Pharma and life sciences

Quality and logistics functions in pharma answer to auditors. A system that influences a clinical judgement faces far more scrutiny than one that counts boxes.

Switzerland has no AI law of its own. The Federal Council chose on 12 February 2025 to regulate AI sector by sector.¹ On 8 May 2025 the FDPIC confirmed that existing data protection law applies directly to AI.² For patient and clinician data, the revised FADP is the law in force today. GxP validation is a separate question for different people, and a project has to settle both.

The first projects to get funded leave clinical judgement alone. They cut cost and risk inside functions that already have an auditor:

• Keeping a temperature-sensitive supply chain provably intact. Our cold-chain command centre is a working prototype for this.
• Reconciling what comes back against a manifest. See visual reconciliation, also a working prototype.
• Using patient or clinician data with a model while keeping real identities out of it. See anonymise before inference, an internal build, and on-device inference, a working prototype.

Each can be evaluated against a baseline before anyone opens a validation file, and each produces an audit trail by design.

• GAMP 5 was first published in 2008, and its second edition appeared in July 2022. It predates adaptive, learning AI.³
• ISPE closed part of that gap with its GAMP Guide: Artificial Intelligence in July 2025.⁴
• EU GMP Annex 22 is the GMP-level annex for AI. Its public consultation ran from 7 July to 7 October 2025, and final adoption was expected by the end of 2026. Check the current status before you cite it.⁵
• FADP Art. 22 requires a data protection impact assessment for high-risk processing, and AI-driven processing can qualify.⁶

You are validating against a target that is still moving, so say so in the validation plan. Build the evaluation and the audit trail in from the first architecture decision; retrofitting them costs more.

This page is a screening note, not legal advice. Ask your counsel before relying on any classification.

Start with the AI opportunity assessment, one to two weeks. It names a metric and an owner, and its regulatory applicability note separates the FADP questions from the GxP ones. If the data is the main risk, commission the data readiness review first. For the wider Swiss and EU picture, see AI regulation in Switzerland.

• WorkA cold-chain command centre
• WorkVisual reconciliation for returned kits
• WorkAnonymise before inference
• WorkOn-device inference, with nothing leaving the device
• WorkA project and quality management platform for regulated pharma