Regulators are starting to use the same class of AI they are asking industry to govern. The FDA, for example, states that it uses AI to support work including identifying inspection priorities. If so, the limiting factor in an inspection shifts from the inspector's capacity to find records to your ability to explain them. Undocumented AI use is exactly the kind of gap that pattern analysis surfaces.
What has changed?
Historically an inspection was limited by how much one person could locate and cross reference in the time available. Inspectors sampled documents and systems, and gaps in documentation could go unexamined simply because nobody got to them. That limit is loosening. Regulators are adopting AI tools for their own work, and the same tools make it easier to process submissions and inspection data at scale.
What can be said accurately
The FDA launched an agency wide generative AI assistant called Elsa in June 2025, and states that it is used for tasks including supporting scientific reviews, summarising adverse events, comparing labels and helping identify high priority inspection targets. It is accurate to say that the FDA says it uses AI to support inspection targeting. It is not accurate, on the public record, to say that these tools conduct autonomous inspections or determine findings. We try to stay inside that line, and we suggest you do too.
The European Medicines Agency has also set out its thinking, including a reflection paper on AI across the medicines lifecycle, and the EMA and FDA have published shared principles for good AI practice in drug development. The direction of travel is consistent on both sides.
What it means for readiness
Preparing for an inspection used to mean assembling binders and locating evidence. With a better equipped regulator, quality of data, traceability, audit trails and system ownership become more exposed, not less. Preparation means being able to explain and defend every output your AI has produced: what it was asked, what it relied on, who reviewed it and what they decided.
Two situations are especially exposed. The first is AI use that nobody has recorded, such as staff using general purpose assistants, or features switched on by default inside software you already own. The second is AI use that is recorded but has no stated intended use, no owner and no evidence of testing.
A practical readiness list
- Know where AI is used, including embedded and supplier AI.
- Have a written intended use and a named owner for each use.
- Be able to show the evidence that each use is fit for that purpose.
- Keep a record of outputs, refusals and decisions that you can search and reconstruct.
- Rehearse the conversation. Ask a colleague to play the inspector and see whether the answers come quickly.
This is a forward looking interpretation. Regulators do not inspect this way everywhere today, and the pace varies between agencies. The preparation is worth doing either way, because it is what good governance looks like on any day.
Frequently asked questions
Will an AI inspect my site?
There is no public evidence that regulators use AI to carry out inspections autonomously. There is public evidence that agencies use AI to support their work, including identifying priorities, which makes your records easier to examine at scale.
What should we have ready for an inspector asking about AI?
An inventory of AI use, a written intended use and owner for each use, evidence that each is fit for purpose, and a record of outputs and decisions that can be reconstructed on request.
Does this apply to the MHRA or EMA as well as the FDA?
The FDA has been the most explicit about its own use of AI. The EMA has published its approach to AI across the medicines lifecycle. Whatever the regulator, the underlying expectations of traceability, ownership and evidence are the same.
Sources and further reading
- EMA: Reflection paper on the use of artificial intelligence in the medicinal product lifecycle (PDF)
- European Commission: consultation on draft Annex 22 (Artificial Intelligence), revised Annex 11 and Chapter 4
- ICH quality guidelines, including Q9(R1) Quality Risk Management
This article is general information, not legal or regulatory advice. Regulatory texts change, and some discussed here are drafts: check the current official text before relying on any detail.
