Compliant on paper, indefensible in practice

The short version

A regulated enterprise can be fully compliant on paper and still unable to defend a single assertion when an inspector, an auditor, or a plaintiff asks the only question that matters: show me where this came from, who stood behind it, and what breaks if it is wrong. This paper names the reason. The governance gap that remains after two decades of compliance investment is an evidentiary gap: a structural inability to produce an inspectable, hop-level, assertion-level chain of evidence across the seams where systems and organizations hand work to one another. Surface compliance is necessary. It is never sufficient.

• The gap lives at the seams. Inside any one validated system, provenance is usually fine. It breaks where systems and organizations hand work to each other, and it breaks in five recurring ways.
• It recurs across the regulated economy. We show the same pattern in four domains: manufacturing, regulatory submissions, commercialization, and clinical supply.
• Enforcement has arrived. In 2026 the FDA cited AI-generated records in a manufacturing warning letter, and the FDA and EMA issued joint guiding principles calling for AI provenance to be traceable and verifiable. Regulators specify what the evidence must do. None of them mandates a product.
• The strongest objection is aimed at the cure. Concentrating control in one hub can create a new single point of failure. Any remedy is acceptable only with its governance attached.
• Defensibility is a property of the assertion, not the perimeter. It has to be captured as work happens, at every hop, or it is lost.

Two terms carry the argument. A hop is any step where a fact moves from one system, organization, or AI model to another. An assertion is a specific claim a company stands behind: a batch-release decision, a sentence in a drug label, a promotional claim, a coded adverse event.

Compliant is not the same as defensible

Twenty years of compliance spending in regulated healthcare and life sciences bought real protection, and nothing here disputes it. What we dispute is what that spending is assumed to have bought. The recurring error is to read a compliant perimeter as a defensible assertion: to believe that because the systems are validated, the signatures legal, and the vendors under contract, the specific claim those systems produced can be defended on demand. Often it cannot, and the reason is structural.

Consider the two columns a regulated organization actually holds.

The first column is surface compliance: the controls that show the organization has the right posture in place. Each one is genuinely necessary.

• A Business Associate Agreement (BAA, the HIPAA contract that lets a vendor handle protected health information) makes it lawful for a vendor to touch patient data. It does not, on its own, show that any particular use of that data was authorized.
• A Security Information and Event Management system (SIEM, the log-collection tool a security team watches) records what happened and flags anomalies. It is a record of events, not a decision about whether a specific action should have been allowed before it ran.
• A catalog access-control list governs who may read a table.
• A validated software suite shows the software behaves as specified.
• A 21 CFR Part 11 username-and-password signature is a legal electronic signature.
• A human-in-the-loop checkbox records that a person clicked.
• A cloud vendor's SOC 2 report attests to the vendor's own controls.

Every one of these is worth having.

The second column is the evidence infrastructure: the properties an assertion must carry to be defensible, as opposed to the properties a perimeter must carry to be compliant. It is the ability to reconstruct, for one specific assertion, its chain of custody across every boundary it crossed: who or what produced it, under what authorization, which named person reviewed and cleared it, and which version of the evidence it was frozen against. Three properties matter most.

• Hop attestation. For each step where a fact crosses a boundary, a reconstructable record of what moved, under what authorization, and which person, system, or model produced or changed it.
• Admit privilege. The ability of a system of record to refuse a write whose provenance is incomplete, instead of accepting it and flagging it later.
• Custody-bound human sign-off. A signature whose record side is the exact, frozen version the person acted on, bound so that it cannot be removed or transferred by ordinary means [1].

An organization can hold everything in the first column and still lack the second. The first is a property of the perimeter. The second is a property of the assertion itself, and it is what defensibility requires.

Figure 1. Surface compliance versus evidence infrastructure. Surface compliance is a property of the perimeter: necessary, bought once, audited annually. Evidence infrastructure is a property of the assertion: captured at every hop, or lost. Source: author synthesis; obligations cited to NIST SP 800-207 and Part 11 and Annex 11 signature linkage.

The columns come apart because they answer different questions. Surface compliance answers is the environment controlled? Evidence infrastructure answers can this specific assertion be reconstructed and defended? The first can be bought once and audited annually. The second must be captured when each assertion is created, at every hop, or it is gone. Rebuilding it later is the expensive digital archaeology regulated organizations now pay skilled people to perform: digging through email, spreadsheets, and old versions to work out what was known, when, and by whom.

Two anchors anyone can check

This argument rests on two published obligations, one from security doctrine and one from data-integrity regulation.

The first is NIST Special Publication 800-207, Zero Trust Architecture, the US National Institute of Standards and Technology's reference architecture for zero-trust security. Its sixth tenet holds that authentication and authorization are "a constant cycle" of re-evaluation, not a one-time grant made at login [2]. A login, a BAA, and a SIEM do not continuously authorize a specific hop from a system to an AI model.

