Why Is Pharmacovigilance AI Flagged During an Audit?

An inspector's first question is usually the simplest one: what AI or machine learning systems touch case intake, triage, coding, narrative drafting, or signal detection, and where is that documented. Safety departments are expected to maintain a central listing of every AI implementation in use, often within or alongside the Pharmacovigilance System Master File, cataloging each system's purpose, risk classification, validation status, model version, performance metrics, and the person accountable for it. A pharmacovigilance function that cannot produce that list on request has already failed the first test, independent of whether any individual AI system is working correctly.

The gap usually is not that no inventory exists. It is that the inventory is incomplete, because AI is often embedded inside an already-validated case management or signal detection platform and never gets separately catalogued as an AI component with its own context of use statement. An examiner who finds one undocumented AI feature reasonably asks what else was never listed.

Pharmacovigilance case processing has to meet the same ALCOA-based data integrity expectations as any other GxP record: attributable, legible, contemporaneous, original, and accurate, with secure, computer-generated, time-stamped records that an operator cannot delete or modify. When an AI system triages a case, suggests a MedDRA code, or flags a possible signal, the audit trail needs to show which model version processed the case, what the AI's own output and confidence were, and what the human safety analyst independently determined, as two linked but separate entries.

Many pharmacovigilance AI deployments were built for processing speed, not for this level of traceability, so the audit trail collapses the AI's suggestion and the analyst's decision into one entry, or drops the AI's original output once a human edits it. Either way, an inspector cannot verify whether the case was actually reviewed independently or whether the analyst simply accepted the AI's output, which is exactly the ambiguity that turns into a finding.

Generative AI is increasingly used to draft narrative case summaries, literature review excerpts, and even portions of periodic safety reports. Inspectors are now asking directly for the policy that governs this: what evidence exists that a qualified person reviewed AI-drafted safety content before it entered the record, not just that the content was eventually approved. The risk is not hypothetical. Testing of leading language models against clinically designed vignettes with deliberately planted errors found the models repeated or elaborated on the planted error in up to 83% of cases, which is precisely the failure mode an unreviewed generative AI draft can carry straight into a safety report.

A closely related FDA warning letter, issued April 2, 2026 to a manufacturer for a different GxP function, shows how this plays out when it is missed. The firm's Quality Unit approved AI-generated documentation that omitted a required process validation step, and when asked why, the firm said it was not aware of the requirement because the AI agent it used never flagged it. The FDA's finding was direct: human accountability cannot be delegated to an AI system, and an AI's failure to surface a requirement does not excuse the organization from meeting it. The same principle applies directly to AI-drafted pharmacovigilance content that goes unreviewed.

Until early 2026, expectations for AI explainability and traceability in pharmacovigilance were mostly inferred from general GxP data integrity principles. On January 14, 2026, the FDA and EMA jointly released Guiding Principles of Good AI Practice in Drug Development, ten principles spanning human-centric ethical design, risk-based development and performance assessment, data governance and document management, and data quality and lifecycle management. The agencies explicitly named pharmacovigilance as a function AI is expected to strengthen, while holding it to the same standards of documented data provenance, model selection, and validation reporting as any other regulated use.

That means an AI system a safety team considers a maturity win, faster case triage, earlier signal flags, can still generate an inspection finding if the underlying model selection, validation, and monitoring documentation was never built to the standard the joint principles now describe by name, rather than left as an assumption from older, general data integrity guidance.