The FDA's AI Credibility Draft Is Still a Draft. Boards Should Not Wait.

Updated October 21, 2026. First published January 8, 2025.

Twenty-one months after the FDA proposed a framework for judging AI models used in drug and biologic submissions, the guidance is still a draft. The evidence it describes has nonetheless become what regulators, partners, and acquirers expect, and the question of who oversees that evidence now belongs in the boardroom.

In Brief

The Problem. Sponsors already rely on artificial intelligence (AI) to produce evidence about the safety, effectiveness, and quality of drugs and biologics. The U.S. Food and Drug Administration (FDA) has proposed how that evidence should be shown to be credible, but its January 2025 guidance remains a draft.

Why It Persists. Draft status invites boards to treat the matter as a technical one for regulatory affairs. Meanwhile, the FDA and the European Medicines Agency (EMA) have published shared principles, and Delaware courts have held directors accountable for weak oversight of FDA compliance.

What Boards Should Do. Ask management for an inventory of AI that touches regulatory evidence, a named owner for each high-risk use, credibility evidence on file, and contract terms that secure it. Record the review in the minutes, and test AI-generated evidence in every licensing and acquisition decision.

The Draft Is Still a Draft. The Expectations Are Not.

My argument is simple. The formal status of the FDA's guidance is the least important fact about it. What matters is that AI-generated evidence is already in the files regulators review, that regulators on both sides of the Atlantic now describe the same expectations for it, and that a board which cannot show how it oversees that evidence carries both regulatory and fiduciary exposure. Boards that wait for a final text will find that the standard arrived without one.

AI now touches nearly every stage of the drug development pipeline, from discovery to postmarket surveillance:

• Drug discovery: AI aids in target identification, drug repurposing, and predicting a compound's efficacy and safety.
• Preclinical development: AI refines lead compounds by forecasting pharmacokinetic and toxicological properties.
• Clinical trials: AI supports patient selection and recruitment and helps identify biomarkers for study endpoints.
• Manufacturing: AI supports production optimization and automated quality control.
• Postmarket surveillance: AI analyzes real-world data to detect adverse events and to generate real-world evidence for safety monitoring.

These uses bring efficiencies, and they also bring new oversight problems. Deep learning models can be opaque, which complicates validation and regulatory review. When the FDA announced the draft on January 6, 2025, then-Commissioner Robert M. Califf, M.D., said that "with the appropriate safeguards in place, artificial intelligence has transformative potential to advance clinical research" (FDA, 2025a). The guidance is the agency's description of those safeguards. A board's task is to know whether its organization has them.

What the Guidance Covers

The draft, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products, applies to human and animal drugs and biological products when an AI model produces information that supports a regulatory decision about safety, effectiveness, or quality. It does not address AI used in drug discovery or AI used only for operational efficiencies, such as internal workflows, resource allocation, or drafting a regulatory submission (FDA, 2025b). The line is drawn by consequence: the guidance concentrates on the models whose outputs can shape patient outcomes and product quality.

The draft defines AI as "a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments" (FDA, 2025b). Machine learning (ML), a subset of AI that trains algorithms to improve their performance from data, is the most common technique in drug research and development. The definition is deliberately broader, so methods that do not yet exist will fall under the same expectations.

The FDA built the draft from experience, not theory. The agency cites more than 500 drug and biological product submissions with AI components from 2016 to 2023, an expert workshop in December 2022, a public workshop in August 2024, and more than 800 external comments on its May 2023 discussion paper (FDA, 2026b). AI in regulatory evidence is not a future scenario. It is already in the files the agency reviews.

Why AI Evidence Is Different

Traditional statistical methods are fixed and inspectable. AI models rely on large, varied datasets, and some can change as their data change. The draft names the resulting challenges plainly (FDA, 2025b):

• Opacity. Understanding how a model was developed and how it reaches its conclusions may be difficult. In a regulated setting, that opacity raises questions of accountability, especially for decisions about treatment or product release.
• Uncertainty. The accuracy of a deployed model's output may be difficult to interpret, explain, or quantify.
• Data quality and bias. Training datasets vary in quality, size, and representativeness. A model built on historical data may carry forward patterns that do not serve all patient groups or production conditions.
• Drift. A model's performance can change over time or across deployment environments, for example when a patient population or a manufacturing process changes.

