Why Enterprise Clinical AI Requires Private Infrastructure

Introduction

On December 27, 2024, the HHS Office for Civil Rights published the first major proposed update to the HIPAA Security Rule since 2013, with the notice appearing in the Federal Register on January 6, 2025 ^[1]. The proposal's primary driver was the sharp rise in ransomware attacks and cyberattacks against healthcare entities. Among its notable new provisions, the proposed rule addresses AI systems explicitly: it discusses protections for ePHI used in AI training data and algorithms, and expects AI use cases to be included in a regulated entity's risk analysis and risk management obligations ^[1]. It would also remove the historic distinction between "required" and "addressable" safeguards, treating encryption, access controls, and incident response as non-negotiable for any system that processes ePHI. For sponsors and CROs deploying AI to generate regulatory documents, screen patients, or analyze trial data, that rule change signals something larger than a compliance update. It signals that shared multi-tenant SaaS architectures, which many AI vendors use, create governance dependencies that regulated clinical workflows cannot easily absorb.

The question of where enterprise clinical AI runs is not an IT procurement question. It is a regulatory, legal, and competitive question with consequences that extend well beyond any single trial.

Why Infrastructure Matters More Than the Model

The majority of discourse around clinical AI focuses on model quality: whether a large language model hallucinates, whether fine-tuning on regulatory text improves output accuracy, whether RAG architectures can retrieve the right protocol clause. These are meaningful concerns. But they are secondary to a more foundational problem that most organizations are still failing to address.

Where does the data go when a clinician, medical writer, or regulatory affairs manager submits a protocol draft to an AI system? Who else is on the same infrastructure? What happens to the inferences the model draws from that input? And can the sponsor demonstrate, with full traceability, exactly what information the AI processed, when, and why?

A 2024 Tufts Center for the Study of Drug Development assessment conducted between May and August of that year found that two-thirds of sponsors and CROs reported low confidence in the accuracy and quality of data used to train AI solutions, and that data governance, data privacy, and intellectual property concerns were among the top challenges slowing adoption ^[2]. The infrastructure question is not peripheral to these concerns. It is central to them.

The Real Risks of Multi-Tenant AI in Clinical Settings

Many commercial AI platforms serving clinical and pharmaceutical customers are built on shared, multi-tenant architectures, where a single model deployment serves multiple clients against shared infrastructure, optimized for cost efficiency at the provider's scale. For general enterprise productivity tasks, this is an entirely reasonable design. For clinical trial operations, it introduces three categories of risk that sponsors rarely quantify before signing a contract.

Data Leakage at the Inference Layer

Research published at the 2025 Network and Distributed System Security (NDSS) Symposium by Wu et al. demonstrated a class of attack affecting multi-tenant large language model serving environments ^[3]. In these systems, model providers share key-value caches across requests with identical prompt prefixes to reduce compute cost. The paper showed that a malicious tenant could reconstruct prompt fragments from other tenants by analyzing cache hit timing as a side channel. The attack, catalogued by the authors as PROMPTPEEK, does not require a breach of the model's application-layer access controls. It exploits an optimization mechanism that a BAA alone would not address.

A separate class of risk involves vector databases used in retrieval-augmented generation (RAG) systems. Security researchers have documented that when documents belonging to different clients share the same vector index without strict per-tenant access partitioning, a carefully crafted query can surface content from adjacent tenants ^[21],[22]. OWASP's Top 10 for Large Language Model Applications identifies sensitive information disclosure as a primary risk category for AI systems with inadequate data isolation controls. For a clinical AI platform processing protocol drafts, investigator brochures, and patient eligibility data from multiple sponsors, a shared vector index represents precisely this risk.

Intellectual Property Exposure

Clinical trial data carries commercial value that few other enterprise data types can match. A molecular structure submitted in a drug development dossier can represent a billion-dollar opportunity. Proprietary trial outcomes determine whether a compound advances to market. Protocol design choices embedded in a sponsor's platform input reflect years of strategic investment.

