Which FDA and EU AI Rules Apply to a CRO, and Which Reach It Only Through Its Clients

The question behind the budget line

The question usually comes up when someone has to put a number on AI compliance: our clients file with FDA and EMA, so do we have to comply with every AI guidance those agencies publish? For a CRO the answer is no, but some of it does land on you directly, and much of the rest arrives through contracts, quality agreements and audits. This is our reading of the rules as of October 2026, not legal advice.

Sorting the documents by who they are addressed to makes the budget conversation much shorter. It also tells you which evidence you need to produce yourself and which you only need to support when a sponsor asks.

What applies to the CRO directly

The EU AI Act applies to any company that deploys AI in the EU, so a CRO's European entities are deployers under Article 2, and a US entity can be in scope where its AI output is used in the EU. For office tools that means AI literacy measures and the Article 5 prohibitions, with the high-risk rules only coming into play if AI is used for employment decisions. GDPR and, in Germany, works council law apply to the same deployments.

GxP rules apply directly wherever the CRO is the testing facility. 21 CFR Part 58 covers GLP safety studies, and Part 11 applies when AI creates or changes electronic records that a predicate rule requires. In Germany the OECD GLP Principles are binding through section 19a of the Chemicals Act, and GLP inspectors apply OECD advisory documents No. 17 on computerised systems and No. 22 on data integrity, which the German Federal Institute for Risk Assessment lists with their dates. A site that does GMP quality control testing is also bound by EU GMP Annex 11, which EudraLex Volume 4 still lists in its January 2011 revision.

What reaches you through your clients

FDA's guidance on using AI to support regulatory decision-making for drugs and biologics is still a draft from January 2025. It is addressed to sponsors and sets out a seven-step, risk-based credibility framework. It expressly excludes AI used in drug discovery, and AI used for operational efficiencies that do not affect patient safety, drug quality or the reliability of results from a nonclinical or clinical study. A CRO meets it when a sponsor asks how an AI step that touched study data was shown to be credible.

The practical line for a CRO runs between paperwork and results. AI that drafts a quote or summarises a meeting sits inside FDA's operational-efficiency exclusion. AI that classifies images, flags outliers or calculates values in a dataset a sponsor will submit can affect the reliability of nonclinical results, and the sponsor will then need credibility evidence that only the CRO can produce.

The same applies to the ten guiding principles of good AI practice that EMA and FDA published on 14 January 2026, which are non-binding and aimed at medicine developers and applicants. EMA's reflection paper on AI in the medicinal product lifecycle, adopted in September 2024, is addressed to applicants and marketing authorisation holders, and for non-clinical work it expects existing SOPs to extend to AI and points to the OECD GLP documents. Sponsors pass all of these down through quality agreements, questionnaires and audits.

What to watch

EU GMP Annex 22 on AI went to consultation together with a revised Annex 11 from 7 July to 7 October 2025, according to PIC/S, and it is still a draft. EMA's June 2026 data steering group minutes target publication in early 2027. The draft says generative AI and large language models should not be used in critical GMP applications, but EMA's workshop report of 2 October 2026 concludes there may be viable pathways for generative AI under appropriate controls, so the final text could look quite different.

Two more items belong on the watch list. The same EMA minutes record that the inclusion of non-clinical AI guidance is under discussion, which would matter more to a preclinical CRO than Annex 22. The AI Act's employment rules apply from 2 December 2027, and they only become direct obligations for a CRO that uses AI in hiring or in evaluating staff.

Answer sponsors with one evidence pack

My opinion is that a CRO should not run a separate compliance programme for each piece of sponsor-facing guidance. The questions sponsors ask are nearly always the same: what the AI does, who reviews its output, how data integrity is protected and what happens when the model changes. One evidence pack per AI use, kept current, answers most questionnaires with small edits. For each use it holds the intended use, the data classes involved, the human review step, the test evidence and a log of changes to the model or prompt.

Where AI touches the data you hand over, the evidence should travel with the data, which ties into the handoff problems I described in this post on sponsor and CRO data handoffs. A sponsor reviewing a data package months later should be able to see which values passed through an AI step and who checked them.

The caveat is that a quality agreement can turn guidance into contract. If a sponsor writes the FDA credibility framework into its agreement, it binds you for that work whatever its status at FDA, so read each agreement before you treat a document as advisory. Quality and legal should review new agreements together for this reason, because the AI language often sits in a quality annex that legal never sees.

How we help at QueryNow

QueryNow helps life-science teams sort which rules bind them and then builds the evidence pack and the controls behind it. Governance work starts with a short discovery and then a fixed price for the rest, and where an AI step touches regulated data we follow the approach on our GxP AI validation page. Our AI governance for life sciences work draws on 12 years as technology partner to Arcondis, a life-science compliance consultancy.