AI Dossier Governance Checklist: What DJ Fang's Benchmark Means for eCTD Teams

When DJ Fang, Chief Operating Officer of market-access platform Pure Global, detailed how his firm's Latin America team cut regulatory document-assembly turnarounds across 27 pilot projects by roughly 75%—reducing dossier preparation time from 25–30 business days down to 5–8 business days—the figure captured immediate attention across regulatory operations departments. Fang attributed the pilot to Pure Global's AI Builder; the company also operates a separate Pure Global AI regulatory-data portal. The case illustrates the potential for language models and structured retrieval to accelerate technical-document assembly in a defined workflow.

For biopharma regulatory affairs, electronic Common Technical Document (eCTD) authors, and Chemistry, Manufacturing, and Controls (CMC) leads, however, that headline figure requires immediate regulatory context.

First, the 75% efficiency gain is a self-reported, unaudited internal metric generated exclusively on medical-device and in vitro diagnostic (IVD) submission files under Latin American (specifically Brazil's ANVISA) regulatory frameworks. It does not measure health agency review speed, it has not been validated by independent auditors, and it does not represent pharmaceutical NDA, BLA, ANDA, or CTD dossier assembly. Medical device technical files differ structurally and legally from drug eCTD dossiers; transplanting device document-assembly timelines into drug submission workflows may overlook predicate-rule, electronic-record, data-integrity, and submission-format controls that depend on the pharma workflow's actual intended use.

Second, while the U.S. Food and Drug Administration (FDA) has reported receiving more than 500 drug and biological product submissions containing artificial intelligence components since 2016, regulatory agencies do not grant submission relief simply because a document was generated by an advanced algorithm. Whether an eCTD module is authored by a human regulatory writer or drafted with a large language model (LLM), the sponsor remains responsible for the accuracy, support, and integrity of the submitted content.

To evaluate AI-assisted document assembly without compromising compliance, pharmaceutical regulatory teams need a vendor-neutral governance checklist anchored in applicable regulations, predicate rules, submission specifications, and FDA, European Medicines Agency (EMA), and International Council for Harmonisation (ICH) guidance.

Direct Answer: Which Rules Govern AI in Pharmaceutical Submissions?

Before allowing generative AI tools to draft, format, or summarize content for an eCTD submission (NDAs, BLAs, ANDAs, or investigational drugs under INDs), regulatory leads must understand which regulatory frameworks actually apply:

Start With Scope, Not a Universal AI Rule: The FDA's January 2025 draft guidance, Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products (FDA-2024-D-4689), outlines a 7-step risk-based credibility framework. It excludes AI used solely to streamline internal operations or draft submissions when the use does not affect patient safety, drug quality, or the reliability of study results. That exclusion is only from this draft framework; it does not decide whether predicate rules, Part 11, CGMP data-integrity expectations, privacy duties, or internal quality controls apply.
Part 11 Applicability Depends on the Record and System: Part 11 applies to electronic records created, modified, maintained, archived, retrieved, or transmitted under FDA predicate-rule requirements. When an AI-enabled closed system creates or changes records within that scope, § 11.10(a) calls for validation appropriate to accuracy, reliability, intended performance, and the ability to discern invalid or altered records. A drafting aid outside that scope should still receive risk-based assurance, but not because every LLM is automatically a Part 11 system.
Human Ownership Is a Governance Control; Signature Rules Are Conditional: An AI system is not a legal person or regulatory signatory. Sponsors should assign named human owners and document review responsibilities. If a predicate rule or approved workflow requires an electronic signature, § 11.50 governs what the signature must display and § 11.70 requires the signature to remain linked to its record; those sections do not independently require every eCTD section to carry a signature or prescribe reviewer credentials.

