How risk-based assurance, AI governance and regulatory compliance are shaping the adoption of artificial intelligence in life sciences.
By Magdalena Sosinowska, Consultant, Digital Quality, ProductLife Group
On 26โ27 October 2026, pharmaceutical, biotechnology, quality, regulatory and technology professionals gathered in Krakรณw, Poland, for AI in Pharma 2026, organised by the ISPE Poland Affiliate and its GAMP Community of Practice, to explore how artificial intelligence is changing the way the life sciences industry operates.
The conference brought together perspectives from across drug discovery, clinical development, manufacturing, quality management and regulatory affairs, reflecting both the opportunities AI presents and the practical challenges of implementing it in regulated environments.
As a Main Sponsor, ProductLife Group (PLG) played an active role in the event, contributing expertise in Digital Quality, AI governance, GxP assurance and regulatory compliance through a presentation, a hands-on workshop and the closing panel discussion.
Presentation: Ross Wareing, Team Lead, Digital Quality, ProductLife Group presented โ๐๐๐จ, ๐ฎ๐ค๐ช ๐๐๐ฃ ๐ช๐จ๐ ๐ผ๐ ๐๐ฃ ๐ ๐๐ญ๐ ๐๐ฃ๐ซ๐๐ง๐ค๐ฃ๐ข๐๐ฃ๐ฉ: ๐๐๐ง๐โ๐จ ๐๐ค๐ฌโ, on AI readiness in GxP environments.
Workshop: Ross Wareing and Natalia Sammler led an interactive workshop on AI inspection readiness.
Closing panel: Magdalena Sosinowska moderated the panel โAccountability in the Age of Autonomous Systems: Who Signs Off When a Machine Makes the Decision?โ
These sessions built on PLGโs pre-conference webinar, โDeploying AI in the GxP Worldโ, available on demand here
One thing became particularly clear throughout the discussions: the conversation around AI is maturing.
While much of the industry previously focused on exploring AI's potential, attention is now shifting towards implementation. How can organisations move beyond successful pilots? What controls are needed when AI becomes part of regulated processes? How should organisations assess systems that can act autonomously or produce variable outputs? And how can they demonstrate that these systems remain fit for their intended purpose?
These questions are becoming increasingly relevant as AI moves from experimental initiatives into everyday pharmaceutical operations.
One of the most interesting aspects of the conference was the breadth of AI applications being explored and implemented across the pharmaceutical lifecycle.
From target identification and molecular design to clinical trial recruitment, manufacturing optimisation, automated visual inspection and quality operations, AI is increasingly being used to support processes that traditionally required considerable manual effort and specialist expertise.
These developments also reflect the industry's broader Pharma 4.0 ambitions, with AI becoming part of more connected digital environments involving laboratory systems, manufacturing platforms, quality management systems and enterprise applications.
However, as AI becomes more closely integrated with established business processes, the implications of its use become more significant.
An AI assistant summarising internal documentation presents a fundamentally different risk profile from a system supporting manufacturing decisions, assessing quality deviations or generating information used in regulatory submissions.
The distinction is important. Not every AI application requires the same level of assurance, and applying identical controls regardless of intended use can be both inefficient and ineffective.
For organisations operating in GxP environments, the starting point should be understanding the intended use of the system, the decisions it influences and the potential consequences of failure.
This provides the basis for determining proportionate controls and the evidence needed to demonstrate that the application is suitable for its intended purpose.
Agentic AI was one of the recurring topics at the conference, reflecting growing interest in systems capable of going beyond content generation and individual responses.
Unlike traditional generative AI applications, agentic systems can plan activities, retrieve information, interact with other applications and execute multi-step workflows with varying degrees of autonomy.
These capabilities offer considerable opportunities to improve efficiency and automate complex activities. They also introduce challenges that organisations need to understand before integrating such systems into regulated processes.
When an AI system moves from providing information to taking action, questions around accountability, human oversight, access management and traceability become much more important.
What decisions can a system make independently? Which actions require human approval? How do we establish that the system is operating within its defined boundaries? And who is accountable when an autonomous system produces an incorrect outcome?
These were also the questions at the heart of the conferenceโs closing panel, moderated by PLG. These questions extend beyond technology and into organisational governance, quality management and regulatory responsibility.
Regardless of how much autonomy a system is given, accountability for its use and outcomes remains with the organisation deploying it.
This means that responsibilities, decision-making authority, oversight mechanisms and appropriate controls need to be clearly established.
For regulated organisations, governance cannot be something added once a system has already been deployed. It needs to form part of the design, implementation and ongoing management of AI-enabled processes.
The growing use of AI presents an important opportunity for Digital Quality functions to take a more active role in technology adoption.
The pharmaceutical industry already has established principles for risk management, computerised system validation, supplier oversight, data integrity, change control and lifecycle management.
These principles remain relevant. However, the way they are applied needs to reflect the characteristics of AI-enabled systems.
Traditional Computerised System Validation (CSV) approaches were largely developed around systems with defined functionality and relatively predictable behaviour. AI introduces additional considerations, particularly where outputs may vary, performance depends on the quality and representativeness of data, or system behaviour can change over time.
As a result, assurance activities may need to consider not only whether a system performs its intended functions, but also the reliability of its outputs, the limitations of the model, the effectiveness of human oversight and the controls required throughout its operational lifecycle.
This does not necessarily mean creating entirely new validation frameworks.
Existing approaches, including Computer Software Assurance (CSA) and established GxP risk-management principles, provide a foundation for determining the appropriate level of assurance.