Each of these is a reason the guidance asks for continuing evidence rather than a single validation at launch. Each is also a reason a board cannot rely on a statement that "the model was validated" without asking when, against what data, and by whom.

The Three Parts of the Framework

The draft has three parts: a risk-based credibility assessment, life cycle maintenance of credibility, and early engagement with the agency (FDA, 2025b).

Risk-Based Credibility Assessment

The core of the draft is a seven-step process for establishing that a model is credible for a specific context of use (COU), such as predicting adverse events in a trial or informing a product release decision in manufacturing:

1. Define the question of interest the model will help answer.
2. Define the context of use: what the model will be used for, how, and whether its output is the sole basis for a decision or one source of evidence among several.
3. Assess the model risk.
4. Develop a plan to establish credibility within that context of use, covering data, model development, performance targets, and the handling of bias.
5. Execute the plan.
6. Document the results in a credibility assessment report and discuss any deviations from the plan.
7. Determine whether the model is adequate for the context of use, and if not, refine it, add evidence, or change the approach.

Model risk combines two factors. Model influence is the contribution of the AI-derived evidence relative to other evidence used to answer the question. Decision consequence is the significance of an adverse outcome if the decision is wrong (FDA, 2025b). The higher the combined risk, the more testing, documentation, and scrutiny the sponsor should plan. For a board, the useful insight is that the same model can be low risk in one use and high risk in another. The inventory a board receives should therefore list uses, not just tools.

Life Cycle Maintenance

A model that was credible at submission may not stay credible. The draft asks sponsors to monitor performance over the life of the product and to manage model changes through the manufacturer's change management system within its pharmaceutical quality system. Sponsors may also address model changes in postapproval change management plans and may propose model elements as established conditions (FDA, 2025b). Regular retesting against established benchmarks matters most when patient populations or manufacturing processes shift, because small shifts in either can change model accuracy. Integrating this monitoring into existing quality processes, rather than building a parallel system, is the sound approach.

Early Engagement

The draft encourages sponsors to engage the FDA early, before significant resources are committed, about the credibility assessment and the use of AI (FDA, 2025a). It lists the routes available, including the Initial Targeted Engagement for Regulatory Advice on CBER/CDER Products (INTERACT), Pre-Investigational New Drug Application (pre-IND) meetings, the Complex Innovative Trial Design (CID) Meeting Program, the Emerging Drug Safety Technology Program (EDSTP), the Innovative Science and Technology Approaches for New Drugs (ISTAND) program, the Model-Informed Drug Development (MIDD) Paired Meeting Program, the Center for Drug Evaluation and Research (CDER) Emerging Technology Program (ETP), the Center for Biologics Evaluation and Research (CBER) Advanced Technologies Team (CATT), the Digital Health Technologies Program, and the Real-World Evidence Program (FDA, 2025b). These routes let a sponsor test model design, data representativeness, and long-term oversight with the agency before a submission depends on them. A board should know which of them its organization has used, and why not if the answer is none.

What Has Changed Since January 2025

The guidance remains a draft. The FDA guidance page still labels it a draft and describes its contents as non-binding recommendations (FDA, 2025b). The CDER artificial intelligence page, current as of May 1, 2026, lists no final version (FDA, 2026b). Five developments since then matter more to a board than the missing final text.