Comparative Matrix: Medical-Device AI Benchmarks vs. Pharma eCTD Realities

To prevent executive teams from demanding impossible turnaround cuts based on device-side press reports, regulatory operations must clearly communicate the structural differences between device dossier assembly and pharmaceutical eCTD creation:

Governance Dimension	Medical Device / IVD Document Assembly (e.g., Pure Global Benchmark)	Pharmaceutical eCTD Dossier Assembly (NDA / BLA / ANDA)
Primary Scope	Technical file compilation, product registration forms, device description, STED/CSDT summaries, and regional labeling for market access.	5-Module eCTD binder containing raw analytical validation, batch records, clinical study reports, stability data, and Established Conditions.
Applicable Controls	National medical device regulations (e.g., ANVISA RDC rules, EU MDR/IVDR Annex II/III) plus the manufacturer's quality-system controls.	Predicate rules; Part 11 when electronic records/signatures are in scope; CGMP data-integrity expectations; eCTD specifications; and EU Annex 11 for relevant GMP computerized systems. FDA's CSA guidance has a narrower production/QMS software scope.
Reported Speed Claims	Self-reported 75% internal turnaround cut (25–30 days down to 5–8 days across 27 Brazil pilot projects); unaudited.	Unvalidated for drug applications; speed is constrained by source-document verification, analytical audit trails, and human sign-off.
Data Integrity Risk	Varies with intended use: an administrative form and a clinical-evidence summary do not carry the same consequence.	Potentially high: a hallucinated impurity limit, batch number, or dissolution result can undermine review and trigger significant deficiency questions.
Regional Content Reuse	Often involves translation and reformatting of central device master files across LATAM/APAC jurisdictions.	Modules 2–5 are common across ICH regions (FDA/EMA/PMDA), but Module 1 requires strict regional XML backbones and administrative forms.
Model / Software Assurance	Product-facing AI may fall under device requirements; internal document tools require their own intended-use and quality-system assessment.	FDA's Jan 2025 draft credibility framework excludes qualifying pure-drafting uses. Separately assess predicate rules, Part 11 scope, data integrity, cybersecurity, privacy, and fit-for-use testing.

The 7-Gate Vendor-Neutral AI Dossier Governance Checklist

To allow generative or retrieval-augmented AI tools into pharmaceutical dossier workflows, regulatory operations must enforce seven sequential governance gates.

┌─────────────────────────────────────────────────────────────────────────┐
│              PHARMA AI DOSSIER-ASSEMBLY GOVERNANCE GATES                │
├─────────────────────────────────────────────────────────────────────────┤
│ [Gate 1] Scope, Intended Use & Regulatory Applicability Map             │
│    │                                                                    │
│    ▼                                                                    │
│ [Gate 2] Risk-Based Software Assurance (Part 11 if in scope)           │
│    │                                                                    │
│    ▼                                                                    │
│ [Gate 3] Claim-to-Source Traceability & Data-Integrity Review           │
│    │                                                                    │
│    ▼                                                                    │
│ [Gate 4] eCTD Module Boundaries & Regional Cross-Border Reuse (ICH M4)  │
│    │                                                                    │
│    ▼                                                                    │
│ [Gate 5] Human Ownership & Signatures Where Required                    │
│    │                                                                    │
│    ▼                                                                    │
│ [Gate 6] Version, Change Control & Applicable Audit Trails              │
│    │                                                                    │
│    ▼                                                                    │
│ [Gate 7] Confidential Data & Trade Secret Protection Controls           │
└─────────────────────────────────────────────────────────────────────────┘

Gate 1: Scope, Intended Use, and Regulatory Applicability

Before onboarding any commercial AI submission tool, the regulatory team must classify the tool's intended use against FDA and EMA guidance:

Model Credibility Framework Scope: When an AI model is used to produce information or data intended to support regulatory decision-making about drug safety, effectiveness, or quality—for example, a model that predicts trial endpoints or analyzes biomarker signals—the FDA's January 2025 draft guidance may apply. The draft describes a 7-step credibility framework; teams should verify scope against the model's specific context of use rather than classifying it by technology name alone.
Submission Drafting Exclusion Scope: The draft guidance excludes uses limited to internal operational efficiencies, including qualifying submission-drafting activities that do not affect patient safety, drug quality, or study reliability. This exclusion does not exempt the resulting records from any otherwise applicable predicate rule, Part 11 control, CGMP expectation, privacy obligation, or submission specification.
Governance Action: Write an intended-use statement, identify every input and output, determine whether any output becomes a required regulated record, and document the basis for the Part 11, CGMP, privacy, cybersecurity, and credibility-framework scope decisions.

Gate 2: Risk-Based Software Assurance and Conditional Part 11 Validation

Generative AI models are non-deterministic: the same prompt can yield different wording across runs. A test strategy limited to static expected-output scripts may therefore miss material failure modes in an LLM-assisted dossier workflow.

