EMA AI Roadmap: 61 Use Cases for Pharma GxP Compliance

1.0. Introduction: The EMA AI Roadmap for Pharma

Most pharmaceutical AI strategies are being built backwards.

An organization starts with a technology an LLM, RAG, an AI agent, or a copilot license then searches for a problem it can solve. A few pilots follow. Some produce impressive demonstrations. Others stall because nobody has determined how the system should be validated, monitored, governed, or integrated into existing workflows.

The European Medicines Regulatory Network (EMRN) offers a different model.

Rather than starting with technology, the Network has been mapping use cases, tools, data, processes, governance, and reuse. The result is a more practical way to think about an AI portfolio: identify where AI can create value, classify those opportunities, standardize what works, and establish the controls required to operate AI responsibly at scale.

But the strongest lesson is not the number of use cases. It is the monitoring problem.

The report makes the point directly, AI systems can change over time, and evidence generated at deployment may not fully describe system behavior later. Models can change. Prompts can change. Retrieval sources can change. Data can change. Vendors can change the model behind an API without changing the user interface.

That creates a gap between validating AI once and knowing that AI remains fit for purpose.

For pharma, that gap is where the compliance pressure will concentrate.

2.0. The AI Pilot Graveyard: From 61 Use Cases to Scalable AI

The Network AI Tools framework and catalogue and the 61 AI use cases collected through workshops with national competent authorities are not the same thing. They represent two complementary views of the Network’s AI landscape.

The tools catalogue uses five categories: knowledge mining, personal productivity, process automation, process improvements, and anonymization/data protection.

The 61 use cases are grouped into four broad clusters, drafting and summarization, validation and quality assurance, knowledge mining and information retrieval, and other diverse use cases.

The report does not publish the 61 use cases as a detailed checklist, and it would be a mistake to treat the number as a catalogue for direct replication.

The value is strategic.

The clusters show where AI is being considered first: text-intensive, knowledge-heavy, and generally human-supervised work. The first two areas are being taken forward through validated, reusable prompts intended to harmonize and standardize AI use across the Network, supported by a pilot EMRN Prompt Community.

An ecosystem of AI assistants is also planned for knowledge retrieval. This is a very different picture from an AI strategy centered on autonomous decision-making.

The early emphasis is on human-reviewed activities where AI can augment professionals without eliminating accountability. A regulatory writer might use a validated prompt to draft a first version of a PSUR section. A quality team might use AI to compare controlled documents, while qualified reviewers remain responsible for the final assessment.

For pharma, that creates a useful portfolio principle:

Start with high-volume, human-supervised activities where the value is measurable and decision authority remains with qualified people but design monitoring before scaling them.

Regulatory writing, document summarization, comparison, information retrieval, quality checks, and other knowledge-intensive activities naturally fit this model.

The lesson is not that every company should reproduce the exact 61 use cases. The lesson is that use-case selection should come before technology selection and monitoring design should come before deployment.

3.0. From AI Experimentation to AI Infrastructure

The direction of travel is visible in the Network Data Steering Group’s 2026 work.

The NDSG reported progress on AI-related activities including the AI Observatory Report, AI research priorities, international collaboration, and the establishment of an AI coordination group to oversee AI guidance development across regulatory domains.

At the same time, the broader NDSG program is focused heavily on structured data, interoperability, data quality, and reuse.

The Product Management Service (PMS), for example, is being developed as a trusted source of medicinal-product master data, with a public API and ongoing work on data quality and qualification.

This is an important signal for pharma. AI cannot become a reliable enterprise capability if it sits on top of fragmented, poorly governed information. The regulatory ecosystem is increasingly being designed around structured data that can be reused across processes and systems.

That same principle should shape the pharmaceutical AI portfolio.

A system cannot be monitored meaningfully if the organization does not know what data it used, which version it retrieved, what configuration produced the output, or how the underlying information changed.

The regulator’s AI agenda is therefore beginning to look less like a collection of experiments and more like infrastructure planning. The question is no longer simply which tools can generate useful outputs. It is whether the surrounding data, controls, and evidence systems are mature enough to support those outputs over time.

4.0. Continuous Monitoring Is the New Validation

A traditional validation mindset can assume that a system is tested against a defined configuration and then released.