• A shared transatlantic position. On January 14, 2026, the FDA published ten guiding principles of good AI practice in drug development, developed with the EMA. They cover human-centric design, a risk-based approach, adherence to standards, a clear context of use, multidisciplinary expertise, data governance and documentation, model design and development, risk-based performance assessment, life cycle management, and clear, essential information (FDA, 2026a). Adoption is currently voluntary, but the principles are intended to inform future regulatory policies and guidance across jurisdictions (Jones Day, 2026).
• European practice. The EMA adopted a reflection paper on AI across the medicinal product life cycle in September 2024. In March 2025, it issued its first qualification opinion on an AI tool, AIM-NASH, which helps pathologists assess liver biopsies in clinical trials; the EMA accepts the evidence when a pathologist supervises the tool (EMA, n.d.).
• Manufacturing. European inspectors and the Pharmaceutical Inspection Co-operation Scheme (PIC/S) consulted from July 7 to October 7, 2025 on a new Good Manufacturing Practice (GMP) Annex 22 on AI. The draft does not apply to generative AI and large language models, and states that they should not be used in critical GMP applications (Barton, 2025).
• Modeling standards. The International Council for Harmonisation (ICH) adopted guideline M15 on model-informed drug development on January 29, 2026, and it took effect in the European Union on July 23, 2026. It names AI and machine learning among the modeling methods that model-informed drug development can include (EMA, 2026).
• The regulator as AI user. On June 2, 2025, the FDA launched Elsa, an agency-wide generative AI tool that its staff use to accelerate clinical protocol reviews, summarize adverse event reports for safety profile assessments, and identify high-priority inspection targets (FDA, 2025c). On December 1, 2025, it extended agentic AI tools to staff for work that includes premarket reviews and inspections (FDA, 2025d). The FDA also held a second public workshop on AI in drug development on October 7, 2025 (FDA, 2026b).

Implications for Sponsors

The guidance reaches beyond scientific validation into budgets, staffing, and strategy. These consequences belong in the plans a board approves.

• Development costs and timelines. Credibility planning, explainability work, and postapproval monitoring add cost early in development and can lengthen timelines. The return is fewer regulatory setbacks and less rework later. A board should expect the cost of credibility evidence to appear in program budgets, not to be absorbed silently.
• Talent. Regulated AI requires people who combine machine learning, clinical research, manufacturing, and regulatory affairs. In my experience these combinations are scarce, and organizations that rely on a single vendor or a single expert carry concentration risk. Training, interdisciplinary teams, and succession for key technical roles reduce it.
• Data as an asset. Data governance, quality, and traceability determine whether AI evidence will hold up. A well-governed data estate supports compliance today and makes the next model faster to qualify.
• Prioritization by risk. Because risk depends on model influence and decision consequence, AI projects differ in regulatory stakes. Starting with lower-risk uses lets an organization build its credibility process before applying it to high-consequence decisions.
• Regulatory strategy. Documented model development, records of data use, and planned engagement with the agency reduce ambiguity and costly rework. They also produce the record a board will want if a submission is questioned.

Implications for the Board

The fiduciary dimension has sharpened since this article first appeared. On September 2, 2025, the Delaware Court of Chancery declined to dismiss oversight claims against directors of the drug maker Teligent in Giuliano v. Grenfell-Gardner (Giuliano v. Grenfell-Gardner, 2025). The complaint alleged that the board "had no committee charged with overseeing" FDA compliance, and that at least one compliance report reached the board "at management's election" rather than through any reporting system. The court allowed the claim that the board failed to implement a monitoring system to proceed, holding that evidence that management "could have made the Board aware of specific issues at specific times" did not show a board-level system. A red-flags claim against the former chief executive and chief scientific officer also survived. The claims remain allegations, and the case has moved on: on August 21, 2026, the court allowed the defendants to seek summary judgment only on a time-bar argument, finding that their other arguments, including that they did not "utterly fail" to implement a reporting system, "rest on factually rife issues" (Giuliano v. Grenfell-Gardner, 2026). The reasoning applies to any board whose regulatory evidence now depends on AI.

Four governance choices follow, each updated from the original version of this article.

• Place AI oversight in a charter. Boards need not form a dedicated AI committee, but one committee should hold AI oversight in its charter, whether risk and compliance, quality, or science and technology. The Teligent allegations show the cost of leaving FDA compliance without a committee home. Regular reporting on model performance and risk lets the committee escalate issues before a regulator does.
• Build an organization that can carry the work. Management should promote AI literacy across functions and hold open forums on regulatory developments and data governance practice. Collaboration among clinical research, manufacturing, regulatory affairs, and data science is what makes the credibility process work.
• Govern partnerships by contract. Vendors, contract research organizations (CROs), and academic partners can speed validation and share regulatory burden. Agreements should settle data ownership, intellectual property, audit rights, notice of model changes, access to validation records, and postapproval responsibilities.
• Treat ethics as part of quality. Fairness, bias mitigation, and privacy affect whether regulators, patients, and the public trust AI-derived evidence. Ethical review belongs in model design and in the governance record, not only in a policy statement.