The second is the UK Medicines and Healthcare products Regulatory Agency (MHRA) data-integrity principle that metadata are "an integral part of the original record" and that without them data "has no meaning" [3].

Together they turn "the governance gap is an evidentiary gap" from a slogan into two obligations a reader can verify.

Why "data is the new oil" fails at origin

The MHRA sentence is the regulator's version of "data alone is worthless." The industry's favorite slogan, "data is the new oil," works tolerably well for consumer data, where one purchase record is much like another. Oil is interchangeable too: take a barrel away from its wellhead and you still have oil.

Take the origin away from a clinical fact and you have a number. The sponsor still holds it, is still accountable for it, and can no longer defend it. Data without its origin is not merely worthless. It is a liability. Critics of the oil metaphor have pointed to the mechanism: data can be falsified without detection, so models need provenance that traces which raw inputs fed which prediction [4]. Surface compliance can leave that liability on the books, which is why a complete perimeter is necessary and never sufficient.

The mechanism: evidence dies at the seam

The evidentiary gap is not a vague cultural failing. It has a mechanism, and the mechanism is the seam.

Every consequential regulated workflow is a chain of specialist systems and organizations. A laboratory information management system (LIMS) hands off to a manufacturing execution system (MES), which hands off to a quality management system (QMS), which hands off to a regulatory information management system (RIM). A sponsor hands work to a contract organization and back. An AI model proposes and a human decides. Inside any one system, provenance is usually fine: the LIMS knows its own samples, the MES its own batch steps. The chain breaks at the boundaries.

Pharmaceutical Chemistry, Manufacturing and Controls (CMC, the science and quality work of making a drug) shows the failure clearly. In our analysis, the core systems of record (LIMS, chromatography data systems, MES and electronic batch records, QMS, enterprise resource planning, document management, and RIM) are typically linked by a batch number, a material lot, a document ID, or a manually typed reference. That is the whole mechanism in miniature. A typed reference is not an attestation, and a shared identifier is not a chain of custody. When the only thing joining two validated systems is a lot number someone keyed in, the assertion that crosses that seam carries no reconstructable evidence of who moved it, under what authority, or against which version of the evidence, even though both systems are individually compliant.

The FDA's own data-integrity expectation sets the standard this falls short of: electronic records must include "the metadata needed to reconstruct the CGMP activity" [5]. (CGMP is current Good Manufacturing Practice, the FDA's manufacturing quality rules.)

Figure 2. Where evidence chains break. Provenance is intact inside each validated system; the chain breaks at the seams, where the only join is a shared identifier or a manually typed reference. Five recurring break-types become the five failure modes. Source: author synthesis; the reconstruct-the-CGMP-activity duty is cited to FDA guidance.

The prediction follows directly: wherever an evidence chain crosses a seam that no single system owns, the gap will appear, however compliant each system on either side may be.

Five failure modes

The seam breaks in five recurring ways. Each is documented against primary regulator and standards sources, and each shows precisely where surface compliance stops. For each, we separate what is established from what is not, because the gap is real while the remedy is, in places, still a design.

1. Unknowing training elections: data leaving through everyday AI tools

Executives and senior staff in biopharma already use general-purpose AI assistants to write quick scripts, draft presentations, gather competitive intelligence, and workshop protocol language. By default, that traffic can amount to a decision about training and data use that the organization never consciously made. This is not a debate about who owns the output. It is an evidence problem: can the organization show, under audit or inspection, what left, under what policy, to which tool, and what was created from what?

The behavior is widespread. A 2024 ZoomRx survey of 211 pharma and biotech professionals, as reported in the trade press, found roughly half of companies restricting ChatGPT use, rising to 65 percent among the top 20 pharma companies, chiefly over concerns about leaking sensitive data. Yet more than half of respondents still used it at least a few times a month, and about a quarter more than once a week [6, 7]. Security teams call this shadow AI, and the rule behind it is simple: if the governed path is slower than copy and paste, copy and paste wins. Prohibition without a sanctioned fast path creates hidden paths instead of eliminating them.

The regulatory floor is the same evidentiary property described above. The January 2026 FDA and European Medicines Agency (EMA) good-AI principles, which are guidance rather than binding obligations, call for data-source provenance, processing steps, and analytical decisions to be "documented in a detailed, traceable, and verifiable manner, in line with GxP requirements" [8]. (GxP is the family of Good Manufacturing, Clinical, and Laboratory Practice rules.) Article 12 of the EU AI Act requires high-risk AI systems to allow automatic event logging over their lifetime [9]. None of these distinguishes a model the organization deployed from a public model its executives happened to use. The requirement attaches to the assertion that enters regulated work.

When a vice president's AI-drafted protocol change enters the validated clinical trial management system, the perimeter sees an authorized user making an authorized edit. The record is silent on whether the wording came from the executive or from a model the organization has no contract with and no logs from. Executives put the requirement more simply: can I show the board how we arrived at this protocol, this deck, this label sentence? When provenance is captured as work happens, that history becomes a lookup instead of an excavation.

