Zachary Zubulake

Clinical trial supply chains are growing more complex as drug development spreads into new regions. 

China's share of global trial starts climbed from roughly 8% in 2013 to 29% in 2023, while lower- and middle-income countries saw a 36% increase in newly recruited studies from 2020 to 2023

 analysis. That expansion raises the stakes for importation compliance: the 

FDA's guidance on exporting investigational new drugs (21 CFR 312.110)

 sets requirements for moving unapproved product across borders for clinical use,

the agency's October 2025 final guidance on fit-for-purpose clinical outcome assessments (COAs)

 is reshaping how sponsors plan patient-reported endpoints.

 Christy Owings, vice president and general manager, the Americas business unit, Thermo Fisher Scientific, spoke with 

 about keeping clinical supply chains moving as trials go global.

PharmTech: How Has Clinical Trial Supply Chain Complexity Changed as Trials Go Global?

 Trials as a whole are becoming more globalized and more complex, in step with the world around them. That makes advance planning more critical than it used to be. Sponsors need a solid global infrastructure and a supply strategy built well ahead of first shipment, rather than something assembled reactively once a trial is already underway.

What Importation Risks Do Sponsors Face Entering Latin America?

Latin America is a region that has enormous potential, but I've seen sponsors underestimate the complexity of entering the market. Problems often trace back to gaps like not securing shipment approval before importation, or importation documentation that isn't fully consistent. The worst outcome is a large, precious batch of investigational product held up in customs, exposed to temperature excursions, for an extended stretch, risking lost product and, just as important, lost time that could otherwise serve patients and generate data that moves a therapy toward approval. In Mexico, for instance, random customs screening is routine, and a delayed shipment with no local contact to explain what's happening creates stress across the entire organization.

What Should Sponsors Look for In an Importer-of-Record Partner?

It comes down to having people on the ground with real standing with local customs authorities, not a process that feels like tracking a late-night online order. I want a named contact who understands the process and can advocate on a sponsor's behalf in-country. That relationship matters from the protocol design stage onward: partners whose local depot address customs authorities already recognize as ethical and compliant move shipments through more predictably.

Where Is AI Reshaping Clinical Trial Supply Chain Operations?

Personal relationships still matter most for accessing regions like Latin America, Southeast Asia, or the Middle East, but AI is supplementing our workforce in real ways. One example is shifting clinical-site shipment coordination toward a 24-hour, chatbot-style interface, so sites can confirm patient scheduling on their own timeline. AI also helps combine data across our clinical supplies, CRO, and drug substance divisions to serve a customer's needs, optimizing a sensitive product's supply chain around historical import success by season, or spotting trends, like China-based biotech increasingly choosing Latin America over the US or EU for its first ex-China marketing approval.

How Do eCOA and Other Protocol Elements Affect Supply Chain Timelines?

A protocol may already be locked by the time we start partnering with a biotech customer, but critical supply elements aren't always fully developed yet. Electronic clinical outcome assessment (eCOA) strategy is a good example, licensing and translation work can take around six months to launch, which matters in competitive spaces where sites and patients often favor a digital solution over paper-based assessments. The earlier a supply partner is brought in, the more that becomes a thought partnership rather than a scramble to catch up on items that should have been addressed during protocol creation.

What's Your Top Advice for Sponsors Managing Global Supply Chains?

Visit your critical sites in person. That includes not just primary fill-finish or clinical packaging and labeling sites, but depot-network locations too, Argentina, Brazil, India, or a Southeast Asia hub like Singapore. There's a lot to be gained from those relationships, and visiting builds confidence in both the supply plan and the people executing it.

21 CFR § 312.110—Import and export requirements.

 Electronic Code of Federal Regulations. Accessed September 18, 2026. 

https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312/subpart-F/section-312.110

Patient-focused drug development: selecting, developing, or modifying fit-for-purpose clinical outcome assessments: guidance for industry, Food and Drug Administration staff, and other stakeholders.

