AI in Regulatory Submissions: What FDA and EMA Now Expect from Sponsors

Back to Knowledge Hub

The FDA's January 2025 draft guidance and the EMA's September 2024 reflection paper have established the first substantive regulatory frameworks governing AI use in drug development submissions. Both agencies adopt risk-based approaches, but the FDA centers its framework on model credibility while the EMA frames expectations more broadly around validation, governance, and lifecycle oversight — differences with real practical implications for sponsors filing on both sides of the Atlantic.

AI is no longer a peripheral tool in pharmaceutical development. It informs target identification, shapes clinical trial design, processes pharmacovigilance data, and increasingly generates outputs that flow directly into regulatory submissions. What had been missing was a clear, consolidated regulatory position on how agencies expect sponsors to handle, document, and substantiate those AI-generated inputs. That gap has begun to close: in January 2025 the FDA published its first dedicated draft guidance on AI in drug and biologics development, and eight months earlier the EMA had adopted its own reflection paper covering AI across the full medicinal product lifecycle. Together, these documents establish the earliest substantive regulatory framework on this question — with important differences that sponsors operating across both jurisdictions must understand.

Why Regulatory Clarity on AI Submissions Has Been Slow to Arrive

For much of the past decade, AI use in pharmaceutical development sat in a regulatory grey zone. Sponsors submitted AI-informed analyses without any agreed standard for documenting the models or demonstrating their fitness for purpose. The FDA's Center for Drug Evaluation and Research (CDER) has reported receiving several hundred submissions containing AI components between 2016 and 2023, across therapeutic areas including oncology, neurology, and gastroenterology.¹ An independent peer-reviewed landscape analysis of FDA submissions from 2016 to 2021 similarly identified oncology, psychiatry, gastroenterology, and neurology as the most represented therapeutic areas.² Yet until 2025, no dedicated FDA guidance defined specific evidentiary expectations for AI-generated regulatory outputs, notwithstanding earlier discussion papers and workshop reports.

The lag reflects genuine complexity. AI systems in drug development span a wide range — from generative chemistry platforms used in discovery to machine-learning models in adaptive trial designs, from NLP tools used in safety narrative automation to deep learning systems analysing imaging data for efficacy endpoints. A single regulatory standard across all of these must be flexible enough for diverse use cases yet specific enough to be operationally meaningful. Both the FDA and EMA have responded with risk-stratified approaches, arrived at through different institutional processes and with different emphases.

The FDA's January 2025 Draft Guidance: A Risk-Based Credibility Framework

The FDA's draft guidance, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products (January 2025, docket FDA-2024-D-4689), is the agency's first guidance document specifically addressing AI in drug and biological product development for human and animal use. The public comment period closed in April 2025, and the guidance remains in draft form as of this writing; a final version is anticipated, and sponsors should monitor the agency's docket for updates.

The guidance is explicitly scoped to AI uses that generate data or information intended to support regulatory decision-making regarding the safety, effectiveness, or quality of a product. It does not cover AI used purely in internal operations, administrative processes, or discovery activities that do not feed into regulatory submissions.³

The central organising concept is the context of use (COU) — the specific role an AI model is intended to perform within a defined regulatory context. There is no universal standard of evidence for AI credibility; the level and nature of evidence required is calibrated to the risk that a model's failure would pose to the regulatory decision it supports.

The guidance proposes a structured, seven-step risk-based process for establishing AI model credibility:

• Define the question of interest to be addressed by the AI model
• Define the context of use (COU) for the AI model
• Assess the risk that AI model failure would present to the regulatory decision
• Develop a plan — the credibility assessment plan — to establish the credibility of the AI model output within the COU
• Execute the credibility assessment plan
• Document the results in a credibility assessment report and address any deviations from the plan
• Determine the adequacy of the AI model for the COU

The risk assessment is two-dimensional: it considers both the influence of the AI model's output on a regulatory decision and the consequences of model failure in that context. A model used for adverse-event risk categorisation in an ongoing trial carries a very different credibility burden than one used for an internal exploratory analysis. The guidance illustrates this with a worked example on patient risk stratification for a drug with a narrow therapeutic window, where misclassification could have direct patient safety consequences.