An industry survey published by Kiteworks in March 2026 reported that 83% of pharmaceutical companies surveyed had not deployed automated controls to prevent sensitive data from reaching external AI tools, and that employees regularly submit molecular structures, clinical trial results, and patient records to consumer-grade AI platforms ^[4]. That figure is from a vendor-commissioned study and should be treated as directional rather than definitive, but it reflects a pattern of control gaps that multiple observers have noted. The IBM Cost of a Data Breach Report 2024, covering 604 organizations, found that healthcare retained its position as the most expensive industry for data breaches for the 14th consecutive year, with average breach costs reaching $9.77 million per incident and per-record costs for intellectual property breaches rising to $173 ^[5].

What distinguishes IP leakage in multi-tenant AI from a conventional data breach is that the leakage mechanism may never be detected. Trial protocols submitted through an AI writing assistant on a shared platform may inform that platform's model weights or retrieval indices in ways the vendor's terms of service nominally prohibit but cannot technically prevent across all architectural configurations.

Audit Trail Integrity Under Regulatory Scrutiny

FDA guidance on computerized systems used in clinical trials, which reflects the requirements of 21 CFR Part 11, specifies that any system supporting trial recordkeeping must maintain a secure, computer-generated, time-stamped electronic record allowing full reconstruction of every creation, modification, and deletion event ^[6]. Documentation must capture who made changes, when, and why. The FDA may inspect any record intended to support a regulatory submission regardless of how it was created or maintained ^[6].

When a sponsor uses a multi-tenant AI platform to draft a protocol or an informed consent form, the question of who "owns" the audit trail becomes architecturally complex. On shared infrastructure, the platform vendor typically controls log storage, log format, retention policy, and access. In a regulatory inspection scenario, a sponsor must be able to demonstrate, with specificity, that the records are complete, unaltered, and under their custodial control. Multi-tenant architectures generally make this difficult to achieve without explicit contractual provisions and the vendor's active cooperation, which is a governance dependency sponsors may not fully appreciate before signing a contract.

ICH E6(R3), adopted at Step 4 by the ICH Assembly on January 6, 2025 ^[7], introduces strengthened expectations for computerized system validation in clinical trials, explicitly requiring that any system supporting trial operations demonstrate security, audit trail completeness, and traceability. The EMA implemented the guideline on July 23, 2025; the FDA issued its formal guidance on September 8, 2025. The guidance treats vendor oversight as a sponsor responsibility. Signing a business associate agreement does not satisfy this requirement; it must be accompanied by active governance, system validation documentation, and a defensible qualification record.

The Regulatory Architecture Favoring Private Deployment

Four overlapping regulatory frameworks now converge on the infrastructure question in ways that make shared cloud deployment increasingly difficult to defend.

HIPAA and the January 2025 Proposed Security Rule Update

The proposed January 2025 HIPAA Security Rule revisions would require covered entities and business associates to conduct vulnerability scanning at least every six months, penetration testing at least once per year, and to restore critical systems within 72 hours of a loss event ^[1]. The proposed rule explicitly addresses AI, including protections for ePHI used in AI training data and algorithms, and expects AI use to be considered in a regulated entity's security risk analysis. The proposed rules would also eliminate the "addressable" category of safeguards, making encryption of data at rest and in transit, audit controls, and access management uniformly mandatory ^[1]. For AI platforms where PHI flows through prompt payloads, inference outputs, and retrieval contexts, each of these represents an independent compliance obligation that shared multi-tenant architectures complicate materially.

According to HIPAA Journal's 2025 healthcare data breach report, which draws from HHS OCR breach portal data, 289,162,330 individuals had their protected health information exposed or impermissibly disclosed in 2024, setting a new annual record ^[8]. That figure reflects an environment where AI deployments in clinical operations are multiplying the number of PHI touchpoints faster than governance frameworks are adapting.

21 CFR Part 11 and GxP Validation Obligations

21 CFR Part 11 requires that any electronic system used in regulated clinical activity demonstrate validation for accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records ^[9]. In practice, this means an AI platform used to generate or edit regulatory documents must be qualified under a formal validation protocol: installation qualification, operational qualification, and performance qualification at minimum.

On a private, dedicated deployment, a sponsor or their qualified system vendor can execute validation directly against the production environment. On a shared platform, the validation boundary becomes difficult to define. The underlying model version, the infrastructure layer, and the data handling pipeline are all under the vendor's control and may change without notice. FDA has stated clearly that validation expectations apply to the actual system in production use, not to a notional description of how the system is designed to function ^[9].

