AI in life sciences and medtech: regulated, evidenced and ready to scale

Life sciences and medtech organisations were early to experiment with AI: in drug discovery, clinical trial operations, manufacturing quality, pharmacovigilance and medical devices themselves. The challenge now is not experimentation. It is scaling AI inside processes and products that are regulated, audited and safety-critical.

The organisations that scale fastest are not those with the most pilots. They are the ones that treat AI with the same discipline they already apply to quality and compliance.

Two kinds of AI, two levels of control

It helps to separate AI into two broad groups:

• AI in the business — tools that support research, operations, regulatory writing, commercial teams and back-office work.
• AI in regulated processes and products — AI that affects product quality, patient safety or regulatory submissions, including AI within or as a medical device.

The first group needs good governance and proportionate controls. The second needs validation, change control and evidence that will satisfy regulators and notified bodies. Mixing the two leads either to over-controlled productivity tools or under-controlled regulated ones.

The regulatory picture is settling

The rules for AI in regulated health products are becoming clearer across major markets:

• European Union: AI that is part of, or is itself, a medical device regulated under the MDR or IVDR is treated as high-risk under the EU AI Act. Following the 2026 Digital Omnibus amendments, those obligations apply from 2 August 2028, alongside existing device requirements.
• United States: the FDA has finalised guidance on predetermined change control plans for AI-enabled device software, allowing manufacturers to agree in advance how a model may be updated after authorisation.
• United Kingdom: the MHRA is developing its approach to AI as a medical device, including a regulatory sandbox, the AI Airlock, to test how novel AI devices should be regulated.

The common thread is lifecycle control: regulators want to know how a model was built, how it performs, how it will change and how it will be monitored.

Validate for the intended use

Validation is where many AI initiatives slow down. Traditional computer system validation was designed for software that behaves the same way every time. AI models are probabilistic and can drift. A proportionate approach focuses effort where risk is highest:

• define the intended use and the decisions the AI supports;
• assess risk based on the impact of a wrong output on patients, product quality or data integrity;
• test performance on data representative of real use, including relevant subgroups;
• document limitations clearly, so users know where not to rely on the output.

Risk-based approaches such as computer software assurance help teams spend validation effort where it matters, rather than producing documentation for its own sake.

Plan for change from the start

The most common surprise for teams scaling AI is the cost of change. Models need retraining, data sources evolve and performance shifts over time. Build change control into the design:

• agree which changes require revalidation and which can be made within pre-defined limits;
• monitor performance in use and set thresholds that trigger review;
• keep a clear record of model versions, training data and decisions;
• make sure suppliers of AI components can support your change control and audit needs.

Keep data integrity at the centre

Regulators have long expected data to be attributable, legible, contemporaneous, original and accurate. AI does not change that expectation; it extends it to training data, prompts, outputs and model versions. Where AI tools touch regulated records, the audit trail needs to show what the AI did, what a human reviewed and what decision was made.

Where to start

For most organisations, three steps create momentum without creating risk:

• Inventory every AI use, classify it as business or regulated, and name an owner.
• Standardise a proportionate validation and change-control approach for regulated AI, agreed with quality and regulatory teams.
• Evidence value and performance from the first deployment, so the case for scaling is built on data.

AI will change how medicines and devices are discovered, made and monitored. The organisations that benefit most will be those that can show regulators, partners and patients that their AI is controlled, validated and doing what it claims.