Written and maintained by CASRAI Editorial Board
Last updated
AI model governance for pharmacovigilance (PV) is the set of controls a sponsor puts around an AI model so that its output can be trusted when it feeds safety work such as individual case safety report (ICSR) handling. FDA’s January 2025 draft guidance on AI to support regulatory decision-making for drugs and biologics names “identifying, evaluating, and processing for reporting postmarketing adverse drug experience information” as one of the uses it considers, and supplies a seven-step, risk-based credibility framework for it. This guide explains what that framework asks of a PV team, how it sits beside the E2B(R3) message standard, and what it leaves to the sponsor’s own procedures. It is a different angle from the general overview in FDA’s AI guidance for drugs and devices.
What FDA’s AI guidance covers, and excludes, for pharmacovigilance
The guidance is titled “Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products” (docket FDA-2024-D-4689). It is a draft: the document states “Not for implementation. Contains non-binding recommendations,” and where it says “should” it describes a suggestion, not a requirement. FDA’s guidance page still labels it a draft dated January 2025 (checked 2026-10-29).
Scope is defined by purpose. It applies to AI used to produce information or data that supports regulatory decision-making about the safety, effectiveness or quality of a drug. Two uses are outside it: drug discovery, and operational efficiencies such as internal workflows, resource allocation or drafting a regulatory submission, provided they do not affect patient safety, drug quality or the reliability of study results. For PV, the practical reading is that a model that influences which cases are reported, how they are classified or what safety information is extracted sits inside the guidance, while a tool that only schedules internal work does not.
The seven-step credibility framework
The guidance defines credibility as “trust, established through the collection of credibility evidence, in the performance of an AI model for a particular COU” (context of use). The seven steps in section IV.A are:
- Define the question of interest.
- Define the context of use (COU) for the AI model.
- Assess the AI model risk.
- Develop a plan to establish AI model credibility within the COU.
- Execute the plan.
- Document the results of the credibility assessment plan and discuss deviations from the plan.
- Determine the adequacy of the AI model for the COU.
The COU “defines the specific role and scope of the AI model used to address a question of interest.” This is the step PV teams most often under-specify: “AI for ICSR processing” is not a context of use, whereas a statement of exactly which task the model performs, on which input, and what a human does with its output, is.
Model risk: influence and decision consequence
Step 3 rates risk from two factors that are determined independently of each other:
| Factor | FDA’s definition |
|---|---|
| Model influence | “the contribution of the evidence derived from the AI model relative to other contributing evidence used to inform the question of interest” |
| Decision consequence | “the significance of an adverse outcome resulting from an incorrect decision concerning the question of interest” |
Both ratings together determine model risk, and the credibility evidence expected grows with that risk. The guidance does not assign ratings to PV tasks. Placing a given task, for example a model that proposes a seriousness assessment which a trained reviewer then confirms, is the sponsor’s own judgement and should be written down with its reasoning at step 3.
Where E2B(R3) ICSR processing fits
E2B(R3) is a fixed message standard: the data elements and structure of an ICSR do not change because an AI model helped populate them. The European Medicines Agency states that the ICH E2B(R3) message format became mandatory for all ICSR and SUSAR submissions to EudraVigilance on 30 June 2022. Governance therefore attaches to the model’s role upstream of the message, not to the message itself. See E2B(R3) data elements for the structure and the ICSR processing workflow for the stages where a model could take part.
The table below is an illustration of how the framework’s vocabulary applies to ICSR work. It is our worked reading of the steps, not text from FDA.
| Framework step | Question a PV team would document for an ICSR task |
|---|---|
| Question of interest | What decision does the output inform, for example whether a report is valid or how an event is coded? |
| Context of use | Which task the model performs, on what source material, and what a person does with its output |
| Model risk | How much the model’s output outweighs other evidence, and what follows from a wrong result |
| Credibility plan and execution | Evidence planned and gathered that the model performs as needed for that task |
| Adequacy | A recorded conclusion that the model is fit for that context of use |
Documentation and inspection
The most useful PV-specific passage is a footnote (25). It states that in postmarketing pharmacovigilance “certain documentation (e.g., processes and procedures) is not generally submitted to the Agency but is maintained according to the sponsor’s standard operating procedures and made available to the Agency upon request (e.g., during an inspection).” In such cases, sponsors “may choose to complete all the steps outlined in the guidance without seeking early engagement with the Agency.” It adds that sponsors “remain responsible for compliance with statutory and regulatory requirements, including postmarketing safety surveillance and reporting requirements, regardless of the technology utilized.”
Three consequences follow. The credibility record belongs with the PV system’s SOPs and is expected to be inspection-ready. Early engagement with FDA (section IV.C) is optional here, not a gate. And using a model never transfers responsibility for timely, accurate reporting. Related reporting context is in pharmacovigilance in clinical research and EudraVigilance reporting.
Life cycle maintenance
Section IV.B treats governance as continuing. FDA describes life cycle maintenance as “the management of changes to AI models whether incidentally or deliberately, to ensure the model remains fit for use over the drug product life cycle for its COU,” through “a set of planned activities to monitor and ensure the model’s performance and its suitability.” The stated reason is that “a model’s performance can change over time or across deployment environments.” For a PV team that means a monitoring plan and a change-control route for model updates, defined before deployment.
FAQ
Is the FDA guidance binding for AI used in PV?
No. It is a draft with non-binding recommendations. Statutory and regulatory reporting duties still apply in full, and the guidance itself says so in footnote 25.
Does AI change the E2B(R3) data elements?
Nothing in the guidance changes E2B(R3). The message standard stays the same; the framework addresses whether the model that helped produce the content can be trusted for its stated context of use.
Do I have to submit my credibility documentation to FDA?
For postmarketing PV, FDA says such documentation is generally kept under the sponsor’s SOPs and made available on request, for example during an inspection. Sponsors may complete all the steps without seeking early engagement.
Are purely administrative AI tools in scope?
Operational-efficiency uses that do not affect patient safety, drug quality or the reliability of study results are outside the guidance’s scope.
Where does human oversight come in?
The CIOMS Working Group XIV report on artificial intelligence in pharmacovigilance, published 4 December 2025, warns that misguided automation risks “eliminating the value added by humans in the loop.” FDA’s framework records the human role as part of the context of use.
For wider clinical-trial uses of AI, see AI in clinical trials.
Sources
- U.S. FDA, Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products, draft guidance, January 2025 (full text PDF), checked 2026-10-29.
- CIOMS, Working Group XIV, Artificial Intelligence in Pharmacovigilance, checked 2026-10-29.
- European Medicines Agency, EudraVigilance: electronic reporting (ICH E2B(R3) mandatory date), checked 2026-10-29.
