2026-09-16-0908-ai-regulation-gxp-environments-lecture

Gaurav Walia lecture on AI regulation in GxP environments

Recorded 2026-09-16 at 0908 via Plaud. 23:17.

Summary

The conference’s regulatory-landscape lecture (Plaud names the instructor Gaurav Walia; he self-identifies as a PQE Group vice president) surveys the rules arriving for AI in life sciences: the EU AI Act, the Cybersecurity Act, Annex 11 updates, Annex 22, and the FDA draft guidances issued since January 2025. His through-lines: validation is becoming lifecycle-long and continuous for anything short of a frozen, locked model; the FDA is the forward-thinker while European bodies stay conservative; and Annex 22 slid to 2027 after an industry delegation spent a day presenting use cases to European regulators, followed by seven hours of regulator questions.

Room polls showed few formal AI training programs and a thin proof-of-concept-to-pilot-to-commercialized funnel, with pharmacovigilance workload reduction the one commercialized GxP example offered. He reports the EMA’s first qualified AI tool (AIM-NASH, for consistency in liver-biopsy analysis), the EMA multi-annual AI work plan through 2028, the FDA’s use of Elsa for submission review, and the push to standardize unit procedures across sites before standing up machine learning. He closed on his unanswered question: asked repeatedly for a date when AI autonomy in critical GxP decisions arrives, AI itself declined to speculate.

Plaud AI notes

<App-generated notes from the Plaud cloud, verbatim.>

Date Time: 2026-09-16 09:08:42 Location: [Insert Location]: Raleigh Instructor: [Insert Name]: Gaurav Walia

Plaud summary

In this lecture, Gaurav Walia explores the evolving regulatory landscape for Artificial Intelligence (AI) in GxP environments, emphasizing alignment with FDA, EMA, and Annex 11/22 expectations. Presented on September 15, 2026, the session notes that the industry remains in early adoption while regulators actively build frameworks. Walia underscores a risk-based, total product lifecycle approach for AI, prioritizing transparency, continuous validation, and robust governance. He contrasts the FDA’s more forward-thinking stance with the EU’s conservative approach, highlighting convergence on principles like lifecycle management and early engagement. Drawing on AI misuse examples from other industries, he stresses the need for guardrails and addresses challenges AI poses to traditional compliance and data integrity concepts.

Knowledge Points

1. Regulatory Landscape for AI in Life Sciences

• Overview of the Current Regulatory Climate
  • Presented in Raleigh, the lecture addresses global trends in AI for GxP, noting early industry adoption.
  • Key documents and frameworks include the EU AI Act, the Cybersecurity Act, updates to Annex 11, the introduction of Annex 22, and multiple FDA draft guidances.
  • Central themes: risk-based approaches, transparency, lifecycle management, and strong governance for AI systems, especially in high-risk areas like medical devices and drug development.
• Comparison of US (FDA) and EU (EMA) Approaches
  • The FDA is viewed as more forward-thinking, issuing several draft guidances since January 2025 on AI-enabled medical devices and AI in biological product manufacturing.
  • European bodies remain more conservative. Annex 22 is restrictive, classifying the industry as high-risk and currently recommending machine learning over broader AI for continuous learning.
  • Despite differences, convergence is underway, mirroring historical alignment between Part 11 and Annex 11.
• Regulatory Engagement and Industry Collaboration
  • Early and continuous engagement with regulators like the FDA is encouraged throughout AI-enabled product development.
  • A recent industry initiative presented use cases and strategies to European regulators, contributing to Annex 22’s implementation postponement to 2027 and opening the door for revisions.
  • Regulators themselves are building and using AI tools—e.g., the FDA’s “Elsa” for submission reviews and inspectional software—to rapidly analyze large datasets.
• Specific Regulatory Updates and Tools
  • The EMA has qualified its first AI tool, AIM-NASH, enhancing consistency in liver biopsy analysis for MASH disease and potentially accelerating clinical trials.
  • The EU is developing an AI tool to assess liver disease severity.
  • The EMA’s multi-annual work plan (through 2028) targets AI use across the regulatory network, including guidance, technology adoption, collaboration, and experimentation.

