Efpia on AI Across the Medicines Lifecycle: Governance, GxP and Regulatory Policy Insights

EFPIA’s “AI Across the Medicines Lifecycle” report maps how companies already govern artificial intelligence from discovery through post-authorisation, arguing that many uses can sit inside existing GxP and medicines frameworks when controls are risk-based and context-specific.

Key Takeaways

• EFPIA frames AI governance as a five-stage management system from planning through ongoing monitoring.
• Early findings from industry case studies suggest many AI uses are already covered by GxP-style controls plus AI-specific validation.
• Cross-functional oversight (legal, regulatory, quality, data science, bioethics) should vet use cases against GDPR, EU AI Act criteria, and emerging EMA guidance.
• Policy asks include clearer GxP interpretation for AI, EMA risk examples, and globally aligned, non-duplicative oversight.

What does EFPIA mean by AI governance across the lifecycle?

EFPIA defines an AI governance model as a stage-based system that specifies who does what, when, and with what evidence across planning and design; data collection and processing; model development and validation; deployment and use; and ongoing monitoring and risk mitigation.

The full PDF is published at EFPIA: AI Across the Medicines Lifecycle, with a summary post on EFPIA’s news page.

How do companies operationalise controls in early stages?

At planning and design, companies establish cross-functional structures spanning legal, regulatory, medical, bioethics, data science, quality, and compliance. Use cases are vetted against EU AI Act criteria, GDPR, GxP practice, and emerging EMA guidance so high-risk systems are flagged early.

Documentation of key decisions is treated as part of regulatory readiness, not optional process theater.

Where do GxP and computerised-system expectations still apply?

EFPIA’s related manufacturing position paper stresses data integrity (ALCOA-style), risk management tied to autonomy and intended use, and computerised system validation with procedures to keep AI/ML applications in a validated state.

See EFPIA’s GMP/manufacturing AI position paper (Sept 2024) for how Annex 11 / GAMP-style thinking is applied without reinventing basic validation principles.

• Data integrity and audit trails for training and operational data
• Risk assessment scaled to patient and product impact
• CSV lifecycle controls with periodic review/retesting

What policy asks does EFPIA put to EMA and peer regulators?

EFPIA wants existing medicines frameworks leveraged for AI tools, EMA as the primary oversight body for AI in medicines development, clearer examples of risk-based assessment by context of use, and globally aligned approaches that balance transparency with protection of innovation.

Those themes also appear in EFPIA’s broader position PDF on artificial intelligence in the medicinal product lifecycle.

What remains unproven after the case studies?

The report presents preliminary industry case studies, not a binding EMA guideline or a quantitative performance benchmark across companies. It does not claim that every AI use is GxP-ready, nor that the EU AI Act never applies; context of use still drives classification and residual controls.

Related NovaPharma coverage

• ICH Technology Platform Report
• CHMP backs nerandomilast for IPF and PPF in EU
• NovaPharma data sources

How should quality and regulatory teams apply the five stages?

In planning and design, teams should define intended use, patient and product impact, and whether the tool influences a GxP decision. During data collection and processing, ALCOA-aligned data integrity, provenance, and access controls matter as much as model architecture. Model development and validation should produce acceptance criteria, performance metrics, and change-control plans before deployment.

Deployment and use require monitored environments, role-based access, and clear human oversight boundaries. Ongoing monitoring should detect drift, unexpected outputs, and security incidents, with predefined escalation to quality and pharmacovigilance when patient safety could be affected. EFPIA case studies show companies already combining these steps with existing SOPs rather than inventing parallel AI-only quality systems.

For manufacturing environments, EFPIA September 2024 position paper reinforces that autonomy level and intended use drive the depth of validation. A supervised analytics dashboard used by qualified persons differs from an autonomous process-control agent. Both still need risk assessments, but the evidence packages differ. That distinction helps avoid under-control of high-impact AI or over-validation of low-impact tools.

Policy teams should also track EMA reflection paper on AI in the medicines lifecycle alongside the EU AI Act. EFPIA argues medicines R&D oversight should remain with EMA using risk-based medicines law, while still screening use cases against AI Act criteria early. Documenting that screening decision is itself part of governance evidence for inspectors and partners.

Frequently Asked Questions

What governance model does EFPIA describe for AI?

EFPIA describes a stage-based AI governance model covering planning and design; data collection and processing; model development and validation; deployment and use; and ongoing monitoring and risk mitigation, proportionate to inherent risk and context of use.

Can existing GxP frameworks govern many AI uses?

EFPIA’s case-study report argues many AI uses in the medicines lifecycle are already sufficiently governed under existing frameworks such as GxP, with AI-specific controls and validations layered on where needed.

What policy clarity does EFPIA request from regulators?

EFPIA asks for clearer interpretation of GxP expectations for AI tools, EMA risk-based oversight examples across use cases, and globally aligned approaches that avoid duplicative regimes while protecting patients and innovation.

Primary Sources

1. EFPIA PDF: AI Across the Medicines Lifecycle
2. EFPIA news summary of the report
3. EFPIA: AI in a GMP/manufacturing environment