The board does not need to master the seven steps. It needs to confirm that management knows where AI touches regulatory evidence, that someone answers for each use, and that the evidence would satisfy a reviewer. Nose in, fingers out. Four items, reported at least annually to the committee that holds AI oversight, give directors a sound basis for reliance:

1. An inventory. Every AI model whose output appears, or will appear, in a submission, a manufacturing release decision, or a safety report, with the risk rating for each use.
2. A named owner. One accountable executive for each high-risk use, with authority over the data, validation, and change control of the model.
3. Credibility evidence on file. For each high-risk use, a credibility plan and report of the kind the draft describes, and a record of any FDA or EMA interaction about it.
4. Partner and vendor terms. Contracts with technology vendors and CROs that secure audit rights, change notification, data-use limits, and access to validation records.

The board should record its review of these items in the minutes. When a regulator, an auditor, or a court later asks what the board knew, the minutes are the evidence. A thorough technical briefing that leaves no trace in the record does not help the board later.

What Boards Should Expect From AI Vendors

Third-party AI developers that serve pharmaceutical and biotechnology sponsors now sell into a more structured regulatory environment. Directors should expect management to hold vendors to the same evidence the sponsor must produce.

• Products built for regulated use. Platforms used for regulatory evidence should provide validation logs, data lineage tracking, and records that align with the FDA's expectations. A vendor that cannot supply them shifts the documentation burden, and the risk, to the sponsor.
• Documentation as a selection criterion. Advanced algorithms matter less than documentation a reviewer can follow, risk reporting the sponsor can monitor, and controlled workflows for retraining. These features should weigh in vendor selection.
• Transparency about change. Clear documentation of model architecture, data use, and performance, and prompt notice of updates, patches, and security fixes, are the basis of trust between vendor, sponsor, and regulator.

Implications for Investors and Dealmakers

Private equity, venture capital, acquirers, and licensing partners increasingly assess companies that use AI to support regulatory decisions. The guidance adds two factors to that assessment: readiness to meet the credibility expectations, and the maturity of the data behind the models. Licensing and acquisition teams now buy evidence as well as molecules.

• Due diligence. Financial and market assessments do not suffice. Diligence should establish which results depend on AI, how each model was validated, whether a regulator has commented on it, and who will own the model after closing. Specialists in machine learning and regulatory affairs can identify gaps such as missing documentation or bias in training data.
• Evaluating opportunities. Credibility expectations favor companies that already document their models well. Such companies may face fewer regulatory delays, which improves expected returns.
• Portfolio oversight. After investment, owners can align performance indicators with AI governance and ask for routine reporting on model performance, data transparency, and regulatory developments.
• Mergers and acquisitions. An acquirer must assess whether the target's AI infrastructure and data governance are compatible with its own. Audits of data pipelines, training methods, and controls show where integration will be smooth and where it will not.
• Licensing and partnerships. Where a licensed asset's data package relies on AI, the agreement should assign responsibility for ongoing validation, data governance, and regulatory interaction.

A gap in any of these is a valuation question, not only a technical one. The board approving the transaction should see that the diligence report addressed it.

The Strongest Objection

The strongest objection is that this is management's work. The guidance is not final, it is addressed to sponsors rather than directors, and boards that reach into model validation risk confusing oversight with management. A director might reasonably ask why the board should spend agenda time on a draft.

The objection is right about the line between oversight and management, and wrong about where the line falls. The board should not review credibility plans or second-guess validation methods. It must, however, ensure that a reporting system exists for a risk that is central to the business, and for a company whose approvals depend on regulatory evidence, the integrity of that evidence is central. Teligent turned on exactly this point: the allegation was not that directors misjudged a technical question, but that no committee owned FDA compliance and management decided what the board heard (Giuliano v. Grenfell-Gardner, 2025). Draft status changes none of this. It only means the board cannot point to a final rule as the reason it was not ready.

