From Documents to Data: The Prerequisite Behind Pharma's AI Implementation

The main regulators on both sides of the Atlantic are doing two things at once:

• Moving the regulatory record off PDFs onto structured, machine-readable data.
• Setting the first real expectations for AI across the medicines lifecycle.

Put the two together and one priority emerges: the data foundation itself, with concrete milestones landing in the coming years.

The document-to-data transition is accelerating

Since regulatory interactions have existed, the document has been the element of information exchange. The industry moved from paper dossiers, to a common structure, to an electronic one, and at every step the files got better organized, but what was never questioned was the element of exchange itself. By 2023, roughly 94% of CDER submissions were filed through the eCTD, and CDER now handles more than 300,000 submissions a year, yet reviewers were still looking through repeated documents across applications and reconciling the same quality data across subsections, and the cost translated into extended review timelines.

Three things are moving at once:

• The container of a submission
• The vocabulary that identifies a product
• The assessment itself

All three are moving from documents to data.

Simultaneously, the first AI rulebooks arrived from the FDA and the EMA. Coincidence? We don't think so.

Where the shift is showing up

Four moves: three of them shaping the data structure, the fourth setting the terms for using it.

1. eCTD v4.0

The dossier gains context and structure. The submission format is being rebuilt on HL7 FHIR⁹: unique identifiers, reuse of one document across applications, and metadata-driven “context of use” in place of a rigid folder tree. FDA voluntary use opened in September 2024 (mandatory projected around 2029); the EU opened voluntary use for centrally authorised products in December 2025. Japan went furthest, making v4.0 mandatory for new applications on 1 April 2026, the first major authority to do so.

2. ISO IDMP

Every product gets a unique ID. IDMP⁴ is a suite of five global ISO standards that give a medicinal product a precise, machine-readable identity: substance, strength, dose form, units, product. Both the FDA and the EMA are adopting it. The EMA is furthest along operationally, through SPOR⁶ and its Product Management Service; the FDA maps its own identifiers (UNII, NDC, UCUM)⁵ onto the same framework. Deadlines are already biting: structured enrichment for the EU's critical-medicines products fell due in June 2026.

3. ICH M4Q(R2) and KASA

A leap onto structured review. The review itself is going structured. ICH's M4Q(R2)², issued in FDA draft³ in January 2026, restructures the quality dossier at the point of authoring and applies across ICH regions. The FDA is furthest along in operating it: KASA⁷ and PQ/CMC⁸ turn Module 3 narratives (manufacturing, stability, impurities) into computable, IDMP-aligned data its systems can risk-rank, and the EMA is building the equivalent backbone. The direct consequence: flawless narratives can still be refused on bad structured data.

4. The AI rules

Surprise: they are data rules. The FDA's January 2025 draft guidance¹⁰ sets a seven-step, risk-based credibility assessment, weighing how much an AI agent influences a decision against how consequential that decision is. The EMA's reflection paper¹¹ (September 2024) runs in parallel, framed as “high patient risk” and “high regulatory impact”. In January 2026 the two agencies issued joint Guiding Principles of Good AI Practice¹²: ten shared principles on human oversight, data governance, provenance, and lifecycle monitoring.

• “Data capabilities determine AI outcomes more than model sophistication.” (Forrester).
• 60% of AI projects will be abandoned through 2026 without AI-ready data (Gartner).
• 63% of organizations lack, or aren't sure they have, the data management AI needs (Gartner).

The harness

Read the FDA's formula closely: an AI agent's risk is its influence multiplied by the consequence of the decision it touches. Consequence is set by the use case; influence is not. An AI agent boxed inside a governed workflow, running on structured data with the context to act, exerts far less unchecked influence, because the workflow (and the human on top of it) catches what it gets wrong. It all comes down to the harness.

That also reframes the year's most-quoted AI statistic. MIT's finding¹⁵ that roughly 95% of enterprise GenAI pilots return nothing is widely misread as a data-quality verdict. The report points instead to a learning-and-context gap: tools that never retain the workflow they are meant to serve. Structured data and a defined context of use are exactly what close that gap, which is the same foundation the regulators are demanding.

The map: two converging tracks

The document-to-data mandates and the AI rulebooks arrive on the same calendar, and meet in January 2026.

What does that convergence mean?

How you address this shift is the whole game. Most organizations will treat it as two efforts: a regulatory-submissions IT project on one side, an AI strategy on the other. In reality, both respond to one central requirement.

This is an operating-model change. Accountability moves from the document down to the individual data element. For the pharmaceutical industry that is a cultural shift, and it is the best predictor of who copes with the 2026-2028 agenda: in one benchmark, only 4 of 59 organizations had pushed accountability down to that level.

Paying for more powerful AI agents will not close the gap. The differentiator is whether your data is ground truth, and whether a human still owns the judgment on top of it. That last point became tangible in April 2026, when the FDA issued what is widely described as its first AI-focused cGMP warning letter¹⁹, after AI agents generated specifications, procedures, and master production and control records that went into use without proper Quality Unit review.

What this means for a regulated operation

If you structure your data and control your processes, the 2026-2028 agenda stops being a threat and becomes a window of opportunity.

1. Treat the foundation as the priority. Map where one fact (a specification, a manufacturing site, a strength) is restated across dossier, trackers, product information, and email threads, along with which processes and actors are involved and accountable. That shows you where the inspection risk and the AI blocker sit.
2. Push accountability to the data element. Name data owners and stewards, not only document authors and approvers.
3. Align with IDMP. Understand the data structure your product information will need.
4. Make implementing a harness the priority. Define the context of use, weigh AI-agent influence against decision consequence, and keep a qualified human accountable for every GxP output.
5. Treat the deadlines as a forcing function. Restructure how you author, and set common, methodical guidelines to get ahead of each deadline.

The takeaway

There is a way to read all of this as a compliance burden: more standards, more deadlines, more remediation. That reading misses what the regulators are describing. When they insist the record be structured, traceable, and rich in context, they are specifying the same foundation that makes AI trustworthy, submissions faster and more accurate, and inspections smoother. And the benefit is not only for the machines: people reason better over data that is connected and carries its own context, so the same structure that makes an AI agent trustworthy makes a human reviewer's work more fluid. Compliance, speed, and AI stop competing for the same budget and start emerging from a single foundation.

That is the bet behind Krevyos: build regulated-industry work on data that is ground truth by default, so the submissions, the inspectors, and the AI agents all draw from that one source. The organizations that move forward with an operating-system upgrade are the ones who will have the advantage for the decade that follows.

This is the first analysis in a series reflecting on where information management and AI are heading in the life sciences.

Questions leaders are asking