FDA unveils long-awaited guidance on AI use to support drug and biologic development

Key regulatory expectations in the draft guidance include:

• A 7-step risk-based framework, which FDA expects sponsors to use to assess AI model credibility.
• Credibility assessment plan, which would be submitted to FDA and comprehensively outlines the model’s design, data strategy, training methodologies, performance metrics and evaluation methodologies.
• Credibility assessment report, compiled from the execution of the credibility assessment plan. The report should include a comprehensive description of the outcomes of the plan, confirm the AI model’s credibility for its intended context of use (COU), outline any deviations from the plan, and be submitted to FDA early in the process, either within a regulatory submission or upon request during an inspection.
• Lifecycle maintenance plan to ensure continuous monitoring and maintenance of AI model performance throughout its lifecycle, considering ongoing updates and new data.
• Early engagement with FDA is recommended to navigate new regulatory expectations in the guidance. 

FDA’s 7-Step Risk Based Credibility Framework, Including Credibility Assessment Plan and Report

The guidance introduces a seven-step, risk-based framework for assessing the credibility of AI model outputs, tailored to the model’s COU. This process includes defining the question and COU, assessing model risk, and developing and executing a plan to establish credibility.

• Step 1: Define the Question of Interest. This focuses on the specific concern or decision the AI model aims to address – e.g., clinical development or manufacturing and helps ensure the AI model is aligned with the specific regulatory objectives. Companies should have a well-defined question of interest and identify and incorporate appropriate sources of evidence — such as clinical trials, testing, or manufacturing data — that will support the AI model’s outputs.

• Step 2: Define the COU. The COU outlines the specific role and scope of the AI model in addressing a particular question of interest. This includes a clear description of how the AI model will be used, what data it will rely on, and whether additional sources, such as animal or clinical studies, will supplement the AI-generated outputs. Sponsors also should ensure the COU clearly delineates the model’s intended function and how its outputs will be applied within the broader regulatory context in which the AI model operates. 

• Step 3: Assess AI Model Risk. Model risk is determined by evaluating model influence (how much the AI model’s output contributes to decision-making) and decision consequence (the potential impact of an incorrect decision based on the AI output). Higher model influence or decision consequence increases overall model risk, requiring more rigorous validation and oversight for effective regulatory compliance. Sponsors should conduct a thorough risk assessment early in the development process, develop a risk matrix which considers the detectability of AI model risk, and engage with FDA to ensure proper evaluation and management of the model’s risk throughout the drug lifecycle. 

• Step 4 and 5: Develop and Execute a Credibility Assessment Plan. FDA encourages sponsors to engage early with the agency by leveraging a credibility assessment plan to guide the discussion on AI model validation and risk evaluation. The timing of when this plan is presented to FDA will depend on the sponsor’s chosen method of engagement. Sponsors may choose to present the plan as part of a formal meeting package or using another appropriate method of engagement. FDA expects that sponsors using AI, where model risk and COU is high, will develop and submit the credibility assessment plan in a way that allows for constructive, ongoing feedback between the sponsor and FDA. Some key components of a credibility assessment plan include:
  • Model and Development Process Description: The plan should include clear articulation of the model’s inputs, outputs, architecture, features, feature selection process, any loss functions used for model design and optimization and parameters, as well as the rationale for the chosen modeling approach.
  • Data Strategy: The plan should include detailed descriptions of the training data (data used to develop the model’s weights and components) and tuning data (data used to evaluate and adjust the model), including how the data was collected, processed, and annotated, and how it aligns with the intended COU. It must also address potential algorithmic bias and data limitations, such as underrepresentation, and provide justification for dataset choices. 
  • Model Training: The plan should provide a comprehensive description of the AI model’s training process, contextualized by its associated risk. Among other details, it should outline the learning methodologies employed, the performance metrics used to evaluate the model, any calibration processes aimed at enhancing model accuracy and repeatability, and quality assurance and control procedures for the AI model’s software.
  • Model Evaluation: The plan should thoroughly describe the evaluation of the fully trained AI model using independent test data, covering data collection, processing, annotation, storage, control, and use. It should specify methods to ensure data independence, justify any overlap between test and development data, and explain the relevance of the model and test data to the intended COU. The plan must address potential issues arising from differences between test data and the deployment environment, as well as performance metrics (e.g., ROC curve, recall, sensitivity, specificity, predictive values, F1 score), optimization methods (e.g., gradient descent), and uncertainty estimation. It should also include a summary of limitations, biases, and quality control procedures. Additionally, the plan must detail the agreement between model predictions and observed data, providing rationale for chosen evaluation methods, particularly if the COU involves a "human in the loop," and ensure performance estimates are accompanied by confidence intervals.