CSA Scope and Transferable Principle: FDA's CSA guidance is scoped to production and quality management system software and was updated on February 3, 2026 to align with QMSR. It is not a blanket rule for every pharma eCTD authoring tool. Its risk-based, intended-use testing concepts can still inform an assurance strategy; if the AI system also supports a process within the guidance's scope, apply the guidance directly as appropriate.
Risk Depends on the Output: A tool that only reformats approved text usually has a different risk profile from one that summarizes raw stability data or proposes clinical conclusions. A hallucinated number entering an application can create a serious data-integrity and review risk even when the tool does not control manufacturing equipment or patient dosing.
Governance Action: Combine scenario-based testing, prompt-regression tests, source-grounding checks, security testing, and representative failure cases in proportion to intended use. Require vendor notice and impact assessment for material model, retrieval, or prompt changes.

Gate 3: Claim-to-Source Traceability and ALCOA+ Data Integrity

FDA's December 2018 guidance Data Integrity and Compliance With Drug CGMP: Questions and Answers addresses data integrity for records required by drug CGMP. It describes reliable data as attributable, legible, contemporaneously recorded, original or a true copy, and accurate—often summarized as ALCOA. Many quality organizations extend that mnemonic with complete, consistent, enduring, and available. Teams should distinguish the regulatory requirements for the underlying record from the expanded mnemonic used in an internal SOP.

The Hallucination Barrier: Generative models can produce plausible but unsupported values, citations, or stability dates. An incorrect impurity result in Module 3 can trigger deficiency questions, undermine the application, or contribute to a more serious review outcome depending on materiality.
Source-Grounding Control: Retrieval-augmented generation (RAG) tied to controlled repositories can reduce unsupported drafting, but RAG is not an FDA-mandated architecture and does not itself prove accuracy. Other architectures may be acceptable if they provide equivalent control and evidence.
Governance Action: For critical claims and tables, retain traceability to the controlled source document, version, and location. Define when line-level citation is required, when section-level provenance is sufficient, and when ungrounded generation must be blocked based on risk.

Gate 4: eCTD Module Boundaries and Cross-Border Regional Reuse

A common misconception among commercial operations is that because ICH M4 harmonizes the Common Technical Document format across the US, EU, and Japan, AI can automatically assemble a single global dossier and deploy it worldwide.

Modules 2–5 vs. Regional Module 1: While Modules 2–5 share the ICH CTD structure, Module 1 is regional. FDA and EMA use different administrative forms, product information, regional specifications, and lifecycle rules. Even the common modules may require region-specific content decisions; harmonized structure does not mean identical conclusions or text.
EMA AI Reflection Paper Alignment: EMA's September 2024 reflection paper applies a risk-based, human-centric approach across the medicines lifecycle. It does not create a blanket permission for automated translation or document adaptation; teams must assess the particular use and every applicable regional requirement.
Governance Action: Prevent automatic transplantation of regional assets. Treat Module 1 as jurisdiction-specific, and require a documented regional gap assessment before reusing material from Modules 2–5.

Gate 5: Human Ownership and Electronic Sign-Off Where Required

When an electronic signature is required by an applicable predicate rule or controlled workflow, 21 CFR § 11.50 specifies its displayed name, date/time, and meaning, while § 11.70 requires the signature to remain linked to the record.

Named Human Ownership: AI software cannot serve as a legal signatory. Author, reviewer, and approver metadata should identify the people responsible under the sponsor's procedures.
Verification of Human Review: Define review depth by risk. Critical numerical tables, interpretations, and benefit-risk conclusions may warrant line-by-line comparison with controlled sources; low-risk formatting changes may warrant a different check. Part 11 does not itself prescribe the reviewer's professional credentials or require a signature on every eCTD section.
Governance Action: Establish SOP checkpoints that name owners, reviewer qualifications, evidence retained, escalation rules, and the circumstances in which an electronic signature is required.

Gate 6: Version and Change Control under ICH Q12 and Audit Trails

Pharmaceutical regulatory lifecycle management is governed by ICH Q12 (Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management). When post-approval changes occur—such as site transfers, analytical method updates, or scale-up modifications—regulatory teams file supplements or variations supported by updated eCTD Module 3 sections.

