Note October 20, 2026 · 17 min read · 3,279 words

Twelve AI concepts for pharma teams

Twelve AI terms for pharma and Quality teams, from agents and RAG to evals and model drift. Each one defined, how it shows up in regulated work, and an example.

ai basics glossary agents rag evals gxp

This page is for pharma business and Quality people who work with AI teams, and for AI or IT people new to pharma.

Start with the first section, then jump to any term.

Pharma AI Tracker examples link to public entries and describe what the cited source reports.

Status as of October 2026. This is a reference, not legal advice.

Overview diagram with numbers that match the sections below. A request from a person goes into the assistant, an AI model run as a fixed workflow or as an agent (1), which may be fine-tuned (11). Above it sit the prompt, the context and the memory it uses (9). Below it sit what it can reach: RAG, which finds passages (4) with embeddings (5) and a vector database (6); tools and MCP (3); and skills, on demand (2). The assistant writes a draft answer that carries a risk of hallucination (8). Before the result is used or sent, checks run: grounding in sources (8), guardrails (10) and a person in the loop (10). Underneath, evals (7) and drift checks (12) measure the whole setup over time.

From simple workflows to agents

AI systems range from one question and one answer, through workflows where people set the steps in advance, up to agents where the AI picks its own steps. Start with the simplest option that does the job.

How does this show up in regulated work? The further down the list an option sits, the harder it is to predict and test what the system will do. GxP uses usually need more testing, tighter limits and clearer human checkpoints for options further down.

In Building Effective Agents (December 2024), Anthropic separates workflows, where models and tools follow predefined code paths, from agents, where the model directs its own process and tool use. Anthropic describes five workflows and says they are not prescriptive. Its advice is to start with the simplest solution and add complexity only when needed. It notes that agents can bring higher costs and compounding errors.

Single prompt: one question, one answer.
Prompt chaining: fixed steps in order.
Routing: sort the request, then send it down the right path.
Parallelization: several calls at once, then combine.
Orchestrator-workers: one call splits the job and hands out parts.
Evaluator-optimizer: one call writes, another critiques, repeat.
Agent: the AI picks its own steps and tools.

Example (Pharma AI Tracker): AstraZeneca, Brand Assistant. Built on Databricks for commercial teams, it has a supervisor agent that coordinates specialized subagents, and it grew from five agents in a proof of concept to more than 20 in production. That fits the agent end of the seven options below. The source does not call it GxP.

Seven ways to use an AI model

The AI gets more flexibility at each step down the list, from 1 to 7.

Start here
1. Single promptThe model answers one question in one go.
Workflows
People set the steps in advance.
1. Prompt chainingThe model works through fixed steps, one after another.
2. RoutingThe model sorts the input, then sends it to the right next step.
3. ParallelizationSeveral model calls run at the same time.
4. Orchestrator-workersA manager model hands parts of the job to helper models.
5. Evaluator-optimizerOne model writes, another critiques, and they repeat.
Agent
The AI picks its own steps.
1. AgentThe AI runs the whole job.

Agentic systems often trade latency and cost for better task performance, and errors can compound. Pick the first option on the list that can do the job.

Source: Anthropic, Building Effective Agents (Dec 2024)

Skills

A skill is a reusable set of written instructions that an AI agent loads only when a task calls for it. Vendors use the word differently; Anthropic’s Agent Skills are folders of instructions, scripts and resources.

How does this show up in regulated work? A skill works like a short work instruction for the AI. Give it an owner, a version and a review cycle. Following a skill does not replace a person’s approval.

Suppose a test lead asks an agent to review a draft test case. The agent loads a “review a test case” skill: check that each requirement says what is tested, then list findings as finding, where, why it matters and suggested fix. A person still approves the findings.

How a skill gets used

Loaded only when a task needs it.

You ask for a task
The agent spots a matching skillOnly short skill descriptions stay in view.
It loads the full instructions
It applies the same instructions each time

A skill folder holds instructions (always), and templates and scripts (optional).

A skill is only as good as its writing. Give it an owner and a version. It does not approve anything.

Source: Anthropic's Agent Skills (Oct 2025)

Tools and MCP

A tool is a function the AI model can ask its application to run, such as searching a system or sending an email. MCP (Model Context Protocol) is an open standard for connecting AI applications to servers that offer tools, data resources and prompt templates, so each connection does not need custom wiring.

How does this show up in regulated work? Each connection can expose data or actions. Grant only the access needed, prefer read only, require a person’s approval for actions that matter, and assess any connection to a GxP system as part of the whole system. Text a tool returns can carry instructions that try to steer the AI (prompt injection).

