FDA · EMA · January 2026

Ten principles for AI in drug development

What they say, what they mean, and where the industry is heading. My reading of the joint FDA and EMA Guiding Principles of Good AI Practice in Drug Development, and how to have a validation plan in place before the principles turn into regulation.

The ten principles are the regulators’ text: read the official document (PDF) or the EMA announcement. The plain-language readings, the six stages and the outlook below are my interpretation, not regulatory guidance. For my own framework built on them, see Seven Principles for Pharma 5.0.

The ten principles at a glance

1Human-centric by design
2Risk-based approach
3Adherence to standards
4Clear context of use
5Multidisciplinary expertise
6Data governance and documentation
7Model design and development
8Risk-based performance assessment
9Life cycle management
10Clear, essential information

What each principle means in practice

For each one, a plain-language reading and the question I would ask a team first.

Principle 1 of 10

Human-centric by design

The AI serves a person’s decision. The person keeps the authority, and the screen gives them the means to use it.

Ask yourself Can someone here reject an AI output and be supported for it?

Principle 2 of 10

Risk-based approach

Scrutiny scales to what a wrong answer would cost. The same tool carries different risk in different uses.

Ask yourself Which of your AI tools are low-risk and which are high?

Principle 3 of 10

Adherence to standards

AI gets no exemption. The work is deciding which standards apply to this system, not listing all of them.

Ask yourself If an inspector asked how you qualified your AI supplier, what would you hand them?

Principle 4 of 10

Clear context of use

Write down what it does, for whom, for which decision, and what it must not be used for.

Ask yourself Could you produce a written context of use for every AI tool in production today?

Principle 5 of 10

Multidisciplinary expertise

Science, quality, engineering and regulatory, together and throughout. Not a sign-off at the end.

Ask yourself A scientist can build and deploy an AI tool in an afternoon. Does anyone in Quality know?

Principle 6 of 10

Data governance and documentation

Where the data came from, what was done to it, what was decided and why, recorded so someone else could reconstruct it.

Ask yourself Pick one AI-influenced decision. Could you reconstruct it end to end?

Principle 7 of 10

Model design and development

Ordinary engineering discipline first. The simplest model that does the job. Where the AI cannot be explained, its reach is constrained instead.

Ask yourself If your AI vendor disappeared tomorrow, could you still explain the results in your records?

Principle 8 of 10

Risk-based performance assessment

Test the whole system: model, screen, person and workflow. The errors that survive human review are the metric.

Ask yourself Have you ever tested whether your people catch the AI’s mistakes?

Principle 9 of 10

Life cycle management

Validation is a starting point, not a permanent state. Things drift with nothing deployed.

Ask yourself Who owns each AI system by name, and what is the plan to retire it?

Principle 10 of 10

Clear, essential information

Users learn what the tool cannot do where they use it, in plain words. Not in a report nobody opens.

Ask yourself Where does a user learn what this tool cannot do?

My interpretation: six stages a team can follow

The numbering is a grouping, not a build order. In practice the work starts with the people (principle 5), then what the system is for (principle 4), then the risk (principle 2). Put in that order, the ten principles become six stages.

Define

Who, what for, what not for

Classify

What a wrong answer costs

Design

AI out of the reproducible path

Build and check

Whole system, people included

Release and inform

Limits told at point of use

Operate and review

Watch drift; ask what it is used for now

The one design idea that matters most

Let the AI help where the input is messy. Keep the answer itself reproducible.

The AI layer. Reads, drafts, suggests, explores. A person confirms.
The regulated calculation. Same input, same answer, every time. Validated conventionally. The AI cannot write to it.
The rule between them. The AI asks the calculation. It never replaces it.

Risk belongs to the use, not the tool

One calculation can serve four uses, each with a different level of scrutiny, because each puts the cost of an error on someone different.

Use	Who absorbs the error
Discovery screening	Rework
Process characterisation	A manufacturing decision
Batch release	Product quality
Patient eligibility cut-off	A person, directly

Where regulation is heading

In Europe, the draft Annex 22 on artificial intelligence is still a draft, and it is already moving.

July 2025: draft published. Fixed models in scope. Generative AI and large language models kept out of critical GMP use.
Late 2025: industry pushed back. The consultation closed on 7 October 2025 with about 1,300 comments, many favouring safeguards over exclusion.
Mid 2026: EMA convened a workshop on guardrails. A risk-based approach to generative AI is under consideration. There is no final text yet.

What it means for you: a direction of travel, not a checklist. The direction is guardrails around the AI, not a ban on it. Four things already make sense:

Guardrails, not bans. The question moves from whether to use AI to how.
Evidence, not promises. No preferred vendor or hosting; what counts is what you can show.
A named human owns it. The AI assists. It does not sign.
Inventory before ambition. Know what runs before adding more.

Putting a validation plan in place now

Four weeks to clarity, before anyone builds anything. This is where a first engagement usually starts.

Inventory

Every AI tool in use, sanctioned or not.

Context of use

One page each: what it is for, and what it is not for.

Risk tiers

Sort the tools by what a wrong answer costs.

One pilot

The six stages on one workflow, end to end.

Local-first where the data must stay yours. Quality in the room from day one. Nothing acts on a record without a person. See how a validation engagement runs and request the sample validation package.

Get the visual edition

The full 22-slide deck as a PDF, to read offline or share with your quality, IT and science teams. Enter your email and I’ll send it to you.

References

U.S. Food and Drug Administration and European Medicines Agency. Guiding Principles of Good AI Practice in Drug Development. January 2026. PDF
European Commission. EudraLex Volume 4, Annex 22: Artificial Intelligence. Draft for public consultation, 7 July 2025. Consultation closed 7 October 2025.
European Medicines Agency. Multistakeholder workshop on artificial intelligence guidance development (Annex 22), 30 June to 1 July 2026.
U.S. Food and Drug Administration. Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products. Draft guidance, January 2025.
European Commission. EudraLex Volume 4, Annex 11: Computerised Systems. 2011. Revised draft for consultation, July 2025.
U.S. Code of Federal Regulations, Title 21, Part 11: Electronic Records; Electronic Signatures.
International Council for Harmonisation. ICH Q9(R1): Quality Risk Management. 2023.
International Society for Pharmaceutical Engineering. GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems, 2nd edition. 2022.
European Medicines Agency and Heads of Medicines Agencies. Guiding principles on the use of large language models in regulatory science and for medicines regulatory activities. 2024.
Parasuraman R, Riley V. Humans and automation: use, misuse, disuse, abuse. Human Factors. 1997;39(2):230 to 253.
Goddard K, Roudsari A, Wyatt JC. Automation bias: a systematic review of frequency, effect mediators, and mitigators. Journal of the American Medical Informatics Association. 2012;19(1):121 to 127.

Regulatory status statements are time-sensitive and were verified in September 2026.