AI has the potential to reduce the considerable time and effort involved in preparing regulatory submissions, particularly in chemistry, manufacturing, and controls (CMC), where data is often fragmented across systems, formats, and external partners.

However, an important distinction must be made between using AI as an operational aid for drafting, organizing, or retrieving content and using it to generate information that supports regulatory decision-making. The latter demands greater scrutiny because it can influence assessments of a product’s safety, effectiveness, or quality.

Against the backdrop of the FDA’s draft guidance, we spoke with Aishwarya Balajee, Scientific Data Management and CMC Expert at Zifo, to better understand where the industry stands today, where AI could make the greatest difference in CMC regulatory authoring, and how organizations can balance speed with data credibility, traceability, human oversight, and patient safety.

1. To begin with, what is the central idea you want to convey through this discussion? What is changing in regulatory submissions, and where does AI come into the picture?

Aishwarya Balajee (AB): Regulatory submissions have always been part of the process. INDs, BLAs, and NDAs are not new. They have always served as stage gates through which a potential drug candidate becomes a real product for patients.

What has emerged now is the possibility of using AI to reduce the time and effort required from the many people involved in preparing these submissions. GenAI, in particular, is proving useful for working with text, and that has gained considerable traction.

Every Biopharma company has a large group of people who put significant effort into making these submissions robust. The submission is what regulators examine to understand and assess the years of work that have gone into developing a drug. It must therefore be accurate and represent every important detail involved in creating that product.

The industry has already evolved from CTD to eCTD, with electronic portals and increasingly digitized data within sponsor organizations. All of this leads to the question: Can we use AI to accelerate the authoring of these sections?

Regulatory authoring is not an easy area in which to use AI because information cannot be invented. These submissions directly affect regulatory decisions and patient safety. The FDA’s draft guidance indicates that the agency is considering how AI can be used in the regulatory space. The crucial question is how the appropriate guardrails should be established.

The guidance discusses the credibility of data and AI model outputs, along with the need for appropriate review. That review can be subjective because each organization’s quality function must determine which sections require human review and what level of review is necessary.

It would be inefficient to manually repeat the entire process simply to verify what the AI has done. At the same time, organizations cannot allow AI to do everything without sufficient oversight. We need to find a middle ground.

To summarize, the rise of AI has raised the possibility of accelerating regulatory document authoring. The FDA is providing indications that AI can be used, but it must be used with caution. That caution depends heavily on credible data, clearly defined contexts of use, and appropriate review. This brings us to why data is so important in CMC.

2. The FDA guidance is still in draft form and contains nonbinding recommendations. How likely is it that the final guidance will depart significantly from the current version? For instance, requirements around data provenance and credible data sources are unlikely to disappear, correct?

AB: Yes, the final guidance is still awaited, and the current recommendations are nonbinding. However, some of the fundamental principles are unlikely to change significantly. The need to establish the credibility of AI model outputs and use credible data sources is fairly obvious, but the fact that these expectations are coming from the FDA is important.

The draft has reduced some of the scepticism about whether organizations should use AI. Companies are now less likely to dismiss AI outright because the FDA is effectively saying that it can be used, provided that it is used with appropriate caution.

The guidance is broad and establishes relatively fundamental expectations. It says that organizations must establish the credibility of AI model outputs, use credible data, define their processes, and explain how data is integrated and used. In that sense, the guidance helps the industry see that the FDA is open to the use of AI.

3. Some of the FDA’s recommendations may appear self-evident at a conceptual level. Most people would agree that data sources must be credible, for example, but practices may differ significantly between organizations. How, in practice, can an organization determine whether a data source is credible?

AB: That is where the quality assurance function within each organization plays an important role. QA determines the extent of the controls that need to be put in place.

We are sometimes seeing QA functions being more stringent than the regulators themselves because they want to be certain that accelerating a process will not lead to additional questions or an unfavorable review from the FDA. The organization’s QA function therefore has to establish the appropriate guardrails.

