The Regulatory Framework Map — CIOMS, EU AI Act, FDA-EMA, and GVP

Lesson 13.7 covered CIOMS WG XIV in depth as the primary international reference. But it doesn’t operate alone — multiple regulatory frameworks apply to AI in pharmacovigilance simultaneously, and none of them are optional for an organisation operating in the jurisdictions they cover. This lesson maps the full landscape as it stood through 2026, building on Module 2’s global framework foundation.

The FDA-EMA Joint AI Guiding Principles, published January 2026, is a joint policy position from both agencies — not yet binding regulation, but effectively defining the standard AI tools are expected to meet in both the US and EU. Its ten principles echo and extend CIOMS WG XIV: governance, data quality, transparency, validation, human oversight, monitoring, documentation, a risk-based approach, stakeholder communication, and an explicit commitment to evolve the framework as the science develops.

The EU AI Act (Regulation (EU) 2024/1689), enacted in 2024 with phased enforcement through 2025-2026, is genuinely, legally binding — and it specifically classifies PV signal detection AI as high-risk, the Act’s strictest general tier. That classification requires a documented risk management system, full technical documentation, defined human oversight mechanisms, specified accuracy standards, and registration in the EU AI database before the system can even be deployed. This connects directly to Module 7’s Lesson 7.8 on the EU PRAC signal management process — EMA GVP Module IX Rev 2, binding as part of GVP since 2025, explicitly acknowledges AI-assisted signal detection while making validation and human oversight mandatory, and is the same regulation that abolished standalone signal notifications in favour of EudraVigilance’s continuous monitoring.

The practical challenge is that these frameworks overlap in scope but differ in specifics — CIOMS WG XIV and the EU AI Act both require human oversight, for instance, but define what counts as adequate oversight at different levels of granularity. The EMA GVP AI Annex, still in draft as of this course’s writing and expected to finalise in 2026, will eventually provide the most operationally specific EU guidance. Until then, the practical approach organisations are taking is using CIOMS WG XIV as the primary reference framework while independently verifying that any EU-facing AI system would separately satisfy the EU AI Act’s high-risk requirements — belt and braces, because both frameworks carry real regulatory consequences and neither one alone is guaranteed to cover the other’s specific requirements.