FDA Draft AI Credibility Guidance (FDA-2024-D-4689)

The FDA issued its inaugural draft guidance on AI in regulatory decision-making in January 2025, introducing a structured seven-step credibility framework for AI models used to support drug and biological product submissions ^[10]. The framework requires sponsors to characterize the AI model's intended use, assess context of use, evaluate model fitness, and document risk-proportionate evidence of performance. The public comment period closed in April 2025, and the agency is currently reviewing submissions before finalizing the guidance ^[11].

One important scope boundary in the draft: the guidance explicitly excludes AI used for operational efficiencies in drug development, such as drafting regulatory submissions, where those uses do not affect participant safety, the reliability of study results, or drug quality ^[10]. This means the credibility framework's direct requirements apply to AI that generates or analyzes data informing regulatory decisions, not to AI writing tools used purely for document formatting or administrative drafting. The infrastructure implications, however, extend further. AI tools used in clinical document generation still touch PHI, produce GxP-relevant records, and must satisfy audit trail and validation requirements under 21 CFR Part 11 and ICH E6(R3) regardless of whether they fall within the credibility framework's primary scope.

The FDA-EMA joint guiding principles, published January 14, 2026, reinforce the broader governance expectation, calling for transparency in AI use, traceability of AI-assisted outputs, and lifecycle governance that includes change management documentation across the full medicines lifecycle ^[12].

EU AI Act High-Risk Classification

The EU Artificial Intelligence Act entered into force on August 1, 2024, establishing a risk-based regulatory classification system ^[13]. Under the Act, AI systems classified as high-risk include those that function as safety components of regulated products, such as AI integrated into medical devices under the Medical Device Regulation, and systems listed in Annex III. AI used in clinical research does not automatically qualify as high-risk; classification depends on the specific use case and whether the system falls within a listed category. Where clinical AI tools do constitute high-risk systems, their providers must implement risk management systems, data governance controls under Article 10, technical documentation, record-keeping supporting traceability, human oversight mechanisms, and cybersecurity controls ^[13]. Obligations for high-risk standalone Annex III systems are deferred to December 2, 2027, and Article 6(1) product-integrated systems to August 2, 2028, under the provisional political agreement on the Digital Omnibus on AI reached on May 7, 2026, pending formal adoption before the original August 2, 2026 deadline ^[14].

Article 10 of the EU AI Act requires that training, validation, and test datasets for high-risk systems be relevant, representative, free of errors, and governed through appropriate access controls and accountability procedures ^[15]. For a clinical AI platform, this means the data used to train or fine-tune the model cannot sit in an architecturally commingled environment where traceability of data provenance is lost.

What Private Infrastructure Actually Requires

Private infrastructure for clinical AI is not synonymous with on-premises hardware or a locked server room. The architecturally meaningful distinction is between shared compute where multiple customers' data coexists in the same logical environment and dedicated, isolated deployment where a sponsor's data, model inferences, and audit records operate in a separated, governed perimeter. The table below summarizes how the three main deployment models compare across the dimensions that matter most in regulated clinical contexts.

Dedicated VPC Deployment

Amazon Web Services Virtual Private Cloud allows organizations to create a logically isolated network environment within AWS, defining IP ranges, subnets, and routing rules to control data flow at the network layer ^[16]. A dedicated VPC is still cloud infrastructure; it is not synonymous with on-premises or physically dedicated hardware. The distinction it provides is logical network isolation and sponsor-controlled access governance, not a different physical deployment model. Private deployment reduces architectural governance risk, but it does not replace the need for sponsor-maintained SOPs, formal vendor qualification, validated change control processes, and appropriate legal agreements covering data processing and security obligations. When a clinical AI platform runs within a sponsor-dedicated VPC, the clinical data submitted to the system remains within a network perimeter that the sponsor can govern, audit, and validate independently of other customers on the same cloud provider. AWS services including S3, SageMaker, and inference endpoints can be configured to operate without public internet egress using VPC endpoints ^[16].

Several pharmaceutical companies have adopted this pattern for sensitive AI workloads. A federated learning collaboration across nine major pharmaceutical organizations described by Owkin and partners used dedicated AWS accounts with private VPCs per partner, removing internet access from both data storage and compute subnets before any ML operations commenced ^[18]. The entire platform underwent a formal external security audit before production use, a standard that shared multi-tenant SaaS platforms rarely offer to individual customers.

