arrive. I would furiously type about paying extra for next-day delivery, only to receive automated responses that solved nothing. I was, quite literally, an old man yelling at a cloud. That was AI then: novel, occasionally interesting, rarely helpful and more often frustrating. It felt comfortably distant from anything remotely GxP-critical.
Fast forward to 2026 and AI is embedded in pharmacovigilance workflows, classifying documents in the TMF, supporting deviation trending, batch analytics, signal detection and protocol optimisation. It is influencing decisions inside regulated environments in ways that would have seemed improbable only two years ago. The capability curve has been exponential, almost vertical, and the fear of being left behind is testing even the most technically sophisticated organisations.
The technology may have arrived, but the governance architecture is still catching up and that is where the real risk sits.
GxP Is Not a Plug-In
In regulated life sciences, GxP is not something that can be attached once the exciting work is complete; it is the operating system upon which everything else runs. Quality professionals who lived through the introduction of 21 CFR Part 11 will recognise the pattern immediately.
When Part 11 arrived in 1997, the industry responded decisively. Electronic systems were purchased, audit trails were enabled, validation packs were written and SOPs were updated with all the language of the day. Over the following decades, billions were invested in electronic systems. Platforms such as Veeva have rightly become industry standards, and a well-implemented electronic quality management system is unquestionably a sound investment. It allows quality professionals to focus on quality rather than administration, freeing them from endless filing, spreadsheet updates or frantic searches for deviations that need to be closed for batch release. However, it was not always that straightforward.
Most of us of a certain vintage can remember the name of our first eQMS, the one that promised seamless Part 11 compliance but fell short in practice. We remember paper workarounds that became more time-consuming and less reliable than the systems they replaced. In some cases, those systems had to be endured simply to justify their considerable cost. In others, they were quietly abandoned after a few painful months. I was once contacted by a recruiter specifically because I had experience transitioning an eQMS back to paper; apparently, it had become a niche and valuable skill. It was not an experience anyone was keen to repeat.
Electronic systems have undoubtedly evolved, yet nearly twenty-five years later data integrity still tops inspection findings and, in my own experience, still features prominently in audit observations. Typically, the systems appear compliant on paper. Procedures reference FDA, MHRA and EU guidance, and the correct terminology is used throughout. However, it often becomes clear that those words are not consistently understood or reflected in day-to-day behaviour. The architecture looks compliant; the operation does not.
AI Is Following the Same Trajectory
AI regulation already exists in meaningful and enforceable forms. In the United States, it sits within the FDA’s Software as a Medical Device framework; in Europe, under MDR and now the EU AI Act; and in the UK, through MHRA’s evolving software and AI change programme. These frameworks are real, and enforcement is real, even if interpretation continues to mature.
Innovation will always outpace regulation because regulators respond to technological developments rather than invent them. By the time guidance is drafted, consulted on, revised and implemented, the technology landscape has already shifted again. That gap is inevitable, but it does not attract only genuine innovators. It also attracts opportunists.
When regulatory language is still forming, some organisations invest in lifecycle control, data governance, validation discipline and robust oversight. Others move quickly, make bold claims and assume governance can be layered on later. History suggests that regulators eventually close the gap, and when they do, the question becomes whether what you have built is durable or whether it requires expensive reconstruction.
Want to ensure your AI strategy will withstand regulatory scrutiny?
The “Compliant Today” Trap
Quality leaders are, by necessity, pragmatic. Chasing perfection while ignoring basic compliance is rarely sustainable. However, the experience of Part 11 demonstrates that aiming only for what is acceptable today can create problems tomorrow. Interpretation deepened over time, expectations sharpened. The risk assessment that satisfied an inspector three years ago would not necessarily satisfy the same inspector today. AI is likely to follow the same trajectory.
Systems built to satisfy minimal current interpretation may require significant revalidation as oversight tightens around drift monitoring, bias control, retraining governance and transparency. Revalidation in an AI context is unlikely to be cosmetic. It will most likely involve reconstructing training datasets, retrofitting logging capability, redesigning change control processes or formalising oversight structures that were previously informal.
Compliance Language vs Compliance Outcome
Experience makes this distinction clear. I have worked in organisations that invested heavily in electronic systems they believed were compliant. Policies referenced every relevant guidance document, validation packs were extensive and the terminology was impeccable. However, when real workflows were observed, the cracks became visible.
The language in the validation package was compliant while its real-world functionality was not.
AI introduces an even greater emphasis on effective validation. There is a risk of over-reliance on outputs without appropriate critical review, informal retraining decisions, performance monitoring that is reported but not actively interrogated, and limited understanding of the datasets that underpin model outputs. If governance exists primarily in documentation rather than in technical understanding, regulatory exposure is not a matter of if, but when.
What Actually Works
The most effective QA leaders are not slowing AI initiatives, rather they are embedding themselves at the design stage. Successful organisations adopt a GxP-first approach to AI design, defining intended use before development begins, conducting proportionate risk assessments at concept stage and aligning validation strategy to impact.
They build traceability into data and models from the outset, ensuring version-controlled datasets, clear lineage, defined performance thresholds and active drift monitoring. They position QA as a strategic partner shaping system architecture rather than as a gatekeeper reviewing outputs at the end.
Compliance, when embedded properly, does not slow AI. Instead it enables it to move from demonstration to deployable capability.
The Real Question
The relevant question is not whether an AI solution can pass an initial validation, but whether it will remain defensible as regulatory expectations mature. Those who remember the early days of Part 11 will recognise the familiar pattern of ambitious investment, confident declarations, evolving interpretation and costly remediation.
AI is significantly more complex than electronic document management ever was, and if we approach it with the same short-term mindset, the consequences are likely to scale accordingly.