2. AI Implementation and Validation

• Industry Adoption Status
  • A quick audience poll showed few organizations have formal AI training programs.
  • While some companies have completed AI proofs of concept (POCs), fewer have advanced to pilot phases, and only a small number have commercialized AI use cases in GxP (e.g., pharmacovigilance reduction).
• Lifecycle Management and Validation Models
  • Evolving regulations point to fast, continuous validation models for non-frozen, non-locked AI.
  • A total product lifecycle approach is essential, with ongoing monitoring for drift, bias, and hallucinations, particularly in continuous learning models.
  • Standardizing unit procedures across sites prior to implementing ML/AI is crucial to simplify updates and ensure consistency.
• Compliance Challenges and Data Integrity
  • AI/ML tools are data consumers and introduce new compliance challenges.
  • Data integrity cannot improve downstream; it is only as strong as the original record and can degrade.
  • A tailored approach is needed to preserve regulated data integrity, meet intended use, and ensure software safety and effectiveness.

3. AI Violations and Ethical Considerations

• Examples of AI Misuse from Other Industries
  • The FTC has acted against deceptive AI claims (e.g., money-making tools, “AI Lawyer” services).
  • Enforcement has targeted companies using AI to generate fake reviews to deceive consumers.
• Governance and Accountability
  • Regulators learn from misuse trends in other sectors, shaping guardrails for life sciences.
  • A major unresolved issue is accountability and the legal framework for AI autonomy in critical GxP areas, contributing to uncertainty about timelines for full autonomy.
  • Texas prohibits government use of AI with “dark patterns” and requires clear disclosure when interacting with AI, reflecting a growing emphasis on ethical use.

Questions

• [Insert Question/Confusion]

Assignments

• 1. Read the EU AI Act, Annex 11, Annex 22, and all FDA draft guidances on AI issued since January 2025 to understand current regulatory thinking.
• 2. Establish a robust, risk-based AI governance framework with a total product lifecycle approach, continuous monitoring, and transparency.
• 3. Standardize operational procedures across sites before implementing machine learning to ensure consistency and simplify model management.
• 4. Engage early and continuously with regulatory bodies like the FDA when developing AI-enabled products, as recommended in recent guidance.

Highlights (button-flagged moments)

Gaurav Walia Opens Talk on AI Regulatory Alignment, Polling Audience on Adoption

As the title slide for his presentation on AI alignment with FDA, EMA, and Annex 11/22 expectations is displayed, speaker Gaurav Walia begins his talk by outlining his intent to cover these evolving regulatory frameworks and surveying the audience on their current stage of AI implementation. • Visual Context: The slide introduces a presentation by Gaurav Walia on aligning intelligent systems with FDA, EMA, and Annex 11/22 expectations for AI, validation, and documentation. • Discussion Insight: The speaker begins by polling the audience on their organization’s AI maturity, from having formal training programs to proof of concepts (POCs), pilots, and commercialized use in GxP environments. • Key Takeaway: The presentation will address the evolving regulatory landscape for AI, including the EU AI Act, Cybersecurity Act, and Annex 11/22 updates, which is the central theme introduced on the title slide.

Global AI Regulatory Updates and the Shift to Continuous Lifecycle Management

The speaker elaborates on the presentation slide, explaining how recent AI compliance updates from the FDA, EU, and EMA are driving a fundamental shift towards augmented risk approaches and continuous lifecycle management for AI systems in the life sciences industry. • Visual Context: The slide outlines recent AI compliance updates, including the FDA’s draft guidance on AI medical devices, the EU AI Act, and the EMA’s reflection paper on the medicinal product lifecycle. • Discussion Insight: Speaker 1 contrasts the regulatory bodies, suggesting the FDA is more ‘forward-thinking’ while European bodies are more ‘conservative,’ but notes that both are moving towards similar principles for AI governance. • Key Takeaway: The evolving regulations necessitate a new model of continuous validation and lifecycle management to handle AI model drift and bias, a departure from traditional, static validation practices.

Speaker Elaborates on Key AI Regulatory Takeaways Presented on Slide

The speaker’s discussion expands on the exact points listed on the presentation slide, detailing the importance of a total product lifecycle approach, ongoing risk management, and early regulatory engagement as key principles from US and EU AI guidances. • Visual Context: The slide summarizes key takeaways from AI guidances, emphasizing Transparency, Lifecycle Management, and Early Engagement with the FDA. • Discussion Insight: The speaker highlights that a core theme across US (FDA) and EU guidances is a ‘total product life cycle approach’ with continuous validation, directly mirroring the ‘Lifecycle management’ point. • Key Takeaway: Both the visual and the transcript stress that for AI-enabled medical products, continuous and early engagement with regulators like the FDA is recommended at each stage of development.

