AI governance in Medical Affairs engagement

Medical Affairs teams are being offered AI from every direction. The engagement platform has added a drafting assistant. The insight tool now summarizes field observations. A vendor proposes an assistant that answers HCP questions on the medical portal. A liaison has started using a general-purpose tool to prepare for meetings. Each arrives separately, each is useful, and each raises questions that the team answers again from the beginning.

This article describes where AI is being used in Medical engagement, the questions every use has to answer, and how Medical leadership can govern the whole without slowing the parts. It does not recommend tools or describe model design. Regulation is moving, including the EU AI Act, and the principles below are the ones that have held steady across the companies we have worked with.

Where is AI being used in Medical Affairs engagement?

The right-hand column is the one that matters for governance. Risk rises as the distance falls. A summary of insight that is slightly wrong is caught in a planning meeting. An answer to an HCP that is slightly wrong can affect a clinical decision.

Which questions must every use case answer?

• Is it accurate, and how do we know? The team has tested the output against scientific sources, knows how often it is wrong and has decided what error rate is acceptable for this use.
• Who is accountable for the output? A named Medical professional is responsible for what the system produces, as they would be for a colleague's work.
• What data does it use, and where does that data go? HCP personal data, interaction records and unpublished data are handled within privacy law and company policy, and the team knows whether the vendor retains or trains on them.
• Does it keep Medical and Commercial apart? The system does not combine medical interaction data with commercial data, and its output is not available to commercial teams.
• Does the HCP know? Where AI contributes to something an HCP receives, the company has decided what to disclose and has a route to a person.
• Can we show what happened? The system keeps a record of what it was asked and what it produced, sufficient for an audit and for pharmacovigilance obligations.

These questions follow from obligations Medical already has under the IFPMA Code of Practice, the EFPIA Code, privacy law and adverse event reporting rules. AI changes how they are met. It does not remove them. A question typed into an AI assistant that mentions a side effect is an adverse event report in the same way as one made to a liaison.

Who should govern AI in Medical Affairs?

Medical, with Legal, Compliance, data protection and IT security at the table. Company-wide AI governance usually exists and sets general rules. It rarely addresses scientific exchange specifically, and it cannot judge whether an AI-drafted summary of a trial is balanced. A small Medical group that applies the questions above to each proposed use, keeps a register of what is approved and reviews it as tools and rules change is enough for most companies. It should be able to give an answer on a new use within weeks.

Where should human review sit?

Before anything reaches an HCP, for now. Most companies we see have decided that AI may draft, summarize, classify and prepare, and that a Medical professional approves what an HCP receives. Direct AI answers to HCPs are being piloted, usually limited to retrieving approved content word for word with its references, with unusual questions passed to medical information. That is a reasonable place to stand while accuracy and regulation mature. The position should be written down, so that the next vendor proposal is measured against it.

What are the warning signs?

• Tools are adopted team by team. Nobody in Medical can list which AI tools are in use and for what.
• Drafts reach HCPs unreviewed. Time pressure has turned a drafting assistant into an author.
• Data are pooled. A single model draws on medical and commercial interaction data because the platform made it easy.
• General-purpose tools hold HCP data. Liaisons paste interaction notes into public tools to prepare for meetings.
• There is no record. The team cannot reproduce what the system told an HCP last month.
• Adverse events are missed. Questions put to an AI channel are not screened for safety information.

Where should a Medical Affairs team begin?

With an inventory. List every AI use in Medical today, including the informal ones, and place each on the scale of distance from the HCP. Apply the six questions to the two or three nearest the HCP first. Write the position on human review in one paragraph and have Medical leadership, Legal and Compliance sign it. Then choose one low-risk use with clear value, usually insight analysis, and run it properly as the example for the rest. Teams that start this way adopt AI faster than those that evaluate each tool in isolation, because the difficult questions are answered once.