AI complicates that model. The model can change. The retrieval corpus can change. The prompts can change. The underlying data can change. A vendor can change the model behind an API without changing the user interface.

Therefore, evidence generated at deployment may not fully describe system behavior months later. This is not merely a theoretical concern. It is the central operational problem for regulated AI.

The question is not only:

Was the system validated before use?

It is also:

How will the organization know that the system remains reliable after use begins?

Consider a summarization model used by a QA team. Its initial testing may show acceptable performance against a defined set of documents. Months later, the model provider updates the underlying model, the document corpus expands, and users begin relying on the output in a slightly different workflow. The system may still appear to work. But does the original evidence still support its intended use?

That requires a monitoring model capable of detecting meaningful change.

For each AI application, organizations should be able to determine whether the system is still performing as expected, whether the model, prompt, retrieval corpus, or underlying data has changed, whether user behavior or workflow has shifted, and whether the risk conditions remain the same. They also need defined triggers for reassessment, retraining, revalidation, restriction, or retirement.

This is the gap between deploying AI and operating AI responsibly.

Validation cannot simply be a gate at the beginning of the lifecycle. It needs to become an ongoing capability.

The NDSG’s broader emphasis on data quality, qualification, automation, and AI-enabled approaches reinforces this direction. The 2026 report identifies ongoing work around PMS data qualification and opportunities to use automation and AI-enabled approaches to support data-quality activities.

The implication for pharma is clear:

Continuous monitoring is not an optional enhancement to AI governance. It is part of the evidence that the system remains fit for purpose.

5.0. Annex 22 and the January 2026 Principles Raise the Stakes

The monitoring issue also provides the bridge to the broader compliance conversation.

Annex 1 of the report includes Annex 22 and the EMA/FDA “Guiding principles of good AI practice in drug development,” published in January 2026.

Together, they provide a natural follow-up to the Network’s operational AI work.

The Network’s tools, use cases, prompts, and AI assistants show how AI is being organized in practice.

Annex 22 and the EMA/FDA principles sharpen the question of what organizations will need to demonstrate when AI is used in drug development and other regulated contexts.

That is where the portfolio discussion becomes a compliance discussion.

A company may have an approved AI tool, a validated prompt, and a documented use case. It may still lack a defensible answer to the most important question

What evidence shows that the system continued to perform appropriately throughout the period in which its outputs influenced regulated work?

This is why continuous monitoring is the strongest hook in the regulator’s work. It turns AI governance from a policy exercise into an operational obligation.

The compliance question is moving from Can we use AI? to How do we prove that the AI remained controlled, appropriate, and fit for purpose as conditions changed?

6.0. Knowledge Mining Is an AI Architecture Problem

The Network’s planned ecosystem of AI assistants for knowledge retrieval contains another important lesson.

Knowledge retrieval is often presented as a simple RAG problem, connect an LLM to a vector database, index some documents, and ask questions.

In a regulated environment, that is rarely enough.

Which documents are authoritative? Which version should the assistant retrieve? How is source provenance maintained? What happens when two controlled sources contain conflicting information? How are access permissions enforced? How is the retrieval system tested when the underlying content changes? How is retrieval performance monitored after deployment?

These are fundamentally data, integration, governance, and lifecycle questions.

The NDSG’s broader priorities reinforce this direction. Industry has called for PMS, ePI, eCTD, electronic application forms, and related regulatory systems to be better aligned to create an end-to-end, data-centric regulatory process and eliminate duplicated data entry.

For pharma organizations, the implication is straightforward: an AI assistant is only as reliable as the controlled information ecosystem beneath it.

That architecture matters because every link can change. A new document version can alter retrieval. A revised prompt can alter reasoning. A model update can alter output style or factual performance. A change in user behavior can alter the risk profile. Monitoring has to see the whole chain, not just the final answer.

7.0. Your AI Prompts Are Now Controlled Documents

One of the most overlooked ideas in this model is the treatment of prompts as reusable, controlled assets.

When a regulator moves toward validated and reusable prompts to harmonize AI use, the prompt stops being an informal instruction typed into a chatbot.

It becomes part of the system configuration. That raises a very different set of enterprise questions.

Who owns the prompt? Which version is approved? What changed between versions? What data was used to test it? What are its acceptance criteria? What happens when the underlying model changes? Can the organization reproduce the output or demonstrate that the prompt remains fit for purpose? How will it know that the prompt continues to perform appropriately after the surrounding system changes?