EMA Qualifies First AI Tool, AIM-NASH, to Accelerate Drug Development

The speaker reviews a presentation slide highlighting the European Medicines Agency’s (EMA) landmark qualification of AIM-NASH, an AI tool designed to streamline liver disease analysis in clinical trials and accelerate drug development. • Visual Context: The slide announces the first AI tool qualification by the EMA for AIM-NASH, which helps pathologists consistently analyze liver biopsy scans for MASH disease severity. • Discussion Insight: The speaker confirms this update around timestamp 968490ms, adding that the EU is developing its own AI tools to better diagnose and accelerate drug development for liver diseases. • Key Takeaway: The qualification of AIM-NASH signifies a tangible step by regulators to integrate AI into the clinical trial process, aiming to reduce patient numbers and speed up the delivery of new medicines.

Speaker Elaborates on AI/ML Compliance Challenges, Emphasizing Data Integrity and Model Confidence

As the presentation slide outlines the compliance challenges of new technologies like AI/ML, the speaker verbally expands on these points, particularly the difficulty of ensuring data integrity and confidence in a complex, “gray environment” where the inner workings of models are not always clear. • Visual Context: The slide highlights that AI/ML tools are ‘Data Consumers’ and warns that data integrity cannot be improved through its lifecycle, only maintained or degraded. • Discussion Insight: The speaker notes the challenge of operating in a ‘gray environment’ where it’s difficult to truly know what AI technologies are doing with the data they consume. • Key Takeaway: To manage these compliance risks, there is a growing emphasis on standardizing processes and ensuring the ‘confidence of the machine learning’ model, which is a foundational step before broader AI adoption.

Speaker Cites FTC Actions Against Deceptive AI Practices

As the presentation displays a slide on AI violations, the speaker provides real-world examples of FTC crackdowns on companies for making deceptive AI claims, generating fake reviews, and offering services like an ‘automated lawyer’. • Visual Context: The slide details regulatory actions against AI misuse, including deceptive claims (e.g., ‘AI Lawyer’), fake reviews, and manipulative ‘dark patterns’. • Discussion Insight: The speaker expanded on the slide’s points, citing FTC actions against companies with false claims about weight loss, posture improvement, and automated legal services. • Key Takeaway: Governments are actively learning how AI is being used improperly and deceptively, leading to the establishment of regulatory ‘guardrails’ to protect consumers.

