ReflectivAI

Request Demo

← All insights

· 5 min read · Tony Abdelmalak

The Compliance-Audit Clock Is Ticking: MHRA, FDA, and EMA Now Expect Active AI Governance—Not Later

At a 2026 industry conference, MHRA's David Brown delivered an unambiguous message that AI governance is a present, not future, regulatory requirement, and that inspectors are already asking about it.

The Clock Everyone Keeps Pretending Isn't Running

Everyone is talking about Annex 22.

Very few people are talking about what's already happening without it.

Teams are treating AI governance like a compliance deadline on a calendar, something to prepare for once the EU finalizes its rules. Meanwhile, inspectors in the UK and the US are already asking questions, writing warning letters, and documenting the cost of getting this wrong. The guidance isn't finished. The enforcement already is.

MHRA Said It Plainly, In Public, On Stage

At a 2026 industry conference, MHRA's David Brown communicated a clear position on AI governance. According to Total Delivery Pharma's coverage of Making & Distributing Pharma 2026, the agency's message was that ⟦Q"Effective AI governance is a present regulatory requirement. It is not something organisations can schedule for a future sprint or defer until Annex 22 is finalised. Inspectors and auditors are asking questions about it now."⟧

That's a direct answer to the most common industry defense. Brown also communicated that ⟦Q"The proposition that AI is simply a tool, and therefore sits outside the scope of commercial governance, is not a defensible position. The requirement to govern AI usage exists now. Annex 22 is not the starting gun,"⟧ per the same conference coverage.

Not later. Now.

The Inspectors Already Have the Receipts

Two months after that conference, the MHRA Inspectorate put it in writing. In a June 2026 blog post, the agency made clear this isn't about banning AI from the inspection process. ⟦Q"Our concern isn't whether you use AI; it's whether your submissions are accurate, verifiable, and prepared under appropriate oversight,"⟧ the MHRA Inspectorate communicated.

Oversight isn't optional. The blog described a real case where AI-assisted drafting didn't save time. It multiplied the work. ⟦Q"The contents of this response required review from multidisciplinary teams, as well as a full analysis of previously issued MHRA guidance, resulting in the time needed to review and respond increasing from around 4 hours to over 20 hours,"⟧ the agency wrote.

Four hours became twenty. That's not efficiency.

According to ECA Academy's coverage of MHRA's expectations, inspectors ⟦Q"have also encountered responses containing references to MHRA guidance that doesn't exist, citations of inappropriate regulatory frameworks, and responses to serious deficiencies that appear designed to mislead rather than address underlying problems."⟧

Fabricated guidance. Misleading responses. This is documented behavior, not a hypothetical risk.

The FDA Made It Enforceable

Governance language is one thing. A warning letter is another.

On April 2, 2026, the FDA issued what Kneat called a regulatory first: a warning letter to Purolea Cosmetics Lab that ⟦Q"marks a regulatory first,"⟧ explicitly naming inappropriate AI use as a cGMP violation. The firm had used AI agents to draft critical quality documents, drug specifications, SOPs, and master production records without the review that's supposed to catch exactly this kind of problem.

According to MasterControl's reporting on the letter, the company appears to have failed to implement adequate human review or validation of AI-generated documents before they were incorporated into the regulatory record.

Not that AI was used. That nobody checked its work before it became part of the regulatory record.

"Later" Was Never Real

Annex 22, the EU's first dedicated GMP annex addressing AI, genuinely isn't final yet. Eupry reported that ⟦Q"the public consultation closed on 7 October 2025 and drew roughly 1,300 comments, which the working group is now working through,"⟧ with finalization targeted for the end of 2026. IntuitionLabs confirmed that as of its August 2026 publication, ⟦Q"draft Annex 22 remains unadopted... and as of the report's August 2026 publication date no final guidance has replaced it."⟧

The draft is real. The delay is real. But regulators aren't waiting on it to act.

The FDA built its own framework well before any AI-specific rule was finalized. Its January 2025 draft guidance, according to DLA Piper, ⟦Q"provides recommendations on how FDA plans to apply a risk-based credibility assessment framework to evaluate the use of artificial intelligence (AI) models that produce information or data intended to support regulatory decision-making regarding safety, effectiveness, or quality of drugs and biological products."⟧

The agencies were never waiting for permission. They were building the expectation in public, then checking who was paying attention.

What This Actually Means for Commercial Teams

Most AI governance conversations in life sciences stop at content generation. Did a model draft this regulatory response accurately? Did someone review the SOP before it shipped?

That's necessary. It's not enough.

The same governance gap exists in commercial conversations, the ones happening between reps and HCPs, where judgment calls get made in real time and almost none of it is visible after the fact. If regulators expect oversight on a drafted document, the same logic eventually reaches how commercial teams make and document judgment calls in the field. Not because a rule says so yet. Because the standard already does.

That's the premise behind what we're building at ReflectivAI: Signal Intelligence, a way to make the judgment inside high-stakes conversations visible, measurable, and human-led, rather than something a team assumes happened and hopes was right. We're early. This is pilot and roadmap work.

But the direction is clear. Inspectors aren't asking whether you used a tool. They're asking whether anyone was watching while you used it.

If an inspector asked your team today to show the oversight behind a judgment call made last month, could you?

Sources