Established: biopharma professionals use general-purpose AI tools [6, 7], and regulators require traceable provenance for AI-touched regulated work [3, 8, 9]. Not claimed: that organizations already log every executive AI interaction, or that any regulator has acted specifically on undeclared training elections. The claim is scoped to the evidentiary gap.

2. Mediation without continuous authorization

When a fact moves from a system of record to an AI model (from a clinical trial management system to a large language model, or from a safety database to a coding assistant), the path is usually authorized only in broad strokes: a user logged in, a vendor signed a BAA, a network route exists. None of these continuously authorizes the specific hop. NIST SP 800-207 says authorization must be "a constant cycle" of re-evaluation, not a one-time grant after login [2]. The OpenID Foundation's Continuous Access Evaluation Profile (CAEP) exists so that systems can reduce access for human or automated users, devices, and sessions when conditions change [10]. That is a standards-level admission that a grant made at the start must be revocable midstream.

At scale, this is a machine-identity problem. The Cloud Security Alliance reports that non-human identities (service accounts, application programming interface keys, OAuth tokens, machine certificates, and the credentials AI agents use) outnumber human users by roughly 45 to 1 on average and up to 144 to 1 in cloud-native environments, and that ownership of these identities "remains a fundamental governance gap" [11]. CyberArk's 2025 survey of 1,200 security leaders found that half had suffered breaches linked to compromised machine identities [12]. The World Economic Forum's Global Cybersecurity Outlook 2026 finds 94 percent of leaders naming AI as the most significant driver of change in cyber risk, while roughly a third of organizations still lack any process to assess the security of AI tools before deploying them [13]. A standing enterprise model key that any workload can use is the opposite of per-hop authorization: a single grant, made once, never re-evaluated.

Established: NIST requires continuously re-evaluated authorization [2], and machine identities at scale are a first-class AI-security problem [11, 12]. Not claimed: that any life-sciences sponsor runs a production mediation path with per-hop attestation and the ability to cut off access midstream. We found none.

3. Notification without custody

The third failure mode mistakes reaching a person for making that person accountable. A high-stakes event triggers an alert, the alert is delivered, and the system records that it was sent. But "messaged" is not "accountable." The Joint Commission's guidance on closed-loop communication defines the complete loop as every result sent, received, acknowledged, and acted on, with escalation when an abnormal result stays unacknowledged past a set period [14]. A four-year study of an alert notification system in radiology found policy adherence above 98 percent when referring providers used the system to acknowledge critical results, and its authors noted that acknowledgment is still not proof of correct follow-up [15].

The regulatory floor for closing the loop is already written. Part 11 requires unique identity, a printed statement of what the signature means, and permanent linkage between signature and record, so that a signature cannot be removed or transferred by ordinary means [1]. FDA's October 2024 guidance on electronic systems in clinical investigations restates those obligations [16]. EU GMP Annex 11, sections 14 and 15, expects electronic signatures to carry the same weight as handwritten ones, with permanent linkage and named identification [17]. These describe custody, a specific named person bound to a specific frozen record, not the delivery of a message.

There is an honest limit. A valid signing step proves that a signature event occurred, not that the person engaged with the content. MHRA's AI Airlock sandbox report observes that as AI systems show consistent accuracy, users may trend toward less scrutiny, which can weaken human-in-the-loop arrangements over time [18]. Custody is necessary. It is not sufficient proof of judgment.

Established: Part 11, Annex 11, and FDA's 2024 guidance require identity, meaning, and permanent signature-record linkage [1, 16, 17], and closed-loop practice treats an unacknowledged result as an open defect [14, 15]. Not claimed: that any sponsor runs a unified custody system in production.

4. Generation without an admit gate

This is the failure mode enforcement has now reached. An AI model produces an output (a specification, a deviation report, a coded adverse event) and that output flows into a validated system of record without an authorized person clearing it first.

In April 2026 the FDA issued a warning letter to Purolea Cosmetics Lab citing AI-generated specifications, procedures, and master records that had entered operations without review by the firm's Quality Unit under 21 CFR 211.22(c) or process validation under 211.100 [19]. The nuance matters, and we carry it exactly: FDA faulted missing human oversight and an absent evidence chain, not the use of AI. The core deficiency was the missing review, which a provenance record alone would not have supplied [19, 20]. Enforcement validates documented oversight. It does not, by itself, mandate any technology.

Regulators' language points one way. FDA data-integrity guidance requires metadata sufficient to reconstruct the CGMP activity [5]. EMA's reflection paper places responsibility for fitness for purpose on the sponsor, manufacturer, or marketing authorization holder, not on the model [21]. The draft EU GMP Annex 22 on AI would require logging of confidence scores for predictive models in critical GMP applications and states that generative AI should not be used for critical GMP applications at all [22]. Practice reflects the same logic: a 2022 Bayer presentation on medical coding describes a pipeline of automatic coding, then an AI proposal, then human review and acceptance, then human quality assurance, noting that authorities still expect human involvement in coding decisions [23].