Transcript

[00:00] Speaker 1: I’m in Raleigh, so I think about a year ago when I was in Cork, Ireland, they wanted me to go over what the latest trends on inventory are, what’s the evolving landscape around the world, and we’re still in the early days of AI when it comes to that. I think I need that thought as a keynote at 7:30 a.m. Right, so I would try to make sure. I know it’s so in the morning here, just kind of getting kicked off. So you know, we’ll go over we’ll go over some of the highlights of the EUAI Act. You know, slightly touch upon the Cybersecurity Act as well. That kind of, in my opinion, some of these things that you’ll see in draft guidance from the FDA is you see some of the framework of of updates to Annex Eleven as well as Annex. Too, you know, there is some influence inside security. Some organizations, for the last few years, it’s not a you know there might be a separate infrastructure cyber entity within the organization, but you know we have this whole product lifecycle, right? And even if it’s not product software, that means that cyber has to be infused into it. As you infuse AI, it means that that you know fine service. You’ll see some examples, just like yesterday. I’m going to show you examples not only from life science but other industries, things that were that were citations or observations from regulatory and those specific sectors, whether it’s financial or or lending practices, field. You’re going to see some similarities. We discussed about human loop and things like that. So, ultimately. If you really pay attention to ISO 1345 in terms of the essential standard that is that is relies very right, that typical national standards. If we can play and read this together, it’s the importance is you’ll see some similarities between all the documents, focusing on things like cybersecurity, on lifecycle. Validation, looking at looking at risk and trust and what’s risk, right? So, so let’s go ahead and get started. I think you know. Let me just take a quick poll. I should have done yesterday. I didn’t. How many people? How many people have a formal AI training program in their organization? Raise your hand. Okay. Very few. That’s why I started. Okay. How many actually have an AI? And I’ll ask you a few questions. Then we’ll get started. How many? How many questions? How many? How many companies here have actual performed a AI proof of concept and any use case? Okay, so I’ll pick on you if you don’t mind. And if you can’t share, that’s fine too. What What was the use case? Sorry. Okay. Okay. How many people? Gone from POC to a pilot in the same use case. Raise your hand. Okay, good. So less people, but continue. Any any commercialized use of AI in a GXP environment? Raise your hand. What? Can you share? Oh, well, we’re we’re the same word. We, there’s there’s one for, I’m just trying to think, which. PV reduction, yeah, PV reduction. Yeah, PV reduction’s been talked about, so that’s one. So, you know, as we evolve, you know, the problem is is the landscape. What framework do we have? We’re just kind of thinking about it. That’s my background. I think a lot of you have come to at least one of my talks, so so you know who I am. I’m currently the vice president of PQE Group. PQE Group is a global life sciences. Consultancy with fifty one offices, down to our third largest U. S. Surgical neurosurgeon office in Chicago, and so you know my career spans—I get bored easily—so my career spans science to technology to quality oversight to the United States. And the idea was my first job in my career; they told me to do a bunch of Chemistry, acids, I’m HPLC, and they didn’t tell me why. What what happens before I do that? What happens after I do that? What happens when the results go this way or that way? They didn’t tell, they didn’t teach me about the drug development process, right? Because the bosses at that time they were just too busy doing things, right? And it was a bunch of myself, sometimes. So it’s kind of been part of my DNA in life to understand the whole process. I always felt. Even when I started, first getting involved in backroom of of inspections, what I found was you know oftentimes we needed ten people to answer one question. Maybe as a young guy, it was ludicrous, right? How come how come we need all these people? You know, because it’s people are so siloed, they’ve really didn’t have experience, or it was a trust factor about everybody has their role, which I get in some cases. It just meant that I felt that it was important, you know, to to understand the context, right? Because in life, in life, we can have a room of people, and it’s good to have opinions and have different viewpoints, but it’s good to know yourself what that that whole that whole train ride is going to look like, right? And so, so if we look at some of the updates, right? What we’re seeing, whether we talk about Europe or the U.S., and remember, it’s new technology. There’s a global race, and we’re we’re only one of many industries. That means, as you read things like the EUI Act, you’ll see some examples today. There’s a it’s a more widespread government strike that that brings commonality to some of the trade. Yeah, and although in the beginning, just like Part Eleven, Annex Eleven, were maybe not exactly. Saying they’re much more similar today, its current version than it was 10, 20 years ago. So, the same things are going to happen with AI. Different governments and different communities have different views, and so just like we do. And so, so what we’re seeing is we’re seeing you know risk has always been there in terms of looking at risk, but we’re seeing more of an augmented, augmented risk approach. So risk is a little bit different now with the augmentation. Technology. That means also the lifecycle management. What you’re going to hear today is over and over again is the the real summary of of these changes is talking about a new model of valuation, a new model has to be fast, has to be continuous. This is a continuous lifecycle, right? Unless you have a deterministic, frozen, locked model that’s not going to drift, that’s not going to have bias. That’s not going to hallucinate. You have proper initial training data. You validate that model very similar to the current validation practices today, and you may monitor other character characteristics that that we haven’t had in our landscape yet. But this is