The challenge is adapting these approaches to the technology, its intended use and the risks associated with the decisions it supports.
Digital Quality teams are well positioned to contribute to this process. Their experience in risk assessment, validation, data integrity, supplier management and lifecycle control provides much of the expertise needed to support AI implementation.
Involving these functions early also allows potential compliance and quality challenges to be addressed during design rather than becoming obstacles later in the project.
The objective is not to introduce controls simply because a system uses AI, but to establish sufficient confidence that the system can perform its intended purpose within an acceptable level of risk.
In his presentation, Ross Wareing, [Job title] at ProductLife Group, addressed these challenges through a practical approach to AI governance, GxP controls and risk-based assurance.
A central consideration was how organisations can evaluate AI use cases consistently while recognising the significant differences between technologies, applications and levels of autonomy.
Rather than beginning with the question of whether AI can be used in a regulated process, the approach focuses on understanding the specific use case, identifying its risks and determining which controls and assurance activities are necessary.
An important distinction is the difference between AI autonomy and AI complexity.
A system that generates information for human review does not present the same governance challenges as one capable of executing actions without mandatory human intervention.
Similarly, a deterministic, rules-based solution may require a different assurance strategy from a generative or agentic AI application that produces variable outputs, interacts with external tools or executes multi-step workflows.
These characteristics need to be considered alongside the intended use and GxP impact of the application.
The framework presented by PLG brings these considerations together through a structured assessment of business value, context of use, GxP relevance, data criticality, autonomy, complexity, existing controls, assurance requirements and lifecycle monitoring.
It also considers whether the residual risk remains acceptable within the organisation's defined risk and compliance framework.
This provides a practical basis for deciding which AI use cases can be implemented, what additional safeguards may be necessary and what evidence is required to support their intended use.
This approach becomes particularly important as AI functionality is increasingly introduced through existing enterprise platforms and Software-as-a-Service (SaaS) solutions.
Quality Management Systems (QMS), document management platforms, ERP solutions, validation tools and analytics applications are all beginning to incorporate AI-enabled capabilities.
These developments can create substantial opportunities for efficiency, but they also introduce a practical governance challenge.
An organisation may already have an established validation and change-control framework for a particular system, yet the introduction of AI functionality can change how that system operates, what information it generates or which decisions it influences.
The fact that AI is embedded within an existing application does not automatically mean that its risks are already understood or adequately controlled.
Organisations therefore need mechanisms to identify where AI is being used, assess its intended purpose, understand its potential impact and determine whether existing controls remain appropriate.
Maintaining visibility of AI-enabled capabilities through inventories, use-case assessments and defined governance processes becomes an important part of managing this risk.
It also supports more consistent decision-making across the organisation, particularly when AI functionality is introduced by multiple suppliers or adopted independently by different business functions.
For PLG, this approach aligns closely with its expertise in Digital Quality & Compliance, Computerised System Validation, Computer Software Assurance, Data Integrity, Quality Management Systems and regulatory compliance.
The aim is to apply established quality and regulatory principles in a way that supports the practical adoption of emerging technologies without losing control over GxP-relevant processes.
Another important theme emerging from AI in Pharma 2026 was the challenge of moving beyond isolated proofs of concept.
Demonstrating that an AI solution works in a controlled pilot is one thing. Integrating it into an established pharmaceutical organisation, with existing processes, quality systems, infrastructure and regulatory responsibilities, is considerably more complex.
Successful implementation depends on much more than the capabilities of an individual model.
Organisations need appropriate data management, clearly defined ownership, suitable technical infrastructure, effective governance and people who understand both the potential and the limitations of the technology.
It also requires collaboration across functions that have traditionally approached technology from different perspectives.
IT and Data Science teams bring technical expertise, while Quality, Regulatory Affairs and business process owners contribute an understanding of operational requirements, regulatory expectations and the consequences of failure.
Bringing these perspectives together early helps ensure that AI solutions are not only technically capable, but also appropriate for the environment in which they will operate.
Equally important is recognising that AI assurance is not necessarily a one-off activity completed before deployment.
Depending on the application, ongoing monitoring, change management, periodic evaluation and reassessment of risk may be required to maintain confidence in system performance over time.
Governance, when implemented effectively, should therefore support the sustainable adoption of AI rather than become an additional administrative burden.
AI in Pharma 2026 highlighted the progress being made across the life sciences industry, but also the work that remains to translate technological capability into sustainable operational value.
As AI becomes more capable, interconnected and autonomous, organisations will need to understand not only what these systems can do, but also how their use can be appropriately controlled.
This is particularly relevant in regulated environments, where the consequences of incorrect decisions may extend beyond operational efficiency to product quality, patient safety and data integrity.
For PLG, the conference provided an opportunity to share practical approaches to these challenges, exchange perspectives with industry professionals and contribute to the ongoing discussion around the role of Digital Quality in AI adoption.
It also reinforced the importance of bringing together technical, quality and regulatory expertise when designing and implementing AI-enabled solutions.
The industry's next challenge is not simply to deploy more AI. It is to integrate AI into established processes in a way that is proportionate to risk, supported by appropriate evidence and sustainable throughout the system lifecycle.
Ultimately, successful AI adoption will depend not only on what the technology is capable of, but on how well organisations understand, govern and control its use.
PLGโs Digital Quality & Compliance experts support life sciences organisations in assessing AI use cases, defining proportionate governance and assurance strategies, and preparing for regulatory inspection of AI-enabled processes.