The guidance also encourages early engagement with the FDA: sponsors are encouraged to contact the agency before finalising their credibility assessment plans, to align expectations and identify issues early. It further addresses post-deployment monitoring, recognising that model performance may shift over time and that ongoing assessment is part of responsible AI governance in a regulatory context.

A January 2026 Update: Joint FDA-EMA Guiding Principles

On 14 January 2026, the FDA and EMA jointly released Guiding Principles of Good AI Practice in Drug Development⁴ — ten high-level principles spanning the medicinal product lifecycle, covering human-centric design, risk-based oversight, clear definition of context of use, data governance and documentation, and lifecycle management. The principles are non-binding and do not replace either agency's own guidance, but they signal a degree of transatlantic coordination on AI that did not previously exist, and sponsors developing AI tools for global submissions should read them alongside the agency-specific frameworks below.

The EMA's September 2024 Reflection Paper: Lifecycle Scope and Dual Risk Dimensions

The EMA's Reflection Paper on the Use of Artificial Intelligence (AI) in the Medicinal Product Lifecycle (EMA/CHMP/CVMP/83833/2023, adopted September 2024) takes a different structural approach. Where the FDA guidance is scoped narrowly to AI supporting specific regulatory decisions, the EMA's paper addresses AI across the full medicinal product lifecycle — from discovery through non-clinical and clinical development, manufacturing, and post-authorisation pharmacovigilance.

Its regulatory status is worth noting: a reflection paper represents the EMA's current thinking rather than a binding guideline adopted under the CHMP procedure. It nonetheless carries significant practical weight and informs how CHMP assessors evaluate submissions.

The EMA's risk classification introduces two dimensions that interact to determine the level of scrutiny required:

• Patient risk: whether the AI system affects patient safety directly
• Regulatory impact: whether the AI output has a substantial bearing on regulatory decision-making

A system may be high on one dimension and low on the other, and the paper sets out that the overall approach to validation, documentation, and governance should reflect the combination.⁵

The reflection paper explicitly names the clinical trial sponsor, marketing authorisation applicant, marketing authorisation holder, and manufacturer as parties responsible for ensuring AI systems are fit for purpose and compliant with applicable standards. This assignment of responsibility across the development and post-authorisation chain signals that accountability for AI governance extends beyond the MAH at the point of submission.

The EMA paper also emphasises transparency and human oversight as organising principles, reflecting both the scientific requirements of regulatory assessment and the ethical framework of the EU AI Act (Regulation (EU) 2024/1689), which entered into force in August 2024.⁶ It states explicitly that it should be read alongside the AI Act and other overarching EU legislation, including GDPR and the Cybersecurity Act.

The EU AI Act is sector-agnostic and applies a four-tier risk classification (unacceptable, high, limited, and minimal risk). AI systems that are themselves, or are safety components of, products covered by Annex I sectoral legislation (such as medical devices) are classified as high-risk under Article 6(1) — but conditionally, not automatically: it applies specifically where the product must undergo third-party conformity assessment under that legislation. The Act's original 2024 text set two high-risk compliance dates: 2 August 2026 for stand-alone Annex III systems (e.g. recruitment, credit scoring, education) and 2 August 2027 for Annex I systems embedded in already-regulated products, including AI-enabled medical devices. The EU's Digital Omnibus on AI — politically agreed 7 May 2026, formally adopted by Parliament (16 June 2026) and Council (29 June 2026), and published in the Official Journal as Regulation (EU) 2026/1744 on 24 July 2026, entering into force on 27 July 2026 — has pushed both dates further out, to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).⁷ These later dates are now binding law rather than a political agreement, and sponsors developing AI-enabled medical devices should plan against them accordingly. For AI used in drug development rather than as a regulated device, the precise scope of the Act remains an active area of regulatory interpretation, with the European Commission due to publish detailed classification guidance; sponsors should treat this as unsettled rather than finalised.

