Small pharma has one big AI advantage: less to undo

Howdy Friends,

This week I want to make the case for all the little (and medium) guys in pharma and biotech to start seriously thinking about digitizing and standardizing your documents. I don't mean "well, we scan them." I mean the steps past that — actually breaking your documents down into computer-readable data and building a superhighway of data flow so AI can start doing real work for you.

Why little pharma? Because Big Pharma has a monster-sized obstacle I don't envy. Little has a shared drive with folders, maybe a right-sized eQMS, and a few people tasked with keeping it organized. If Big wants to structurally change how data gets captured or stored, they need a steering committee. Then meetings to set up the meetings. Then extra headcount hired just to run training on the new system. Fuuuun. (If you're in Big Pharma, don't worry — there are plenty of companies out there throwin' bows to sell you GxP AI integration, and there's even one in the news section below.)

I've spent most of my career in manufacturing operations and quality assurance at small sites, and I've always had a fondness for them. That fondness comes bundled with some data issues. Maybe the file system was run by Janet for the last 15 years, and then Janet gets a grandbaby and decides to retire tomorrow (congratulations, Janet!). Now Ryan the intern has inherited it, and he's opening his 150th PDF trying to find where one deviation landed — the first one being ‘scan0034_final_FINAL(2).pdf’.

Before, you asked Janet and she'd whip it out in a jiffy. Ryan is updating his LinkedIn and looking for the exit.

But here's the thing: I'd argue the little guys are at an advantage. Restructuring a shared drive and building out a data schema is far more doable for you, in less time than you'd think. And it has to happen to get the real advantages of an AI workflow. I love talking about the latest model capability as much as anyone, but we're at the point where the raw material matters more than the model. That takes some upfront, unglamorous work. It's worth it.

Analysts have been saying for years that roughly 80% of enterprise data is unstructured (at  least that’s figure gets quoted a lot). Pharma is almost certainly on the worse end of it. Not by accident, either. We chose this. Our whole discipline is built to produce documents: signed, dated, versioned, archived, and shaped so a trained human reviewer can pick up page 14 and understand what happened. That's a great design, and it's saved us more than once. But it only serves humans. A batch record tells a reviewer everything and tells a computer nothing — it sees a picture of words and can't tell the yield from the lot number from the page number. Every safeguard we built to make records legible to people is the same thing making them illegible to the assistants we now want help from.

So where do you start? Not with the whole ocean. Take a walk through the drives and the filing cabinets and just write down what's there — document type, format, roughly how many, and how much it hurts when someone needs one. Then pick one family where somebody loses a day a month to archaeology. Before you convert a single file, standardize the words: if one document says "WFI," another says "Water for Injection," and a third says "water (injection grade)," you'll extract all three into a register nobody can filter, and you'll have built a brand-new mess on top of the old one. Agree on dates, units, product codes, and status words first — it's one meeting at your size, not a governance body. Then convert in small batches, have a person verify every extracted value against the source, and keep a link back to the original signed record in every row. That verification step is what turns "AI output" into something your quality unit will actually stand behind. And nothing here is throwaway, because if you buy an eQMS in three years, the structured library you built is your migration package.

Thanks for reading!

Alexa

P.S. I'm putting together something to help small and mid-sized quality teams get their data ready for AI. More on that soon — stay tuned.

News

Hitachi ships a GMP data platform with a hard line drawn around generative AI

What's New: Hitachi Ltd. and Hitachi Industry & Control Solutions have started selling a "pharmaceutical manufacturing domain platform" built specifically for GMP operations. It pulls manufacturing, testing, and quality data into one place so users can work across records that currently live apart in MES, LIMS, and QMS — with named integrations to HITPHAMS and TrackWise. The first three use cases target exactly the workflows QA people dread: product annual review, deviation investigation, and audit response. Generative AI sits on top to draft quality documents, including APR narratives, from the collected data.

How It Works:

• Central data layer aggregates and structures manufacturing, testing, and quality records across systems, so a question doesn't require opening three applications

• Platform functions ship as a CSV-capable solution, with validation documentation provided as a whitepaper

• Generative AI features are explicitly marked outside CSV scope — judgment and finalization stay human

• Roadmap phases beyond launch: image and video AI for work-error detection, procedure digitization, equipment optimization from shop-floor feedback, and eventually digital twin and robotics

• Longer-term positioning is a broader pharma DX platform under Hitachi's HMAX Industry portfolio

Why It Matters: Hitachi picked APR/PQR assembly, deviation history chase, and audit packs first — three workloads where the effort is almost entirely retrieval and assembly rather than judgment. That's the honest place to start. More interesting is the boundary they drew: the deterministic data platform is validated, the generative layer is not, and they say so in the product documentation rather than leaving it for an inspector to discover. That's a defensible architecture and a template worth borrowing regardless of vendor.

My Take: The CSV boundary is the part I expect to see copied across the industry. It resolves a question that has been stalling projects everywhere: how do you validate a system whose outputs vary run to run? Answer — you don't. You validate the data plumbing, leave the generative layer unvalidated and clearly labeled, and put a human signature at the end.

Sources: PR Times release | Hitachi ICS product page | IBTimes JP English summary

What happens when AI stops asking permission at every step

What's New: Rupesh Acharya of Biogen's Capability Center India published an iSpeak essay in ISPE's Pharmaceutical Engineering arguing that life sciences is drifting from AI-as-copilot toward AI-as-autopilot — agents executing multi-step regulatory, clinical, and commercial workflows on their own. His concern is the collision underneath: agents are probabilistic, and GxP expects records that are deterministic and attributable. His answer isn't slowing down, it's building the guardrails into the IT stack rather than bolting them on afterward.

How It Works: He proposes three layers:

• Semantic validation. Agent outputs get checked against master data and validated ontologies — MedDRA, SNOMED CT, WHO Drug. Anything off-ontology is automatically isolated instead of flowing downstream.

• Limited write access by default. Agents can flag, analyze, and prepare documentation, but cannot finalize changes in validated systems without an authorized Part 11 electronic signature.

• Risk-tiered human-in-the-loop gates, designed as engineered decision milestones rather than a QA review at the end of the pipeline. Low risk gets retrospective sample audit; medium triggers an exception gate on confidence thresholds or rule breaches; high requires authenticated human sign-off — submissions, FAERS and safety data, GxP system changes, IND protocol modifications.

Why It Matters: The "limited write access by default" layer is the one small teams can act on immediately, and it costs nothing. Most people experimenting with AI agents in a quality context are already relying on the fact that the tool can't actually change anything — but relying on it informally, as a happy accident of how the tools are set up. Writing it down as a design principle turns that accident into a control you can show an inspector. Same for the risk tiers: you almost certainly already treat a stability trend summary differently from an IND amendment. Documenting why is the whole exercise.

My Take: I’m a broken record when it come to the risk tiering, because it's the fix for the two failure modes I see most often. Teams either require senior sign-off on everything, which is how AI projects die of friction, or they wave it all through and get caught by something that mattered. Sorting work into tiers before you build the workflow is unglamorous and it's the whole ballgame.

Source: ISPE iSpeak — Autonomy Without Architecture (author opinion; ISPE notes iSpeak posts are not Society endorsement)