This is essentially configuration management applied to generative AI, with continuous monitoring added to the lifecycle.

Pharmaceutical companies already understand the concept. Software configurations, specifications, test scripts, procedures, and other controlled artifacts have owners, versions, change histories, and approval mechanisms.

AI prompts that materially influence regulated work deserve the same level of discipline.

The question is no longer simply whether an employee is allowed to use generative AI.

It is whether the organization knows which AI configuration was used, for what purpose, against which information, under whose control, with what evidence of performance, and how that performance was monitored over time.

8.0. The AI Tools Catalog Solves a Different Problem

The Network AI Tools framework provides the portfolio-level view.

Its five categories which is knowledge mining, personal productivity, process automation, process improvements, and anonymization/data protection show the breadth of AI applications being considered across the Network.

The underlying technologies include capabilities such as LLMs, NLP, speech recognition, OCR, and other AI approaches.

But the real value of a catalog is not the technology list.

It is visibility. An organization cannot govern or monitor an AI environment it cannot see.

For a pharmaceutical company, an AI inventory should reveal what AI tools are being used, which business processes use them, what data they access, which outputs influence regulated activities, who owns each application, what controls apply, what performance indicators are monitored, what changes trigger reassessment, and what happens when the model or vendor changes.

This becomes particularly important as AI adoption spreads beyond formally approved enterprise platforms.

The biggest AI risk may not be the system IT approved.

It may be the system employees quietly adopted because it solved a problem faster and that nobody is monitoring.

Shadow AI is not just an IT visibility problem. It is a lifecycle evidence problem. If an unregistered tool contributes to a regulated workflow, the organization may not know which model was used, what data left the environment, what configuration generated the output, or whether the system changed after the work was completed.

The important point is sequencing.

• Inventory first.
• Discover use cases second.
• Classify and prioritize third.
• Define monitoring requirements before deployment.
• Control, validate, and monitor continuously.
• Scale only when the evidence supports it.

That is fundamentally different from buying an AI platform and asking employees to find something to do with it.

The platform-first approach often creates a familiar outcome: a handful of impressive demonstrations, followed by uncertainty about ownership, validation, data access, and long-term value. A portfolio approach reverses the order. It starts with the work, identifies the risk, defines the evidence, and then selects the technology that fits.

9.0. Why the EMA AI Roadmap Matters Beyond the Regulator

The NDSG discussion also shows that digital transformation is becoming increasingly interconnected.

Industry called for improved data quality, data-driven variations, integration of ePI into the product lifecycle, harmonized reporting, API-based submissions, and greater reuse of structured data.

The Network ultimately emphasized the need to move from planning to practical implementation, interoperability, process simplification, clear governance, and continued regulator-industry collaboration.

That is exactly where enterprise AI strategies need to mature. The winning pharmaceutical AI portfolio will not be the organization with the largest number of copilots.

This is why the broader digital agenda matters. Better APIs, structured product data, interoperable systems, and reusable information are not separate from AI strategy. They are what make reliable AI possible.

The differentiator will not be how many assistants an organization has deployed. It will be whether those assistants operate within an information and control environment that can explain what happened, detect what changed, and demonstrate why continued use remains justified.

10.0. What Pharma Should Do Next

The Network’s approach provides a useful starting point.

First, build the inventory. Identify every AI tool, application, assistant, API, and significant prompt being used across the organization, including shadow AI. Without that baseline, governance is largely theoretical.

Next, harvest use cases across Regulatory Affairs, Quality, Pharmacovigilance, Clinical, Manufacturing, IT, and other functions. Capture the problems before selecting technologies. Then classify the portfolio consistently across areas such as drafting, summarization, validation and QA, knowledge retrieval, process improvement, automation, and other use cases.

Prioritize human-supervised opportunities where AI can reduce repetitive work while qualified professionals retain decision authority. At the same time, establish controlled prompt libraries for important workflows, with owners, versions, test cases, acceptance criteria, and change history.

Monitoring requirements should be defined before deployment, not added after the first incident. Organizations need to specify what performance will be measured, what data will be collected, what changes matter, and what thresholds trigger investigation or reassessment.