Service providers also have a significant role to play. We work with the data sources, help design some of them, and integrate data from different systems. Ensuring that information is accurately mapped from its source to its destination is a major step, and that mapping must be thoroughly verified.

This can be done through human review or an automation framework. If automation is used, the framework itself must be tested to establish that it is doing its job correctly.

From the perspective of credible data, there should be no point in the process at which someone can alter the data without authorization or traceability. Suppose information is extracted from a PDF into an Excel file. If people can freely edit that Excel file, the process may not be accepted by regulatory QA.

There must be controls to ensure that no one can change the underlying data except through authorized activities such as mapping or standardization. Those activities must also be clearly defined and thoroughly justified.

4. Is that where the “human in the loop” comes into the picture, with QA playing a key role? Do Biopharma companies already have people performing this type of review?

AB: Yes. Regulatory functions within pharmaceutical companies generally have a QA component. These teams review the data, verify whether the source is credible, and ensure that it comes from a system or process that can be trusted.

They also consider applicable expectations relating to data integrity and validation, including ALCOA principles, GMP requirements, and 21 CFR Part 11, where relevant.

AI now gives them an additional responsibility. QA teams must understand the credibility of AI models, the possibility of hallucinations, and which kinds of models are suitable for particular uses. That requires an additional level of expertise because they must help determine which models can be used, under what circumstances, and with what controls.

5. AI is being used across the Biopharma value chain. On the clinical side, data collection and submission are more standardized, and data capture is comparatively mature. Given that the FDA guidance applies more broadly, is CMC the most important area for the application of AI in regulatory submissions? Could Module 3 be described as the linchpin holding everything together?

AB: I would not describe it that way. I consider CMC, clinical, preclinical, and toxicology data equally important to a regulatory submission. From the regulator’s perspective, these elements form one complete story.

A company has developed a compound, and the regulator wants to understand its toxicity and how those levels were established. The regulator then needs to understand how the company developed a process to manufacture it, whether that process is credible, and whether it can consistently produce comparable batches. Finally, the regulator needs to understand how the product performed in humans.

It is therefore a holistic story. I would not say that one part is inherently more important than another.

However, in the context of using AI for regulatory authoring, the clinical space is easier to standardize. There are established ways of collecting clinical data and long-standing standards governing how clinical study reports and related submissions should be prepared.

AI can accelerate work in the clinical space, but in my opinion, it may not be as transformative there. The potential for AI to move the needle is greater in CMC because so many processes remain manual, the data sources are highly variable, and the destination is less standardized.

Module 3 has defined sections, but within those sections, there is not always the same level of standardization at the level of individual data variables and fields that exists in clinical data.

AI can therefore play a substantial role in CMC regulatory authoring, accelerating submissions and helping teams assemble data. However, organizations must be very careful about the boundaries they set for AI. Patient safety is involved, and the information examined by regulators must be accurate. There can be no fabricated or hallucinated data and nothing that presents an incorrect account of the product or process. Validating that the correct data has been represented is critical.

6. What are the main CMC data challenges that companies continue to encounter?

AB: At a broad level, one of the main challenges is the complexity of defining manufacturing processes. Processes are not the same between companies. Although standards such as ISA-88 exist, every process and every recipe can be different. What an organization manufactures, and the steps it uses to manufacture it, may be unique. This becomes even more complicated with newer modalities.

Another significant challenge is that CMC data comes from multiple organizations. Pharmaceutical companies work with numerous CDMOs and CMOs, and each may provide data in its own format and terminology. Information may arrive as images, scanned documents, descriptions, or records in different languages. This diversity, combined with the lack of detailed common standards, makes integration difficult.

A major issue at the heart of CMC data is batch genealogy, meaning the complete journey of a batch. From a regulatory perspective, you need to understand what happened to the batch, where it originated, what it produced, how it was made, which controls were used, and what yield was achieved.

A batch can have parent, child, and related batches, creating an entire genealogy that must be reconstructed and understood. Establishing that journey is a major challenge for many organizations.

The second major issue is process knowledge. Process information is rarely maintained in one place. It is extensive, accumulates over time, and does not fit neatly into a single template or database.