Conditional Audit-Trail Requirement (21 CFR § 11.10(e)): For closed systems and electronic records within Part 11 scope, § 11.10(e) requires secure, computer-generated, time-stamped audit trails for operator entries and actions that create, modify, or delete records.
Tracking AI Prompt Evolution: In an AI-assisted environment, change control extends beyond document text to include system prompts, RAG embedding databases, and model version updates. If a vendor updates its underlying LLM from Version A to Version B, the output behavior of the dossier assembly tool may shift significantly.
Governance Action: Based on the applicability and risk assessment, retain enough prompt, source, configuration, model, and edit history to reconstruct how regulated content was produced and approved. Apply formal change control to material model, retrieval, and prompt-template updates. For post-approval lifecycle tracking, align version control with established site change control and supplement workflows, including eCTD Module 3 lifecycle hygiene and global CMC change classification procedures.

Gate 7: Confidential Data and Trade Secret Protection

Dossier assembly requires handling proprietary commercial assets: trade secret chemical synthesis pathways, drug substance manufacturing parameters, formulation quantitative compositions, and unblinded patient data.

Hosted-Service Risks: Sending Module 3 CMC text or clinical data to an external AI service can expose trade secrets or personal data if the service retains prompts, trains on customer content, permits cross-tenant access, or lacks appropriate regional safeguards. Vendor terms and technical controls differ; verify them rather than assuming either safety or retention.
Infrastructure Controls: Select public-cloud, private-cloud, single-tenant, or on-premises deployment based on the data classification and threat model. Contract terms should address retention, training use, subprocessors, residency, access controls, encryption, incident response, and deletion.
Governance Action: Require legal, privacy, quality, and cybersecurity review proportionate to the data and intended use, with a Data Processing Agreement where applicable.

Practical Regulatory Operations SOP Checklist

Use this practical operational checklist when reviewing generative AI vendor claims or onboarding dossier-assembly tools:

[ ] 1. APPLICABILITY MAP: Is the intended use documented, including the basis for credibility-framework, predicate-rule, Part 11, CGMP, privacy, and cybersecurity scope decisions?
[ ] 2. SOFTWARE ASSURANCE: Does testing cover representative use, foreseeable failures, source grounding, security, and material model or configuration changes at a depth proportionate to risk?
[ ] 3. TRACEABILITY: Can reviewers trace critical generated claims and tables to controlled source documents without assuming that RAG alone proves accuracy?
[ ] 4. DATA INTEGRITY: Do controls preserve the reliability and required attributes of any CGMP or other regulated records the workflow handles?
[ ] 5. MODULE BOUNDARIES: Are automated re-use rules configured to separate common ICH M4 Modules 2–5 from regional Module 1 requirements?
[ ] 6. HUMAN OWNERSHIP: Does the SOP define accountable owners, risk-based review depth, reviewer qualifications, retained evidence, and signatures where the applicable rule or workflow requires them?
[ ] 7. AUDITABILITY: For records and systems in Part 11 scope, do audit trails meet § 11.10(e); for other uses, is enough provenance retained to reconstruct critical content?
[ ] 8. CHANGE CONTROL: Is there a formal change-control process for AI model updates, prompt template modifications, and post-approval eCTD lifecycle maintenance?
[ ] 9. DATA SECURITY: Do architecture and contracts match the data classification, including controls for retention, training use, access, residency, encryption, incidents, and deletion?
[ ] 10. BENCHMARK DISCIPLINE: Have executive expectations been managed by clearly separating device/IVD speed metrics (such as DJ Fang's 75% Brazil pilot) from drug eCTD requirements?

Inter-Disciplinary Context: Where Device and Pharma Governance Intersect

While medical-device speed metrics cannot be directly applied to pharmaceutical eCTD dossiers, biopharma companies developing Combination Products (under 21 CFR Part 3) or cross-labeled Companion Diagnostics (CDx) must navigate both regulatory regimes simultaneously.