The field clearly supports treating AI output as a draft until a person clears it. What it does not yet operate is a mechanical admit privilege: a write path that refuses an AI-touched record when the model version, the input reference, or the meaning of the sign-off is missing.

Established: AI outputs used in CGMP activities require clearance by an authorized Quality Unit reviewer [19], and propose-then-clear is well supported in regulation and practice [23]. Not claimed: that the market already refuses records with incomplete provenance. That is a design hypothesis, consistent with regulators' clearance duty but not confirmed as any deployed control.

5. Connectivity without authority

The fifth failure mode confuses being wired in with being allowed to matter. Inserting an AI layer into GxP operations is buildable today, but only if day-one connectivity is kept separate from day-one authority.

Cloud providers say so themselves. Amazon Web Services states that "there is no GxP certification for a commercial cloud provider" and that the regulated organization remains responsible for verifying its own compliance [24]. A 99.9 percent uptime commitment is not business continuity: the Amazon Bedrock service level agreement makes a service credit the "sole and exclusive remedy" for unavailability and excludes customer configuration errors and inoperable models [25]. It is a financial instrument, not a continuity guarantee. Life-sciences deployment guidance rejects all-at-once cutovers in favor of staged rollouts (blue/green, canary, and feature-flag releases) with rehearsed rollback [26].

The scarce resource is not connectivity but authority: who may sit on the path of regulated work, and when. A route can be technically live in weeks while the assurance case that lets it carry regulated traffic takes far longer, because the authority to influence a regulated decision is earned through assurance for a defined context of use, not through a network connection. "Connected on day one" is an honest promise only if it does not smuggle in "authorized on day one."

Established: no commercial cloud offers a GxP certification that replaces the customer's own assurance [24]; service credits are not continuity [25]; staged rollout with rehearsed rollback is the endorsed pattern [26]. Not claimed: that staged promotion of authority is an established, named industry practice.

Enforcement has arrived

Four anchors carry the enforcement case, in order of weight.

Purolea. FDA Warning Letter 722591, issued April 2, 2026, is the first FDA warning letter we have found that cites AI as a CGMP deficiency. The firm stated that the AI agent "never told [them]" the requirement existed [19]. FDA acted under existing CGMP authority, 21 CFR 211.22(c) and 211.100 [19, 20], without invoking any AI-specific rule. That is the point: the clearance duty already applies.

The FDA-EMA good-AI principles. In January 2026 the two agencies issued joint guiding principles, intended to inform future regulatory policy rather than impose a new mandate, which call for "data source provenance, processing steps, and analytical decisions are documented in a detailed, traceable, and verifiable manner, in line with GxP requirements" [8].

Signature linkage under Part 11 and Annex 11. Unique identity, signature meaning, and permanent linkage between signature and record [1, 17], restated in FDA's October 2024 clinical-systems guidance [16].

Reconstructability. MHRA's principle that metadata are integral to the record [3], FDA's requirement for metadata sufficient to reconstruct the CGMP activity [5], and, at the frontier of policy, the EU AI Act's requirement for automatic lifetime event logging in high-risk systems [9].

Every one of these specifies a property of the evidence (provenance, reconstructability, linkage, continuous logging), and none specifies a product. That is exactly the shape of a governance gap that is really an evidentiary gap. Regulators have said what the evidence must be able to do, and the industry has bought perimeters that do not do it.

The field is moving faster than its evidence

Adoption is outpacing reporting. In August 2026 a commentary in DIA Global Forum called on the clinical-research industry to create a registry of AI outcomes in trials, arguing that an AI trust gap exists because positive and negative AI outcomes do not have to be reported the way drug-trial results do [27]. Public reporting is thin: only 5.6 percent (47 of 842) of completed AI and machine-learning studies registered on ClinicalTrials.gov had results posted [28].

Pilots far outnumber deployments. A Health Management Academy and Microsoft report published in 2026, based on a survey of 30 executives at 30 leading health systems, found 43 percent piloting or testing agentic AI tools and 3 percent, roughly one organization, with active deployment in live workflows [29]. The report names governance, workforce readiness, and data infrastructure as linked barriers and calls for integrated audit and provenance capabilities.

Security teams are finding agents they did not know they had. A Cloud Security Alliance and Token Security survey of 418 IT and security professionals, fielded in January 2026 and published April 21, 2026, found that 82 percent of enterprises had discovered at least one AI agent or workflow their security teams did not previously know about, 41 percent more than once, while 68 percent still reported high confidence in their visibility. Only 21 percent had formal procedures for decommissioning AI agents [30]. When an unknown agent turns up, the evidentiary question is whether anyone can say whom it acted for, on whose authority, and in what context.

Inspection readiness is being framed as reconstruction. Vendor guidance on AI in pharmacovigilance (drug safety monitoring) poses three questions for FDA and EMA inspections: can you reconstruct every AI decision (data in, model version, human oversight); can you show the system performs within defined limits; and can you show compliance across the AI lifecycle [31]. It is vendor commentary, not a regulator's manual, but it maps directly onto the second and fourth failure modes.

