Where pharma AI actually is — a 2026 ISPE AI Summit field readout

I spent two days at the 2026 ISPE AI summit, across a dozen-plus operator and vendor sessions. Here’s the honest map of where regulated-pharma AI actually is — not where the keynotes say it’s going. Everything below is generalized to what was presented publicly; no private names, no numbers off anyone’s slides.

The center of gravity is governed document work, not autonomous GMP agents

Strip away the agent hype and the real production footprint is knowledge and document work: enterprise copilots, regulatory drafting, audit preparation, literature surveillance, batch-record chat. That’s where value is being banked today. Almost everyone “has a chatbot.” Far fewer have a system-level deployment they’d put in front of an inspector — system-level maturity got described, repeatedly, in the single digits.

One shape kept resurfacing across the operator talks: the large majority of AI pilots — on the order of seven in eight — never reach production. The bottleneck isn’t training a model; it’s governing a growing portfolio of them across legacy MES / LIMS / QMS / historian systems, each one carrying lifecycle, audit-trail, and portability obligations. That unglamorous gap — between a demo that impresses a steering committee and a system that survives an inspection — is where most of the industry actually lives.

Agentic systems show up only in narrow, low-patient-risk niches — regulatory-intelligence ingestion, pre-audit data mining, a few multi-agent audit-prep pilots. Nobody presented an autonomous agent running in a GMP space. The human line at high-impact decisions like batch disposition is still hard, and the most aggressive public roadmaps put real movement at the end of the decade.

The validation recipe is converging

The interesting part: independent teams described nearly the same validation pattern without coordinating. It looks like this:

1. Risk-classify by context of use (how close to the patient?) and map to a GAMP category.
2. GAMP 5 lifecycle — custom builds land as Category 5, with IQ/OQ/PQ plus production monitoring.
3. A golden evaluation set with LLM-specific metrics (factual consistency, hallucination / false-negative rate).
4. Determinism controls — temperature 0, schema-locked / fail-closed outputs, deterministic logic wherever possible.
5. Traceability — citations-or-fail, model/prompt/version lineage, and treating the prompt as an electronic record.
6. Structural human-in-the-loop — the human isn’t bolted on; low-confidence cases are withheld from the tool by design, and accountability is defined up front.

If you’re validating a non-deterministic system, this is the emerging house style. The one live fault line is how much rigor the high-risk edge needs — lighter, risk-based assurance versus keeping full CSV inside the quality system for the highest-consequence models — but the six-step spine above was near-universal.

Regulators are going AI-native

The clearest signal of the event wasn’t an operator talk — it was the regulators. AI-native inspection platforms are consolidating dozens of data systems into something that trends toward a “check-engine” diagnostic for inspections. The strategic takeaway is uncomfortable and obvious: audit yourself the way the regulator soon will. Build the same capability first.

The white space: almost nobody owns AI security

Here’s the gap I came away fixated on. Across all those sessions, operational AI security and adversarial risk were almost entirely absent. Only one cloud security leader owned it — threat modeling, prompt and indirect-injection, a model firewall, red-teaming — but at the cloud-architecture level. Pharma operators, almost without exception, reduced “guardrails” to governance gates and human review.

Nobody presented an operational pharma program for AI security: credential and egress control at the gateway, agent tool-policy, adversarial testing mapped to validation evidence. That’s the gap this whole site is about — and it’s the cheapest finding to fix now and the most expensive to discover in an inspection later.

What to do Monday

If you own a GxP AI system, five concrete moves this week — none of them need a budget line:

1. Write the context of use in one sentence. What decision does the output support, how close is it to the patient, and where is the human gate? If you can’t write it, you can’t classify the system — and every downstream control, evidence artifact, and sign-off hangs off that classification.
2. Pin your determinism controls. Temperature 0, schema-locked / fail-closed outputs, deterministic logic wherever the task allows. Non-determinism you didn’t deliberately choose is a finding waiting to happen.
3. Treat the prompt as an electronic record. Version prompt, model, and config in source control. “Which prompt produced this output, on which date?” should have a git answer, not a shrug.
4. Stand up a golden evaluation set. A fixed set of inputs with known-good outputs and LLM-specific metrics (factual consistency, hallucination / false-negative rate). Re-run it on every model or prompt change — that’s OQ/PQ evidence, not a one-time demo.
5. Name an owner for AI security. Not “we have guardrails” meaning a governance gate and a reviewer — an actual owner for credential and egress control at the gateway, agent tool-policy, and adversarial testing mapped to validation evidence.

That last one is the whole reason this site exists. The rest of the room has the validation recipe converging nicely. The security layer underneath it is still, mostly, nobody’s job.