AI playbook for mid-sized medical device manufacturers

1Understand

Profile essentials

ManagementManagers

Typical situation

Several product lines, several sites and international distribution.
An ISO 13485 certified quality management system and software in place: document management, complaints, CAPA, ERP, CRM.
Large volumes of complaints, non-conformities and post-market data, mostly handled manually.
Scattered AI trials and governance that still needs to be formalised.

Common mistakes

Letting each department choose its own tools.
Introducing AI into a quality process without validation proportionate to the risk.
Handling MDR/IVDR and the AI Act separately for a product that includes AI, instead of bringing everything into the same quality management system.
Forgetting who maintains the tool after launch.

The three priorities

Set up simple governance
AI committee, fast track for low-risk trials, validation rule for tools used in the quality management system.
Roll out a company AI assistant for everyone
With mandatory training and an AI champion per department.
Move 3 to 5 cases into production within the year
Starting with quality and post-market activities: complaint triage, root cause analysis, regulatory monitoring, technical documentation.

To start in the next two weeks

Appoint a sponsor on the executive committee and a head of AI.
List the AI trials and tools in progress: department, tool, data used, results.
Set up the AI committee: IT, quality, regulatory, legal, DPO and 2 or 3 business departments.
Approve the AI usage policy, the “green light” test and the validation rule for tools used in the quality management system.
Choose the company AI assistant and plan its rollout in waves.

Role by role: what to do

Role	To do	Chapters
Management	Set three AI priorities for the year and the related budget. Appoint a sponsor on the executive committee and convene the AI committee every month. Ask for a quantified review every quarter: use, time saved, costs, incidents.	4 8 13
Managers	Choose with the team two uses from the role sheet to test this month. Free up two to three hours per person for the basic training. Report every use case idea with the use case sheet.	7 8 12
All employees	Read the policy and complete the basic training. Use only the approved tool, with your business account. Try the prompts on your role sheet and share what works.	3 6 7
AI lead	Keep the register of uses and answer approval requests. Run the network of AI champions and prepare the AI committee. Track the indicators and update the policy every quarter.	3 5 8 13
IT and security	Configure the approved tool: access, rights, logging. Control or block unapproved AI tools. Check every supplier against the ten control points.	5 9 10
DPO, legal and compliance	Approve the policy and the clauses in supplier contracts. Carry out the necessary data protection impact assessments. Check HR uses and sales documents prepared with AI.	3 4 9
Quality, regulatory and PRRC	List the AI tools used in the quality management system and in products. Define risk-proportionate validation for these tools. Build the use of AI into the relevant procedures.	4 9 10

In chapter 7, every employee finds the sheet for their role: three uses to start this week, ready-to-use prompts and points to watch.

2Understand

Understanding AI

Everyone

To do

Identify which type of AI each planned use falls under.
Aim for level 2 first: team efficiency.
Review every output: a well-written answer is not necessarily a correct one.

Three families of AI coexist. They are not used for the same things and do not call for the same controls.

Classic AI

A person sets the question, the AI analyses data.

Input: Numerical and structured data
Output: Forecasts, scores and alerts that support a human decision
Autonomy: None: it informs a decision

Use it for

Analyse structured data
Predict an outcome or a value
Classify or score at scale
Spot trends or anomalies

Example

Forecasting spare parts needs, spotting an abnormal rise in complaints.

Generative AI

A person interacts with the AI, which produces new content.

Input: Text, images, documents, audio
Output: Drafts, summaries, translations, answers
Autonomy: None: it responds to a request

Use it for

Write new content
Summarise unstructured information
Answer from a document base
Interpret freely worded requests

Example

Writing the first draft of a work instruction, summarising a test report.

Agentic AI

A person sets a goal and rules, the AI chains the steps needed to reach it.

Input: A goal, and access to tools, data and systems
Output: A sequence of actions and decisions across several systems
Autonomy: It acts on its own within set limits and adjusts to feedback

Use it for

Chain several steps without intervention at each one
Take on a whole process, with control points
Coordinate actions across tools, systems and people
Handle repetitive tasks in volume

Example

Preparing a complaint for handling: gathering the history, proposing a category, preparing the analysis for the quality manager.

