What's Changed for AI in Pharma, and What to Watch Next
Two years ago, most conversations about AI in pharma asked whether a chatbot could write a SAS macro. That question has gone. The FDA now runs AI agents of its own and has agreed a shared set of principles with the EMA, and one of the biggest clinical data science conferences has filled its agenda with talks about trust, audit and accountability.
The PHUSE EU Connect 2026 agenda is the clearest snapshot. More than 50 sessions have AI, large language models (LLMs) or agents in the title, spread across a dedicated AI stream and almost every other stream besides. Many of those titles ask who checks AI-generated analyses, who authorised an agent’s actions, and how anyone can trust an agent in a regulated workflow.
What has changed
From assistants to agents
The first wave of AI in clinical programming was autocomplete and chat: paste in a spec, get back some code, check it by hand. Now around 15 PHUSE sessions are about agents, which read files, run code, inspect the output and try again, building SDTM mappings, ADaM specifications and TLFs.
Regulators have moved just as fast. In December 2025 the FDA made agentic AI available to all of its staff for pre-market review, post-market surveillance and inspections. The person reviewing your submission may well be working with an AI agent.
Tool access, through protocols such as the Model Context Protocol, is what makes agents useful, and also what makes them a governance problem. A model that can only talk cannot change your ADaM datasets. A model with tool access can.
Tool access can also make agents more trustworthy, if the tools supply facts the model would otherwise guess.
Our talk at PHUSE EU Connect
Colin Gillespie, CTO, Jumping Rivers (Tuesday 17 November, 11:00 to 12:30 GMT session, Boisdale 2)
An LLM coding assistant only knows the package releases that existed before its training cut-off. Diffify computes the differences between package versions with no LLM involved, and its MCP server passes those diffs to the assistant. The assistant updates code against what changed, and the team gets a list of what needs fixing and what is safe to leave alone.
Can't make the session? Colin is on stand 25 throughout the conference, and happy to show you the Diffify MCP server beta.
The same split works for agents in regulated work generally: tools supply the facts, and the model only reasons about them.
Regulators now share a vocabulary
“Waiting for regulatory clarity” has worn thin as a reason to hold back.
- September 2024 The EMA adopts its reflection paper on AI in the medicinal product lifecycle.
- January 2025 The FDA publishes draft guidance on AI to support regulatory decision-making.
- December 2025 The FDA makes agentic AI available to all of its staff.
- January 2026 The EMA and FDA jointly publish ten guiding principles of good AI practice in drug development.
None of these is a detailed rulebook, and the joint principles are voluntary for now. But they agree on the core ideas: define the context of use, scale controls to the risk, keep humans involved, document your data and model, and manage the system across its lifecycle. Teams that build to those ideas now will have less to undo when detailed guidance arrives.
Most pilots stall
For all the activity, most AI work in pharma has not reached everyday use. Bessemer and Bain’s 2026 healthcare AI survey found the share of pharma organisations piloting AI rose from 20% to 31% in a year, while production use moved from 5% to 6%.
A ZS survey of pharma technology leaders found only 40% of AI pilots reach scaled deployment, with neglected data quality and governance the most common reason initiatives fail.
That gap explains the tone at PHUSE. The most pointed sessions are about getting model output into a validated workflow and defending it to an auditor. One tackles shadow AI, where programmers use personal subscriptions because the approved route is slow or does not exist. Banning it rarely works; giving people a supported route that is logged usually does.
The foundations still decide the outcome
Some of the most useful PHUSE sessions barely mention models. They focus on metadata, standards and treating clinical data as a product, because AI performs only as well as what sits underneath it.
Language choice matters too. Agents work best in open, scriptable environments where every step is code that can be read, versioned and rerun. Teams that have moved analysis from SAS into R or Python, with validated packages and a clear view of package risk, find that AI slots into the work they already do. Teams still weighing up whether SAS is worth keeping now have another reason to decide.
What to look out for
If you are adopting AI in a regulated setting, these are the six things we would check before scaling anything.
Start with the context of use, not the tool. An agent drafting a first-pass ADaM spec for human review is a very different risk from one producing outputs that go straight into a submission. Write down the use case, the cost of failure and what success looks like before choosing a vendor.
Check that the human in the loop is doing something. A reviewer approving 200 AI-generated tables a day is not a control. Plan review capacity as carefully as you plan the automation.
Validate the code, and log how it was made. LLMs are not deterministic, but the R or Python code they produce is. Treat it like any other contribution, with version control, peer review and tests. Record the prompts, model versions and tool calls behind it, and rerun your checks when the model changes, because hosted models are updated on the provider’s timetable, not yours.
Know where your data goes. Be clear about what leaves your environment, which tools an agent may call and what it is allowed to write. Least-privilege access applies to models as much as to people.
Assume the reviewer has AI too. Inconsistent naming, unexplained derivations and gaps between analysis and narrative are easier to spot when regulators use AI on submissions, so clean, traceable outputs matter more than they did.
Protect the learning curve. Reviewing AI-generated code takes as much expertise as writing it. Decide how junior staff will build that expertise when the model writes the first draft. In the EU this is also a legal point: the AI Act requires organisations that use AI to take steps to build their staff’s AI literacy.
Where this leaves pharma
Agent capability is not what holds most teams back. Clean metadata and reproducible code decide whether AI output can go anywhere near a submission, and that still needs people who understand the work well enough to check it.
At Jumping Rivers we help pharma and other regulated organisations put those foundations in place, from AI and LLM projects to package validation with Litmus. If you are working out how AI fits into your clinical programming, get in touch, or if you are at PHUSE EU Connect, come and find us on stand 25.
