The importance of a sound AI policy in pharma research and development

[pdusit/Adobe Stock]

From accelerating drug discovery and optimizing clinical trials to automating regulatory documentation and improving patient engagement, AI offers opportunities to improve efficiency, reduce costs, and bring therapies to market faster.

However, as AI tools become more integrated into research and development (R&D) workflows, they also introduce new risks, especially related to data privacy, intellectual property (IP), and regulatory compliance. For pharmaceutical companies, where innovation is both a competitive advantage and a regulatory obligation, establishing a sound and comprehensive AI policy is no longer optional: it is a strategic imperative.

The role of AI in pharma R&D

AI technologies are rapidly becoming essential to the pharmaceutical pipeline. Machine learning models are being used to predict molecular interactions, identify drug candidates, and personalize treatment plans. Generative AI tools can assist in drafting scientific publications, summarizing clinical trial data, and even designing molecules.

But while these tools can enhance productivity and reduce time to discovery, they must be deployed with caution. The sensitive nature of biomedical data, combined with strict intellectual property frameworks and regulatory standards, makes it essential that pharmaceutical companies adopt AI in a manner that protects both their scientific integrity and their business interests.

AI platforms: Promise and pitfalls

Many AI platforms, especially those available as public or commercial services, operate as “black boxes.” Their internal mechanics are opaque, and their training datasets are vast and often unverifiable. These platforms are frequently trained on publicly available information, which may include proprietary or copyrighted content.

When pharmaceutical researchers interact with these tools, particularly by inputting confidential research data, patient information, or unpublished findings—they risk unintended exposure of sensitive information. In some cases, that data could be incorporated into the model’s future outputs, potentially becoming accessible to other users or competitors.

To mitigate this risk, pharmaceutical companies must implement clear restrictions on the use of AI platforms. Any tool used for R&D purposes should undergo thorough legal, technical, and security evaluations. Ideally, companies should prioritize the use of private or on-premise AI instances that provide full control over data handling, access, and retention.

Protecting proprietary and patient data

The pharmaceutical industry is governed by strict regulations, including HIPAA, GDPR, and other local privacy laws. Compliance with these regulations is not only a legal requirement—it is essential for maintaining public trust and protecting patient welfare.

An effective AI policy must establish strict data governance rules. For example:

Proprietary research data must never be shared with unapproved AI platforms.
Patient information, even in de-identified form, should be protected with the same level of caution as identifiable data.
Contractual obligations with clinical partners, research institutions, or regulatory bodies must be honored, especially if they prohibit the use of AI for specific data sets.

Only platforms that have undergone comprehensive approval by legal, compliance, and IT departments should be permitted for use with sensitive or regulated data.

Human oversight is non-negotiable

Despite their capabilities, AI platforms are not infallible. Errors such as hallucinations—where an AI fabricates information or presents false data as fact—are common. In pharmaceutical research, such inaccuracies can have serious consequences, from flawed experimental designs to misinformed regulatory filings.

A sound AI policy should mandate that all AI-generated outputs be reviewed by qualified subject matter experts before use. This review must include scientific validation, accuracy checks, and context assessment to ensure compliance with ethical and regulatory standards.

The human expert bears full responsibility for the output, just as if it were generated independently. In highly regulated environments, such accountability is crucial.

Intellectual property considerations

In pharmaceutical R&D, intellectual property is paramount. Patents protect the enormous investment of time and capital required to bring a therapy to market. However, the growing role of AI in generating ideas, data, and even inventions introduces a level of ambiguity into traditional IP frameworks.

Under current U.S. law, the United States Patent and Trademark Office (USPTO) requires that a human make a “significant contribution” to any invention for it to be patentable. This creates specific obligations for companies using AI in innovation.

An AI policy should provide guidance on:

Prompt engineering: Crafting detailed prompts that reflect human creativity and direction.
Post-AI refinement: Substantially modifying or enhancing AI outputs to qualify as human-led innovation.
Utility recognition: Demonstrating that a human recognized and proved the value of an AI-generated idea.

Activities that lack meaningful human input, such as submitting a generic problem to an AI and accepting the first proposed solution—may jeopardize future patentability.

Documentation and audit trails

To protect IP rights and ensure regulatory defensibility, pharmaceutical companies must maintain comprehensive records of AI usage. This includes:

Prompts submitted to AI systems
AI-generated outputs
Human modifications and evaluations
Testing results and scientific validations
Data sets used to train or fine-tune AI models

In the event of IP disputes, regulatory audits, or publication challenges, these records can substantiate claims of human authorship, data integrity, and compliance.

For companies operating in multiple jurisdictions, maintaining centralized, standardized AI usage logs will be vital. Platforms such as internal collaboration tools or AI-specific documentation software can streamline this process.

Guidelines for responsible use

A modern AI policy in the pharmaceutical sector should include the following components:

Definitions and scope. Clearly define AI models, tools, and platforms; delineate who is covered by the policy, including researchers, contractors, and collaborators.
Approval processes. Create pathways for reviewing and approving new AI tools, with oversight from legal, IT, compliance, and data privacy teams.
Data usage rules. Categorize which data can be used with which tools. Prohibit the use of confidential or regulated data with public or unapproved platforms.
Human review requirements. Require expert validation of all AI outputs prior to application in scientific work, regulatory submissions, or public disclosures.
IP protection measures. Instruct researchers on how to use AI without jeopardizing invention rights. Encourage detailed prompt creation, critical evaluation, and substantive human contribution.
Record-keeping protocols. Mandate thorough documentation of AI interactions, especially when outputs influence publications, filings, or product development.
Prohibited practices. Identify specific behaviors—such as using public AI platforms for analyzing clinical data—that are expressly forbidden.

Conclusion

As AI becomes a powerful force in pharmaceutical innovation, the need for thoughtful governance grows more urgent. A robust AI policy is not a limitation on discovery—it is a framework that enables responsible, secure, and legally defensible innovation.

Ryan N. Phelan

Pharmaceutical companies that prioritize AI governance will be better equipped to protect their scientific breakthroughs, maintain compliance, and accelerate the delivery of life-changing therapies to patients around the world.

By embedding responsible AI practices into the heart of their R&D operations, these organizations can ensure that innovation and integrity go hand in hand.

Ryan N. Phelan is a partner and patent lawyer with the Chicago-based intellectual property law firm Marshall, Gerstein & Borun LLP. He may be reached at rphelan@marshallip.com.

DISCLAIMER: The information contained in this article is for informational purposes only and is not legal advice or a substitute for obtaining legal advice from an attorney. Views expressed are those of the author and are not to be attributed to Marshall, Gerstein & Borun LLP or any of its former, present, or future clients.