Automation or agent?

A scheduled task remains automation as long as a person has set the logic, the scope and the control points. It becomes an agent when the AI chooses its own steps and tools, and acts without review at each step. The difference changes the controls you need (chapter 9).

Automation

Every week, the list of open complaints is extracted, summarised with a fixed template and sent to the quality team.

Agent

A program spots a series of similar complaints, opens an investigation, queries the manufacturing data and proposes a corrective action.

The four levels of value

Value increases at each level, but each level rests on the ones below.

Products and patients

New products or services that include AI, for patients and healthcare professionals.

Business processes

Speeding up research, development, manufacturing, quality and commercialisation.

Team efficiency

Saving time on everyday tasks: writing, searching, summarising, analysing.

Foundations

Reliable and accessible data, secure tools, clear rules and skills.

For this profile: Extend levels 1 and 2 to everyone, and bring 3 to 5 cases to level 3. For a product that includes AI, level 4 is already in play: product compliance (MDR/IVDR and AI Act) is handled in parallel, in the quality management system.

What AI does well

Summarising, rewording and structuring a text
Comparing two versions of a document
Extracting information from long documents
Suggesting options, outlines, questions
Translating and adapting to an audience
Writing or explaining simple formulas and code

What calls for caution

Figures, units and calculations: always check
Bibliographic references: AI can make them up
Recent information: only if the tool is connected to up-to-date sources
Medical, regulatory or quality decisions: AI prepares, a person decides
Topics with no reliable source: the answer can be wrong and convincing

A well-written answer is not necessarily a correct one.

3Govern

The rules of the game

Everyone

To do

Share the policy and have every user accept it.
Put every new use through the “green light” test.
Declare to the AI committee any use that goes beyond personal efficiency.

Before you start

Read and accept the AI usage policy
It sets the approved tools, the prohibited data and the review rules. It also covers image creation and the recording or transcription of meetings.
Complete the basic training
Key concepts, benefits, risks and ethical questions. Access to the tools depends on it.
Declare your use case
As soon as a use goes beyond your own work (writing, summarising, searching for yourself). The test below tells you.

Green light test

Can this use start without approval?

Tick each condition that is met. All seven are needed to start without approval.

The tool is an AI tool approved by the company, used with a business account.The use is only for personal efficiency: writing, summarising, searching for yourself.The data used is internal and allowed in this tool, with no health data and no patient data.No regulated data is used: complaints, CAPA, vigilance, clinical investigations, quality records.The output does not commit other people and does not support a business, regulatory or medical decision.The company has the right to use the data given to the tool: licences, contracts, partner confidentiality.The output does not need intellectual property protection (patent, copyright).

The result appears here as soon as the first box is ticked.

An AI committee, a fast track and a standard track

Declare
A single form: need, tool, data, users, expected results.
Business review
The sponsor of the department concerned confirms the value, the priority and the budget.
Expert review
Depending on the risks, the request goes to security, the DPO, quality or legal.
Clearing reservations
The project owner answers the points raised.
AI committee decision
The case becomes a project, with an owner and indicators.

Fast track

Fast track for low-risk trials (no sensitive data, no GxP impact): target answer within 5 working days. Standard track: target opinion within 3 to 4 weeks.

Good to know

The committee meets every month. It also tracks the portfolio: it stops projects with no results and extends those that work.

The more precisely the declaration describes the use case, the faster the approval.

Who does what

Role	Responsibilities
Executive management (sponsor)	Sets the ambition, decides priorities and budget, leads by example.
AI lead or head of AI	Runs the programme, keeps the register, advises teams, prepares decisions.
AI committee	Approves risky cases, tracks the portfolio, stops projects with no results.
IT and security	Chooses and secures the tools, manages access, monitors use.
DPO	Checks GDPR compliance, carries out data protection impact assessments.
Quality, regulatory and PRRC	Assesses the impact on the quality management system, approves tools used in regulated processes and product documentation.
Legal and compliance	Supplier contracts, intellectual property, communication rules, liability linked to agents.
Managers	Spot use cases, free up time for training, track results.
AI champions	Help their colleagues, share good practice, report needs.
Every employee	Follows the policy, checks the outputs, reports errors and incidents.