 Published June 2025. Accessed September 18, 2026. 

https://www.fda.gov/regulatory-information/search-fda-guidance-documents/patient-focused-drug-development-selecting-developing-or-modifying-fit-purpose-clinical-outcome

Articles

Globalization of clinical development is amplifying operational complexity and elevating the impact of import/export compliance on timelines and product integrity. Rapid growth in trial starts in China and in lower- and middle-income countries is pushing sponsors to build proactive, infrastructure-backed supply strategies well before first shipment. Latin America offers strong potential but carries material customs and documentation risks, including temperature excursions during holds. Effective importer-of-record partnerships hinge on in-country advocacy and trusted local depot reputations. AI is increasingly augmenting coordination and forecasting, while eCOA licensing and translation can add ~6 months if not planned early.

Christy Owings, Thermo Fisher, explains clinical trial supply chain risks in Latin America, importer-of-record strategy, AI, and eCOA delays.

Q&A: How Can Sponsors Respond to Clinical Trial Customs Delays?

Validation, data integrity, and quality risk management shape CGMP compliance for digital tools and AI in pharmaceutical manufacturing.

Digital transformation in pharmaceutical manufacturing carries real promise for quality and efficiency, but only when validation, data integrity, and capable infrastructure keep pace with the technology, according to Andrea K. Kerrigan, MSV, Branch Chief, OGAD, CVM, FDA.

 Kerrigan laid out this foundation during her panel, Validation and Utilization of Digital Tools, delivered at the 2026 PDA/FDA Joint Regulatory Conference.

What Is CDER's Stake in Digital Transformation?

Digital tools can deliver quality and efficiency advantages, but three foundational elements determine whether that promise is realized: suitability for intended use, data integrity, and capable facilities.

 Kerrigan also flagged a subtler risk: software can encode the same cognitive biases as the humans who build it, a concern addressed in ICH's Q9(R1) training materials on quality risk management.

Why Does Data Integrity Resurface as a Compliance Failure?

Despite years of FDA guidance built around the ALCOA framework, data integrity lapses remain among the most cited violations in warning letters, noted Kerrigan,

 who quoted Dr. Carmelo Rosa's 2024 remarks at a PDA India Chapter meeting, describing testing into compliance, data alteration, and result omission as one of the most important and relevant topics currently discussed by industry and regulators from around the world. That persistence tracks with a 

2016 analysis of rising data integrity citations

 to more recent scrutiny of falsified microbiology records.

What Happens When AI Outputs Go Unreviewed?

Two case studies anchored Kerrigan’s compliance discussion.

 In the first, FDA investigators found that a topical drug manufacturer had used AI agents to draft product specifications, SOPs, and master production records. When confronted about missing process validation under 21 CFR 211.100, it was determined that the AI agent never told them it was required. FDA's resulting warning letter made clear that AI-generated output must be reviewed and cleared by the firm's quality unit, and that 

overreliance on AI without human verification itself constitutes a CGMP violation.

 The second case study centered on an OTC sterile manufacturer for whom investigators found microbial plates with visible growth swapped for clean ones and lab forms pre-filled with results before testing occurred. These violations were tied to 21 CFR 211.194(a) that triggered a CAPA requiring time-stamped photographic documentation of every sample.

How Should Manufacturers Apply Quality Risk Management to Modernization?

Kerrigan tied both case studies back to ICH Q10's pharmaceutical quality system framework, arguing that sustainable compliance depends on proactive, prevention-focused systems rather than reactive fixes.

 Opportunities cited included electronic batch records, vision-based defect detection, predictive maintenance, and AI-assisted investigations, provided each is validated for its intended use. Citing analysis from Rick Friedman, Kerrigan linked higher-capability technology to measurable gains in yield, throughput, and first-cycle regulatory approval.

What's the Bottom Line for Manufacturing Quality?