The data foundation comes next. AI should be connected to authoritative, governed information rather than uncontrolled document collections. Finally, reassessment must continue throughout the lifecycle, covering model changes, prompt changes, data changes, retrieval changes, user behavior, and performance evidence.

This is the same operating model that underpins the emerging concept of Continuous Intelligence in GxP. Platforms such as xLM’s Continuous Intelligent Validation (cIV), for example, illustrate a broader industry movement toward continuous validation, automated evidence generation, traceability, and always-on audit readiness rather than evidence assembled only at discrete milestones. The important point is not the platform itself. It is the operating principle: validation evidence and risk monitoring need to be generated continuously if organizations are expected to demonstrate ongoing fitness for purpose.

11.0. The Real AI Roadmap Isn't a Technology Roadmap

The most important lesson from the Network’s AI work is not that pharma needs more AI.

It is that pharma needs a better way to organize, evidence, and monitor AI.

The emerging regulatory model is increasingly data-centric, interoperable, and focused on reuse. The NDSG’s 2026 work reflects this direction, with structured data, quality, APIs, system integration, AI coordination, and practical implementation all appearing as connected priorities.

The 61 use cases provide the demand-side view, where AI can be useful.

The Network AI Tools catalog provides the capability-side view, what tools and technologies exist.

The validated prompt approach provides the control layer, how AI use can become standardized and reusable.

The monitoring requirement provides the lifecycle layer, how the organization can demonstrate that AI remains fit for purpose after deployment.

And the planned ecosystem of AI assistants points toward the architecture layer, how AI can become embedded into knowledge and regulatory workflows.

Annex 22 and the January 2026 EMA/FDA guiding principles provide the compliance pressure that follows naturally from this operating model.

Put together, these are not merely examples of regulatory experimentation. They are the beginnings of an AI operating model.

For pharmaceutical companies, that may be the more valuable roadmap. The question is no longer “Where can we use AI?”. It is:

How do we build an AI portfolio that remains useful, governed, validated, explainable, and trustworthy and how do we prove that it remains so as the technology, data, and regulatory environment continue to change?

The Network has started answering that question with use cases, catalogs, reusable prompts, structured data, interoperability, governance, and continuous monitoring.

The opportunity for pharma is to learn from that structure before AI portfolios become another collection of disconnected pilots and before the absence of lifecycle evidence becomes a compliance problem.

The future of regulated AI will not be defined by the first successful deployment. It will be defined by what happens afterward: whether the organization can see change, understand its significance, generate evidence, and act before fitness for purpose becomes an assumption.

That is the real roadmap. Not AI once. AI, continuously understood.

12.0. References

1. Summary report of the annual Network Data Steering Group meeting with industry stakeholders
2. Guiding principles of good AI practice in drug development
3. #036: How Does Industrial DataOps Enhance Predictive Maintenance?
4. #069: EU Annex 22: AI Guidelines for Pharma Compliance
5. #0100: AI Governance in GxP: 10 FDA & EMA Guiding Principles

13.0. About the Authors

Nagesh Nama
CEO, xLM Continuous Intelligence | Founder, ValiMation

Nagesh is a pioneer in AI/ML-driven GxP compliance with nearly three decades of experience helping pharmaceutical, biotech, and medical device companies navigate validation, data integrity, and regulatory compliance. He is the founder and CEO of both ValiMation (founded 1996) and xLM Continuous Intelligence, the company that first introduced a Continuous Validation platform supporting IaaS/PaaS/SaaS environments compliant with 21 CFR Part 11 and Annex 11. Today, xLM offers a comprehensive suite of continuously validated AI/ML managed services spanning intelligent validation (cIV), predictive maintenance, temperature mapping, and GxP AI agents. Nagesh is a member of the Forbes Technology Council and the Fast Company Executive Board, a contributor to Forbes and Fast Company, and has been featured on Microsoft's AI Agents Vlog. He holds an M.S. in Manufacturing Engineering from the University of Massachusetts, Amherst.

Kashyap Joshi
Program Manager, AI/ML ContinuousOS Apps | xLM Continuous Intelligence

Kashyap Joshi is a Program Manager at xLM, where he leads the implementation of complex AI systems for life sciences organizations by aligning stringent GxP regulatory requirements with next‑generation technology and xLM’s ContinuousOS Suite of Apps to deliver measurable ROI, continuous compliance, and long‑term transformation for clients across pharma, biotech, and medical devices.