Example (Pharma AI Tracker): Novo Nordisk, Rare Disease analytics agent. Novo Nordisk’s Rare Disease Insights & Analytics team built a text-to-SQL agent with Dataiku and GPT-4, so analysts can ask plain-language questions of claims and prescription data. Running the database query is a tool at work. The source does not mention MCP and describes business analytics, not GxP.

Diagram. The assistant, an AI model, connects to MCP, the Model Context Protocol, drawn as one standard plug. Through that plug it can reach many tools: a ticket system for tickets and projects, email to read and draft, a code repository for code and changes, and any other tool, such as a document system. The assistant asks, the tool acts, and the result comes back. Give each connection the smallest access it needs.

One connection, smallest accessA server can offer tools, data resources and prompt templates.
System	What the AI can do
Quality records	Read only
Email	Draft only

The AI application (with the model) reaches these systems through one standard connection, the Model Context Protocol (MCP). MCP is an open standard introduced by Anthropic in November 2024.

Give each connection the smallest access and check what comes back. Tool text can carry instructions, which is called prompt injection.

RAG and context

RAG (retrieval augmented generation) means the system first retrieves relevant passages and gives them to the model as context before it answers. The model can still draw on its training, so retrieval helps ground an answer but does not guarantee it. Retrieval alone does not change the model, though a RAG setup can also use a fine-tuned model.

How does this show up in regulated work? The retrieved text is only as current and controlled as the library behind it. Retrieve only effective, approved versions, show the source link, and have a person check important claims.

Example (Pharma AI Tracker): Merck & Co., RAG for manufacturing deviation management. MSD and AWS explored RAG for manufacturing deviation management. The source says the solution mostly limits generative content creation to low-risk areas and includes human oversight and other guardrails. The Pharma AI Tracker labels the entry a pilot; the source describes an explored approach with plans for a later enterprise-scale product.

Embeddings

An embedding turns text into a vector: a long list of numbers designed to keep useful features of its content or meaning. Texts that the embedding model treats as similar tend to get nearby vectors, even when the wording differs.

How does this show up in regulated work? Vector similarity can surface a past deviation worded differently from today’s, for a person to review. It is a search lead, not evidence that two cases share a cause. Research has shown that text can be partly recovered from its embeddings, so handle them with the same care as the source.

Suppose an investigator types “freezer alarm overnight, product moved.” The search compares its embedding with embeddings of past deviation descriptions. The closest match reads “cold storage unit out of range, stock relocated,” which shares no key words. The investigator reads both and decides whether they are related.

Vector databases

A vector database, or vector index, stores vectors and finds the ones nearest to the vector of a question, often approximately, to keep search fast. It can also store the text and details such as document number and version, but a link back to the source exists only if someone designs it in.

How does this show up in regulated work? Treat it as a search index, not the system of record. Store version and source details, filter for effective content, and rebuild or sync the index when controlled documents change, or it can return superseded text.

Suppose a site splits each SOP into short passages and stores each with its embedding, SOP number, version, effective date and a link to the controlled copy. A question finds the closest passages, a filter keeps effective versions only, and the RAG step passes them to the AI with links. After each SOP revision, the index is rebuilt.

What comes back with each of the three nearest passagesThe controlled copy stays in the document system.
Detail	What it is for
SOP number	Names the source document
Version	Shows which version the passage came from
Effective date	Shows when that version took effect. A filter can use it to keep effective versions only.
Link	Opens the controlled copy in the document system

Standard operating procedures (SOPs) are split into passages. Each is stored with its vector and version details. A question finds the closest passages, and the passages go to the AI with links.

It is a search index, not the system of record. Rebuild or sync it when SOPs change. Search is often approximate.

Evals

Evals are tests for an AI system. You give it inputs or tasks, apply defined grading rules or human review, and measure whether it meets success criteria set in advance. Some evals compare output with a reference answer; others grade the outcome or use expert judgment.

How does this show up in regulated work? Run evals on representative tasks to produce repeatable evidence for a risk-based assessment. Record the data, the graders, the pass thresholds and the system version. A good score does not validate the whole system.

Example (Pharma AI Tracker): Pfizer, PK-CSR.Gen. Pfizer scientists published PK-CSR.Gen, a generative AI workflow that drafts pharmacokinetic sections of clinical study reports. Experts graded AI-generated and expert-written reports in two blinded sessions for accuracy and how much needed changing. That blinded grading is an eval in practice.