As a result, many companies are now investing in CMC data platforms, warehouses, or broader data landscapes that can bring process knowledge together and make it more usable.

7. Considering these challenges, AI could have a much greater impact on CMC. What kind of practical change could AI bring to CMC? Also, when the FDA’s proposed guidance and the increased use of AI come together, do you see them creating friction, or will they be complementary?

AB: I see the FDA’s release of the draft guidance as a signal to Biopharma companies to be bolder and take steps toward using AI. Many companies have been sceptical. The fact that the FDA has released a framework helps them consider AI as a genuine possibility.

Without guidance from regulators, the industry would be reluctant to use AI in regulatory processes. Companies would continue relying on manual processes because they would not have sufficient confidence to move forward. The release of the draft guidance is therefore a positive sign.

As for the practical change AI can bring to CMC, regulatory and CMC teams currently invest a significant amount of time in assembling and authoring submission content. That creates a substantial logistical burden.

AI could support the integration, mapping, extraction, standardization, and preparation of data. In smaller-scale examples involving documents from four or five CDMOs, work that could take more than a month when performed manually can sometimes be completed in days.

That shift is real. Even after adding human review, risk-based checks, and the guardrails expected by the FDA, organizations could still accelerate the work substantially. My estimate would be a reduction of about 30% to 50% in certain activities, but that is based on experience and conversations rather than a formally established industry benchmark.

There is an important caveat. Organizations must invest in cleaning and improving their data sources. Traditionally, there has not been enough investment in the CMC data ecosystem or in modernizing the processes that produce CMC data.

Some organizations still work with batch records that run to hundreds of pages, including scanned PDFs and handwritten signatures. Without investment in the underlying CMC data landscape, companies will not achieve the level of improvement that AI could otherwise deliver.

8. The FDA guidance may provide a framework and give the industry greater confidence, but companies have continued operating with their existing manual systems. Drugs are still being developed and launched despite the inefficiencies. Is there a sufficient incentive for companies to undertake the difficult “plumbing” work of modernizing their CMC data systems?

AB: If modifying a source system could disrupt an ongoing program, companies are unlikely to touch it. That risk is real.

Adoption is therefore likely to begin with legacy data. Organizations can use historical data to test whether new approaches to data generation, mapping, integration, and authoring work as intended. They are unlikely to begin by using these methods for an active IND submission or by changing an ongoing program.

The more practical approach is to experiment with older data, establish that the process works, and then apply it to a new program before that program begins. There are ways to manage and stagger an implementation like this, but it will take several years.

I do not see widespread reluctance based on the belief that existing processes are good enough. Many CMC and regulatory professionals recognize that the current situation is not ideal. They do not want to continue working in this way indefinitely and genuinely want change.

The concern is that touching something already in operation could break or disrupt it. That concern is valid, but it can be addressed through a carefully phased implementation.

9. In that case, might adoption accelerate once one large Biopharma company demonstrates a clear breakthrough, creating competitive pressure for others to follow?

AB: Yes, that is possible. If a large Biopharma company demonstrates a successful use case and makes the results visible, it can create momentum across the industry.

Other companies may see that AI-enabled regulatory processes are producing measurable improvements and feel pressure to respond. That combination of demonstrated value, competition, and fear of missing out can help accelerate adoption.

10. Looking further ahead, could Module 3 eventually become a continuously generated expression of CMC data, rather than something assembled periodically from fragmented information?

AB: For the sake of the industry and patients, that should be the ideal outcome. However, the reality is still quite far from it.

CMC development is not a linear process. It includes multiple decision points, input from external parties, and information arriving from different systems and organizations. There is considerable variation because each pharmaceutical company may use its own unique process to manufacture a drug.

All these sources and decision points would need to be streamlined before continuous generation could become practical. Those challenges mean that we are still some distance from making it a reality.

Ideally, teams would be able to focus on executing the manufacturing and development processes while the associated data automatically aligns, organizes itself, and flows into the relevant submission sections. That would be a valuable outcome, but considerable foundational work is still required.