What Is the Role of AI in Regulatory Submissions in Pharma?
A regulatory submission compresses years of clinical work into a large dossier. Regulatory submissions are also an active area of enterprise AI experimentation in pharma. Large pharmaceutical companies are already piloting AI-assisted drafting for filings to agencies such as the FDA. The FDA, meanwhile, has run its own AI assistant, Elsa, agency-wide since June 2025. Human oversight remains. The agency has built that oversight into Elsa as it expands what the tool can do.
AI can draft submission documents. CIOs and heads of AI at pharmaceutical companies must determine whether the output can survive a GxP audit. GxP refers to the good-practice regulations governing laboratory, clinical, and manufacturing records. The controls around the model matter more than the model itself.
Where AI Cuts Time in Pharma Regulatory Submissions
Documented pilots show gains in document authoring and dossier assembly, they have also helped with health authority correspondence. These are three of the most labor-intensive stages of a filing, where delay eats into the review clock. Major drugmakers are already deploying AI in these areas. CIOs should prioritize the filing area with the most repeatable volume in the filing calendar. Volume sets priority. Recurring work often pays off faster because teams can reuse the same validated controls across filings.
Regulatory document authoring now includes clinical study reports, patient narratives, electronic Common Technical Document (eCTD) documentation, and Quality Overall Summaries. These summaries consolidate key quality information. Large pharmaceutical companies have been piloting generative AI for regulatory filings. They have identified submission packages as a recurring bottleneck.
Assembly and publishing automation runs deeper than drafting. A generics firm trained an agent to populate country-specific templates with data from internal systems. The agent also assembled the required PDFs and packaged them for eCTD submission. The Module 1 pilot covered the country-specific administrative portion of that assembly. It cut cycle time by 35% to 45% and reduced rework from administrative errors by 30%. Those rework cycles had been consuming over 30% of the team's time.
Health authority queries are a third target. Each EMA clock stop pauses the review clock while an applicant responds to questions. Each FDA information request inside the review cycle creates similar time pressure. Teams must draft technical responses quickly. Generative tools grounded in prior submissions can produce first drafts of those responses. Some regulatory teams are also exploring AI-assisted query preparation to reduce back-and-forth with regulators.
The gains aren't automatic. A December 2024 DIA Global Forum article reported that the expectation that generative AI would reduce human input and produce better submissions faster has not yet materialized. Agentic AI still sits primarily in pilot phases across most sectors. A 2025 industry survey reflects that pattern.
What FDA and EMA Say About AI in Submissions
Regulators have drawn the line around what the AI produces. FDA's January 2025 draft guidance, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products, proposes a risk-based credibility framework. The framework applies to AI models that produce data supporting decisions on safety, effectiveness, or quality.
It explicitly excludes drug discovery, operational efficiencies, and the mechanics of drafting submissions. The comment period has closed. It remains a draft, with finalization pending.
The draft guidance excludes AI used only to draft a submission. That exclusion applies when the use does not affect patient safety, drug quality, or the reliability of study results. An AI model falls within its scope when it produces clinical or quality data supporting regulatory decisions. EMA drew a parallel line in its finalized AI reflection paper. It advises developers to seek early regulatory support when an AI system may affect a medicine's benefit-risk balance.
In January 2026, FDA and EMA jointly published 10 guiding principles. They center on a human-centric, risk-based approach with strong data governance and transparent model development.
FDA also runs AI on its own side of the desk. It launched Elsa agency-wide. By May 2026, Elsa 4.0 and HALO, another FDA system, were part of the unified platform. The two systems had consolidated more than 40 disparate FDA application and submission data sources, systems, and portals into a single platform. FDA Chief AI Officer Jeremy Walsh said staff previously had to bring data to Elsa, whereas Elsa can now access FDA data directly.
FDA's rollout reinforces human review in regulated workflows. Strict containment and clear governance support that review. Sponsors should prepare for FDA systems to summarize and cross-check a dossier before a human reviewer completes the assessment.
Build Deterministic Controls Around Probabilistic AI in GxP
Traditional GxP validation methods work most directly with deterministic behavior. With that behavior, identical inputs produce identical outputs. Probabilistic components require a different control approach. Teams must define bounded intended uses, performance criteria, change control, and human review. These controls help keep variable model output from becoming an uncontrolled GxP record.
Large language models (LLMs) don't behave deterministically. Temperature settings and stochastic sampling mean the same prompt can return different answers. Model retraining or infrastructure updates may also change reproducibility.
Risk sets the limit. The draft of EU good manufacturing practice (GMP) Annex 22 takes a cautious position on using AI for active, critical GMP decisions. It indicates that generative AI and LLMs are not suitable for such uses, while appropriately validated static, deterministic approaches may be suitable. The draft appeared in a 2025 public consultation. It excludes continuously learning models from critical GxP processes and proposes mandatory explainability for AI models. These remain draft consultation positions. The restrictions that apply depend on intended use and risk.
GAMP 5 Second Edition (2022) is a risk-based framework for validating computerized systems. It treats AI/ML as a subsystem within a larger computerized system. GAMP 5 Second Edition and the draft frameworks support a pattern that puts probabilistic AI inside deterministic workflows. A deterministic workflow layer sequences the process and limits what each agent can see and produce. It then routes outputs through human-in-the-loop review before anything becomes a controlled record.
Retrieval-augmented generation (RAG) grounds drafts in validated sources with verifiable citations. Grounding narrows the risk without removing it. Even with validated sources and verifiable citations, review remains necessary. Human reviewers remain the control that catches unsupported output.