Encryption and Access Architecture

Encryption at rest and in transit is necessary but not sufficient. The more operationally significant control is access architecture: which identities can reach which data, under what conditions, with what logging. In multi-tenant AI deployments, the vendor's engineering staff typically have administrative access to the underlying infrastructure as a matter of operational necessity. In a private deployment, the administrative boundary aligns with the sponsor's own access controls, governed through identity management policies the sponsor controls directly.

AWS Identity and Access Management, when applied within a dedicated VPC, supports least-privileged access enforcement with logging through AWS CloudTrail ^[17]. CloudTrail provides time-stamped, immutable records of API calls and data access events that can contribute to the audit trail evidence 21 CFR Part 11 requires, though full Part 11 compliance depends on a validated process, appropriate access controls, retention procedures, and documented governance, not on CloudTrail alone.

System Qualification and Validation Boundaries

A privately deployed clinical AI system can be qualified against a stable, version-controlled environment. The sponsor or their qualified technology partner defines the qualification scope, executes the validation protocols, and retains the documentation under their own quality management system. When the model is updated, the change management process is controlled and documented before the update enters production. Private deployment does not automatically create 21 CFR Part 11 compliance; it creates the architectural conditions under which a sponsor-controlled qualification and validation process can be properly scoped and executed. Even in vendor-hosted dedicated deployments, sponsors must still establish and maintain their own SOPs, conduct periodic access reviews, and oversee the vendor's change management activities. Shared platforms present an additional challenge: the validation scope necessarily extends to infrastructure and model versioning the sponsor does not directly control, which complicates the demonstration of qualification that FDA inspections require.

Clinical Data Sovereignty as a Competitive and Legal Obligation

It helps to be precise about what clinical trial data actually comprises, because different categories attract different legal obligations. Protected health information, as defined by HIPAA, covers individually identifiable health information and triggers privacy and security requirements wherever it is processed. Confidential commercial information, including protocol design choices, endpoint selections, and unpublished biomarker data, is intellectual property protected under trade secret law, not healthcare regulation. GxP records, meaning any electronic records that support regulatory submissions or clinical operations under ICH E6(R3) and 21 CFR Part 11, must satisfy audit trail, integrity, and validation requirements regardless of whether they contain PHI. A single AI-assisted regulatory writing session can touch all three categories simultaneously, and the infrastructure question applies equally to each of them.

The data sovereignty argument for private infrastructure extends across all three categories. Clinical trial data represents one of the most concentrated forms of intellectual property in any industry. A Phase III trial generating statistically significant efficacy data can determine whether a compound reaches the market. Protocol design choices embedded in a trial run reflect R&D investments measured in years and billions of dollars.

European data protection law reinforces this directly. GDPR Article 5(2), the accountability principle, requires data controllers to be able to demonstrate compliance with data protection obligations, not merely assert it ^[19]. For a sponsor using a shared AI platform to process clinical data containing personal information, that demonstration depends on being able to show how data was handled, by whom, and under what controls. When those controls sit on infrastructure the sponsor does not govern, the demonstration becomes contingent on the vendor's cooperation rather than the sponsor's own evidence. The European Health Data Space Regulation (EU) 2025/327, which entered into force in March 2025, further frames secondary use of health data within a governance architecture that places accountability obligations on health data holders ^[23].

A 2025 DIA Global Forum analysis of AI in drug development noted that clinical trial data, including protocols, reports, and patient-level information, is vital for competitive positioning, and that reidentification risks in AI-processed data remain particularly acute for rare disease populations ^[20]. Where the AI platform is shared, the sponsor's ability to enforce data minimization, restrict secondary use, and audit access against these populations depends entirely on the vendor's architecture rather than the sponsor's own controls.

How Kitsa Approaches This Problem

Kitsa reports that its platform has achieved SOC 2 and ISO 27001 certifications and is designed to operate within HIPAA-compliant, AWS VPC-isolated deployment boundaries rather than shared multi-tenant environments (prospective customers should request security documentation or refer to Kitsa's trust center for verification, and should validate the applicable deployment scope, certification audit coverage, and audit-log custody arrangements as part of their own vendor qualification process). KScribe, Kitsa's AI-powered regulatory document generation tool covering protocols, ICFs, IBs, DSURs, and CSRs, is designed to operate within this architecture so that sponsor protocol inputs, model inferences, and generated document outputs remain within a governed perimeter. For sponsors evaluating AI-assisted regulatory writing, this means system validation can be executed against a stable, sponsor-scoped environment, audit trails are maintained under the sponsor's custodial control, and the qualification documentation required by 21 CFR Part 11 can reflect the actual production deployment rather than a vendor's self-certification.