Innovation without compliance remains just a demo. For organisations building AI in regulated R&D, manufacturing, safety or quality environments, the choice is straightforward: start with GxP as the foundation or be prepared to start over later.
For organisations exploring AI in regulated environments today, the challenge is not just innovation — it is ensuring that innovation remains defensible as regulatory expectations evolve.
Building AI That Regulators Will Accept
Many organisations are experimenting with AI across R&D, pharmacovigilance, quality and manufacturing workflows.
The difference between experimentation and sustainable deployment is GxP-aligned governance, validation and lifecycle oversight.
At Arithmos, we help life sciences organisations design and implement AI systems that are regulator-ready from day one, ensuring innovation can scale without creating future compliance risk.
Speak to our experts about deploying AI in regulated environments.
Current regulatory guidance to consider
Guiding Principles for Good AI Practice in Drug Development (FDA & EMA)
Extends AI governance expectations beyond devices into the medicinal product lifecycle.
Reflection Paper on the Use of Artificial Intelligence in the Medicinal Product Lifecycle
EMA’s core position on AI use in clinical development, pharmacovigilance, manufacturing and regulatory submissions.
EMA–HMA Network Data Steering Group Workplan (2025–2028)
Outlines EMA’s forward-looking AI and data strategy, including experimentation cycles and regulatory science development.
https://www.ema.europa.eu/en/documents/other/network-data-steering-group-workplan-2025-2028_en.pdf
Guiding Principles for Good AI Practice in Drug Development (Joint EMA–FDA)
Signals transatlantic alignment on AI governance in medicines development.
https://www.ema.europa.eu/en/news/ema-fda-set-common-principles-ai-medicine-development-0
EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Classifies many medical AI systems as “high-risk” and introduces explicit requirements for data governance, logging, human oversight and lifecycle control that sit alongside MDR/IVDR.
https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
Software and Artificial Intelligence (AI) as a Medical Device
Explains how AI is currently regulated under UK medical device law.
Software and AI as a Medical Device Change Programme: Roadmap
Outlines planned UK reforms addressing adaptivity, transparency and AI-specific regulatory challenges.
Machine Learning Medical Devices: Transparency Principles
Defines expectations for clear communication of AI system limitations and performance.
https://www.gov.uk/government/publications/machine-learning-medical-devices-transparency-principles
Predetermined Change Control Plans for Machine Learning-Enabled Medical Devices: Guiding Principles
Reinforces lifecycle governance expectations for adaptive systems.
Impact of AI on the Regulation of Medical Products
MHRA’s broader reflection on regulatory implications of AI across healthcare products.
https://www.gov.uk/government/publications/impact-of-ai-on-the-regulation-of-medical-products
Draft Annex 22 – Artificial Intelligence (GMP Guide)
Introduces GMP-specific requirements for AI selection, validation, monitoring, change control and human oversight.
Revised Annex 11 – Computerised Systems (Draft Update)
Strengthens lifecycle management and data integrity expectations for computerised systems, including AI-enabled systems.
Revised Chapter 4 – Documentation (Draft Update)
Why it matters: Reinforces documentation and data governance requirements relevant to AI-enabled workflows.
Artificial Intelligence and Machine Learning (AI/ML) in Software as a Medical Device (SaMD)
Central index for FDA’s approach to AI/ML-enabled medical devices, including discussion papers, action plans and lifecycle expectations.
Proposed Regulatory Framework for Modifications to AI/ML-Based SaMD (2019 Discussion Paper)
Introduced the concept of a “Predetermined Change Control Plan” (PCCP) for adaptive AI systems. This is foundational to FDA’s lifecycle thinking.
AI/ML-Based SaMD Action Plan (2021)
Sets out FDA’s strategic direction for AI oversight, including GMLP, transparency, real-world performance monitoring and regulatory science.
https://www.fda.gov/media/145022/download
Marketing Submission Recommendations for a Predetermined Change Control Plan (PCCP) for AI-Enabled Device Software Functions
Provides specific expectations on how manufacturers can manage post-market learning and updates in AI systems.
Good Machine Learning Practice (GMLP) for Medical Device Development: Guiding Principles
Defines baseline expectations for dataset representativeness, separation of training/testing, performance evaluation and lifecycle control.
Transparency for Machine Learning-Enabled Medical Devices: Guiding Principles
Clarifies expectations around communicating AI limitations, intended use and performance to users.
About the Author
GMP Auditor
Chris Strong joined Arithmos in January 2024 as a GMP Auditor, planning and executing Good Practice audits for clients across multiple sectors, managing audit findings, and supporting quality system and business improvement initiatives.
Previously, he spent over six years as Quality Specialist at Dechra Pharmaceuticals, providing quality oversight across the contract manufacturing network, leading CMO audits, and supporting technical transfers, new product introductions, and remediation activities. Earlier roles include Quality Manager at Quality Context, where he managed GMP and ISO 9001 quality systems and delivered QMS consultancy and training, as well as positions at Church & Dwight UK, Reckitt Benckiser, and FUJIFILM Diosynth Biotechnologies.
With more than 20 years’ experience in the pharmaceutical and life sciences industries, Chris specialises in GMP compliance, contract manufacturing quality, and audit management. At Arithmos, he leads auditing and quality assurance services including site audits, risk assessments, batch record reviews, QMS improvements, and gap analysis.
About Arithmos
With deep expertise in the Life Science Industry, Arithmos supports companies in their digital transformation journey to achieve the best value from technology-enabled solutions and excellence in business operations.
Arithmos team share extensive knowledge of the full GxP regulated environment for both deliveries of services and technologies, and our domains range from Clinical Development, Quality & Compliance, Pharmacovigilance & Safety and, Regulatory Affairs.
