FDA's AI Credibility Framework for Regulatory Documentation Teams

Regulatory affairs teams and medical writers have adopted AI drafting tools at a rate that outpaced any AI-specific FDA signal about what that means for submission compliance. Protocol sections, informed consent forms, investigator brochures, clinical study reports: all are being touched by large language models at sponsors and CROs who, until recently, were making their own governance judgments without AI-specific regulatory guidance to anchor them.

On January 7, 2025, the FDA published its draft guidance, "Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products" (Docket No. FDA-2024-D-4689) ^[1]. The document is the agency's most detailed statement to date on AI in drug development, and it has been widely discussed in regulatory circles. It has also been frequently misread.

The guidance does not establish a blanket framework for all AI-assisted regulatory document work. Its scope is more precise than many summaries suggest, and its exclusions are just as important as what it covers. Understanding exactly where the line falls is the prerequisite for calibrating any AI documentation program correctly.

What the Guidance Covers and What It Does Not

Before applying this guidance to any AI tool or workflow, the scope section deserves a direct reading. Section II of the draft guidance states:

"This guidance discusses the use of AI models in the drug product life cycle, where the specific use of the AI model is to produce information or data to support regulatory decision-making regarding safety, effectiveness, or quality for drugs." ^[1]

Then, in the same section:

"This guidance does not address the use of AI models (1) in drug discovery or (2) when used for operational efficiencies (e.g., internal workflows, resource allocation, drafting/writing a regulatory submission) that do not impact patient safety, drug quality, or the reliability of results from a nonclinical or clinical study." ^[1]

The exclusion of "drafting/writing a regulatory submission" is the FDA's own language. A tool that drafts background sections of a clinical protocol from a sponsor synopsis, or that reformats ICF language from a template, is not in scope for the January 2025 credibility assessment framework, provided that drafting activity does not itself affect patient safety, drug quality, or study reliability.

The guidance is also nonbinding. As the document states on its first page, FDA guidances "do not establish legally enforceable responsibilities" and "should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited." ^[1] The word "should" throughout the guidance means suggested or recommended, not required. This distinction matters when building a compliance program around what the document says.

Where the Boundary Becomes Relevant for Documentation Teams

The scope exclusion does not mean AI documentation tools operate without any regulatory consideration. It means the January 2025 credibility assessment framework does not automatically govern them. What determines whether a given AI use crosses into the guidance's scope is whether the AI model is producing information or data that informs a regulatory decision about safety, effectiveness, or quality.

The FDA's own illustrative examples clarify the intent. The clinical development example in the guidance involves an AI model that stratifies patients for inpatient versus outpatient monitoring based on their risk for a life-threatening adverse reaction ^[1]. The manufacturing example involves an AI system performing automated fill-volume assessment for vial release ^[1]. In both cases, the AI model generates the evidence or decision basis for a regulatory action that directly affects patient safety or product quality.

The table below maps common clinical documentation tasks against the scope framework:

The ambiguous cases are where sponsors need judgment. The draft guidance explicitly recommends early engagement with the FDA when sponsors are uncertain whether their AI use falls within scope ^[1]. For tools in the middle of the spectrum: AI that structures analytical decisions, summarizes evidence in ways that affect interpretation, or generates content whose downstream use affects how results are assessed, early engagement through FDA's available pathways is a lower-risk posture than proceeding without clarity.

A practical decision path:

Does the AI model output constitute new information or data that will be used to support a regulatory determination about safety, effectiveness, or quality? If yes, the January 2025 credibility framework is the relevant FDA recommendation. If no, existing obligations under Part 11, GCP, and applicable regulations still govern how that AI-assisted work is managed.

The Seven-Step Credibility Assessment Framework

For AI use that falls within the guidance's scope, the January 2025 draft describes a seven-step risk-based credibility assessment framework ^[1]. This framework is a recommendation, not a regulation, but it reflects FDA's current thinking on what constitutes defensible AI use in regulatory decision-making.

Step 1: Define the question of interest. The sponsor should precisely articulate what regulatory question the AI model is intended to address ^[1]. The specificity is deliberate: it bounds the model's task and determines which credibility evidence is relevant.

Step 2: Define the context of use (COU). The COU describes the specific role and scope of the AI model: what it models, how its outputs will be used, and whether other evidence sources complement the model output ^[1]. A COU for a pharmacokinetic prediction model differs substantially from a COU for an adverse event classification model, even if both use similar underlying architectures.

Step 3: Assess model risk. The draft guidance maps risk along two axes: model influence (how directly the AI output determines the regulatory decision) and decision consequence (the severity of an adverse outcome from an incorrect decision) ^[1]. The FDA's clinical example makes this concrete: an AI model that is the sole determinant of whether a patient undergoes outpatient versus inpatient safety monitoring carries high model influence and high decision consequence, resulting in a high model risk assessment ^[1]. Higher model risk calls for more rigorous credibility evidence.

