AI Maturity in GMP: Accelerating Your Digital Journey at Warp Speed, Safely

Most AI projects fail. The organizations that succeed are the ones that build governance before they build velocity.

Written by Tracy Hibbs and Tony Sacchetti, Waters Corporation

Artificial intelligence (AI) is poised to take routine work and shift it to fully automated workflows. Currently, 80% of AI projects fail.¹ As with most paradigm-shifting technology, it will require time, patience, and strong data governance to realize the potential gains. It requires deep expertise to ensure the AI performs as expected for your intended use and vigilant, continuous oversight to reduce the potential for risks to be realized.

Failure is not an option

With approximately 95% of pharmaceutical companies investing in AI,² it is clear hopes are high that it will accelerate drug development, secure supply chains, increase operational resilience, streamline audit predictability, and reduce time and cost to patients. At the same time, regulatory agencies are investing to increase the speed of filing response, identify potential supply chain issues and trends, and pinpoint where to focus inspections. Innovation and regulation are happening in parallel, increasing the criticality of getting it right, or risk falling behind.

For a closer look at the regulatory landscape and at inspection readiness specifically, see our recent post, “Is Your Organization Ready for AI Inspection?”

“In pharma, 75 to 85 percent of workflows contain tasks that could be enhanced or automated by agents, potentially freeing up 25 to 40 percent of an organization’s capacity.” ³

Considering the extensive investments that have been made, organizations are still experiencing a lack of ROI. Whether it is efforts to build homegrown AI with existing resources, gaps in needed expertise, siloed and disparate activities, or data governance issues impacting success is to be determined, and in many cases, it is likely combinations of challenging dynamics.

From a practical standpoint, there are critical areas, such as AI validation and GMP compliance, where things can break down:

You cannot AI your way out of bad data

Data integrity is not optional and ALCOA++ is essentially the regulatory floor. Any potential data integrity issues that exist in your input data will persist in your AI—it inherits and amplifies your data. You may miss issues if your approach is black box and you lack a clear understanding of how the model you use works and where it fails. Your data governance and validation practices must be in a continuous state, especially if you are attempting to adopt adaptive AI.

These fundamentals must be working in concert to truly realize the potential of AI.

If you consider agentic AI, for example, it is not just AI. It is AI that plans, reasons, and executes multi-step actions toward a goal—language that mirrors the FDA’s own working definition of agentic AI.⁴ It is not generating one single, simple prediction, it is making a sequence of decisions, often with autonomous correction. Think of an AI that does more than just flag an OOS result, it autonomously launches the investigation, retrieves prior batch records, drafts the deviation report, and routes it for approval.

Your AI vendor choice becomes your AI governance choice

How will you ensure your AI consistently produces reliable outcomes? If you are building solutions for your organization, your custom code carries a high validation burden compared to partnering with an organization that has intentionally designed and built solutions for high-value use cases. You also gain the burden of building and maintaining all infrastructure required to sustain the custom code you developed.

AI accelerates transformation at warp speed, but only mature organizations can safely control and sustain that speed. As your organization looks to accelerate, your vendor selection becomes a critical piece that is essentially a regulatory decision.

Things to consider:

• Choose vendors for governance posture, not merely feature breadth.
• Look to get it right the first time over getting there first.
• Execution that increases confidence is as critical as innovation.

The right vendor will ensure there is AI transparency, with documented inputs, outputs, decision boundaries, and limitations. Alongside this, vendor assessments against regulations, data flow and process flow maps, and risk assessments are imperative to streamline your compliance efforts and support your quality risk management. It is critical to have a clear understanding for your quality unit (QU) and frameworks that provide explicit information for human oversight, locations of where the human can be put into the loop, and authorization.

Getting it right means continuous, embedded validation with performance monitoring, drift detection, and change control embedded in the same platform of capabilities versus an external bolt-on or afterthought.

Is your organization ready to leap ahead?

Connect with a Waters expert. Bring your gaps and we will bring the compliance expertise needed. Together, we will keep your data inspection ready.

References

1. Rand^®, Gartner^®, Stephen Ferrell – CPO Valkit.ai, ISPE^® GAMP^®
2. Mordor Intelligence™ (2025)
3. Reimagining life science enterprises with agentic AI, McKinsey (2025)
4. FDA Expands Artificial Intelligence Capabilities with Agentic AI Deployment (December 2025)