A pharmaceutical company operating in the EU and US wants to use GenAI to help summarize adverse-event reports for regulatory submissions. Leadership is concerned about compliance risk. What is the most important first step?
Select an answer to reveal the explanation.
Short Explanation
You'd check which building codes apply before you start construction, not after the walls are up, and the same logic holds here. A pharma company working in the EU and US has to map out pharmacovigilance rules and data-protection laws like GDPR before scoping any AI use case, not after.
Full Explanation
Identifying which regulatory regimes apply — pharmacovigilance rules, data-protection laws like GDPR, and any others relevant to each market — and assessing the AI tool's outputs against them is the necessary first step before any use case can be scoped responsibly. Waiting for a single unified global regulation isn't realistic; regulatory frameworks differ by sector and jurisdiction and are unlikely to converge, so this delays action indefinitely without reducing risk. Restricting AI to internal training materials avoids the regulated use case entirely rather than assessing it, which forecloses a potentially valuable and manageable application before any real analysis is done. Accepting a vendor's compliance claim at face value skips the company's own due diligence — vendor marketing isn't a substitute for the company's independent assessment of its specific regulatory obligations. The general principle: compliance risk must be actively identified and assessed before a use case proceeds, not assumed away, avoided, or outsourced to a vendor's claims.