The limits of AI in regulatory and quality intelligence

Harrison’s session wasn’t about whether AI is good or bad. It drew on what regulatory intelligence and quality assurance leaders have shared about where AI helps and where it doesn’t, and on what Infodesk has learned building AI into intelligence feeds for its own clients. The answer he set out is what Infodesk describes as human first, AI empowered: AI takes on the volume and the early-stage effort, so that experts have more time for analysis, decisions and implementation.

Why AI can’t do it all on its own 

AI is already part of the regulatory intelligence workflow, and the value it brings is real. The gap is rarely the technology. It is the process around it, and who owns the outcome.

What AI does well 

• Speed. AI can scan hundreds of health authority sources and flag what has changed in hours rather than days. Trained on how a team has triaged items in the past, it can quickly judge whether a new item is likely to be relevant. 
• Scale. It can categorize update types consistently across thousands of items, filtering out noise that no team could read by hand. 

What it still needs

• Judgment. Unchecked outputs can include invented citations and precedents. Someone accountable still has to confirm what an update means for the organization and make the final call. 

At the RAPS Regulatory Intelligence Conference in Baltimore earlier this year, teams described using personal AI tools for ad hoc health authority searches, then having to check every answer by hand. The point that came up again and again was that a tool is only as good as the process that governs it and the expertise of the person using it.

The rules are catching up

Regulators are moving in the same direction. The EU’s draft Annex 22 to the GMP guidelines sets out where AI can sit in GxP work: 

• Static, deterministic models can be used in critical GMP applications, subject to validation. 
• Generative AI and large language models are kept out of critical applications. Non-critical uses, such as summarizing or drawing out key points, need documented human oversight.
• People stay accountable. Where AI informs a GxP decision, a qualified person owns the outcome. 

Annex 22 is still a draft. The European Commission’s stakeholder consultation ran from July 7 to October 7, 2025, alongside revisions to Annex 11 and Chapter 4, and a final text has not yet been added to EudraLex Volume 4. 

This matches how Infodesk builds its own solutions.

Where AI genuinely helps

The teams getting value from AI are specific about where it fits. Harrison mapped AI against the seven stages of the regulatory and quality intelligence lifecycle, from monitoring through to implementation and closure.

The strongest use cases are in the first two stages, where AI can learn from how humans have triaged and categorized data in the past and use that to find relevant items going forward. Summarizing and routing come next: AI can pull the key points out of a guidance document and suggest which SMEs it should go to. 

AI now has a role in impact assessment too, reading internal documentation to draft the assessment and point to where a team should focus. Harrison was clear about the limit. The system doesn’t reach a final conclusion. It speeds up the assessment and draws out the key points, and the SME or case owner confirms the outcome before anything moves forward.

Deciding, implementing and closing stay with people. That isn’t a technology limitation that will disappear next year. It reflects where accountability sits. Across all seven stages, there is still a named owner and human oversight.

What the numbers tell us 

Harrison shared three figures from an initial benchmark with a consumer healthcare client. They show why the best surveillance combines AI with expert review. 

• 2.4% of items were relevant. Of roughly 8,500 items in the client’s quality feed, covering all of their authorities and sites of interest, analysts judged 205 relevant. That was before any filtering, even by keyword, so the team was working through a large volume of noise. Filtering at that ratio is exactly where AI pays off. 
• 61 hard negatives. These were items the source itself had tagged as quality-related, but which the client’s analysts still rejected. The AI read them as being about quality because the document said so. The analysts, looking through the lens of their own role and organization, decided otherwise. That boundary is where the real decision sits, and where AI needs teaching. 
• 60 – 70% accuracy from AI on its own. Using the items that had qualified in the past as a training set, AI triage on its own reached 60–70% accuracy for content relevance. That is a strong first pass that removes most of the noise, and expert review on top takes it to a standard you can defend. 

Much of the remaining 30% or so is there on purpose. It is peripheral information that may be relevant some of the time, and narrowing the filter too tightly risks missing something that matters. The figure may rise over time as the model learns from the client’s feedback.

Lessons from practice

Setting up AI triage for surveillance taught four lessons. 

• Cast wide, then let AI sort. Capture broadly at source. AI can then work through a volume of data that one or two people never could, judging relevance and categorizing each update by type. 
• Every call shows its reasoning. When an item is rejected, the team needs to know why. A one-line rationale for each decision makes the output checkable and feeds the feedback loop, because analysts can see what the system decided and correct it. 
• Doubt goes to a person. The model doesn’t make a simple choice between relevant and not relevant. There is a middle ground, and when the system isn’t sure, the item goes to a person to review rather than being discarded. 
• AI can’t settle disagreements. In the labelled data, analysts had made different decisions about near-identical PIC/S items. If your experts haven’t agreed a rule, no prompt can learn it. AI exposes inconsistency in a process; it doesn’t fix it. 

Where judgment can’t be delegated 

Interpretation and impact assessment are where an “AI first” approach most often goes wrong. The same signal can mean different things to different teams, even within one organization. 

