The 2025 AI Observatory report, published by the EMA and the national agencies (HMA) in June 2026, contains a line worth more than many headlines: 2025 was the year of transition from exploration to real implementation. This is not rhetoric. It means AI has stopped being a pilot in a corner of the org chart and has become part of the day-to-day work of assessing medicines. And when a regulator starts using the very technology it also supervises, the rules of the game get a lot more concrete.
It is worth reading 2026 not as an isolated novelty but as the convergence of three moves usually told separately: the EMA using AI in production, the EMA demanding data quality through a formal framework, and the EMA aligning with the FDA on a common body of principles. Seen together, they paint something more interesting than any of them alone.
01 The 2026 shift: from exploring to operating
The AI Observatory is the thermometer Europe's regulatory network publishes on AI use across human and veterinary medicines. Its 2025 edition organises the landscape into four fronts: guidance and policy, real AI applications, collaboration between agencies and industry, and progress on EU-funded initiatives. The underlying message is that AI is already embedded across the medicines lifecycle, from discovery to post-market pharmacovigilance. The change of tone matters: the question is no longer whether AI enters regulation, but how it is validated once it is inside.
02 Scientific Explorer: the regulator runs AI in production
The most tangible example is Scientific Explorer, the EMA's own AI-enabled knowledge-mining tool. Since March 2026, its extended functionality lets assessors at the EMA and national agencies search precisely for information related to initial marketing authorisation applications for human medicines, filtering by medicine name, disease or keyword. This is AI applied to the regulatory decision machinery itself. And it raises, in passing, an uncomfortable question we will return to: if the EMA demands rigorous validation from industry, with what transparency does it validate its own?
03 The technical bar: risk-based approach and context of use
The heart of the European framework is not a list of permitted technologies, but a principle: a risk-based approach proportionate to the context of use. The intensity of validation, oversight and mitigation must be proportionate to the weight the model carries in a decision. A model that prioritises candidates in early discovery is not validated like one that informs a labelling or pharmacovigilance decision. That seemingly obvious idea is demanding: it forces you to define in advance what the system is used for and which risks must be managed throughout its life. The EMA's reflection paper on AI in the medicines lifecycle, the scientific bedrock of this whole edifice, also places human oversight not as a final stamp but as a cross-cutting requirement.
04 Data drift and overfitting: why a valid model stops being valid
This is where the framework becomes real engineering. Two failure modes hold the regulator's attention. The first is overfitting: a model that memorises its training set instead of learning the pattern generalises poorly to future contexts; the good news is that it is usually detectable in the test phase when modelling practices are sound. The second, more insidious, is data drift: performance degrades over time because the population, clinical practice or input data change. A model approved today can stop being valid in six months without anyone touching a line of code. That is why the EMA insists on quality systems with continuous monitoring, issue identification and periodic re-evaluation: validation is not an act, it is a process that lasts the model's entire life.
05 Data quality: the RW-DQF framework
No model is better than the data it learns from, and real clinical data is notoriously messy. In March 2026, the EMA's CHMP committee adopted the real-world data (RWD) chapter of its Data Quality Framework, published a few days later. Its goal is to formalise how to measure the quality of the real-world data underpinning the real-world evidence (RWE) used in medicines assessment, consistently and transparently. It is an unglamorous but decisive piece: it puts method where there used to be case-by-case judgement, and connects directly to the reliability of any model trained on that data.
06 EMA and FDA: common principles, not a common law
In January 2026, the EMA and FDA published ten joint "Good AI Practice" principles for medicines development. They stress a human-centric, risk-based approach: a clear definition of the context of use, data governance and quality, lifecycle performance monitoring, document management and cybersecurity, and honest communication of a model's limitations to users and patients. It is a strong signal of transatlantic harmonisation. But it should be read precisely: these principles are foundational, not prescriptive. They create a common vocabulary, not a common body of obligations. In the EU, what is binding will keep coming from the AI Act and pharmaceutical legislation; in the US, from its own framework.
07 EHDS: the substrate arriving in 2029
This whole architecture rests on a data promise that has not yet arrived. The European Health Data Space (EHDS), Regulation (EU) 2025/327, will enable the secondary use of health data —research, innovation, training and evaluation of algorithms— mediated by national access bodies, with a permit regime, secure processing environment and a ban on re-identification. The detail almost nobody underlines is the timeline: secondary use becomes applicable for most categories from March 2029, with genomic data following later. There is, therefore, a three-year gap between the regulator's AI ambition and the European data substrate that should feed it. In the meantime, quality RWD remains sliced across 27 national systems.
Who validates the regulator's AI
The EMA's move is coherent and, technically, sound: the risk-based approach, the attention to data drift and the data-quality framework are exactly what a senior engineer who understands how models fail in production would ask for. But two honest tensions remain that institutional noise tends to cover. The first is one of nature: turning soft law into hard law by way of narrative is a mistake; principles and reflection papers guide but do not bind, and conflating them gives a false sense of legal certainty. The second is one of governance: when the regulator becomes an operator —Scientific Explorer is AI on its own decision desk— someone has to answer who validates that AI, and with what transparency, to the same standard demanded outside.
For anyone building clinical models in Europe, the practical reading is clear. The bar is no longer "does the model work?" but "can you show what it is for, watch for when it stops working and prove that the data feeding it is of quality?". That is the engineering conversation that really matters in 2026, and the one we will keep following from Salud·IA, where we translate this framework into executable practice for teams developing AI in healthcare.
Back to publications