the evolution, right? And and it’s the governance above it. And you’ll see examples of where governance has gone wrong already with companies using AI outside of life sciences, but. It’s a good indicator because people pay attention to that. Not only do inspectors look at what your company is doing in that site, department, in that site, in other locations, depending on if you’re good or bad, but you pay more attention if you’re not doing so good. Terms of regional systemic issues, and so cross-sectionally, you don’t think other other branches of government interact and look at the trends that are going on. So. So they’re learning too about what’s how are people using AI? How are people using it improperly? How are they using it deceptively? Also, and to do bad things. So, and that’s why guardrails have to be put in place. So you know the biggest discrepancy we see today, you know between between FDA. I think I think the FDA is a little more forward thinking. I think the European bodies are. A little bit more conservative in terms of the approach, but what you’ll see is that the development of of different draft guidances. Maybe let me ask one more question. To be honest, how many people have actually read all the FDA draft guidances that have been issued since January of twenty twenty five? So, very few, right? So. You have to read. You have if you really want to be at the forefront of where the train is coming from, what you may do yourself, and where it’s going to go. Then you have to read that because that is the current operational thinking of government. Right? It’s an inspection standard unless you say I’m doing this exactly. Right. So, so it means that you need to not only read the EUAI Act and Annex One and Two, but also read what draft versions. Other regions of the world to think to kind of see because in the end sometimes some pieces are better than others in different in different applications right and so that collectiveness eventually will become more standardized right so if we look at considerations for use of AI some of those draft guidances from FDA focus on decision making of making biological products some are looking at AI enabled. Medical devices. We already know the FDA is using Elsa for regulatory submission review. You know the basic answer is this: you have to know what governments are doing, even if it’s not official, right? And some are published, some are more conversations out there with colleagues about what’s going on in the world. They’re developing inspectional software, right, that can look at some of your data. They’re going to utilize it in some cases, right, maybe not officially, but. Utilizing it just like you are utilizing in some of your use cases to to aid the human in in faster analysis and trend analysis of what’s going on, right? Because hopefully they’re not spending two months in the facility, so so that means that they have to digest a huge volume of data in a short amount of time to come up with conclusions. So the risk. The the risk framework is is really about if you if you read all these documents from Europe to the United States and even some of the GAMP AI guides, it’s really about establishing a better approach, a total product life cycle approach. In some medical device draft guidances of FDA, the focus is on on having almost predicting what might happen in that life cycle and, And having a validation model that’s that’s almost future looking, right? Not every little change I need to I need to revalidate depending on what that changes. So some of that may be encompassed into the original validation. So it becomes important to if if you really see some examples here today, what you’re going to see is that that you see an example from Europe about. AI that’s being used in some of the drug development process, right? By government, about moving the lines. That means that even in the U.S., there’s conversations and even some actions with the current administration about reduced testing in some of the some of the trials, right? The requirements. I think even biosimilars in the last year has severely reduced the amount of work that has to be done in terms of studies, right? And so. I think with the infusion of AI and regulation in the future, they’re they’re looking for quicker pathways to develop products and get them to the market. Especially as they they will become more innovative, I think. So the top part you probably heard quite a bit, you know, on the last day and a half. But it means that validation program and the framework is going to have eventually will have certain criteria that are different than we’ve ever monitored. It means that, of course, that model has to be ensured when you’re talking about continuous learning. At least in the U.S., Annex Twenty Two is restrictive to just machine learning because they generically deem everything high risk in our industry. So they don’t currently recommend AI. What I’ll tell you, you might have heard from Dory yesterday. I belong to four communities of practice for AI. One of them is regulatory. So this summer, we appointed a couple of people from the committee. They went out to Europe and had several meetings with regulatory bodies. The idea was they spent an entire day with a presentation. Of different use cases and strategy that the industry wanted to kind of give their position, and and then after that they spent seven hours of of regulators only asking questions to industry, right? And the idea there is that that Annex Twenty Two that was probably supposed to go into effect this year has been postponed until next year. So hopefully there will be some changes because with organizations that I asked yesterday, well, many of you have. Main city or main country and city organizations. The paradigm is that if the rules are vastly different, that means that maybe you can’t use AI, or maybe the the modeling has to be completely different in that region of the world, depending on what the rules might be in the future. So the engagement becomes important, right? They’re not here this time, but often there’s regulators in some of these key offices where. The ones that come here are pretty friendly. I think that in the end, you can have a drink and be honest, and have a have a you know not an inspectional type standard question. You can have real life conversations about what’s the current thinking, you know, and then of