Evaluating Clinical AI Infrastructure: A Sponsor Checklist

Before deploying any AI platform in a clinical trial context, sponsors and CROs should press for answers to the following:

What Evidence to Request Before Committing

A checklist of questions yields useful answers only if the vendor can produce documentary evidence on request. Before signing, ask for:

A SOC 2 Type II report scoped to the specific infrastructure the sponsor's data will occupy, not a generic company-level report. Review what controls are in scope and whether the audit covered production systems.

An ISO 27001 certificate with the certificate scope explicitly matching the clinical AI platform environment.

A validation package or qualification protocol demonstrating that the vendor has executed IQ/OQ at minimum against the production system, not a test or staging environment.

A signed business associate agreement, and for EU trials, a data processing agreement specifying sub-processors, data locations, and deletion timelines.

A reference architecture diagram showing where PHI, prompt payloads, model outputs, and audit logs reside, and which of those boundaries are shared across customers.

An audit log sample demonstrating the time-stamped, user-attributed, immutable format the sponsor would receive in an inspection scenario.

A change-control standard operating procedure showing how model version changes are managed, communicated, and documented before entering production.

Key Takeaways

• The January 2025 HHS proposed HIPAA Security Rule update would eliminate the distinction between required and addressable safeguards, making encryption, audit controls, and incident response uniformly mandatory for systems processing ePHI in clinical settings.
• Multi-tenant AI architectures expose sponsors to three distinct risk categories: inference-layer data leakage through KV-cache side-channel attacks, IP exposure through shared retrieval indices, and audit trail fragmentation that complicates 21 CFR Part 11 compliance.
• Healthcare data breaches cost an average of $9.77 million per incident in 2024, with per-record IP breach costs rising to $173. A significant share of pharmaceutical companies operate without automated controls to prevent sensitive trial data from reaching external AI tools.
• ICH E6(R3), adopted at Step 4 on January 6, 2025 and effective in the EU from July 23, 2025, imposes computerized system validation and audit trail requirements on any system supporting trial operations. FDA's draft AI credibility guidance (FDA-2024-D-4689) applies its seven-step framework to AI that generates evidence for regulatory decisions, while 21 CFR Part 11 governs all GxP records regardless of the guidance's operational scope exclusions.
• Where clinical AI systems qualify as high-risk under the EU AI Act, Article 10 data governance obligations and technical documentation requirements create architectural demands that shared environments are poorly positioned to satisfy.
• Private VPC deployment provides the architectural foundation for sponsor-controlled access management, system qualification against a stable environment, and verifiable audit records under the sponsor's quality management system.
• Control over clinical trial data is a privacy, security, accountability, and competitive-control obligation. GDPR's accountability principle and HIPAA's security and privacy rules each impose affirmative obligations on data controllers and covered entities to demonstrate governance over how data is processed, by whom, and under what controls. On top of these obligations, the commercial value of protocol designs, trial outcomes, and patient-level biomarker data means the stakes extend well beyond regulatory compliance alone.