Six steps in order. 1, keep a fixed test set: the same tasks every time, such as saved deviation reports with known key facts. 2, change the setup: a new prompt, model version or data source. 3, run the same tests through the changed setup. 4, score each output on the same checklist, for example key facts present, nothing invented, correct references. 5, compare the new scores with the last version. 6, decide: if the scores drop, hold the change back, fix it and test again. A good score is evidence for a risk-based assessment, not validation by itself.

Suppose a changed setup scores lower

Suppose a quality assurance (QA) team reruns its saved deviation reports, with known key facts, on a changed setup, and fewer key facts come back right than on the last version. The change is held back until it is fixed.

Hallucination and grounding

A hallucination is content an AI presents confidently that is false or erroneous, inconsistent with its input, or contradicts itself. NIST calls this confabulation. Grounding connects the output to sources or supplied evidence that a person can check. It can reduce invented content but does not prove every claim correct.

How does this show up in regulated work? Ground important claims in controlled sources, show citations a reviewer can open, and have a person review content before it enters a record, a submission or a medical response. NIST advises reassessing risks after adding RAG, so grounding is one control, not the end of checking.

Example (Pharma AI Tracker): Takeda, SEIMEI and AIMI. Salesforce reports that Takeda’s SEIMEI agent surfaces key findings from clinical literature and internal documents, and analysts verify the content and sources. AIMI uses RAG to suggest responses with specific citations; medical information staff review the evidence, validate the content and deliver every final response.

Without and with groundingGrounding reduces the risk but does not remove it.
Criterion	Without grounding	With grounding
What goes in	Question	Question plus real sources
What comes out	Sounds sure, nothing to check	Answer plus link and quote
What a person can do	Take the answer as it stands	Open the link and read the quote

A citation can point to the wrong place, so open it. The US National Institute of Standards and Technology (NIST) uses the term confabulation in NIST AI 600-1.

Suppose the cited section does not exist

Suppose an assistant answers a question about retention of cleaning records by citing standard operating procedure (SOP) 221, section 6.3, and no such section exists. The reviewer asks for the quote and the link, and the answer is rejected.

Prompts vs context vs memory

A prompt is the input or instructions sent to the model. Context is everything the model can use for the current response, such as system instructions, the conversation, documents, tool results and retrieved passages. Memory is stored information that the application can put back into context in a later turn or session.

How does this show up in regulated work? Check all content that can enter context, not just what a user types. Put confidential or patient data only in approved systems, and govern stored memory like other retained records. Context has a size limit, and details buried in a very long context can get less attention.

Example (Pharma AI Tracker): Takeda, myAibou. Takeda describes myAibou as its own digital assistant. Takeda says it has no access to Takeda data other than what the user gives it in the question or prompt. That means any Takeda data in context comes from what the user supplies. The source does not describe a memory feature.

Prompt, context and memoryWhat each one holds, and how long it lasts.
Criterion	Prompt	Context	Memory
What it is	The input or instructions for this request	Everything the model can use for this response: instructions, conversation, documents, tool results, retrieved passages	Stored information the application can bring back later
How long it lasts	This request	This response. It has a size limit.	Can come back in a later turn or session

Check everything that can enter context, and govern stored memory like other records.

Side by side diagram. On the left, context is the desk: everything the model can use for this response, such as instructions, the conversation, documents and retrieved passages, and tool results. The desk has a size limit, and details in a very long context can get less attention. On the right, memory is the filing cabinet: notes stored outside the conversation, such as saved preferences and standing rules, kept between sessions. Notes can be saved from the desk to the cabinet, and brought back to the desk in a later session. Memory notes can be wrong or out of date, so check what is saved. The model itself does not change; memory is notes placed back in context.

Guardrails and human in the loop

Guardrails are automatic checks on inputs, outputs or tool calls that can allow, block or change what happens. Human in the loop means a named person takes part in a decision or oversight step. It does not always mean every output waits for approval.

How does this show up in regulated work? Choose human checkpoints by risk, especially before a record is created, changed, approved or released. Give reviewers the evidence, the proposed changes and the authority to reject or correct the result, not just a Yes button.

Example (Pharma AI Tracker): GSK, AI visual inspection of environmental petri dishes. Weights & Biases reports that GSK moved from two people double-checking every environmental petri dish to a “one person plus AI” system. A person stays in the check. The vendor page does not say what that person decides.

