AI governance for life sciences, from policy to sign-off in the US and Europe.
Most life sciences companies already use AI before they have a policy for it. Copilot Chat is on, public tools are open, and sponsors and clients have started to write AI into contracts. We put the governance in place: one AI policy for the US and Europe, a written GxP boundary, a register of AI tools, AI literacy training, and the German steps that come before a rollout there, including the DPIA and the works council.
Why AI governance is harder in life sciences.
GxP records need a clear line
AI can help draft and search, but a GLP or GMP record must stay attributable, accurate and approved by a person. Without a written boundary, nobody knows where AI may and may not go.
Sponsors and clients set AI terms
Contracts now ask for no training on confidential data, limits on retention, and a written list of the AI you use. Each term needs a control and evidence behind it.
Europe adds its own steps
The EU AI Act asks for AI literacy, GDPR often calls for a DPIA, and in Germany a works council has a say in any system that can monitor staff, which includes Copilot.
Rules are moving
The EU AI Act was amended in July 2026, EU GMP Annex 22 on AI is still a draft, and the FDA's AI guidance for drug development is still a draft. The policy has to be written so it can follow them.
The governance a regulated team needs before AI goes wider.
One AI policy for the US and Europe
Approved tools, which data may go into which tool, personal accounts, AI features inside SaaS products, disclosure to clients, and how to report a mistake. A German addendum covers GDPR and works council points.
A written GxP boundary
AI is never the source of GxP data, results or conclusions. GxP locations stay out of AI tools until a use has been approved and, where the rules require it, validated.
Open →AI tool register and approval route
Every AI tool and AI feature in use, with an owner, a risk level and the data it may handle, plus a one-page intake for new tools and a vendor checklist.
Controls mapped to the rules
Each control linked to the EU AI Act, GDPR, the NIST AI Risk Management Framework, GxP data integrity and your client contract terms, so an auditor or a client can follow it.
AI literacy training
Recorded training in English and German with completion records, which is what the EU AI Act asks of companies that use AI.
Germany: DPIA and works council
A DPIA prepared with your data protection officer, a works council information pack and the technical annexes for a works agreement, coordinated with your counsel.
The rules a life sciences company meets when it uses AI, as of October 2026.
This is our reading of the published rules, not legal advice. Your counsel confirms how they apply to you.
| Rule | Status, October 2026 | What it means in practice |
|---|---|---|
| EU AI Act, Article 4 (AI literacy) | Applies since February 2025, amended in July 2026 to a duty to take measures that support AI literacy | Training with completion records for staff who use AI |
| EU AI Act, high-risk rules | For stand-alone systems, apply from December 2, 2027 after the July 2026 amendment | Office use of Copilot is not high-risk; AI that screens candidates or assesses staff would be |
| GDPR and German employee data law | In force; German authorities say a DPIA will often be needed for AI | A DPIA before AI tools go live for staff in Germany |
| Works council, §87(1) No. 6 BetrVG | Current law; what counts is whether a system can monitor staff | A works agreement before Copilot and related controls go live at a company with a works council |
| 21 CFR Part 11, GLP and GMP data integrity | In force | AI output becomes part of a record only through a person's review and approval, with an audit trail |
| FDA draft guidance on AI for regulatory decisions | Draft, January 2025; excludes operational uses such as drafting when they do not affect safety, quality or study results | Most office AI use sits outside it; AI that produces data for a submission does not |
| EU GMP Annex 22 on AI | Draft; EMA aims to publish it in early 2027 | The draft keeps generative AI out of critical GMP uses, a sensible line to adopt now |
Three tracks at the same time.
A policy does not protect data while sites are overshared, and a works council will not agree to controls it has not seen, so the tracks run together.
- 01
Discovery
First two weeksAn interim AI rule for staff, the AI tools in use, the AI clauses in your contracts, where GxP data sits, and a confirmed plan and fixed price for the rest.
- 02
Policy and governance
Weeks 3 to 7The policy, the GxP boundary, the register, the controls map, a disclosure pack for clients and AI literacy training.
- 03
Microsoft 365 controls
Weeks 3 to 9Labels, data loss prevention and permission cleanup, so Copilot does not surface sensitive data to the wrong people.
- 04
Germany
Weeks 2 to 11The DPIA, the works council pack and German versions of every document, reviewed by counsel.