CGMP, Kerrigan concluded, is not a checkbox exercise but a lifecycle commitment to quality assurance.

 Facilities that are slow to correct excessive process variability will continue to draw heightened FDA scrutiny, regardless of how sophisticated their digital tools appear on paper.

Parenteral Drug Association. PDA/FDA Join Regulatory Conference 2026 Agenda. Available at 

https://www.pda.org/global-event-calendar/event-detail/pda-fda-joint-regulatory-conference-2026#agenda

Wechsler J. FDA and manufacturers intensify concerns about data integrity. 

. 2016;40(7):16-17. Accessed September 18, 2026. 

https://www.pharmtech.com/view/fda-and-manufacturers-intensify-concerns-about-data-integrity

Chan H. Pharma’s next AI problem is authority. 

. Published online September 8, 2026. Accessed September 18, 2026. 

https://www.pharmtech.com/view/pharmas-next-ai-problem-is-authority

Digital modernization in pharma manufacturing can improve quality and efficiency only when tools are fit for intended use, data integrity is assured, and facilities can support the technology. Persistent FDA enforcement shows ALCOA-based expectations are still frequently missed, including “testing into compliance” and falsified microbiology records. Two enforcement examples illustrate risk: unreviewed AI-generated GMP documents and deliberate manipulation of sterility test evidence. Sustainable compliance is framed within ICH Q10 and Q9(R1), emphasizing validated systems, human oversight, and prevention-focused quality risk management.

Andrea K. Kerrigan, FDA, outlines how validation, data integrity, and QRM determine whether digital tools and AI strengthen or undermine CGMP compliance.

Can AI Agents Satisfy CGMP Documentation Requirements?

Panelists at PDA/FDA 2026 outline the GMP audit lifecycle, from root cause to CAPA closure, including a local vs. above-site decision framework.

A session hosted by Karyn M. Campbell, Senior Director, QA Audit and Compliance, AbbVie, at the PDA/FDA Joint Regulatory Conference 2026, walked attendees through the full lifecycle of a GMP audit finding, from the moment an auditor flags a concern in a daily wrap-up to the effectiveness check that ultimately closes it.

 The presentation used a running example, an incomplete batch reconciliation record, to illustrate how a single observation moves through containment, root cause analysis, risk assessment, CAPA design, implementation, and verification.

Why Does Root Cause Analysis Determine Everything Downstream?

The session's central argument was that a CAPA is only as strong as the root cause investigation behind it.

 Campbell pointed to tools like 5 Whys, fishbone diagrams, and fault tree analysis as ways to separate symptoms from true causes. 

Regulators expect companies to engineer out human error through procedural or technical controls rather than close investigations at operator error.

 The session extended that idea into risk-based prioritization, urging quality teams to confirm that an investigation's scope, or bracket, is accurate before resources are committed to a response.

When Does a Local Fix Become an Above-Site Problem?

The session spoke on a decision framework for scoping impact: does a finding touch a shared system (HVAC, water, LIMS), a common product or supplier, or a repeated trend across sites?

 Using a batch reconciliation case study, Campbell showed how a defect in one batch can trigger an expanded assessment if it shares a packaging material with other batches, versus staying a local, isolated fix. The framework tied directly into a governance escalation pathway running from site quality management up through regional leadership, a corporate quality council, and, for strategic decisions, the global head of quality. The session framed above-site assessment as a way to avoid isolated local fixes that leave systemic risk undetected elsewhere in a network, a concern that echoes broader industry 

discussion of enterprise quality accountability

Campbell broke down what regulators want to see in writing: concise, factual, evidence-based responses that explicitly link the observation to its root cause and to the corrective actions taken.

 Vague commitments and unsupported statements were called out as red flags. 

Companies should follow up with evidence of completed actions and verified effectiveness

 even after submitting a response, rather than assuming silence from the agency means acceptance.