Decision tree. Start: a request goes to the AI assistant, which proposes an action. Question 1: do the guardrails block it? Guardrails are automatic checks on inputs, outputs and tool calls. Yes leads to outcome 1, blocked or sent back. No leads to question 2, the human in the loop: does the person reviewing this key step approve it? Yes leads to outcome 2, approved, and it takes effect. No, sent back, leads to outcome 1. Note: guardrails catch only what they were built for. Put people at the steps that matter.

Fine-tuning

Fine-tuning is extra training on task examples that adapts an existing model. Full fine-tuning changes the model’s own weights. Lighter methods keep the base model’s weights frozen and train a small add-on called an adapter. Either way, the result is a new model setup to test and version.

How does this show up in regulated work? Test and control the tuned model or adapter together with its exact base model. Where EU GMP Annex 11 applies, handle a new model version as a controlled change. For facts that change, such as current SOPs, retrieval is often easier to update and check.

Example (Pharma AI Tracker): Vertex, microscopy image segmentation. Vertex scientists mark areas of interest in a subset of microscope images, and the system uses them to fine-tune an existing proprietary model, which then segments the rest. This is drug discovery research with an image model, and the source does not call it GxP.

Fine-tuning and retrieval augmented generation (RAG)What changes in each.
Criterion	Fine-tuning	RAG
What changes	A new model version, trained on your examples (input and approved answer). Or the base model plus an adapter.	Documents enter context.
What stays	With an adapter, the base weights stay frozen.	Model weights unchanged.
Keep in mind	A tuned model is a new version that needs testing, together with its exact base model.	For facts that change, retrieval is often a better fit. The model itself may also be fine-tuned.

Suppose a team tunes a model on complaint codes

Suppose a team fine-tunes a model on past complaint descriptions with approved category codes. It tests the model on held-back examples, a person reviews the results, and the new version is released through change control.

Model drift

Model drift is a broad operational label for performance changing after a model goes live. Name the cause when you can: input data may shift (data drift), the relationship between inputs and right answers may change (concept drift), or performance may change for another reason. A vendor model update is a component version change, not drift by itself.

How does this show up in regulated work? Monitor live inputs and outcomes as well as a fixed test set. Track vendor model versions and notices separately, since hosted models can be updated, deprecated or retired. Investigate changes, then retrain, replace or update the system through change control when needed.

Suppose a vial inspection model flags cosmetic defects. The site switches to a glass supplier with a slightly different tint, so the input images shift. Over a few weeks false rejects rise. A monthly check on fixed labeled images and live reject rates shows the change. The team retrains, retests and releases the new version through change control.

Line chart with no values shown. A quality score holds steady by month, then, after a marker for a new glass supplier, it slides down over the following months and crosses a dashed action threshold. At the crossing, a person reviews and decides.

How the terms fit together

The overview at the top shows the path: a prompt, context filled by retrieval, tools, skills and memory, a model, then grounding, guardrails and a person. Evals and drift checks measure the setup over time.

Where the rules stand

Status of the main documents in October 2026.

EU GMP Annex 11 (current January 2011 revision): this guideline says computerized systems used in EU GMP work should be validated to an extent set by a justified, documented risk assessment, and changed only under a defined, controlled procedure. Its proposed revision remains a consultation draft.
21 CFR Part 11: requires validation of closed systems within its electronic records and electronic signatures scope.
ISPE GAMP 5 and the GAMP AI guide: industry guidance, not law.
Draft EU GMP Annex 22 on AI: still a consultation draft. It covers static, deterministic models in critical GMP uses and says generative AI and large language models should not be used there.
FDA AI credibility guidance (January 2025): a nonbinding draft for AI that produces information supporting regulatory decisions on drug safety, effectiveness or quality. It excludes drug discovery and efficiency uses that do not affect patient safety, drug quality or study reliability.
FDA Computer Software Assurance guidance (February 2026): final but nonbinding. It covers software for medical device production and quality systems under 21 CFR Part 820, not drug manufacturing as such.
FDA guidance on predetermined change control plans: final, and for AI-enabled devices only.
EU AI Act: binding law. Article 14 sets human oversight duties for high-risk AI systems. A pharma use is high risk under Article 6 only if the AI is a safety component of, or is itself, an Annex I product, such as a medical device or in vitro diagnostic device, that must undergo third-party conformity assessment, or if it falls within an Annex III use case and no Article 6(3) exception applies. Regulation (EU) 2026/1744, the AI Omnibus, entered into force on July 27, 2026. It changed when Chapter III, Sections 1 to 3 apply, except Article 6(5): from December 2, 2027 for Article 6(2) and Annex III systems, and from August 2, 2028 for Article 6(1) and Annex I systems.

Want to run an AI concepts session for your team? That is the work I do.