Life sciences companies are putting AI agents into laboratories, clinical operations, pharmacovigilance and quality systems, where every record they touch may be GxP data and every probabilistic answer meets regulations written for deterministic software. An agent that drafts a deviation report, reconciles clinical trial data or triages adverse event cases is acting inside a validated process, and inspectors will ask who did what, under which identity, and how anyone knows the output is fit for use. This guide covers what is distinctive about agents in GxP settings: deciding whether a use is GxP critical, how Part 11 identity and audit trail rules apply to agent actions, how to validate an agent workflow, how to scope its access to research and patient data, and how to monitor it. It is written for life sciences CISOs, computerised system validation leads, quality assurance and R&D informatics teams. The security baseline for regulated sites, including Part 11, Annex 11 and data integrity guidance, is in the Pharma and GxP Cybersecurity Guide; this page builds on it and does not repeat it.
Source note: regulatory points summarise the cited official texts with status checked on 12 November 2026. EU GMP Annex 22 and the revised Annex 11 are drafts; confirm status before relying on them. Confirm against the official text before relying on it.
Key takeaways
- Classify the use before you build. The draft EU GMP Annex 22 says generative AI and large language models should not be used in critical GMP applications, and FDA's January 2025 draft guidance scopes out internal workflows that do not affect patient safety, quality or study reliability. Where an agent sits decides everything else.
- An agent can act, but it cannot sign. 21 CFR 11.100(a) makes each electronic signature unique to one individual, so review, approval and release stay with qualified people, and the agent's own actions must be attributable to its own identity in the audit trail.
- Validate the workflow, not just the model. Deterministic guardrails, tool permissions, retrieval sources and the human review step are what you can specify and test; the language model is a component whose outputs a qualified person checks.
- Research data needs boundaries the agent cannot cross. Blinded trial data, patient-level records, held-back test sets and confidential compounds need access controls enforced in the source systems, not in instructions.
- Model and prompt changes are GxP changes. Model versions, system prompts, tool definitions and retrieval indexes go under change and configuration control, with a retest decision recorded for each change.
Where agents sit in life sciences
The same model can be harmless in discovery and inspection-critical in batch release. The table maps typical 2026 uses to their regulatory weight.
| Area | Typical agent tasks | Regulatory context | Typical criticality |
|---|---|---|---|
| Discovery research | Literature search, target and compound analysis, running analysis code, summarising assay results | Mostly outside GxP; FDA's draft AI guidance excludes drug discovery; intellectual property and data protection still apply | Low GxP, high confidentiality |
| Nonclinical studies | Data processing, report drafting from study data | GLP where results support submissions | Medium to high |
| Clinical operations | Site queries, data reconciliation, protocol deviation detection, trial master file filing | ICH E6(R3) GCP; patient data protection | Medium to high |
| Pharmacovigilance | Case intake, duplicate detection, coding, narrative drafting | GVP; reporting timelines; patient data | High |
| Regulatory writing | Drafting sections of submissions from approved sources | FDA's draft guidance scopes out drafting submissions where reliability is unaffected; content accuracy is still the sponsor's responsibility | Medium |
| Manufacturing and QC | Deviation and CAPA drafting, batch record review support, trend analysis, laboratory data review | GMP, Part 11, Annex 11, draft Annex 22 | High; critical uses exclude generative AI under the Annex 22 draft |
| Quality management | SOP search, change request triage, audit preparation | GMP documentation rules | Low to medium |
Agents in hospitals and digital health products are covered in the AI Security in Healthcare Guide.