Accuracy is not an inspection answer. A 2025 study in Communications Medicine tested six large language models on 300 physician-validated simulated clinical cases, each containing one planted false detail, across 5,400 outputs. Under default prompts, the models repeated or elaborated on the planted detail in 50 to 82.7 percent of outputs, depending on the model. A mitigation prompt lowered the mean rate from 66 to 44 percent but did not eliminate the problem [32]. These were clinical vignettes, not drug-safety case intake, but the lesson carries: an inspector can ask for the model version, the input, the output, and the human verification, and an explanation without that history is not an answer.

Industry is building shared vocabulary, not mandates. At DIA 2026, the DIA AI Consortium presented a shared glossary of AI terms, a standard template for describing use cases, and a five-stage validation framework as a path from principles to practice [33]. Neither that toolkit nor the proposed outcomes registry is a regulatory requirement.

The strongest objections

A thesis this broad attracts real objections. We state them at full strength and keep the concessions in print. The first two narrow the claim. The third targets the remedy and is the most serious.

"AI embedded in our validated suite already inherits the controls." Platform vendors argue, with justification, that AI embedded in a validated suite inherits that suite's permissions, audit trails, and validated workflows. We concede it: platform controls can genuinely apply inside the suite. But they govern model input and output within that suite's perimeter. They do not, by themselves, provide a registered route, purpose-bound authorization, and an attested record when a fact leaves the suite for another system or an outside model. The claim is therefore scoped to hops between systems, and at that scope it survives.

"Our data catalog is our AI governance." Data-and-AI catalogs are marketed as unified governance covering access, lineage, discovery, and AI assets. They are genuine governance of the data layer, and we say so plainly. But a catalog governs who may read the data. It does not, by itself, bind a purpose to each hop or attest each model input and output once data moves into downstream tools and models. The claim survives as a claim about the path between systems and models, distinct from data-layer governance, and we state it only at that scope.

The strongest objection: the cure recreates the trusted-intermediary risk. If the answer to scattered, unattested paths is to route everything through one designed control point, history warns that trusted intermediaries become the most valuable target in the system. The evidence is concrete. DigiNotar, a certificate authority, issued 531 fraudulent certificates after mundane operational failures in 2011 and collapsed [34]. In the 2016 Bangladesh Bank theft, attackers moved US$101 million of roughly US$1 billion attempted through the SWIFT network using legitimate credentials, a messaging network faithfully carrying a fraudulent payload; the episode led to SWIFT's Customer Security Programme [35]. The February 2024 Change Healthcare incident affected roughly 192.7 million individuals, in large part because the company was a high-privilege clearinghouse sitting between many parties [36]. Concentrating mediation without concentrating governance recreates exactly this exposure.

We accept the constraint this imposes. A mediation hub is a net benefit only if its value is continuous authority to deny and attest, operating under a defined protocol for degrading safely, and not a new integration bus with standing privileges. Put plainly: a hollow hub is worse than distributed dark paths you at least know are dark. Intermediaries have stabilized only when governance caught up with the technical architecture, as SWIFT's security program shows. The remedy is acceptable only with its governance attached, and we state it that way or not at all.

What a defensible assertion requires: defensibility by construction

If the same gap recurs across domains, what closes it should also be the same everywhere, and it is. Stated without any product name, an institution that wants defensible assertions needs five mechanisms. None is claimed here as current market practice. Each is a design requirement.

• An attested path between systems and models. Every hop from a system of record to an AI model crosses a governed path that issues short-lived, purpose-scoped authorization instead of relying on a standing key, and writes a record of the hop (model version, type of input, output, and what the human decided) to a durable archive. This is the positive form of the continuous-authorization obligation NIST states [2].
• An admit privilege that refuses incomplete records. The path into a system of record can refuse an AI-touched assertion whose provenance is incomplete, instead of admitting it and flagging it afterward. Regulators require the underlying duty: clearance before an AI output becomes a record [19], and metadata sufficient to reconstruct the activity [5].
• A custody-bound decision. A high-stakes action is bound to the exact frozen version the named person acted on, with an explicit acceptance of responsibility and a receipt the controlling system must receive before anything proceeds. Permanent signature-record linkage is the regulatory floor [1, 17].
• Authority earned in stages. Connectivity and authority run on separate clocks. A newly connected path runs in shadow first and is promoted onto the regulated decision path only after its assurance for that context of use is met, with rehearsed rollback [26].
• A measurement loop. Governance without measurement is theater. The closing mechanism is ongoing proof that the gap is shrinking: the share of hops that are attested, the count of unknown paths, the time to reconstruct an assertion, and the time to respond when something degrades. The research literature supports the key distinction: whether an answer is correct, whether its citations support it, and whether the answer actually depended on those citations are separate properties, and controlled experiments find citations that do not reflect what the answer actually relied on [37].