Steps 4 through 6: Credibility assessment planning, execution, and documentation. For in-scope AI, the draft guidance recommends that sponsors develop a credibility assessment plan aligned with model risk, execute that plan, and produce a credibility assessment report ^[1]. The report should confirm the model's fitness for its intended COU, document any deviations from the plan, and be made available to FDA either within a submission or upon request during an inspection.

Step 7: Determine adequacy. The sponsor should evaluate whether the credibility evidence is sufficient for the specific regulatory use ^[1]. This is a reasoned judgment proportionate to model risk, not a one-size-fits-all documentation standard.

The draft guidance also recommends lifecycle maintenance planning for certain in-scope AI uses: ongoing monitoring of model performance, with attention to data drift, the phenomenon where model performance degrades as input data evolve away from training data ^[1].

What ICH E6(R3) Adds to the Picture

The January 2025 FDA AI draft guidance should be read alongside ICH E6(R3) Good Clinical Practice, the most significant revision to the GCP guideline since its original publication in 1996, finalized in January 2025 and adopted by the FDA in September 2025 ^[2]. The European Medicines Agency made E6(R3) effective on July 23, 2025 ^[3].

E6(R3) does not address AI documentation specifically, but several of its provisions directly shape the environment in which AI tools operate.

On sponsor accountability: E6(R3) maintains that sponsors retain ultimate responsibility for trial conduct and may not transfer that responsibility through delegation to contract research organizations or service providers ^[4]. For AI-generated content, the qualified person who reviews and approves a document section bears responsibility for its accuracy and regulatory compliance, regardless of whether an AI model produced the first draft.

On data governance: E6(R3) establishes data governance as a shared sponsor-investigator domain, requiring policies for data integrity, traceability, and security ^[4]. For electronic records, E6(R3) expects relevant metadata, including audit trails, proportionate to risk and data criticality. These provisions do not mandate AI-specific attribution in audit trails, but they reinforce the general GCP principle that records must be attributable, legible, contemporaneous, original, and accurate. Applied to AI-assisted workflows, that standard supports maintaining records that show what was produced, how it was reviewed, and who accepted it into the official trial record.

On computerized system controls: E6(R3) expects that computerized systems used in trial conduct support validation, access controls, audit trails, and security, proportionate to the system's role and data criticality ^[4]. These expectations reflect a broader GCP principle of systematic control over digital tools used in trial documentation, rather than a fixed universal requirement.

21 CFR Part 11: What It Covers and What It Does Not

21 CFR Part 11 governs electronic records and electronic signatures in FDA-regulated settings ^[5]. Part 11 and related FDA guidance support controls such as validation, audit trails, access controls, record integrity, and electronic-signature attribution, applied based on predicate rules and risk.

Part 11 applies when AI tools create or modify regulated records. If an AI model contributes content to a case report form, a batch record, or a quality control record, and that record is subject to Part 11, then those controls apply to the system managing that record ^[5].

What Part 11 does not do is establish AI-specific obligations for LLMs, prompt engineering, or model version control. The regulation predates modern AI tools and does not address these categories directly. Industry practice increasingly treats model version control as a change-control event requiring revalidation of affected systems, and treats qualified human review before e-signature as a necessary control for AI-assisted GxP workflows. These practices are reasonable extensions of Part 11's general validation and data integrity principles, but they are not AI-specific Part 11 requirements established by the regulation itself.

The FDA and EMA's jointly published Guiding Principles of Good AI Practice in Drug Development (January 14, 2026) states that AI does not substitute for human accountability and that data source provenance, processing steps, and analytical decisions should be documented in a traceable and verifiable manner consistent with GxP requirements ^[6]. These principles are voluntary and high-level. They reinforce the direction of travel but do not amend Part 11. Sponsors who design AI documentation systems with clear human review steps, model attribution in audit trails, and version-controlled model management are building toward the documentation standard FDA is signaling, even before it is formally codified.

The FDA's Early-Phase AI Pilot Program

On April 29, 2026, the FDA published a Federal Register Request for Information (Docket No. FDA-2026-N-4390), soliciting input on a proposed pilot program to assess how AI-enabled technologies can improve efficiency, speed, and quality of decision-making in early-phase clinical trials ^[7]. The comment period was later extended to June 29, 2026 ^[7].

The RFI describes early-phase trials as a critical bottleneck in drug development, characterized by high uncertainty, limited patient populations, and resource-intensive decision processes ^[7]. The proposed pilot targets CDER, CBER, and the Oncology Center of Excellence and aims to explore AI applications in trial efficiency, safety monitoring, dose selection, and go/no-go decision support ^[7].