 In the first, a company's corrective action for an out-of-calibration scale stalled because the proposed method changes conflicted with a regulatory filing, and the unresolved issue resurfaced as a repeat observation at the next audit. In the second, a contract manufacturer declined to redo airflow visualization studies after deficiencies were flagged in a mock pre-approval inspection, only for FDA to later request the original videos and issue a formal observation on the same deficiencies. Both cases underscored the presentation's closing message: unresolved findings don't disappear, they escalate.

Parenteral Drug Association. PDA/FDA Join Regulatory Confernce 2026 Agenda. Available at 

Schmitt S. Root cause analysis: finding the root of the problem. 

. 2016;40(9):98. Accessed September 18, 2026. 

https://www.pharmtech.com/view/root-cause-analysis-finding-root-problem

. 2018;42(7):20. Accessed September 18, 2026. 

https://www.pharmtech.com/view/responding-fda-capa-requests

A GMP audit finding should be managed as an end-to-end lifecycle: immediate containment, disciplined root cause analysis, risk-based impact scoping, CAPA design and execution, and effectiveness verification. Robust root cause work drives every downstream decision and should distinguish true systemic drivers from symptoms, avoiding premature “operator error” conclusions. Impact assessment must determine whether issues remain local or require above-site escalation when shared systems, materials, suppliers, or trends are implicated. Regulatory responses must be factual, evidence-linked, and followed by documented completion and sustained effectiveness.

PDA/FDA 2026 session maps the GMP audit lifecycle, root cause to CAPA closure, plus a local vs. above-site decision framework and two case studies.

Two Audit Case Studies Reveal the Cost of Incomplete Corrective Actions

Hovione Opens New Facility at New Jersey Campus | Image Courtesy of Hovione

Hovione, a globally integrated pharmaceutical CDMO, has opened a new 31,000-square-foot facility at its East Windsor, New Jersey campus.

 The building, known as 89 Twin Rivers, houses two GMP-ready, commercial-scale PSD-3 spray dryers and doubles the company's US spray drying capacity. The opening also closes out a $100 million investment cycle at the site and marks what the company describes as the first phase in a longer-term buildout of the campus into a broader development and manufacturing hub.

The facility operates under the campus's existing FDA registration and shared quality system, connecting spray drying directly to the site's drug substance and oral drug product manufacturing operations.

Why Does Solubility Remain a Persistent Manufacturing Bottleneck?

An estimated 70% of small-molecule drug candidates face poor aqueous solubility, a limitation that constrains bioavailability and can stall development programs well before they reach the clinic.

 Spray drying is one of the primary tools used to address this problem, converting poorly soluble active ingredients into amorphous solid dispersions that dissolve more readily in the body. Indeed, 

amorphous solid dispersions continue to serve as a leading platform for handling the growing pipeline of poorly soluble compounds

The significance of added spray drying capacity is less about the equipment itself and more about what sits around it.

 Running spray drying under the same quality system and regulatory registration as upstream drug substance work and downstream oral drug product manufacturing shortens the technology transfer process and reduces the number of handoffs a program has to survive as it moves from formulation screening toward commercial scale.

"Opening 89 Twin Rivers is more than a capacity expansion. It marks the next chapter in Hovione's legacy of more than two decades in the US," said Marco Gil and Antonio Almeida, Co-CEOs, Hovione, in a press release.

 "This investment enables us to meet growing demand while further reinforcing our global leadership in pharmaceutical spray drying."

What Does this Signal for Site Selection and Supply Chain Planning?

The East Windsor expansion is not an isolated project.

 Hovione has outlined plans to develop roughly 15 acres of adjacent property into an additional 125,000-square-foot facility over the next 5 to 10 years, with capacity for further laboratories, commercial-scale spray drying and oral drug product manufacturing. Customers will have the option to co-invest in that expansion in exchange for priority access to equipment and engineering resources.

