The EU AI Act has generated a great deal of anxiety in pharmaceutical companies. Legal teams have run workshops. Consultants have published readiness checklists. Some quality teams have paused AI projects until the picture is clearer.
Much of that anxiety is pointed at the wrong law. For most AI used in pharmaceutical manufacturing, quality and development, the rules that will matter in practice are the ones the industry already lives with: GMP, GCP, pharmacovigilance rules and data integrity expectations.
What the AI Act actually targets
The AI Act sorts AI by use. It bans a short list of practices. It places heavy obligations on high-risk uses, which it defines through a fixed list of areas and through links to existing product safety law. It adds transparency duties for some systems and obligations for providers of general-purpose models.
AI that drafts a validation document, flags anomalies in a batch record or helps review a deviation does not appear on the high-risk list in its own right. That surprises people, but it is consistent with how the Act is built. It was designed to cover gaps in existing regulation, not to duplicate sectors that are already tightly regulated.
Where it does apply
There are real exceptions, and they deserve attention.
AI in medical devices, where the AI is the device or a safety component and a notified body is involved, is high-risk under the Act, on top of MDR or IVDR. Device manufacturers have real work to do.
AI used for recruitment, promotion or performance management is high-risk, and pharmaceutical companies use these tools like everyone else, often bought by HR without involving quality or legal.
And the duty to ensure AI literacy among staff who use AI has applied to every organisation since February 2025, whatever the risk level.
Why GMP is the bigger deal
For AI inside GxP processes, the questions an inspector will ask come from familiar ground. Is the system validated for its intended use? Is the data reliable and attributable? Is there appropriate human oversight? Are changes controlled? Is the supplier managed?
These questions already apply under Annex 11 and 21 CFR Part 11. The draft EU GMP Annex 22 sets out how they may be applied to AI specifically, and FDA's draft guidance on AI credibility does similar work in the United States. Neither is final yet, but both point in a consistent direction.
That is where most pharmaceutical companies should focus their effort: on validation, data integrity and oversight for the AI they use in GxP work.
A practical split of effort
Legal and compliance teams should map AI use against the AI Act, paying particular attention to devices and HR tools, and make sure the AI literacy duty is met.
Quality teams should build the AI inventory for GxP processes, define intended use and risk for each item, and apply validation and oversight in proportion. That work is needed under existing GxP rules whether or not the AI Act applies.
The two lists will overlap only a little. Treating them as one exercise, led by the AI Act, tends to produce a lot of legal analysis and very little validation. The inspector will ask about the validation.
For the practical detail, see the EU AI Act for life sciences.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.