FDA launched its internal AI system "Elsa" in June 2025, which analyzes adverse event reports, compliance data, 483 observations, and historical inspection outcomes to prioritize high-risk facilities for inspection. The regulator itself is using AI — the regulated must follow.
Over-reliance on AI without human expert review — AI generates fictitious guidances and references (hallucinations documented by PDA practitioners) — and shadow use of LLMs by analysts without governance — specifically addressed by FDA/EMA 2026 guidance — are the dominant risk patterns.
Uses LLMs and NLP to continuously monitor, interpret, and assess the impact of regulatory changes across jurisdictions. Capabilities include automated scanning of agency websites and guidance updates, instant summarization of lengthy regulatory documents, version comparison (draft versus final), gap analysis against current compliance status, impact assessment for specific products/markets, multilingual support preserving legal nuance, and natural-language Q&A.
Regulatory milestones for AI itself. In January 2025, FDA issued its first comprehensive AI guidance proposing a 7-step risk-based credibility assessment framework for AI supporting regulatory decisions. In January 2026, FDA and EMA jointly released "Guiding Principles of Good AI Practice in Drug Development," addressing "shadow use" of LLMs and mandating continuous monitoring for "data drift." In December 2025, 26 organizations signed the EU AI Act's voluntary Code of Practice (including Amazon, Anthropic, Google, IBM, Microsoft, OpenAI; Meta refused).
Regulatory intelligence platforms (Clarivate Cortellis, Regology, Compliance.ai/Archer), LLM-powered document comparison tools, RAG-based regulatory Q&A systems, automated task assignment and change management integrations.
FDA AI Guidance (January 2025 — 7-step risk-based credibility assessment framework), FDA/EMA "Guiding Principles of Good AI Practice in Drug Development" (January 2026), EU AI Act voluntary Code of Practice (December 2025), ICH Q10 (change control integration), ISO 9001:2015 Clause 9.3 (management review inputs).
Version-controlled creation, approval, distribution, and retirement of SOPs with immutable audit trail, electronic signatures, and access controls.
Regulatory intelligence outputs feed change control and must integrate with the document control system.
Managing product/process change lifecycle through impact assessment, Change Control Board review, and regulatory filing category routing (SUPAC.
Regulatory changes identified by intelligence platform must be routed through change control.
Nothing downstream yet.