The New Jersey investment is also positioned within a broader network strategy that includes recent capacity additions in Portugal and Ireland, part of an effort to support dual-site manufacturing and regionalized supply as companies weigh where to locate CDMO partnerships against tariff exposure and supply chain resilience concerns.

"89 Twin Rivers is a major step forward for Hovione's US operations and a clear expression of our long-term commitment to East Windsor and New Jersey," said David Basile, vice president of Technical Operations, Americas, Hovione.

The new facility is expected to employ approximately 80 people and was formally inaugurated at a September 15 ribbon-cutting event attended by New Jersey state assembly woman Tennille McCoy,East Windsor Mayor Janice S. Mironov, and BioNJ President Debbie Hart.

 Hovione currently works with 19 of the world's 20 largest pharmaceutical companies and is involved in roughly 10% of medicines approved annually by the FDA.

What Does this Mean for New Jersey's Broader Manufacturing Ecosystem?

The East Windsor expansion reflects a trend documented statewide.

 According to the 2026 New Jersey Life Sciences Report, New Jersey ranks first nationally in pharmaceutical manufacturing employment and in FDA-registered manufacturing sites, with more than 700 CROs and CDMOs operating in the state. The report also points to New Jersey's inventory of legacy pharmaceutical campuses, which offer existing infrastructure and regulatory approvals that can shorten development timelines by 12 to 24 months and cut buildout costs by as much as 90%, advantages that continue to draw manufacturing investment to the state.

Hovione. Hovione opens new facility at New Jersey campus, doubling U.S. spray drying capacity [press release]. September 16, 2026. 

https://www.hovione.com/press-room/press-release/hovione-opens-new-facility-new-jersey-campus-doubling-us-spray-drying-capacity

Fazelpoor M. New Jersey builds on legacy of leadership in life sciences. NJBIZ. Published June 29, 2026. Accessed September 16, 2026. 

https://njbiz.com/new-jersey-life-sciences-report-growth/

Hovione expanded its East Windsor, New Jersey campus with a 31,000-square-foot GMP-ready facility housing two commercial-scale PSD-3 spray dryers, doubling US spray-drying capacity and completing a $100 million site investment cycle. Integrated under the existing FDA registration and shared quality system, the setup links spray drying with drug-substance and oral drug-product operations to streamline tech transfer. The expansion supports amorphous solid dispersions for poorly soluble small molecules and aligns with broader dual-site, regionalized supply strategies amid resilience and tariff considerations.

The recently opened NJ spray drying facility doubles capacity for amorphous solid dispersions, addressing solubility limits in roughly 70% of small-molecule pipelines.

Spray Drying Capacity Signals Faster Paths for Poorly Soluble Drugs

Important lessons for GMP facilities for their AI use

At the PDA/FDA Joint Regulatory Conference 2026 in Washington, DC, Karthik Iyer, Associate Vice President, Compliance and Post Market Reporting, Eli Lilly, laid out a working model for how a global manufacturer is using AI to connect inspection findings, audit observations, and deviation data that traditionally live in separate systems.

His presentation, "From Data Noise to Inspection Readiness: AI-Powered Regulatory Intelligence Across Your Quality Landscape," treated AI adoption less as a technology rollout and more as a governance exercise. Gourav Pandey, R&D Quality Lead, Takeda, and Svyatoslav Borshchenko, CEO and co-founder, GxPilot, covered this theme in an assessment of the FDA's 

April 2026 warning letter to Purolea Cosmetics Lab

, which made clear that quality units, not algorithms, remain accountable for what AI-assisted systems produce. Taking a deeper dive into the topic here on pharmtech.com, Brian Drapeau, founder, GxPFrame, q

uestioned whether compliant AI in pharma is even possible

explored how pharma’s next AI problem is authority

What Questions Should a Quality Organization Ask Before Deploying AI?