Underneath all five sits one architectural rule. AI can reason about anything, but it should be able to assert nothing into the factual record of a regulated company without passing an attestation gate. The model is free to propose. Only a governed path, ending in a named human, can commit.

The five mechanisms are one object seen from five sides: an assertion that is authorized at each hop, admitted only when complete, returned into the custody of a named person, promoted only when its authority is earned, and continuously measured. We call that object assertion-level attestation. Its absence, not the absence of any perimeter control, is the governance gap.

The evidence: four domains, one pattern

If the gap is structural, it should appear wherever evidence crosses a seam. We looked for it in four domains, each with primary-source evidence: CMC and manufacturing, regulatory submissions, commercialization and medical-legal-regulatory (MLR) review, and clinical supply.

Two caveats govern the table. First, each cell is our own synthesis of the current state, built on primary regulator sources. The cells are not customer research studies. Second, the clean domains differ in whether enforcement lands inside the cell. So far, only CMC has in-domain AI enforcement (Purolea).

Figure 3. The domain matrix at a glance. Only CMC carries in-domain AI enforcement so far. Source: author synthesis against primary regulator sources.

The pattern is the same in every domain. Each domain is full of validated, audited systems. In each, the assertion that matters (the batch release, the label sentence, the promotional claim, the kit status) crosses a seam that no single system owns, and its evidence is rebuilt by people after the fact. The same holds as work moves across the lifecycle: the evidence chain behind a single blood draw in a trial crosses many boundaries, a batch record's provenance breaks between LIMS and MES, and a label sentence has no first-class identity at all. These are not separate problems. They are instances of one gap.

How we built this argument

This paper is a synthesis of primary sources, not a study of any one organization, and it has not been independently peer reviewed. Three rules govern how claims are made. First, each claim carries the confidence its source supports: regulator texts and standards are cited directly, and trade press, vendor commentary, and single studies are labeled as such. Second, the domain matrix separates our own synthesis from enforcement-grade fact, cell by cell. Third, and most important, the gap is asserted as real, while every remedy is labeled as a design wherever it is one.

What we are confident about, and what remains open

Confident, and externally grounded. Zero-trust doctrine requires continuously re-evaluated authorization, which a login, a BAA, or a SIEM does not provide [2]. Metadata are integral to a reconstructable GxP record [3, 5]. Enforcement has reached AI use in manufacturing under existing authority, for absent oversight and an absent evidence chain, not for using AI [19, 20]. FDA and EMA guiding principles call for traceable AI provenance [8]. Part 11 and Annex 11 require permanent signature-record linkage [1, 16, 17]. Machine identities are a first-class AI-security problem [11, 12, 13]. Unacknowledged results are open defects [14, 15]. Trusted-intermediary risk is real and severe [34, 35, 36]. Correctness, citation support, and citation dependence fail separately [37]. And the pattern recurs, with primary sources, in four clean domains.

Open, and marked as such. The remedies described here are designs, not market practice, and we claim none of them as deployed: an attested path with purpose-scoped authorization that can be withdrawn midstream; an admit gate that refuses records with incomplete provenance; a unified custody-bound decision record; and authority earned in stages. The two partial domains rest on pattern evidence and on the absence of a pattern in public hospital deployments. Three gaps would most strengthen the case: a peer-reviewed study that treats defensibility as an evidentiary property of a regulated assertion (we found none); a second in-domain AI enforcement action outside manufacturing; and practitioner evidence from technology transfer and hospitals that could move those domains from partial to counted.

Claims we do not make. We do not claim a public production case study, in life sciences, of an attested path with per-hop attestation and midstream cutoff. We do not claim FDA has listed the fields an AI mediation record must contain. We do not claim the market already refuses records with incomplete provenance. We do not claim that cryptography proves cognitive engagement or sound clinical judgment. We do not treat data catalogs as anything other than real governance of the data layer. And we do not claim that any ScientixAI design is certified, validated, or deployed.

Conclusion: from compliant to defensible

The question regulated enterprises will be asked is changing. It used to be is your environment controlled? Increasingly it is can you defend this assertion? Inspectors, auditors, and plaintiffs ask about one batch, one label sentence, one adverse event, one decision. A perimeter cannot answer that question, however complete it is. Only the assertion's own evidence can.

That evidence cannot be bolted on later. It has to be captured as work happens, at every hop, and carried across every seam, because the seam is where it dies. Regulators have already named the properties it must have: continuous authorization, reconstructable metadata, signatures bound to what was signed, and traceable AI provenance. The first enforcement action has already landed, and it faulted the missing oversight and evidence chain, not the AI.

The practical shift for an executive is to change what gets measured. Ask not only whether systems are validated and vendors are under contract, but how long it takes to reconstruct a challenged assertion, how many hops carry an attested record, and how many paths into regulated work nobody can see. An organization that can answer those questions has started to close the gap. An organization that can answer them for every assertion, because every fact was captured with its lineage at the moment it was created, no longer does digital archaeology at all.