Classifying an agent use: critical, non-critical or out of scope
Two regulator documents give the vocabulary. The European Commission's draft Annex 22 (consultation 7 July to 7 October 2025) applies to AI models in medicinal product and active substance manufacturing where they affect patient safety, product quality or data integrity. It covers only static models with deterministic outputs, states that it "does not apply to Generative AI and Large Language Models (LLM)", and says such models "should not be used in critical GMP applications". In non-critical applications, qualified and trained personnel must always be responsible for the suitability of the output. FDA's draft guidance Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products (January 2025) uses a context of use and rates model risk from two factors: model influence (how much the AI output contributes relative to other evidence) and decision consequence (how serious a wrong decision would be).
| Question | If yes | If no |
|---|---|---|
| Does the agent's output directly decide or change something affecting patient safety, product quality or data integrity (release, disposition, a GxP record of fact)? | Critical. Under the Annex 22 draft, no LLM-based agent; use a validated deterministic system or a person | Continue |
| Does a qualified person review every output before it has GxP effect? | Non-critical with human in the loop: document the operator's responsibility and monitor review quality (Annex 22 draft 3.3 and 10.5) | Redesign so a person reviews, or treat as critical |
| Does the output support a regulatory decision on safety, effectiveness or quality? | Apply FDA's credibility assessment for that context of use | Continue |
| Is it discovery work or an internal workflow with no effect on patient safety, quality or study reliability? | Outside these GxP documents; apply security, confidentiality and data protection controls | Re-examine the classification |
Record the classification, its rationale and the approving quality representative in the system inventory. Re-run it whenever the agent gains a tool or a new data source, because a read-only drafting assistant that gains write access to the quality system has changed category.
Part 11 and agent identity
21 CFR Part 11 was written for people operating systems, but its controls map cleanly to agents once the agent is treated as a distinct system user with no signing authority.
| Part 11 requirement | What it means for an agent | Control |
|---|---|---|
| 11.10(d) limiting system access to authorised individuals; 11.10(g) authority checks | The agent is an authorised system user with the narrowest role that fits its task | Dedicated agent account per agent role in each GxP system; no shared service account; access reviewed with other GxP accounts |
| 11.10(e) secure, computer-generated, time-stamped audit trails of record creation, change and deletion | Every record the agent creates or changes is attributed to the agent, not to the person who started it | Agent writes under its own identity, with the requesting person captured as a second field; audit trail protected from the agent's account |
| 11.10(i) people who develop, maintain or use systems have education, training and experience | Reviewers of agent output need training on the agent's limits and failure modes | Training records for reviewers; competence checks on detecting agent errors |
| 11.50(a) signed records show name, date and time, and meaning (review, approval, responsibility, authorship) | An agent may be the author of a draft, but approval and responsibility signatures are human | Workflow blocks signature steps for agent identities; drafts clearly marked as agent-prepared |
| 11.100(a) each electronic signature unique to one individual | An agent can never apply a person's signature or use their credentials | No agent access to signature credentials; no agent acting inside a person's session |
The common mistake is an agent that operates inside a scientist's or reviewer's session, so the audit trail shows the person creating records they never wrote. That breaks attributability, the A in ALCOA. Give each agent role its own identity and, where the GxP system supports it, record both the agent and the person it acted for. See the Agent Identity and Access Guide and the Service Account Security Guide.
Validating an agent workflow
Agents are not static models, so traditional validation of the model alone does not work. The practical approach is to validate the deterministic parts and control the probabilistic part by human review, using the draft Annex 22 elements as a checklist even where it does not formally apply.
- Intended use and input space: describe what the agent does, the inputs it will see (document types, data sources, languages), its limitations and expected erroneous inputs, approved by a subject matter expert (Annex 22 draft section 3).
- Acceptance criteria: define metrics before testing, for example extraction accuracy on a labelled set, false negative rate for adverse event detection, or rate of unsupported statements in drafts, and require performance at least as good as the process it replaces (section 4).
- Independent test data: keep test sets separate from anything used to build prompts, examples or retrieval indexes, with access control and audit trails on the test set, and separate the people who built the agent from those who hold the test data or use four-eyes working (section 6).
- Deterministic guardrails under test: tool permissions, input validation, output schemas, refusal of out-of-scope requests and the human review step are specified and tested like any configured system.
- Confidence and abstention: where the agent or its components give confidence, set thresholds below which it flags "undecided" rather than proposing an answer (section 9).
- Credibility evidence for regulatory use: for outputs that support regulatory decisions, follow FDA's seven steps: question of interest, context of use, model risk, credibility plan, execution, documentation of results and deviations, and an adequacy decision.