• Step 6: Document Credibility Assessment Results and Address Deviations. Results from the execution of the credibility assessment plan should be compiled into a final credibility assessment report, which includes a comprehensive description of the outcomes from the previous. The credibility assessment report should establish the AI model's credibility for its intended COU, outline any deviations from the plan, and be submitted as a self-contained document, available in a meeting package, as part of a regulatory submission or available for FDA review upon request. Sponsors should consult with FDA early to discuss the appropriate timing and method for submission.

• Step 7: Determine the Adequacy of AI Model for the Context of Use. Based on the credibility assessment report, a model may be deemed suitable or unsuitable for its intended COU. If credibility is insufficient, the sponsor may provide additional evidence to mitigate the risk, enhance the rigor of the assessment, retrain the model, add development data, introduce new controls to mitigate risks, or alter the modeling approach. In some cases, the sponsor may revise or reject the model.

Life CycleMaintenance Considerations, including Life Cycle Maintenance Plan

AI models in drug development require ongoing monitoring and adjustments to maintain their credibility throughout their life cycle, especially during the manufacturing phase. FDA recommends that sponsors implement a risk-based life cycle maintenance plan, including performance metrics, monitoring frequency, and triggers for retesting. Significant changes to the model or manufacturing processes may require re-executing parts of the credibility assessment, including retraining and retesting. FDA expects the life cycle maintenance plan to be incorporated into the manufacturing site’s pharmaceutical quality system and summarized in the marketing application for any AI models associated with specific products or processes, ensuring regulatory compliance and ongoing oversight. Sponsors should report any changes that impact model performance or product quality to FDA to ensure continuous regulatory compliance.

Preparing for FDA’s Emerging Regulatory Expectations

Establishing robust company-wide AI governance systems is essential for smoothly implementing regulatory expectations and improving risk management throughout the AI model lifecycle. These systems, supported by clear SOPs and policies, ensure that AI models are developed, validated, and monitored in compliance with FDA's new guidance. By embedding human governance and risk management at every stage, companies can more effectively meet regulatory requirements and reduce potential risks. Pharma and biologics companies should establish structured AI governance frameworks which support FDA's new AI guidance, ensuring effective risk management, transparency, and ongoing oversight. This includes developing standard operating procedures (SOPs) and policies for AI model development, risk assessment, and validation. Policies should include a threshold or risk matrix for determining when a particular technology qualifies as artificial intelligence, as defined by FDA, versus complex decision trees and when AI used for operational efficiencies may impact patient safety, drug quality, or the reliability of results from nonclinical or clinical studies, thereby ensuring appropriate regulatory oversight and risk mitigation.

Cross-functional teams, including experts from regulatory affairs, data science, clinical, IT, legal, and quality assurance, should collaborate to ensure that AI systems are aligned with regulatory standards and that potential issues are proactively addressed. Appointing an AI governance lead or chief AI officer helps centralize responsibility and align efforts across teams. Independent oversight mechanisms, such as advisory boards and regular audits, should be implemented to monitor AI systems throughout their lifecycle and maintain regulatory compliance.

Early engagement with FDA is a key component of this process. Sponsors should leverage programs such as the CDER Animal Model Qualification, Digital Health Technologies (DHTs) Program, Emerging Technology Program (ETP), and Model-Informed Drug Development (MIDD) Program. These engagement opportunities allow sponsors to set clear expectations, address challenges early, and ensure their AI models are compliant, improving both regulatory submissions and ongoing AI model performance.

Conclusions

FDA’s new guidance provides a structured and detailed approach for sponsors to navigate the complexities of using AI in drug and biologic development. By following the seven-step risk-based framework, submitting comprehensive credibility assessment plans and reports, and implementing lifecycle maintenance strategies, sponsors can ensure that their AI models meet regulatory expectations while maintaining patient safety, drug quality, and the reliability of results. This proactive approach will help sponsors mitigate risks and support FDA in its review process, fostering an environment of continued innovation and regulatory compliance in the evolving landscape of AI-driven drug development. Furthermore, establishing a strong, company-wide AI governance structure with AI leadership, cross-functional teams and robust SOPs and policies is critical to meeting these regulatory expectations and ensuring effective risk management. By embedding these practices, sponsors can enhance regulatory compliance and mitigate risks, while advancing the responsible use of AI in drug development.

Given the complexities associated with AI’s role in drug development, early engagement with FDA is crucial to navigate the regulatory landscape effectively. Sponsors who proactively consult with FDA can set clear expectations, address potential challenges early, and help ensure the responsible deployment of AI technologies. By adhering to FDA’s framework, sponsors can not only facilitate smoother regulatory processes but also contribute to the safe and effective use of AI in advancing public health.

FDA has invited comments on the draft guidance through April 7, 2025. If you may wish to submit a comment, have any questions on the implications of this guidance on your company’s business, or may need regulatory support for AI products, feel free to contact any of t he authors of this alert or the Hogan Lovells attorney or regulatory specialist with whom you regularly work.

Authored by Melissa Bianchi, Melissa Levine, Bert Lao, Alex Smith, and Ashley Grey.