Why compliance teams are turning to AI and automation
Regulatory work is mostly reading and checking: new rules against current procedures, submissions against requirements, records against standards. The volume keeps growing. In PwC’s Global Compliance Survey 2025, “85% of survey respondents stated that compliance requirements have become more complex in the last three years” (PwC). For regulated life sciences companies, 2026 alone brought FDA’s QMSR, mandatory EUDAMED modules, ISO 9001:2026 and pending EU GMP annexes on computerized systems and AI.
Adoption is real but uneven. PwC found “just under half (46%) reported piloting or using AI in data and predictive analytics,” while “32% of respondents said they are not currently piloting or using AI for any compliance activities.” Most are optimistic: “the majority of respondents (71%) believe that AI will have a net positive impact overall on compliance” (same source). KPMG, citing a Compliance Week survey, reports that “more than half (56 percent)” of chief compliance officers used AI in 2024 (KPMG).
Gartner adds a note of caution. Its analyst calls GenAI and automation “critical to managing the escalating complexity of global regulations and risk,” but warns that early adoption “will likely result in a period of disillusionment before we see widespread, productive legal use cases” (Gartner).
Automation vs AI: two different tools
| Rule-based compliance automation | AI for regulatory compliance | |
|---|---|---|
| What it does | Routes, schedules, reminds, escalates and records according to fixed rules | Reads, classifies, extracts, compares and drafts from unstructured text |
| Examples | Periodic review reminders, CAPA escalation, training assignment, evidence collection | Gap assessments, regulatory change impact analysis, document QC, complaint triage |
| Strength | Predictable and easy to validate | Handles the reading-heavy work people find slowest |
| Main risk | Automating a bad process | Confident but wrong output and over-reliance |
Most programs need both: automation for the workflow, AI for the reading inside it.
Where AI helps most in regulatory compliance
- Gap assessments of procedures against standards and regulations, such as ISO 13485, the QMSR or EU MDR.
- Regulatory change impact analysis, mapping a new rule to the documents it affects.
- Submission and document QC, checking consistency across a technical file or dossier.
- Audit and inspection preparation, finding evidence for each requirement.
- Review of 483 and warning letter responses for completeness and support.
Published, independently verified metrics remain scarce. One of the better-documented examples is company-reported: Merck and McKinsey said generative AI “reduced the time to create a fully human-reviewed CSR first draft from an average of 180 hours to 80 hours” (McKinsey). Regulators are using the same tools. FDA’s Elsa is “designed to assist with reading, writing, and summarizing” (FDA).
What regulators now expect
FDA has enforced against uncontrolled AI. An April 2026 warning letter cited “Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing,” stating that “any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative” (FDA).
FDA’s credibility framework. FDA’s January 2025 draft guidance on AI to support regulatory decision-making for drugs describes a “risk-based framework for sponsors to assess and establish the credibility of an AI model” (FDA), starting with “Define the question of interest that will be addressed by the AI model” (FDA guidance). It remains a draft.
FDA and EMA principles. In January 2026, the agencies “jointly identified ten principles for good artificial intelligence (AI) practice” in medicine development (EMA), beginning with “Human-centric by design” and “Risk-based approach” (FDA).
EU GMP Annex 22 (draft). The draft says generative AI and LLMs “should not be used in critical GMP applications,” and for non-critical uses qualified personnel must be responsible for outputs, “i.e. a human-in-the-loop (HITL)” (European Commission draft). EMA’s work plan targets a final text in Q4 2026 (EMA).
EU AI Act timeline shifted. After the 2026 Digital Omnibus, high-risk obligations now apply from “2 December 2027 for stand-alone high-risk AI systems” and “2 August 2028 for high-risk AI systems embedded in products” (Council of the EU).
The risks to manage
NIST defines confabulation as “The production of confidently stated but erroneous or false content (known colloquially as ‘hallucinations’ or ‘fabrications’) by which users may be misled or deceived,” and warns of “automation bias, or excessive deference to automated systems” (NIST AI 600-1).