Where FDA and EMA Converge — and Where They Diverge

Both agencies share a foundational commitment to risk-proportionate oversight: neither requires the same level of documentation and validation for all AI uses, and both recognise that a low-stakes exploratory model does not warrant the same credibility package as one whose output directly determines a regulatory outcome. Both also support early scientific interaction between sponsors and regulators — though the FDA states this more explicitly as an active encouragement, while the EMA points sponsors toward existing Scientific Advice and Innovation Task Force channels rather than a standalone principle.

The divergences are meaningful, however:

• Scope. The FDA's guidance is narrowly framed around AI supporting specific regulatory decisions on safety, effectiveness, or quality. The EMA's reflection paper spans the entire lifecycle, including drug discovery — with direct implications for how sponsors frame AI disclosure and documentation depending on jurisdiction.
• Structural approach. The FDA's guidance is built around a defined multi-step credibility assessment process with an explicit plan and report. The EMA's paper states principles without a mandatory step-by-step process, meaning sponsors operating under EMA oversight should engage early through Scientific Advice or the Innovation Task Force.
• Regulatory context. The EMA's framework is embedded within the broader EU architecture — the AI Act, GDPR, the Cybersecurity Act, and GxP requirements — creating a multi-layer compliance environment with no direct US equivalent.
• Status. The FDA document remains a draft at the time of writing; the EMA reflection paper is adopted but is a principles document, not a binding guideline. The January 2026 joint principles add cross-agency alignment but do not resolve either document's open status — sponsors should actively monitor both agencies.

Practical Implications for Sponsors

• Documentation should begin at model development, not at submission. Both frameworks imply, without stating it as an explicit requirement, that credibility evidence is best generated alongside model development rather than reconstructed retrospectively at filing.
• Context of use definition is the starting point. Sponsors should define, at the outset of each AI application, what regulatory question the model addresses, in which patient population, at which development stage, and with what consequences if it underperforms.
• Early regulatory engagement is encouraged by both agencies. The FDA explicitly encourages pre-submission contact; the EMA's Innovation Task Force and Scientific Advice Working Party are the natural channels for methodological questions.
• GxP alignment is not optional under the EMA framework. Where AI is used in GxP-regulated contexts — clinical data processing, quality control, pharmacovigilance — existing GxP obligations apply in full, and the AI-specific principles layer on top of them, not in place of them.
• The transatlantic gap requires active management. Sponsors submitting to both FDA and EMA cannot treat one agency's framework as sufficient for the other.

Closing: The Beginning of a Regulatory Architecture

The FDA's January 2025 draft guidance and the EMA's September 2024 reflection paper — now joined by the January 2026 joint guiding principles — represent the opening moves in what will likely become a more detailed and prescriptive regulatory architecture for AI in pharmaceutical development. All three documents acknowledge they are not final: the technology is evolving too rapidly for fixed standards, and the frameworks will need to develop iteratively alongside scientific practice. What they do establish clearly is that submitting AI-informed data without regulatory accountability for the models behind it is no longer a viable approach. Sponsors who begin building the governance, documentation, and engagement practices these frameworks point toward will be better positioned as they mature.

Understanding what regulators are actually asking for, and why, requires more than reading the guidance documents. It requires understanding how risk-based frameworks operate in practice, where interpretive latitude exists, and how FDA and EMA approaches interact for globally-developed products. These are precisely the questions that the Bradford Hill Academy AI in Pharma course examines in depth — equipping regulatory, clinical, and development professionals with the conceptual and practical foundation to navigate this landscape with confidence.

The information in this article reflects the regulatory landscape and published guidance available at the time of writing. Regulatory guidance evolves; readers should verify the current status of all documents cited before relying on them in a professional context.