The audit trail extends accordingly. Under 21 CFR Part 11, the FDA requires secure, computer-generated, time-stamped audit trails for electronic records. Keep a provenance record for each AI run. The provenance record should identify the model and its version. It should also preserve the input prompt and retrieval context. Retain the raw AI output together with the reviewer's action. The final committed record also belongs in the audit trail.
The validation burden focuses on finite guardrail controls, rather than every possible AI output. Teams can test and govern those controls against the system's intended use.
Keep Submission Data Inside Approved Environments
A submission dossier is among the most confidential material a pharmaceutical company produces. Regulation 21 CFR § 314.430 protects drug application data, including manufacturing methods and quality control procedures, from public disclosure. Pasting any of it into an uncontrolled consumer AI tool creates legal and competitive exposure.
Require vendors to commit contractually that they will not use customer data, prompts, inputs, or outputs to train or improve models. Contract terms give the company a basis to enforce the restriction, subject to those terms. For regulated deployments, put that commitment in the master services agreement (MSA) rather than relying on a configurable dashboard setting. The contractual obligation remains if a vendor later changes its dashboard defaults.
Enterprises should also evaluate where AI processing occurs. That review should cover where queries execute and where models run inference. Location matters. Reviewing processing locations helps prevent regulated content from crossing unapproved regional or vendor boundaries.
FDA made an equivalent commitment for its own tool. The models do not train on data submitted by regulated industry, and Elsa runs inside GovCloud, a high-security government cloud environment.
Run AI inside the company's controlled cloud environment to support these requirements. Submission content can remain in the tenant that already holds it under existing validated controls. The quality organization can use its existing, qualified controls for residency, retention, and access.
Sanofi illustrates the pattern in practice. The company runs AI directly against its own data lake, and the same Snowflake-based foundation now powers its research teams as they process real-world clinical data at scale to accelerate the analysis behind drug development decisions, reported by Fortune.
Teams must still validate the configuration, access rules, retention settings, and change controls. Without configuration validation, an approved architecture can still expose data through a permissive setting. Regulatory teams can then use AI to draft and translate content while checking it for consistency, without transferring submission content into an uncontrolled consumer tool.
How Elementum Governs AI
A sponsor building toward GxP use faces the same question FDA answered for its own review-side AI: which controls make probabilistic output defensible to an auditor. Control comes first. The relevant controls include deterministic sequencing, scoped agents, human review before commit, and a complete audit trail.
Elementum’s AI-native enterprise application platform uses this pattern. A deterministic Workflow Engine sequences every step and applies the same governed controls each time. It calls AI agents only where reasoning is required. Our AI Agents give compliance teams configurable decision thresholds and human-in-the-loop checkpoints. We log every agent action and let authorized reviewers revoke it. The record shows which agent was invoked, which workflow ran, and what result it produced. This describes the governance pattern itself, not a delivered submissions implementation. Submission-specific validation against GAMP 5, Part 11, and the sponsor's own intended-use risk assessment stays with the sponsor's quality organization.
Everything runs inside your own cloud data platform tenant under a Zero Persistence architecture. Nothing remains at the execution layer between runs. Your data is always yours.
Contact us to map the replacement path into your architecture and the rest of your AI roadmap.
Frequently Asked Questions About AI in Regulatory Submissions in Pharma
These are the questions pharma regulatory and IT leaders most often raise when evaluating AI for submissions work. The answers depend primarily on the AI system's intended use and its effect on regulated records or decisions.
Can You Include AI-Generated Content in an FDA Drug Submission?
You may include AI-generated material, but the requirements depend on its intended use. The current FDA draft guidance covers AI used to produce data supporting regulatory decisions on safety, effectiveness, or quality. It excludes AI used only for drafting text. That exclusion applies when the use does not affect patient safety, drug quality, or the reliability of study results. You remain responsible for the dossier and for showing the credibility of any AI-generated data that supports a regulatory decision.
Do You Have to Disclose AI Use to the FDA?
No blanket mandate appears in the current draft guidance. FDA asks sponsors to discuss whether, when, and where to submit a credibility assessment report. The report addresses the credibility of AI-generated data used to support a regulatory decision. You may file it with the submission or hold it available for inspection. Early pre-submission engagement with the agency is the recommended path. It reduces the risk of preparing the wrong credibility evidence.
How Do You Validate AI Tools for GxP Use?
You validate AI tools for GxP use primarily through GAMP 5 Second Edition, including its Appendix D11 on AI/ML. Validation follows risk and should address intended use, model behavior, change control, performance monitoring, human oversight, and traceability. High-risk applications need stringent guardrails and mandatory human review. Mandatory review helps stop high-risk output from entering the controlled record without expert approval. Under 21 CFR Part 11, ALCOA+ data integrity requirements also apply when AI output becomes a GxP record. ALCOA+ calls for records that are attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available.
Will AI Replace Your Regulatory Affairs Team?
AI augments regulatory affairs professionals rather than replacing them. Human oversight remains central to FDA and EMA frameworks. Your team's role therefore shifts away from manual document searches and formatting toward regulatory strategy and expert review of AI-drafted output.
Keep Reading
AI Governance Best Practices: A Framework for Enterprise CIOs
AI Governance Framework: A Guide for Organizations
16 AI Governance Terms Every Enterprise Leader Should Know
AI Governance Tools: How Enterprises Monitor and Control AI at Scale
AI Governance Platform: A Buyer's Guide for Enterprise Leaders
AI Governance Explained: Frameworks and Compliance Tips