Has AI Forever Changed Governance Around PV Technology Use?

Of the seven principles set out in the Council for International Organizations of Medical Sciences Working Group (CIOMS) XIV’s newly-published guidance on AI in pharmacovigilance, human oversight may be the one causing the most confusion.

The report was published at the end of 2025, following a comprehensive international consensus-driven process involving regulators, academic researchers and the life sciences industry.¹ Rather than try to ‘legislate’ for a particular technology, the guidance is organized around seven broadly applicable principles: a risk-based approach, human oversight, validity and robustness, transparency, data privacy, fairness and equity, and governance and accountability.

Among the findings harnessed in the hefty report is that an AI system’s trustworthiness cannot be established as a one-off exercise. It needs to remain true for as long as that system is in use. But what does that mean in practice? Where an earlier draft of the guidance was lighter on advice here (something raised during a consultation period), the finalized version sets out how the proposed framework fits within the regulatory and quality systems organizations already in use today. It also clarifies what is needed in the way of evidence for a system’s continued integrity.

Risk As the Ultimate Guide to Governance

The AI in PV framework gives strong emphasis to risk as underlying all of the principles collectively. That is, a risk-based approach should determine all other measures, in contrast to an all-encompassing strategy for keeping AI in check — which would be self-defeating. All other elements (the level of evidence, monitoring and paperwork a given AI use case demands) should be determined by what is at stake if AI were to fail. A drafting tool used for internal notes, and a system feeding directly into causality assessment, respectively warrant very different levels of scrutiny, the guidance notes.

It is this mindset that should guide approaches to human oversight and how this is measured, as part of a wider set of governance provisions. The existence of human oversight alone does not in itself ensure reliable output; it also needs to be adapted based on the identified risk. This is something companies are still getting to grips with.

When it comes to provisions around validity and robustness, the CIOMS guidance specifies the need for monitoring well beyond the point of launch, which again can be framed in the context of risk. An AI model’s inputs will vary from case to case, while prompts will evolve and change, along with the underlying AI model version. Validating a system once, just before a new AI use case goes live, isn’t enough then.

Deciding When an AI System Makes the Grade

So how can PV leads determine when a new AI use case is ready to be operationalized? The CIOMS guidance includes a practical tool for judging whether an AI use case is production-ready, in the form of a ‘governance grid’ (essentially a diagnostic facility). This helps decision-makers drill into such considerations as whether risk has been formally assessed, whether the oversight process has been properly articulated, and whether there is provision for governance to be reviewed regularly. As long as such criteria have been identified and are being addressed, there is no need to hold back progress.

On when to involve relevant PV subject experts, this too has been provided for in the guidance. After much to-ing and fro-ing on the topic, the Working Group decided in favor of SMEs’ early involvement (ideally from the concept stage of a new AI-oriented application project) to maximize the chances of anticipating and addressing any potential blind-spots with the proposed AI model before the real work starts.

Consciously Applying Trust Once Demonstrated

Among the guidance’s implications are those around ongoing approaches to manual review, and how teams adapt to performing those reviews only when necessary – when the instinct is still often to check everything just to be sure. The guidance (around the level or depth of human controls being gradually reduced as confidence in routine AI performance is evidenced to increase) could be interpreted as 12 consecutive months of solid, dependable results being a good enough gauge for scaling back manual reviews – e.g. to just those data extractions returned with markers for low confidence. Nothing has been formalized here though, and regulators’ acceptance will be crucial. For now, the CIOMS guidance calls for continued dialogue between the industry and regulators.

Beyond the domain of PV specifically, regulators are converging on similar thinking around risk, governance and AI, including the need for ongoing monitoring across a system’s deployed use over time. In early 2026, FDA and EMA jointly issued 10 guiding principles of their own, spanning AI use across the whole medicines lifecycle.²

Ultimately, trust in an AI system is not something that can be proven once and then assumed to remain stable. It must be demonstrated again with each new model version, each update, and for each year the system stays in production. Going forward, governance needs to be both all-encompassing and an ongoing discipline that organizations build directly into how they operate.

Jason Bryant is general manager of AI Platforms at ArisGlobal.

This article is based on a recent ArisGlobal AI Exchange podcast discussion with Denny Lorenz, an active member of the CIOMS XIV Working Group.

References

1. Council for International Organizations of Medical Sciences (CIOMS), ‘Artificial Intelligence in Pharmacovigilance’, CIOMS Working Group XIV report, Geneva, December 4, 2025. https://cioms.ch/working_groups/working-group-xiv-artificial-intelligence-in-pharmacovigilance/
2. European Medicines Agency and U.S. Food and Drug Administration, ‘EMA and FDA set common principles for AI in medicine development’, January 14, 2026. https://www.ema.europa.eu/en/news/ema-fda-set-common-principles-ai-medicine-development-0