The consequences are real. In 2025, Deloitte agreed to partially refund an Australian government contract after a report produced with generative AI included “a fabricated quote from a federal court judgment” (AP via News4Jax). US courts have recorded more than 1,000 cases of improper generative AI use in filings, according to one tracking database cited by UNC’s law library (UNC Law Library).
A practical framework for compliance AI
| Principle | What it looks like in practice |
|---|---|
| Define the question and context of use | State exactly what the AI checks, against which requirements, and for which decisions |
| Classify risk | Separate critical uses (release, safety decisions) from supporting uses (drafting, gap finding) |
| Require citations | Every finding points to the passage or record it relies on, so reviewers can verify it |
| Keep a qualified human accountable | Named reviewers approve or reject outputs; overrides are recorded |
| Validate proportionately | Test on representative documents, including cases with no gap; follow FDA’s risk-based CSA thinking for QMS software |
| Control change | Treat model, prompt and configuration changes as QMS changes |
| Monitor performance | Track accuracy, missed gaps and reviewer override rates |
Compliance AI readiness checklist
- Use cases listed with context of use and risk level
- Critical GMP or safety decisions kept out of generative AI unless rules allow
- Every AI output traceable to cited source text
- Human review and approval built into the workflow and recorded
- Validation plan proportionate to risk, with representative test sets
- Change control covers models, prompts and configuration
- Data handling and confidentiality reviewed
- FDA, EMA, Annex 22 and AI Act developments tracked
Evidence-first AI for compliance documents
AskDona is built for the use case regulators are most comfortable with: AI that reads documents against requirements, cites the passage behind every finding, and leaves every decision to qualified people. It assesses procedures, technical files and responses against ISO, FDA and EU requirements or your own checklist.
Run a sample compliance document assessment and check each citation yourself.
FAQ
What is regulatory compliance automation? Using software to route, schedule, track and record compliance work according to defined rules.
How is AI used in regulatory compliance? Mainly for reading-heavy tasks: gap assessments, change impact analysis, document QC and audit preparation, with people approving the results.
Does FDA allow AI in GMP work? Yes, with controls. FDA’s April 2026 warning letter makes clear AI outputs must be reviewed and cleared by an authorized person (FDA).
What is the biggest risk of compliance AI? Confident but wrong output combined with over-reliance by reviewers (NIST).
When do EU AI Act high-risk rules apply? From December 2, 2027 for stand-alone systems and August 2, 2028 for AI embedded in products, after the 2026 amendment.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| PwC: Global Compliance Survey 2025 | Consultancy survey | 2025 | Complexity, AI adoption |
| KPMG: AI and compliance functions | Consultancy | Jul 2025 | CCO AI use |
| Gartner: Hype Cycle press release | Analyst | Sep 9, 2025 | Outlook |
| McKinsey: Merck clinical authoring | Company-reported | Jun 27, 2025 | Use case metric |
| FDA: Elsa launch | Regulator | Jun 2, 2025 | Regulator AI use |
| FDA: AI warning letter | Regulator | Apr 2, 2026 | Human review |
| FDA: AI credibility framework announcement | Regulator | Jan 6, 2025 | Framework |
| FDA: AI draft guidance | Regulator (draft) | Jan 2025 | Step 1 |
| EMA: Common AI principles | Regulator | Jan 14, 2026 | Ten principles |
| FDA: Good AI practice principles | Regulator | 2026 | Principle titles |
| European Commission: Draft Annex 22 | Regulator (draft) | Jul 2025 | GenAI, HITL |
| EMA: Inspectors work plan | Regulator | 2026 | Q4 2026 target |
| Council of the EU: AI Omnibus | Regulator | Jun 29, 2026 | AI Act dates |
| NIST AI 600-1 | Standard | Jul 2024 | Confabulation, automation bias |
| AP via News4Jax: Deloitte refund | News | Oct 7, 2025 | AI error incident |
| UNC Law Library: Hallucinations | Academic library | Jun 8, 2026 | Court cases |