The governance expectations the RFI articulates signal where FDA thinking is heading for AI in clinical development more broadly. The agency states that it supports AI use aligned with the National Institute of Standards and Technology (NIST) AI Risk Management Framework principles (valid, safe, secure, accountable, explainable, privacy-protective, and fair) and that the pilot will apply the considerations outlined in the draft AI guidance ^[7]. For documentation teams, the practical implication is that FDA's internal governance expectations and external sponsor expectations are converging on the same vocabulary: evidence of credibility, risk-proportionate validation, and human accountability.

The FDA-EMA Joint Principles: Voluntary, But Directional

On January 14, 2026, the FDA and EMA jointly published "Guiding Principles of Good AI Practice in Drug Development," a ten-principle framework covering AI across the full drug product lifecycle ^[6]. The principles are voluntary; they do not amend existing regulations or establish new binding obligations.

Their significance is directional. They represent the first formal alignment between the FDA and EMA on AI governance expectations and, as both agencies have stated, will inform future AI-specific guidance in both jurisdictions ^[6]. The core themes are consistent across the FDA draft guidance, E6(R3), and the joint principles: human-centric design, risk-proportionate validation, fitness for purpose, and robust data governance. Sponsors who build AI programs around these themes now will have a shorter compliance distance to cover as future guidance or enforceable requirements develop.

What Sponsors Should Carry Forward

The scope analysis above has a practical implication that runs in both directions. For AI tools that produce evidence for regulatory decisions, the seven-step credibility assessment framework provides the recommended structure, and sponsors would do well to begin applying it even ahead of finalization. For AI tools used in document drafting currently outside the credibility framework's scope, appropriate governance still warrants attention.

Some industry guidance recommends a baseline set of controls for AI-assisted documentation ^[8]:

The key question for each AI tool is not simply whether it is a drafting tool or an evidence-generation tool. It is whether the tool's output, in the context where it is used, informs a regulatory determination about safety, effectiveness, or quality. As defined in the January 2025 draft guidance, "regulatory decision-making" covers both FDA determinations and actions taken by sponsors in conformance with FDA's regulatory authority, including compliance with INDs, CGMPs, and postmarketing requirements ^[1]. That question requires judgment. It may also require the kind of early FDA engagement the draft guidance explicitly recommends ^[1].

How Kitsa Approaches AI Regulatory Documentation

For teams managing document generation across multiple studies and document types, building AI governance that is operationally practical and inspection-ready simultaneously is a significant design challenge. KScribe, Kitsa's regulatory document generation system, produces protocols, ICFs, investigator brochures, DSURs, and clinical study reports within a structured workflow designed to support source traceability, version control, and qualified human review at each document stage. The system is built to assist qualified regulatory and medical writing professionals, not to replace their review accountability or authorship responsibility. The platform operates within infrastructure certified across SOC2, HIPAA, and ISO27001 frameworks. More information is available at kitsa.ai/regulatory-document-generation.

Key Takeaways

• •FDA's January 2025 draft guidance (FDA-2024-D-4689) applies to AI models that produce information or data supporting regulatory decisions about drug safety, effectiveness, or quality. It explicitly excludes AI used for "drafting/writing a regulatory submission" when that activity does not affect patient safety, drug quality, or the reliability of study results ^[1].
• •The guidance is draft and nonbinding. Its "should" language means recommended, not required. Binding obligations for AI-assisted workflows come from existing regulations: 21 CFR Part 11, applicable GCP regulations and requirements, CGMP requirements, not from the draft guidance itself ^[1].
• •Where the seven-step credibility assessment framework applies, it recommends defining a precise context of use, assessing model risk across the axes of model influence and decision consequence, producing a credibility assessment plan and report, and planning for lifecycle maintenance of model performance in certain contexts of use.
• •ICH E6(R3), the most significant revision of the GCP guideline since its original publication, was adopted by the FDA in September 2025. Its data governance and sponsor accountability provisions reinforce that qualified human oversight of electronic records systems, including AI-assisted documentation workflows, should be documented consistently with E6(R3)'s data integrity expectations: records should be attributable, legible, contemporaneous, original, accurate, complete, secure, and reliable.
• •The FDA and EMA jointly published ten voluntary Guiding Principles of Good AI Practice in Drug Development in January 2026. These are not binding but signal shared agency expectations and will inform future guidance in both jurisdictions.
• •Even for AI document drafting tools outside the January 2025 draft guidance's scope, appropriate governance includes vendor qualification, qualified human review before any regulated record is created, Part 11-compliant system validation, and prespecification of AI use in study documents where relevant.
• •The central question for each AI tool is whether its output, in context, informs a regulatory determination about safety, effectiveness, or quality. That question determines which framework applies and at what level of rigor.

FAQ

References

Related Articles