For example, when a drug sponsor develops a monoclonal antibody paired with a diagnostic assay or specialized delivery device, the regulatory submission strategy involves both drug eCTD filings (BLA/NDA) and device approvals (PMA/510(k)/De Novo). Regulatory teams monitoring FDA AI/ML medical-device clearances recognize that while device teams can utilize tools optimized for rapid market-access filings, drug regulatory leads must maintain full eCTD data-integrity controls. When managing change control across both domains, teams should consult guidance on companion diagnostic change control and contrast regulatory eCTD requirements against specialized formats such as the AMCP dossier format used for US commercial payer submission packets.

Frequently Asked Questions

Does the FDA require a specific AI architecture for regulatory submissions?

No. The FDA remains technology-neutral and does not mandate or endorse specific software architectures, neural net designs, or AI vendors. The FDA regulates the safety, efficacy, quality, and data integrity of the drug product and submission record, not the commercial brand of software used to type or assemble the document.

Can we reuse an FDA Module 2–5 draft for an EMA submission using AI?

While ICH M4 harmonizes the structure of Modules 2 through 5, regional differences remain in guidelines, preferred endpoints, and national administrative rules. AI tools can assist in reformatting common technical summaries, but the output must be audited against specific EMA guidelines and regional Module 1 requirements.

Is the 75% time reduction reported for medical-device dossiers transferable to pharma eCTD work?

No. The 75% document-assembly time cut reported by Pure Global in DJ Fang's August 2026 interview is a self-reported, unaudited internal metric based on 27 Latin American medical-device and IVD registration projects. Medical device technical files differ significantly in regulatory structure and verification depth from pharmaceutical eCTD NDAs, BLAs, and ANDAs.

What audit-trail evidence must we keep for AI-assisted dossier content?

There is no universal rule requiring every AI prompt and token to be retained. For a closed system handling electronic records within Part 11 scope, § 11.10(e) requires secure, computer-generated, time-stamped audit trails for operator entries and actions that create, modify, or delete records. The applicability and risk assessment should determine which prompt, source, configuration, model, draft, and human-edit metadata are needed to reconstruct and defend critical regulated content.

What are the confidential-data risks of sending unpublished CMC content to third-party AI tools?

Submitting unpublished eCTD Module 3 Chemistry, Manufacturing, and Controls (CMC) data—such as drug-substance synthesis routes, batch formulas, or analytical validation parameters—to an external AI service can expose trade secrets if access, retention, training use, or deletion is not adequately controlled. A private instance with zero retention may be appropriate for some cases, but it is not the only possible control model; select the architecture and contract after data-classification, privacy, security, quality, and legal review.

Sources

U.S. Food and Drug Administration (FDA). Draft Guidance for Industry: Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products (Docket No. FDA-2024-D-4689). January 2025. FDA Guidance Webpage.
U.S. Code of Federal Regulations. Title 21, Part 11: Electronic Records; Electronic Signatures (21 CFR Part 11). Electronic Code of Federal Regulations (eCFR). eCFR Title 21 Part 11.
U.S. Food and Drug Administration (FDA). Guidance for Industry: Data Integrity and Compliance With Drug CGMP: Questions and Answers (Final Guidance). December 2018. FDA Data Integrity Guidance.
U.S. Food and Drug Administration (FDA). Guidance for Industry and FDA Staff: Computer Software Assurance for Production and Quality System Software (finalized September 24, 2025 by CDRH and CBER; superseded February 3, 2026 by the updated Computer Software Assurance for Production and Quality Management System Software, aligned to the QMSR). Federal Register Notice (Sept 24, 2025); Updated guidance (Feb 3, 2026).
International Council for Harmonisation (ICH). ICH Guideline Q12: Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management (Step 4 Version). November 2019. ICH Official Document.
International Council for Harmonisation (ICH). ICH M4: Common Technical Document for the Registration of Pharmaceuticals for Human Use and FDA eCTD Requirements under Section 745A(a) of the FD&C Act. FDA eCTD Resources.
European Medicines Agency (EMA). Reflection paper on the use of artificial intelligence in the lifecycle of medicines (Adopted by CHMP and CVMP). September 2024. EMA AI Reflection Paper.
ValiantCEO Interview. Transforming Healthcare Compliance with AI: A Q&A with DJ Fang, COO of Pure Global. Conducted by Jed Morley. Published August 1, 2026. ValiantCEO Interview Page.
Pure Global. Official Company Website and AI Solutions Platform. Pure Global and PureGlobal.ai.