Compliance remains necessary. It was never sufficient. Defensibility is the standard, and it has to be built in from the start.

If you would like to talk about any of this, write to us at info@scientix.ai.

About the authors

Bo Lora is the founder of ScientixAI. He is a veteran, led UX design technology at Amazon Business and served as a Principal Design Technologist in Healthcare and Life Sciences at AWS. He started ScientixAI to close the gap between being compliant and being able to defend what an organization says it knows.

Marcie Ogilvy is ScientixAI's Acting Chief Marketing Officer and a digital teammate: an AI agent, not a person. She works alongside Bo and the company's other human and digital teammates. On this paper she turned a longer research manuscript into a standalone piece, checked every claim against a primary source and cut what she couldn't verify, and shaped the argument for an executive audience. Bo set the thesis, wrote the opening, supplied the ideas, and reviewed and approved the final text.

We publish this way on purpose. ScientixAI builds infrastructure so that every claim can show where it came from and who stands behind it. A paper about defensible assertions should do the same.

Sources

1. 21 CFR Part 11, Electronic Records; Electronic Signatures (sections 11.10, 11.50, 11.70, 11.100, 11.200). https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11
2. NIST. SP 800-207, Zero Trust Architecture (2020). Tenet 6: authentication and authorization as a constant cycle of re-evaluation. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
3. MHRA. 'GXP' Data Integrity Guidance and Definitions (March 2018). https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/687246/MHRA_GxP_data_integrity_guide_March_edited_Final.pdf
4. Stach C. Data Is the New Oil, Sort of: A View on Why This Comparison Is Misleading and Its Implications for Modern Data Administration. Future Internet 2023;15(2):71. https://www.mdpi.com/1999-5903/15/2/71
5. US FDA. Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018). https://www.fda.gov/media/97005/download
6. Two-thirds of top 20 pharmas have banned ChatGPT, and many in life sci call AI 'overrated': survey. FiercePharma, August 25, 2024. https://www.fiercepharma.com/marketing/two-thirds-top-20-pharmas-have-banned-chatgpt-and-many-life-sci-call-ai-overrated-survey
7. A majority of pharma and biotech companies prohibit ChatGPT use, survey finds. Endpoints News, August 26, 2024. https://endpoints.news/a-majority-of-pharma-and-biotech-companies-prohibit-chatgpt-use-survey-finds/
8. FDA and EMA. Guiding Principles of Good AI Practice in Drug Development (January 2026). https://www.ema.europa.eu/en/documents/other/guiding-principles-good-ai-practice-drug-development_en.pdf
9. Regulation (EU) 2024/1689 (EU AI Act), Article 12, Record-keeping. https://eur-lex.europa.eu/eli/reg/2024/1689/oj
10. OpenID Foundation. Continuous Access Evaluation Profile (CAEP) 1.0. https://openid.net/specs/openid-caep-1_0-final.html
11. Cloud Security Alliance. Non-human identity and agentic AI governance whitepaper (2026). https://labs.cloudsecurityalliance.org/research/csa-whitepaper-nonhuman-identity-agentic-ai-governance-v1-cs/
12. CyberArk. 2025 State of Machine Identity Security Report (n = 1,200 security leaders). https://www.cyberark.com/CyberArk-2025-state-of-machine-identity-security-report.pdf
13. World Economic Forum, with Accenture. Global Cybersecurity Outlook 2026. https://www.weforum.org/publications/global-cybersecurity-outlook-2026/
14. The Joint Commission. Quick Safety Issue 52: Advancing Safety With Closed-Loop Communication of Test Results (2019). https://www.jointcommission.org/en-us/knowledge-library/newsletters/quick-safety/issue-52
15. Lacson R, et al. Four-Year Impact of an Alert Notification System on Closed-Loop Communication of Critical Test Results. American Journal of Roentgenology 2014;203(5):933-938. https://doi.org/10.2214/AJR.14.13064
16. US FDA. Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers. Final guidance, October 2024. https://www.fda.gov/media/166215/download
17. European Commission. EU GMP Annex 11: Computerised Systems (2011), sections 14 and 15. https://health.ec.europa.eu/system/files/2016-11/annex11_01-2011_en_0.pdf
18. MHRA. AI Airlock Sandbox Phase 2 Programme Report. https://assets.publishing.service.gov.uk/media/6a27ece1e371d9d2c0052aca/AI_Airlock_Phase_2_Programme_Report.pdf
19. US FDA. Warning Letter, Purolea Cosmetics Lab (MARCS-CMS 722591 / 320-26-58), April 2, 2026. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/purolea-cosmetics-lab-722591-04022026
20. 21 CFR 211.22, Responsibilities of the quality control unit. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-B/section-211.22