Iyer claimed the most important questions were: Has a given signal occurred before, internally or externally? How does the enterprise share that signal without creating new exposure? What are the possible adverse inspection and possible litigation risks embedded in each data node? And how does a team guard against confirmation bias or sunk-cost thinking once a model starts producing answers it likes?

 That final point lines up with concerns raised during the FDA's push toward 

 where connected, auditable records are treated as a prerequisite for AI use rather than a byproduct of it.

How Does the System Turn Documents into Defensible Answers?

Iyer walked through track findings by month, site, and health authority alongside Lilly's response and after-action review, with two AI layers sitting underneath it: a Document Explorer that applies retrieval-augmented generation to unstructured files such as inspection PDFs, and a Data Explorer for structured data sets.

 Connecting the system to Lilly's data lake meant wrestling with translation issues, global stop-words, and parameter tuning to balance document volume against accuracy. He urged discipline in weighing outside expertise against internal judgment, and cautioned against using the tools to generate predictions or restate what a reviewer already knows, keeping the focus instead on surfacing a defensible range of outcomes.

Why the Emphasis on Hallucination Research?

Iyer cited the AA-Omniscience benchmark, which found hallucination rates ranging from 22% to 94% across 26 leading models, and noted a sharper finding: accuracy on identical false claims collapsed once a statement was framed as the user's own belief rather than a third party's, with GPT-4 falling from 98.2% to 64.4% and DeepSeek R1 from over 90% to 14.4%. He also pointed to a growing body of research showing that even long-context models lose accuracy as inputs grow. For a compliance function built on getting the source citation right, that's less a footnote than the whole point.

Parenteral Drug Association. PDA/FDA Join Regulatory Confernce 2026 Agenda. Available at 

From guidance to operating model: preparing CMC and quality systems for FDA’s digital-by-default oversight. 

https://www.pharmtech.com/view/from-guidance-to-operating-model-preparing-cmc-quality-systems-for-fda-s-digital-by-default-oversight

AI adoption within global quality organizations is increasingly framed as a governance and accountability challenge rather than a pure technology deployment. A working model integrates inspection findings, audit observations, and deviation data across traditionally siloed systems, using retrieval-augmented generation for unstructured inspection documents and complementary analytics for structured datasets. Key pre-deployment questions focus on signal recurrence, information-sharing risk, inspection and litigation exposure, and cognitive biases introduced by model outputs. Implementation tradeoffs include multilingual normalization, stop-word governance, and parameter tuning, amid persistent hallucination risk.

Karthik Iyer, Eli Lilly, detailed an AI system linking GMP findings, audits, and deviations for cited, inspection-ready regulatory intelligence.

Lessons For AI Governance in Quality Systems

AI can turn medical device risk files from annual reviews into continuous, evidence-based monitoring, while keeping human oversight and validation central.

Risk management in medical devices carries 2 identities. ISO 14971 defines a lifecycle process for identifying hazards, estimating and evaluating risk, controlling risk, and monitoring whether controls remain effective.

 In practice, however, the risk file may still be revisited through periodic, manually assembled reviews. By the time a review is approved, some of the evidence behind it may already have changed.

The mechanics explain why. A risk review asks a team to reconcile hazards and hazardous situations against production and post-production information, including complaints, incidents, nonconformances, service records, and other post-market evidence.

 Where reliable denominator data are available, event counts can be considered against sales volume, the size of the exposed population, or device use to determine whether an observed occurrence rate remains consistent with the risk estimate.

At scale, this becomes difficult to sustain. The evidence may sit across complaint handling systems, vigilance databases, corrective and preventive action and quality systems, service platforms, and enterprise resource planning or sales systems. Teams then spend substantial time finding, cleaning, aligning, and classifying data before they can interpret what it means for risk.

How a Once-A-Year Cycle Delays the Response to Real Risk

The larger issue is latency. If a device's real-world failure rate begins drifting above the threshold assumed in the risk file in February, but the formal review happens in November, the organization may not connect that change to the existing risk estimate for months.