- Change and configuration control: model version, system prompt, tool definitions, retrieval index and guardrail code are configuration items; each change gets a documented retest decision (section 10.1 and 10.2). Pin model versions; a provider updating the model behind an alias is an uncontrolled change.
- Performance and drift monitoring: sample outputs against metrics on a defined schedule and check inputs remain inside the intended input space (sections 10.3 and 10.4).
The AI Model Change Approval Template and the AI Model Risk Management Guide provide supporting structures. The FDA and EMA Guiding Principles of Good AI Practice in Drug Development (14 January 2026) point the same way, with principles including a clear context of use, a risk-based approach, data governance and documentation, risk-based performance assessment and life cycle management.
Research and patient data access
Agents are most useful where they can read widely, which is exactly what research data rules restrict. Enforce these boundaries in the data platforms, not in prompts.
| Data | Risk with agents | Control |
|---|---|---|
| Blinded clinical trial data | An agent with access to unblinded data leaks treatment allocation into drafts or queries seen by blinded staff | Separate agent identities for blinded and unblinded roles; retrieval indexes built per blinding status |
| Patient-level clinical and safety data | Re-identification, disclosure in outputs, transfer to an unapproved model provider | Pseudonymised data by default, approved processing locations, no patient data in prompts to unapproved services, output review |
| Validation test sets | Test data leaks into prompts or examples, inflating measured performance | Test data repository with access control and audit trail; agent build identities have no access |
| Confidential compounds and unpublished results | Exfiltration through tool calls or provider retention | Contractual no-training and retention terms, egress controls, per-project access scopes |
| Partner and CRO data | An agent mixes data across sponsors or studies | Per-study scopes; agents bound to one study context per session |
- Retrieval follows source permissions: an agent's retrieval should return only documents the requesting person may already see. See the RAG Security Guide.
- GCP still applies: ICH E6(R3) principles and Annex 1 came into effect in the EU on 23 July 2025, and Annex 2, covering decentralised elements and real-world data sources, takes legal effect on 15 January 2027. Agents in trial processes sit inside the sponsor's GCP quality system.
- Data access governance: treat each agent as a data consumer with an owner, purpose and approved data sets. See the Data Access Governance Guide.
Threats specific to life sciences agents
- Injected instructions in scientific and safety inputs: adverse event reports, literature PDFs, supplier certificates and site emails are untrusted content (OWASP LLM01:2025 Prompt Injection). A manipulated case report could push a triage agent to downgrade seriousness.
- Record manipulation: an agent with write access to LIMS, quality or safety databases can alter GxP records through error or manipulation (ATT&CK T1565.001 Stored Data Manipulation).
- Research data theft: broad read access makes an agent identity a high-value target for collecting research repositories (ATT&CK T1213 Data from Information Repositories; T1078 Valid Accounts when agent credentials are stolen).
- Unsupported content in submissions: drafts that state facts not present in the source data (OWASP LLM09:2025 Misinformation).
- Excessive agency in the quality system: an agent that can close deviations or approve changes (OWASP LLM06:2025 Excessive Agency).
Implementation: a phased rollout
- Inventory and classify: list every agent and AI feature in R&D, clinical, safety, quality and manufacturing platforms, including supplier-enabled features, with the classification above, owner and quality approver. Record it in the AI agent registry.
- Start outside GxP: discovery and internal knowledge uses build experience with identity, logging and data controls without validation burden.
- Design identities and boundaries: per-role agent accounts in each GxP system, signature steps blocked, study and blinding scopes, protected audit trails.
- Validate non-critical GxP uses: intended use, acceptance criteria, independent test data, guardrail testing and a defined human review step, documented in the validation package.
- Pilot with full review: every output reviewed; measure reviewer correction rates and errors the review caught.
- Operate under change control: pinned model versions, retest decisions for every configuration change, periodic review with other computerised systems.
- Rollback: the manual procedure stays current and staff stay trained on it, so the agent can be switched off without stopping the process; a kill switch revokes agent credentials across systems.
Smaller companies: a biotech without a large validation team should keep agents in discovery and non-GxP work, buy GxP-ready platforms with supplier validation evidence, and require contract terms for model version notice, data retention and audit trail export. Large sponsors need a cross-functional AI quality board that signs off classifications and changes.
