Part 2/2: If AI does more of the review, what does the human need to see?
By Marina Hickson, Vivanti Europe, and Shazad Jafri, ABPI Medical Signatory and Founder, SignAffairs
AI is becoming capable of handling increasingly complex medical, legal and regulatory (MLR) review activities. Beyond checking references and approved wording, it can compare claims, identify inconsistencies and assess content against defined requirements.
The opportunity is not simply faster review. AI could make assessments more consistent, reduce repetitive work and give reviewers better access to supporting evidence.
The challenge is knowing when those assessments can be relied upon.
In Part 1, Shazad Jafri of SignAffairs explored what AI-enabled MLR means for professional accountability. Together with Shana Owen and Vivanti Europe, he introduced three layers of assurance: system assurance, content assurance and item accountability.
The technology question is how to make those layers work together.
AI judgement depends on context
It is tempting to divide review activities into those AI can perform and those requiring human judgement.
That boundary is becoming less clear.
An experienced medical reviewer understands the medicine, intended audience, promotional context and circumstances surrounding a communication.
AI can assess many of these factors, provided the relevant information is available to it.
The limitation is not necessarily the AI’s ability to assess a claim. It may be the absence of information needed to make that assessment reliably.
Providing context is therefore fundamental to workflow design. The system needs the right sources, rules and information about how the content will be used.
It must also recognise when information is missing or an assessment falls outside its validated capabilities.
Context improves what AI can do. Validation establishes how far its outputs can reasonably be trusted.
Three questions for a defensible workflow
The assurance framework can be expressed through three questions.
Can we trust the system?
Has the AI been validated for its intended tasks? Do we understand its limitations, failure modes and appropriate uses?
Can we trust the content?
Are sources approved and current? Are claims supported, and can we distinguish approved wording from newly generated content?
Can I approve this item?
Can the reviewer see what the system has done, what checks were completed and what still requires professional attention?
These questions involve different responsibilities.
Technical and Quality specialists establish system assurance. Medical, Legal, Regulatory and Compliance experts define content requirements and boundaries. The qualified signatory remains responsible for certification where the ABPI Code requires it.
The aim is not to make everyone an AI expert. It is to ensure that each person receives reliable evidence from the preceding stage.
Source control is only the beginning
A controlled evidence base is essential for AI-enabled MLR.
Systems may be restricted to approved claims, prescribing information, SmPCs and certified materials. This reduces the risk of using inappropriate information.
It does not automatically guarantee accurate outputs.
Retrieving an approved statement is different from generating a new explanation based on it. A system can use the correct source and still omit a qualification or change the meaning of a claim.
The workflow should therefore identify whether content was selected unchanged, assembled, modified or newly generated.
It should also be possible to verify that the cited evidence genuinely supports the output.
Approved sources are necessary. Their correct interpretation and use must also be demonstrated.
What does validation actually mean?
AIFA’s July 2026 guidance provides a useful example. It addresses controlled sources, verification of outputs, system validation, stress testing, risk management and human supervision. It also calls for technical documentation supporting a declaration concerning algorithm validation and oversight.¹
The principle is reasonable. The practical question is what evidence demonstrates reliability.
An AI system checking for missing prescribing information requires different testing from one assessing whether a promotional comparison is balanced.
Validation should reflect the intended task.
For example, a system assessing claims should be tested against realistic scenarios, including incomplete evidence, misleading omissions and difficult comparisons.
Testing should examine what the system identifies, what it misses and the consequences of those errors.
A missed unsupported claim may have greater regulatory significance than an incorrectly flagged reference.
Technical specialists should perform and document the validation, with Medical Affairs helping define the relevant risks and acceptable performance.
A medical signatory need not understand every detail of the algorithm. They should know what the workflow has been validated to do, where its limits lie and when human review remains necessary.
Knowing when to stop
Not every question has a sufficiently supported answer.
An AI system may encounter conflicting evidence, missing context or an issue outside its intended use.
A well-designed workflow should recognise those limits.
It may request additional information, flag an unsupported claim or escalate the issue to a qualified reviewer.
Simply displaying a confidence score is unlikely to be enough, particularly if that score has not itself been validated.
A useful escalation explains what is missing, why the system cannot proceed and what decision is required.
Human oversight becomes more effective when people are directed towards the issues that genuinely need their attention.
Five things the reviewer should see
The handover is where technical assurance becomes meaningful for the person making the decision.
A polished output with a green compliance indicator is not sufficient.
The reviewer should have visibility of five things:
- Sources: Which evidence supports the content?
- Changes: What was selected, assembled, rewritten or generated?
- Checks: What was tested, and what were the results?
- Uncertainty: What remains unresolved or requires escalation?
- History: Can the relevant sources, model configuration, prompts, rules and decisions be reconstructed?
These elements should be accessible without overwhelming the reviewer with technical detail.
Their reliability depends on the controls behind them. A displayed citation must genuinely support the claim. A completed check must have been appropriately validated.
The objective is not simply to show the reviewer more information. It is to provide evidence they can meaningfully use.
Assurance does not stop at deployment
AI-enabled workflows change.
Models are updated, prompts revised, source libraries maintained and regulatory requirements amended.
An SmPC update may affect existing claims. A model or prompt change may alter how the same evidence is interpreted.
Organisations need to know which changes require testing, revalidation or re-review.
They also need sufficient records to reconstruct what happened when an item was produced.
NIST’s AI Risk Management Framework and Generative AI Profile emphasise documentation, evaluation, monitoring, provenance and risk management throughout the AI lifecycle.² ³
These principles are particularly relevant when regulated decisions depend on AI-supported work.
Assurance by design
The future of MLR is unlikely to be a simple choice between human review and AI automation.
AI can take on increasingly complex assessments. Medical and regulatory professionals can focus their expertise on questions requiring judgement, escalation and accountability.
The workflow connecting them must make that division of responsibilities credible.
For technology teams, that means validating performance, controlling sources, managing change and making limitations visible.
For Medical Affairs, it means defining the requirements and understanding the evidence supporting AI-assisted decisions.
For signatories, it means having sufficient information to approve material responsibly.
The measure of success should not be how much human involvement disappears. It should be whether the remaining human decisions are better informed, more consistent and more defensible.
That is the practical meaning of assurance by design.
This is Part 2 of a two-part series from Vivanti Europe and SignAffairs. Part 1, Touch-free review, or a signature on the algorithm?, explores final-form certification, professional accountability and the three-layer assurance framework.
Read Part 1: HERE
References
- Linee di indirizzo: utilizzo di sistemi di Intelligenza Artificiale nei materiali promozionali. 24 July 2026.
- Artificial Intelligence Risk Management Framework (AI RMF 1.0). 2023.
- Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. 2024.