FAQ

References

1. [1]HHS Office for Civil Rights. "HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information: Notice of Proposed Rulemaking." U.S. Department of Health and Human Services, December 27, 2024 (Federal Register January 6, 2025). https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html
2. [2]Getz, K. and Tufts CSDD. "New Insights On the Impact of AI-Enabled Solutions." Applied Clinical Trials Online, 2024. https://www.appliedclinicaltrialsonline.com/view/new-insights-on-the-impact-of-ai-enabled-solutions
3. [3]Wu, G., Zhang, Z., Zhang, Y., Wang, W., Niu, J., Wu, Y., and Zhang, Y. "I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving." Proceedings of the 2025 Network and Distributed System Security (NDSS) Symposium. DOI: 10.14722/ndss.2025.241772. https://www.ndss-symposium.org/ndss-paper/i-know-what-you-asked-prompt-leakage-via-kv-cache-sharing-in-multi-tenant-llm-serving/
4. [4]Kiteworks. "AI Data Security: The 83% Compliance Gap Facing Pharmaceutical Companies." Contract Pharma, March 2026. https://www.contractpharma.com/exclusives/ai-data-security-the-83-compliance-gap-facing-pharmaceutical-companies/
5. [5]IBM. "IBM Report: Escalating Data Breach Disruption Pushes Costs to New Highs." IBM Newsroom press release, July 30, 2024. https://newsroom.ibm.com/2024-07-30-ibm-report-escalating-data-breach-disruption-pushes-costs-to-new-highs
6. [6]U.S. Food and Drug Administration. "Guidance for Industry: Computerized Systems Used in Clinical Trials." FDA, May 1999. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/fda-bioresearch-monitoring-information/guidance-industry-computerized-systems-used-clinical-trials
7. [7]International Council for Harmonisation. "ICH E6(R3) Guideline for Good Clinical Practice, Final Version." Adopted Step 4, January 6, 2025. https://database.ich.org/sites/default/files/ICH_E6%28R3%29_Step4_FinalGuideline_2025_0106.pdf
8. [8]HIPAA Journal. "2025 Healthcare Data Breach Report." Drawing from HHS OCR Breach Portal data. February 2026. https://www.hipaajournal.com/2025-healthcare-data-breach-report/
9. [9]U.S. Code of Federal Regulations. "21 CFR Part 11: Electronic Records; Electronic Signatures." https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11
10. [10]U.S. Food and Drug Administration. "Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products." Draft Guidance, Docket FDA-2024-D-4689, January 2025. https://www.fda.gov/media/184830/download
11. [11]U.S. Food and Drug Administration. "Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products; Draft Guidance for Industry; Availability; Comment Request." Federal Register, January 7, 2025. Docket FDA-2024-D-4689. https://www.federalregister.gov/documents/2025/01/07/2024-31542/considerations-for-the-use-of-artificial-intelligence-to-support-regulatory-decision-making-for-drug
12. [12]FDA and EMA. "Guiding Principles of Good AI Practice in Drug Development." Joint publication, January 14, 2026. https://www.fda.gov/media/189581/download
13. [13]European Parliament and Council. "Regulation (EU) 2024/1689 (Artificial Intelligence Act)." Official Journal of the European Union, July 2024. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
14. [14]EU Digital Omnibus on AI. Provisional political agreement reached May 7, 2026 (pending formal adoption). Annex III standalone high-risk AI systems: December 2, 2027; Annex I product-integrated systems: August 2, 2028. https://www.europarl.europa.eu/legislative-train/package-digital-package/file-digital-omnibus-on-ai
15. [15]EU AI Act, Article 10. "Data and Data Governance Requirements for High-Risk AI Systems." Regulation 2024/1689. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
16. [16]Amazon Web Services. "Amazon Virtual Private Cloud (Amazon VPC): User Guide." AWS Documentation. https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html
17. [17]Amazon Web Services. "AWS CloudTrail: Logging and Monitoring AWS Account Activity." AWS Documentation. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html
18. [18]Oldenhof, M. et al. (Owkin and partners). "Industry-Scale Orchestrated Federated Learning for Drug Discovery (MELLODDY)." arXiv:2210.08871, 2022. https://arxiv.org/pdf/2210.08871
19. [19]European Parliament and Council. "Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR)." Article 5(2), Accountability Principle. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
20. [20]DIA Global Forum. "Artificial Intelligence and Regulatory Realities in Drug Development: A Pragmatic View." April 2025. https://globalforum.diaglobal.org/issue/april-2025/artificial-intelligence-and-regulatory-realities-in-drug-development-a-pragmatic-view/
21. [21]OWASP. "OWASP Top 10 for Large Language Model Applications: LLM06: Sensitive Information Disclosure." OWASP Foundation. https://owasp.org/www-project-top-10-for-large-language-model-applications/
22. [22]Gaire, S., Gyawali, S., Mishra, S., Niroula, S., Thakur, D., and Yadav, U. "Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystem." arXiv:2512.08290, December 2025. https://arxiv.org/abs/2512.08290
23. [23]European Parliament and Council. "Regulation (EU) 2025/327 (European Health Data Space Regulation)." Official Journal of the European Union, 2025. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R0327