One team for the policy, the tenant and Germany.
We write the policy and configure the Microsoft 365 controls as one team, in English and German, from Plano, Texas and Munich. For 12 years we have been the technology partner to Arcondis, a life-science compliance consultancy, on work for large pharma, and we built an AI review of medicine and health product advertising for a European pharmaceutical regulator.
Each phase has a fixed price and is paid only after it passes acceptance criteria you sign. We start with a short discovery and give you a fixed price for the rest. Legal sign-off comes from your counsel or an independent German firm we introduce.
Sources for the rules on this page.
Checked in October 2026. Rules change, so confirm the current position with your counsel.
- Lewis Silkin, The Digital Omnibus on AI enters into force today (July 27, 2026)
- lawandtechnology.eu, AI literacy: the Digital Omnibus rewrites Article 4 of the AI Act (July 30, 2026)
- Datenschutzkonferenz, Orientierungshilfe Künstliche Intelligenz und Datenschutz (May 6, 2024)
- Works Constitution Act, §87 BetrVG (current text)
- Federal Labour Court, 1 ABR 20/21 on Office 365 (March 8, 2022)
- FDA, Part 11 Scope and Application guidance (September 2003)
- FDA, Considerations for the Use of AI to Support Regulatory Decision-Making for Drug and Biological Products (draft, January 2025)
- EMA, EMA and FDA set common principles for AI in medicine development (January 14, 2026)
- European Commission, draft Annex 22: Artificial Intelligence (July 2025)
- NIST AI 600-1, Generative AI Profile of the AI Risk Management Framework (July 2024)
What an auditor or a client can ask to see.
The approved AI policy
Signed by leadership, with the German addendum.
The GxP boundary
Issued as a controlled document in your quality system.
The AI tool register
Owners, risk levels and the data each tool may touch.
Training records
Who completed AI literacy training, and when.
The DPIA
With your data protection officer's advice and management approval.
Client answers
Standard responses to AI clauses and questionnaires, backed by evidence.
From workflow to working tool in two weeks.
Scope and sign
We define the workflow, the deliverables, and the acceptance criteria, and sign an agreement on them before anything starts.
Build
We build the tool in your environment, with Claude Code and automated evaluation against your own data.
Pay when it works
$10,000, due only after every criterion in the signed agreement is met. Nothing before that.
We start with a short discovery and then give you a fixed price for each phase. Each phase is invoiced only after it passes acceptance criteria you sign. Microsoft licenses and counsel fees are separate.
Tell us the workflow →Questions buyers ask.
What should an AI policy for a life sciences company cover?
Which AI tools are approved, which data may go into which tool, the use of personal accounts, AI features inside SaaS products, disclosure to clients and sponsors, a written GxP boundary, and how staff report a mistake. A German addendum covers GDPR and the works council.
Does the EU AI Act apply to a company that only uses Copilot?
Yes, in a limited way. Companies that use AI must take measures to support their staff's AI literacy, which has applied since February 2025, and must avoid the banned uses, such as emotion recognition at work. Office use of Copilot is not a high-risk use under the Act.
Do we need a DPIA for Microsoft 365 Copilot in Germany?
In most cases you should plan for one. The German data protection authorities say in their 2024 guidance on AI that a DPIA will often be needed, and Copilot processes staff data through prompts, answers and logs.
Does the works council have to agree to Copilot?
At a German company with a works council, yes in practice. Under §87(1) No. 6 of the Works Constitution Act, the council has a say in technical systems that can monitor staff, and German courts look at what a system can do rather than how you intend to use it.
Can AI be used in GxP work?
AI can help draft and search, but it should never be the source of GxP data, results or conclusions. Any AI step that creates or changes a GxP record needs approval through your quality system and validation where the rules require it.
Do the FDA's AI rules apply to a CRO or a supplier?
The FDA's AI guidance is written mainly for sponsors and is still a draft, so for a CRO or supplier it usually arrives through client contracts, quality agreements and audits. It excludes operational uses such as drafting when they do not affect safety, product quality or study results.
Ready to ship AI that actually works?
Send us the workflow. We return a fixed scope, price, and acceptance criteria in 48 hours. You pay $10,000 only after it works.
Tell us the workflow →Compliance-grade RAG: Retrieval systems a regulator can audit
How to build retrieval that a regulated reviewer can trust and audit.
Read it free →