One signal, two lenses 

Harrison used the UK’s updated clinical trials regulations, in force since April 2026, as an example. AI can find this change, summarize it and flag it within hours. What happens next depends on who is looking.

Without a lot of company context, AI can’t know which lens matters most for your organization, who owns the response or what the risk is if nobody acts. That has implications for how models are built. A model trained on one team’s decisions will reflect one team’s view, so it needs to allow for the different perspectives across the organization. 

Keeping AI accurate at scale 

Where AI runs more of the early process, ownership and continuous improvement still apply. Harrison described three risks and the controls that work against them. 

1. All-at-once runs: batch the work. Pointing an AI agent at every SOP in one pass invites invented clauses, links and gaps. Batching the work by process area keeps each run scoped, grounded and checkable. 
2. Silent misclassification: close the loop. Content tagged to the wrong function, such as clinical trials content marked as CMC-relevant, repeats quietly until someone corrects it. Because each categorization comes with its reasoning, experts can say where it went wrong, and that feedback retrains the model over time. 
3. Plausible precedent: ground it in sources. Generic tools can invent approvals and citations. Tying every output to verified source content means a reviewer can see exactly where a suggestion came from and check it in seconds. If a person owns the process, that is what lets them understand what went right and what went wrong. 

None of this is mainly a technology problem. It comes down to asking the right questions for your company and teaching the AI your context. Not every signal needs an action, but every signal needs a decision: act, monitor or close, and why. That decision is a human one, and it is what an inspector will ask about.

Build versus buy, honestly 

With so many AI tools now available, it has become much easier to spin up an application internally. Harrison shared what Infodesk has heard from clients who started with an in-house build and later moved to working with a vendor, including why they made that change. 

Control is the main reason to build. You aren’t tied to a vendor’s direction, and you can take the tool wherever you need it to go. What you gain from a vendor in return is the feedback it hears from other clients across the industry, which flows into the product you use. 

The question clients raise most often isn’t how to build a solution. It is how to maintain it: who supports it, how updates are managed and who re-validates it when something changes. Running an internal solution tends to take more time and resources than teams expect. 

Building in-house can make sense when: 

• AI and data engineering are core capabilities in your organization.
• There is the budget and capacity to maintain and re-validate the solution for the long term 
• The use case is unique to you 

For most teams, though, the core activities are the same. Organizations monitor different things and work in different ways, but the work of monitoring, triage and assessment is broadly shared.

Human first, AI empowered in practice 

Rather than being AI first, Infodesk’s approach is human first and AI empowered. Harrison closed with five principles from teams that have made AI work in regulatory and quality intelligence. 

• Start with the decision. Begin at the end of the process. Define the decision each signal feeds, then work backwards to where AI makes sense and whether it should make that decision or only support it.
• Make it traceable. Record the source, the rationale and the reviewer for every AI output, so you can see how and why it reached a result and correct it when it’s wrong. 
• People own interpretation. Regulatory text is rarely black and white. Impact assessment and sign-off stay with accountable experts, particularly towards the end of the process. 
• Teach it your context. Different teams and organizations bring different perspectives, roles and responsibilities. Job aids, update categories and feedback from champions shape what the AI sees, so its output is relevant to you. 
• Govern it like a process. Put owners, SOPs and governance forums around it, as you would for any GxP process, covering both how to use it well and how to improve it over time. 

Five questions before you deploy AI 

Whether you are starting out or partway through, these questions can help pressure-test any AI proposal, internal or external. 

1. Which stage of the lifecycle are we automating, and who signs off the output? 
2. Can every AI decision be traced to a source and explained to an inspector? 
3. How will we measure accuracy against our own experts’ decisions? Testing against a set of past decisions before rollout is what many teams do. 
4. What happens to the items the AI rejects, and does anyone have visibility of them? 
5. Who re-validates when the model, or the regulation, changes? 

If a proposal can’t answer these, it isn’t ready for regulated work. 

Conclusion 

AI has changed what regulatory and quality intelligence teams can cover. It can see more, work faster and handle a volume no team could read by hand. What it can’t do is own the outcome. The teams getting real value from AI are the ones that are clear about where it stops: on interpretation, on the decision and on sign-off. 

Harrison’s closing line summed it up: use AI to see more, and use people to decide.

How Infodesk helps 

Infodesk is human first and AI empowered. We use AI where it is strongest, at the start of the workflow, so that regulatory and quality experts can spend their time on interpretation, decisions and implementation. 

• Regulatory intelligence monitors and curates health authority updates, with AI triage that shows its reasoning for every item it qualifies or rejects, and a feedback loop that learns from your team’s decisions. 
• Infodesk AI drafts summaries and highlights key points, grounded in the source content so reviewers can check every output. 
• The Workflow Solution routes each signal to an accountable owner and the right SMEs, records the assessment, the decision and the rationale, and tracks actions through to closure with a full audit trail.