What Endures

The draft describes a risk-based, stepwise approach for AI that produces evidence about safety, effectiveness, or quality. Its larger lesson is organizational. Credible AI evidence depends on cross-functional teams that work together, on risk assessment used as a discipline rather than a barrier, on data that is fit for use, and on documentation that a regulator, a patient, or a partner can follow. It depends on ethical review that addresses fairness and privacy, and on early and continued dialogue with regulators. The regulatory process will keep moving, through the final guidance, the joint principles, ICH M15, and Annex 22. Organizations that build these habits now will adapt to each new text. Those that wait will rebuild their evidence under deadline.

For the Board

• Which of our submissions, manufacturing decisions, or safety reports depend on AI model outputs today, and which will in the next 12 months?
• Which committee charter assigns oversight of AI used in regulatory evidence, and who is the accountable executive for each high-risk use?
• For our highest-risk use, could we hand a reviewer a credibility plan and report this quarter?
• Which FDA or EMA engagement routes have we used to discuss AI evidence, and what did we learn?
• Do our vendor and CRO agreements give us audit rights, change notification, and access to validation records?
• Did the diligence report for our last licensing or acquisition decision address AI-generated evidence?

Explore the life sciences regulatory developments and board question sets in the Avancer AI Governance Navigator.

References

Barton, C. (2025, August 22). Stakeholders' consultation on GMP Annex 11, Chapter 4, and new Annex 22. PharmTech. https://www.pharmtech.com/view/stakeholders-consultation-on-gmp-annex-11-chapter-4-and-new-annex-22

European Medicines Agency. (n.d.). Artificial intelligence. Retrieved October 21, 2026, from https://www.ema.europa.eu/en/about-us/how-we-work/data-regulation-big-data-other-sources/artificial-intelligence

European Medicines Agency. (2026). ICH M15 guideline on general principles for model-informed drug development (EMA/CHMP/ICH/496426/2024; Step 5). https://www.ema.europa.eu/en/documents/scientific-guideline/ich-m15-guideline-general-principles-model-informed-drug-development-step-5_en.pdf

Giuliano v. Grenfell-Gardner, C.A. No. 2021-0452-KSJM (Del. Ch. Sept. 2, 2025) (mem. op.). https://courts.delaware.gov/Opinions/Download.aspx?id=384430

Giuliano v. Grenfell-Gardner, C.A. No. 2021-0452-KSJM (Del. Ch. Aug. 21, 2026) (letter op.). https://courts.delaware.gov/opinions/download.aspx?id=400260

Jones Day. (2026, January). EMA and FDA align on good AI practice in drug development. https://www.jonesday.com/en/insights/2026/01/ema-and-fda-align-on-good-ai-practice-in-drug-development

U.S. Food and Drug Administration. (2025a, January 6). FDA proposes framework to advance credibility of AI models used for drug and biological product submissions [Press release]. https://www.fda.gov/news-events/press-announcements/fda-proposes-framework-advance-credibility-ai-models-used-drug-and-biological-product-submissions

U.S. Food and Drug Administration. (2025b). Considerations for the use of artificial intelligence to support regulatory decision-making for drug and biological products: Guidance for industry and other interested parties (Draft guidance; Docket No. FDA-2024-D-4689). Retrieved October 21, 2026, from https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological

U.S. Food and Drug Administration. (2025c, June 2). FDA launches agency-wide AI tool to optimize performance for the American people [Press release]. https://www.fda.gov/news-events/press-announcements/fda-launches-agency-wide-ai-tool-optimize-performance-american-people

U.S. Food and Drug Administration. (2025d, December 1). FDA expands artificial intelligence capabilities with agentic AI deployment [Press release]. https://www.fda.gov/news-events/press-announcements/fda-expands-artificial-intelligence-capabilities-agentic-ai-deployment

U.S. Food and Drug Administration. (2026a, January 14). Guiding principles of good AI practice in drug development. https://www.fda.gov/about-fda/artificial-intelligence-drug-development/guiding-principles-good-ai-practice-drug-development

U.S. Food and Drug Administration. (2026b, May 1). Artificial intelligence for drug development. Retrieved October 21, 2026, from https://www.fda.gov/about-fda/center-drug-evaluation-and-research-cder/artificial-intelligence-drug-development