21. EMA. Reflection Paper on the Use of Artificial Intelligence (AI) in the Medicinal Product Lifecycle (2024). https://www.ema.europa.eu/en/documents/scientific-guideline/reflection-paper-use-artificial-intelligence-ai-medicinal-product-lifecycle_en.pdf
22. European Commission and PIC/S. Draft EU GMP Annex 22: Artificial Intelligence (stakeholder consultation, 2025). https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en
23. Bayer Global Medical Coding. AI/Machine Learning in Medical Coding. MedDRA US User Group, 2022. https://files.meddra.org/www/Website%20Files/User%20Group%20Files/MedDRA%20US%20User%20Group2022%20-%20Bayer%20AI%20Coding_final.pdf
24. Amazon Web Services. GxP compliance FAQ. https://aws.amazon.com/compliance/gxp-part-11-annex-11/
25. Amazon Web Services. Amazon Bedrock Service Level Agreement. https://aws.amazon.com/bedrock/sla/
26. Amazon Web Services. Well-Architected Life Sciences Lens, LSREL09-BP02. https://docs.aws.amazon.com/wellarchitected/latest/life-sciences-lens/lsrel09-bp02.html
27. Vulcano D, Holmes A, Beare M, Tucker M, Zhang H, Coulter B, Smith J. Accelerating AI Trust By Establishing Outcomes in Clinical Trials Registry. DIA Global Forum, August 2026. https://globalforum.diaglobal.org/issue/august-2026/accelerating-ai-trust-by-establishing-outcomes-in-clinical-trials-registry/
28. Maru S, Matthias MD, Kuwatsuru R, Simpson RJ Jr. Studies of Artificial Intelligence/Machine Learning Registered on ClinicalTrials.gov: Cross-Sectional Study. Journal of Medical Internet Research 2024;26:e57750. https://doi.org/10.2196/57750
29. The Health Management Academy and Microsoft. Agentic AI and the Next Frontier of Healthcare Transformation (2026; survey of 30 executives, fielded 2025). https://assets.ctfassets.net/mw1rgrgliy2h/4ptmxUP7lSFERFqNwUSGeR/e00767de5c68f9bdcf51d0cb823a3a4d/Microsoft_Final_Report_2.5.26.pdf
30. Cloud Security Alliance and Token Security. Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises. Press release April 21, 2026; survey fielded January 2026, N = 418. https://cloudsecurityalliance.org/press-releases/2026/04/21/new-cloud-security-alliance-survey-reveals-82-of-enterprises-have-unknown-ai-agents-in-their-environments
31. Clinevo Technologies. AI Governance in Pharmacovigilance: 2026 Inspection Guide (vendor blog). https://www.clinevotech.com/blog/ai-governance-pharmacovigilance-2026/
32. Omar M, Sorin V, Collins JD, et al. Multi-model assurance analysis showing large language models are highly vulnerable to adversarial hallucination attacks during clinical decision support. Communications Medicine 2025;5:330. https://doi.org/10.1038/s43856-025-01021-3
33. Heidt Shippee J, Mack C. From Potential to Practical at DIA 2026: Building Trust in AI at Scale. Contract Pharma, July 21, 2026. https://www.contractpharma.com/exclusives/from-potential-to-practical-at-dia-2026-building-trust-in-ai-at-scale/
34. Fox-IT. DigiNotar "Operation Black Tulip" interim report (September 5, 2011). https://www.teletrust.de/uploads/media/FOX-IT_Interim_Report_2011-09-05_pdf.pdf
35. ISACA. Lessons Learned from the Bangladesh Bank Heist. ISACA Journal 2023, volume 6. https://www.isaca.org/resources/isaca-journal/issues/2023/volume-6/lessons-learned-from-the-bangladesh-bank-heist
36. HIPAA Journal, citing UnitedHealth Group notifications. Change Healthcare ransomware impact estimate, about 192.7 million individuals (February 2024 incident). https://www.hipaajournal.com/healthcare-data-breach-statistics/
37. Wallat J, Heuss M, de Rijke M, Anand A. Correctness is not Faithfulness in Retrieval Augmented Generation Attributions. Proceedings of the 2025 ACM SIGIR International Conference on Innovative Concepts and Theories in Information Retrieval (ICTIR), 2025. https://doi.org/10.1145/3731120.3744592 (preprint: https://arxiv.org/abs/2412.18004)
38. 21 CFR 202.1 (prescription drug advertising) and 21 U.S.C. 352(n) (misbranding). https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-202/section-202.1
39. 21 CFR 312.57 (sponsor recordkeeping and record retention) and 21 CFR 312.62 (investigator recordkeeping and record retention, including drug disposition). https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312
40. ICH. Q10 Pharmaceutical Quality System. https://database.ich.org/sites/default/files/Q10%20Guideline.pdf
41. The Joint Commission. Environment of Care standard EC.02.05.01, utility systems. https://www.jointcommission.org/en-us/knowledge-library/environment-of-care/utility-systems

© 2026 Scientix.ai Inc. All rights reserved. This paper describes research findings and design requirements. It does not describe a certified, validated, or deployed product.