This delay is at odds with the direction of current post-market requirements. The European Union’s Medical Device Regulation requires manufacturers to actively and systematically gather, record, and analyze relevant data throughout a device's lifetime and use those data to update the benefit-risk determination, risk management, design and manufacturing information, and other safety actions.

 It also requires trend reporting for statistically significant increases in the frequency or severity of certain incidents.

 Signal detection and risk review may still run as separate workstreams, but they depend on the same evidence.

The Strain of Classifying Hazards by Hand

The heaviest work often sits in classification. Complaint and nonconformance narratives are unstructured, yet they must be connected to device problems, causes, health effects, harms, failure modes, and the hazards already defined in the risk file. The International Medical Device Regulators Forum maintains a standardized terminology for categorized medical device adverse event reporting, with 2026 updates to its coding annexes, to support consistent categorization and reporting.

Natural language processing can reduce part of this workload. Studies using medical device adverse event reports and field safety notices have shown that natural language processing models can identify, classify, and aggregate unstructured safety text.

 Those results demonstrate feasibility, not universal accuracy. Performance depends on the device, dataset, taxonomy, labeling quality, and validation method.

Where Combination Products Make the Problem Harder

Nowhere is this strain more visible than in combination products. A prefilled syringe, an autoinjector, a drug-eluting stent, or a metered-dose inhaler carries a drug constituent and a device constituent, and each constituent brings its own risk framework.

Those frameworks were not written to speak to each other. ISO 14971 governs risk management for the device constituent, structured around hazards, hazardous situations, harms, and risk control.

The drug constituent sits under quality risk management principles described in the International Council for Harmonisation’s Q9(R1) guideline, which is organized around product quality and patient risk in pharmaceutical manufacturing.

 The 2 use different vocabularies, different severity concepts, and different criteria for what counts as acceptable residual risk.

Post-market reporting is similarly doubled. In the United States, 21 

 Part 4 Subpart B requires combination product applicants to submit safety reports aligned to both constituent types, so an applicant holding a drug application may also owe device-type malfunction reporting.

 In the EU, integral drug-device combinations are subject to a notified body opinion on the device part under Article 117 of Regulation (EU) 2017/745.

The practical consequence sits in the same place as before, at classification. A single narrative describing a failed injection may reflect a device malfunction, a drug quality defect, a use error, and the distinction often cannot be resolved without investigation. That 1 record may need to be mapped into 2 taxonomies, feed 2 reporting obligations, and update 2 risk assessments.

Denominator data can diverge as well. Device exposure may be counted in units distributed, while drug exposure may be expressed in doses administered or patient-days of therapy. An occurrence rate calculated against the wrong denominator can misstate risk in either direction.

For manufacturers of combination products, therefore, the periodic review cycle carries twice the assembly burden and twice the opportunity for a signal to sit unrecognized between reviews.

The 2 Layers That Can Make Continuous Risk Assessment Possible

Artificial intelligence (AI) can help close the gap, but only within a controlled architecture. That architecture has 2 layers.

The first is an orchestration layer that connects to the systems where post-market evidence lives: complaint handling, adverse event reporting, nonconformance and corrective and preventive action systems, service records, and enterprise resource planning or sales systems that hold denominator data. Instead of relying on periodic spreadsheet exports, the layer can retrieve current data, align it to the product hierarchy, and preserve traceability back to each source.

The second is assisted classification. A natural language processing or language model can propose how a record maps to a defined taxonomy and to hazards or hazardous situations in the risk file. For combination products, that mapping must be explicit about which regulatory framework each classification feeds, because the same record may serve more than one.

The model should not be treated as correct by default. Before operational use in a quality management process, the software needs a documented intended use, risk-based assurance, and objective evidence that it performs as intended.

 Ambiguous or low-confidence records should be routed to qualified reviewers.

