As AI Governance Mandates Converge, One Framework Aims to Solve Pharma’s Multi-Jurisdiction Compliance Problem

A new governance architecture for pharmaceutical AI aims to solve multijurisdiction compliance before the EU AI Acts highrisk obligations take effect in August 2026Pharmaceutical companies deploying artificial intelligence into regulated workflows are facing a problem that has less to do with the technology itself than with the governance infrastructure around it The FDArsquos January 2025 draft guidance on AI in drug development introduced a riskbased credibility assessment framework for AI models supporting regulatory decisions The EU AI Actrsquos highrisk system obligations which cover healthcare applications take effect August 2 2026 In January 2026 the EMA and FDA jointly published ten guiding principles for AI use across the medicines lifecycle And across APAC markets pharmacovigilance authorities are tightening expectations for AIassisted adverse event reportingThe result is that many pharmaceutical companies are now facing several AI compliance requirements at the same time even though most of their existing IT systems were never built to manage that kind of complexity all at once Companies that operate in different jurisdictions now need AI systems that can meet different regulatory expectations within one controlled platform This includes FDA requirements for audit trails EU rules on transparency and human oversight under the AI Act and local pharmacovigilance reporting standards in different regionsIt is against this backdrop that Vibhor Agnihotri who leads US strategy and growth at Zelthy an AIenabled platform provider for regulated pharmaceutical operations has architected what the company calls its AI Governance Framework for Life Sciences The framework covers six regulated areas compliance regulatory affairs pharmacovigilance patient services advanced therapies and supply chain traceability It was designed from the outset to operate across jurisdictional boundaries without requiring parallel governance systems for each marketldquoEvery governance failure we see traces back to the same root cause AI was integrated as an addon and the audit trail has a gap in itrdquo Agnihotri said ldquoWe built this framework so that governance is a structural property of the platform not a layer applied after the factrdquoGovernance as Architecture Not PolicyThe framework is built on Zango Zelthyrsquos opensource Djangobased application framework for enterpriseregulated environments What makes Agnihotrirsquos approach different from traditional compliance systems is that the governance is built to be enforced by the technology itself rather than policydependentZangorsquos rolebased access control engine governs what users and AI agents can initiate review approve or override within any regulated workflow AI actions and human actions share the same permission architecture there is no separate governance layer for machinegenerated outputs Every action regardless of origin is subject to identical access controls escalation paths and approval chainsThe platformrsquos audit logging captures a tamperevident objectlevel record of every system event model version data inputs user identity timestamp and decision outcome The workflow engine enforces sequential rolecontrolled process steps meaning no AI output can advance in a regulated workflow without the required human review checkpoints being completed and loggedThis design choice has practical implications for the EU AI Actrsquos upcoming highrisk obligations which will require providers and deployers of highrisk AI systems to implement risk management human oversight and technical documentation by August 2026 By building these controls into the platformrsquos architecture rather than layering them on through policy documents Agnihotri argues the framework already satisfies the structural requirements that many companies will spend the next several months trying to add laterldquoWhen the FDA or an auditor asks for a complete record of every AIassisted decision who reviewed it what model version was running what data it accessed the answer has to come from the system architecture not from someone compiling spreadsheetsrdquo Agnihotri said ldquoZangorsquos audit logging and policy framework make that record a byproduct of normal operation There is nothing to reconstructrdquoA JurisdictionAgnostic Approach to MultiMarket ComplianceOne of the frameworkrsquos more notable design decisions is the separation of structural governance controls from jurisdictionspecific regulatory configuration The core controls including rolebased access audit logging version tracking and evidence generation operate identically regardless of market Jurisdictionspecific rules reporting formats escalation thresholds and submission requirements are configurable per deploymentFor enterprise pharmaceutical companies operating across FDA EMA and APAC regulatory environments this means maintaining a single governed platform rather than running parallel compliance systems The approach recognizes that although specific regulatory requirements differ from one jurisdiction to another the core controls that make AI governance auditable such as access management provenance tracking and humanintheloop enforcement are fundamentally the same everywhereThe framework covers six regulated operational domains compliance operations including promotional review adverse event management and thirdparty due diligence regulatory affairs submission management dossier assembly regulatory intelligence patient services digital PSP platforms benefits verification adverse event detection in call center operations advanced therapies cell and gene therapy orchestration REMS compliance cold chain tracking commercial operations HCP engagement sample management under PDMA field force management and supply chain traceability serialization authentication lastmile trackingFirst US Enterprise DeploymentThe frameworkrsquos first practical test in the US market came with an enterprise deployment at a global pharmaceutical company The clientrsquos IT validation and quality assurance teams evaluated the AI governance architecture against the documentation audit evidence and change control standards applied to validated computerized systems under FDA 21 CFR Part 11According to Agnihotri the implementation was completed in weeks instead of the six months that is typically required for validated system implementations at large US pharmaceutical companies He attributes this faster timeline to the platformrsquos ability to generate audit and change control evidence automatically rather than requiring validation teams to spend months putting that documentation together manuallyldquoUS enterprise pharma has a wellestablished bar for validated system deploymentrdquo Agnihotri said ldquoWhen we walked their quality team through the audit logging architecture the RBAC policy framework and the change control evidence that Zango generates natively they could evaluate it against their existing validation protocols directly That alignment is what compressed the timelinerdquoThe Convergence Challenge AheadAgnihotrirsquos work on the governance framework reflects a broader challenge the pharmaceutical industry will have to confront as AI governance mandates accelerate The FDArsquos January 2025 draft guidance signaled the agencyrsquos intent to formalize expectations around AI credibility assessment in regulatory submissions The EMAFDA joint principles published in January 2026 indicate increasing international alignment on foundational AI governance expectations And the EU AI Actrsquos highrisk obligations once enforceable in August 2026 will impose concrete technical and documentation requirements on AI systems used in healthcare contextsBefore joining Zelthy Agnihotri founded Dashmed a healthcare technology company that built interoperability infrastructure for Indiarsquos national digital health ecosystem That experience which involved designing systems that had to work at scale across fragmented regulatory environments helped shape his approach to the governance frameworkldquoThe companies that will struggle most are the ones treating AI governance as a compliance exercise rather than an architecture problemrdquo Agnihotri said ldquoCompliance is a moving target Architecture is what lets you hit it across every jurisdiction simultaneouslyrdquoZelthyrsquos platform is currently live in more than ten countries with 300 applications in production serving global pharmaceutical companies The AI Governance Framework is available for enterprise evaluation

As AI Governance Mandates Converge, One Framework Aims to Solve Pharma’s Multi-Jurisdiction Compliance Problem

Other Articles

Mid-Day Fast

Home / Buzzfeed / Article / As AI Governance Mandates Converge, One Framework Aims to Solve Pharma’s Multi-Jurisdiction Compliance Problem

As AI Governance Mandates Converge, One Framework Aims to Solve Pharma’s Multi-Jurisdiction Compliance Problem

Other Articles

Mid-Day Fast