Detection and measurement
- Boundary breaches: agent queries outside assigned studies, access to unblinded or test data repositories, attempts to reach signature functions.
- Record changes: agent writes to GxP records outside the expected transaction types or volumes.
- Configuration drift: a model, prompt or tool definition in production that differs from the validated configuration.
- Review quality: reviewer approval times and correction rates per reviewer and per agent.
| Metric | What good looks like |
|---|---|
| GxP agent uses with a documented, quality-approved classification | 100% |
| Agent-created GxP records attributable to an agent identity | 100%; zero agent actions under personal accounts |
| Production agent configurations matching the validated baseline | 100% at each periodic check |
| Reviewer correction rate on agent outputs | Stable and non-zero; a fall to zero may mean rubber-stamping |
| Configuration changes with a recorded retest decision | 100% |
| Errors found by sampling after review (escaped defects) | Within the acceptance criteria set at validation |
Framework mapping
| Control area | GxP reference | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Agent inventory and classification | Annex 22 draft section 3; FDA context of use | ID.AM-02 | CM-2 | A.5.9 |
| Agent accounts and authority checks | 21 CFR 11.10(d), 11.10(g) | PR.AA-05 | AC-3, AC-6, IA-2 | A.5.15, A.5.18 |
| Audit trails and attribution | 21 CFR 11.10(e) | PR.PS-04 | AU-9, AU-10 | A.8.15 |
| Validation and testing | Annex 22 draft sections 4 to 7 | ID.IM-02 | SA-11 | A.8.29 |
| Change and configuration control | Annex 22 draft section 10 | PR.PS-01 | CM-3, SI-7 | A.8.9, A.8.32 |
| Performance and drift monitoring | Annex 22 draft sections 10.3 and 10.4 | DE.CM-09 | SI-4 | A.8.16 |
Common failure patterns
- Agents inside personal sessions. The audit trail shows a scientist creating records the agent wrote, so attributability fails at inspection.
- Classification by enthusiasm. An LLM-based agent is placed in a critical decision path, such as batch disposition support, without checking the draft Annex 22 position.
- Unpinned models. The provider updates the model behind an alias and a validated agent changes behaviour with no change record.
- Test data in the prompt. Examples drawn from the test set make the agent look more accurate than it is.
- Review in name only. Reviewers approve drafts in seconds, so "human in the loop" exists on paper but not in practice.
- One retrieval index for everyone. Blinded and unblinded documents, or several sponsors' studies, sit in one index behind one agent identity.
Practitioner checklist
- Classify every agent use as critical, non-critical with human review, or outside GxP, and have quality approve it.
- Keep LLM-based agents out of critical GMP decisions while the Annex 22 draft position stands.
- Give each agent role its own account in each GxP system and block it from signature steps.
- Record agent and requesting person in audit trails; never let agents use personal sessions.
- Validate intended use, acceptance criteria, independent test data and guardrails before GxP use.
- Put model versions, prompts, tools and indexes under change and configuration control.
- Scope agent data access by study, blinding status and project in the source systems.
- Monitor review quality, configuration drift and agent writes to GxP records.
- Keep the manual procedure current so the agent can be switched off safely.
Standards and references
- European Commission: EudraLex Volume 4 Annex 22 Artificial Intelligence (consultation draft)
- European Commission: Stakeholders' consultation on EudraLex Volume 4, Chapter 4, Annex 11 and Annex 22
- eCFR: 21 CFR Part 11 Electronic Records; Electronic Signatures
- FDA: Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products (draft)
- FDA: Guiding Principles of Good AI Practice in Drug Development
- EMA: ICH E6 Good Clinical Practice Scientific Guideline
- European Commission: EudraLex Volume 4 GMP Guidelines
Related NHI Mgmt Group resources: Pharma and GxP Cybersecurity Guide, AI Security in Healthcare Guide, Agent Governance and Risk Guide, AI Model Risk Management Guide. This guide summarises regulatory texts and drafts and is not legal or regulatory advice.