Put the two layers together and the risk assessment no longer must wait for a scheduled data-assembly exercise. Occurrence rates can be recalculated as validated complaints, nonconformances, and denominator data are added.

The result is not an autonomous risk decision. It is a more current evidence set for the people responsible for that decision.

Why A Continuously Updated Risk File Can Strengthen Signal Detection

When an observed rate approaches or exceeds the probability assumed in the risk file, the system can surface the change with the underlying records attached. That gives reviewers a direct path from a potential signal to the hazard, harm, control, and benefit-risk questions that require attention.

This approach does not replace required post-market surveillance, vigilance, or trend-reporting processes. It can reduce duplication between them by feeding each process from the same governed evidence base, which matters most where a single record carries obligations under 2 frameworks. FDA guidance recognizes that relevant and reliable real-world data can support regulatory decision-making for medical devices, including post-market uses.

That can shorten the path from detection to decision, whether the next step is a corrective and preventive action, a design change, a labeling update, a field action, or continued monitoring.

None of this removes people from the loop. Decisions about risk acceptability, benefit-risk, and mitigation strategy remain with qualified personnel under the manufacturer's risk management process.

 What AI can reduce is the time spent retrieving data, normalizing it, and performing first-pass classification, provided the system is assured for its intended use and its outputs remain reviewable.

For quality leaders in both device and combination product organizations, the practical question is not whether to automate the risk file in 1 step. It is which parts of evidence collection, classification, and rate calculation can be automated safely, validated, and kept under human oversight. The goal is a risk file that responds to new evidence sooner without weakening the judgment and governance that patient safety requires.

1. International Organization for Standardization. ISO 14971:2019 Medical devices–Application of risk management to medical devices. December 2019. Reviewed and confirmed 2025. Accessed September 15, 2026. 

2. European Parliament and Council of the European Union. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices. Consolidated text, July 19, 2026. Accessed September 15, 2026.  

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02017R0745-20260719

3. Medical Device Coordination Group. MDCG 2022-21: Guidance on Periodic Safety Update Report (PSUR) According to Regulation (EU) 2017/745 (MDR). December 2022. Accessed September 15, 2026. 

https://health.ec.europa.eu/document/download/a7df24c3-d4a3-4218-a8e0-726febfa01c2_en?filename=mdcg_2022-21_en.pdf

4. International Medical Device Regulators Forum. Terminologies for Categorized Adverse Event Reporting (AER): Terms, Terminology and Codes. IMDRF/AE WG/N43 FINAL:2020; Updated Annexes Release No. 2026. March 2026. Accessed September 15, 2026. 

https://www.imdrf.org/documents/terminologies-categorized-adverse-event-reporting-aer-terms-terminology-and-codes

5. Luschi A, Nesi P, Iadanza E. Evidence-based clinical engineering: health information technology adverse events identification and classification with natural language processing. 

 2023;9(11):e21723. doi:10.1016/j.heliyon.2023.e21723. Accessed September 15, 2026. 

https://pmc.ncbi.nlm.nih.gov/articles/PMC10638042/

6. Ren Y, Caiani EG. Leveraging natural language processing to aggregate field safety notices of medical devices across the EU. 

2024;7:352. doi:10.1038/s41746-024-01337-9. Accessed September 15, 2026. 

https://pmc.ncbi.nlm.nih.gov/articles/PMC11618595/

7. Li T, Zhu W, Xia W, et al. Research on adverse event classification algorithm of da Vinci surgical robot based on Bert-BiLSTM model. 

 2024;18:1476164. doi:10.3389/fncom.2024.1476164. Accessed September 15, 2026. 

https://pmc.ncbi.nlm.nih.gov/articles/PMC11682881/

8. International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. ICH Q9(R1) 

. Step 5 version, January 2023. Accessed September 15, 2026. 

AI can turn medical device risk management into a continuous signal.