course you can have your formal meetings and some of the draft guidance is on medical device. They recommend at each stage you have a meeting to actually go over the AI and the algorithms, and you’re all staying approved, right? If we look at some of the new fast track programs in the United States, they are inspectional standards at each step if you’re building new facilities. So when you get to the end, you’re already clear, right? So you can you don’t have to wait a year to to get the stamp to start producing water, right? So. There’s a faster cycle that’s that’s starting to be adopted, and so I I alluded to this where it’s an AI work plan for 2028. I mean, you never know what dates you know these days. It could be closer to next year at least. So so, but it’s the first AI-based clinical tool that that is being that some of the data will be published, and the idea is to accelerate development of medicines. So we are seeing some synergy between the U.S. and Europe in terms of that. The EU is then developing basically a first-ever AI-based tool. There seems to be a lot of uptick in national disease, and so there’s also an AI tool that helps to determine severity of different liver diseases to better diagnose and can also better accelerate drug development. I think it’s in recent last year. I think it went to a fifteen thousand person diagnostic conference with many pharma companies that actually sell have diagnostic divisions and technologies, and there was a big focus on this, specifically on that on that diseases. So the work plan is really looking at a multi annual work plan about using AI across the regulatory network. And they’re looking at four key areas about guidance and policy, how the technology and framework is going to be adopted, as well as the collaboration and change management and experimentation. Remember, my prediction in the future, and it was funny because I was getting ready this morning. I asked AI, give me a summary of all these different. Obviously, I’ve read them, but give me a summary of of all the different acts, guidances, even guides that are out there that we have today. The last almost two years, and then I further probe AI. So, when do you think we’ll actually have AI autonomy, specifically in our industry? Well, it’s about, and you’ll see in some of the slides coming up. Now, they focus on the accountability and legal fact of decision, and that that’s a that’s a big question mark for, And what we’ve done historically, right, so far, and I kept pressing it over and over again to say, give me answer. So I can’t give you answer. I don’t. I can’t give you. I asked you for a year that it thinks where AI will be autonomous to make decisions that sometimes humans make today, even in some critical GSP areas. So I can’t even give you answer for not only the year but a decade. So, and I kept. Forcing it, but it wouldn’t. It wouldn’t answer me. It’s just big tough. It just said because of patentability and legality and what we’ve done so far, we’re just all this what we had talked about this conference. We’re so immature in the process that even it doesn’t postulate. What may happen? So you know, if you look at Annex Eleven, there’s a focus on on, and there was some rumor in the last few years from some, let’s just say, at some of these conferences when we’re speaking with FDA, that there was some there was some rumor, and I don’t have actual fact behind it, but there was rumor that Part Eleven may get updated, and as some of our clients ask, well, what? Right. What’s what’s missing from it? Right. So, so even here, when we talk about AI, as I spoke about yesterday, the data privacy aspect and the flow of data and what happens to that data becomes critical. Right. And you know, when you when you say, okay, I have a tablet press, it’s going to press the tablet at a hundred psi, and you can measure psi, and it’s very it’s very black and white, right. And so. The the environment is becoming more gray, and even our understanding of what happens is, at this time, honestly, is not very good. We don’t know what these technologies are doing unless we built it ourselves and we can explain. Depending on which modeling you have, which software you have, which technology, which LLM that constantly changes, do you really know what’s happening? And so that’s part of the the challenge of of the data. How how are you moving? One theme that I’m reading through these things that may not be explicitly spelled out is speaks about machine learning and the confidence of the machine learning, right? Think of it as a semi-manual step, and that manual step needs confidence because yesterday I spoke about I met with some some of the world’s largest pharma companies, right? The day before the conference, and I talked. I spoke about yesterday. They started talking about this continuous quality excellence. And as I met a couple people, I started understanding that was that was what was being advertised. But what was really being advertised when I talked to the head of engineering was that they wanted to standardize how they perform tasks, unit procedures at various sites. And I think the underlying theme was that they wanted to have one way of doing it, so when They are updating their machine learning. They’re implementing AI that they have one way, makes it easier than if you have a hundred sites and a hundred different ways to do the same thing, right? And as I as I’m evaluating, relooking at some of the current draft guidances and acts is they’re all kind of talking about the optimization and the confidence of the ML first because. That’s our that’s our kind of initial step in many cases. Many of us have done machine learning, or companies have for years, and this is the next evolution of that. So, if we look at some global industry updates, these are some updates from other industries that focus on, for example, the Federal Trade Commission crackdown on companies falsifying AI capabilities, the Thomas Pipeline having claims of. This will help you lose weight, or help you have better posture and medical medical influences that are not really have data to back it up, right? People are using AI to have an automated lawyer, right? And in different types of use cases, and so ultimately, even even companies are using AI to create reviews of restaurants and and feedback and. 其实

Related

• Home
• Governance Risk and Human Factors MOC