AI usage policy template

Template to copy

Use only AI tools approved by the company, with your business account.
Never enter patient data, identifiable health data or materiovigilance (device vigilance) data into a tool that is not approved for that data.
Do not enter confidential information (strategy, prices, partner data, unpatented inventions) outside the tools approved for that level of confidentiality.
Check every output before using it: facts, figures, units, product names, references.
Keep the decision human: AI proposes, a competent person approves, especially for medical, regulatory, quality and promotional content.
Send any content intended for external audiences through the usual approval process: product communication, documents given to healthcare facilities, regulatory documents.
Clearly disclose the use of AI when the law requires it: conversational agent, realistic image, audio or video, avatar, synthetic voice.
Declare any use that goes beyond personal efficiency (“green light” test).
Tell participants before recording or transcribing a meeting, and respect their refusal.
Report any error, data leak or abnormal tool behaviour to the AI lead.

Prohibited by the AI Act since 2 February 2025: inferring employees’ emotions from biometric data (voice, face), except for medical or safety reasons.

4Govern

The regulatory framework

ManagementAI leadsQuality and legal

To do

Train teams and keep a record of the training (AI Act, Article 4).
Disclose any conversational agent and any realistic content produced by AI.
For a device that includes AI, prepare the AI Act requirements in the quality management system before 2 August 2028.

European and French framework checked on 16 October 2026. This chapter gives practical guidance for action. It does not replace legal or regulatory advice.

Key dates

2 February 2025AI Act: prohibited practices and AI literacy obligation.In force
16 May 2026HDS (France): end of the transition to the new certification framework.In force
27 July 2026AI Act: entry into force of the Digital Omnibus on AI.In force
2 August 2026AI Act: transparency obligations (Article 50).In force
2 December 2027AI Act: Annex III high-risk systems, including HR uses.Upcoming
2 August 2028AI Act: medical devices that include AI and are assessed by a notified body.Upcoming

For all healthcare companies

AI Act: the European regulation on AI

In force

Regulation (EU) 2024/1689, amended by the “Digital Omnibus on AI” Regulation (EU) 2026/1744, in force since 27 July 2026.

Already applicable: Prohibited practices since 2 February 2025. An example that concerns companies: inferring employees’ emotions from their voice or face, except for medical or safety reasons.
Already applicable: AI literacy (Article 4), rewritten by the Omnibus: the company takes measures to develop the AI skills of its staff and of people who use AI on its behalf. It does not have to guarantee a specific level, but must be able to show what it has put in place: training, materials, policy.
Since 2 August 2026: Transparency (Article 50): tell people they are interacting with an AI, disclose realistic images, audio and video produced or altered by AI (avatars, synthetic voices), and disclose texts published to inform the public on matters of public interest, unless there is human review under editorial responsibility.
2 December 2027: High-risk systems in Annex III. In a pharmaceutical or medical device company, this mainly concerns human resources: screening job applications, evaluating or monitoring employees.
2 August 2028: High-risk systems built into regulated products (Annex I), including medical devices assessed by a notified body.

To do

Keep a record of training, materials and the policy (Article 4).
Clearly state that it is an AI on any conversational agent open to employees, customers or the public.
List HR uses now (screening applications, evaluating employees) ahead of the 2 December 2027 deadline.

The company’s role changes its obligations. It is most often a “deployer”: it uses an AI system supplied by a third party. It becomes a “provider” if it develops an AI system or places it on the market under its own name.

GDPR and health data

In force

Health data is sensitive data. Using it in an AI tool follows the usual GDPR rules, with extra care.

Legal basis and data minimisation: Use only the data needed, anonymise or pseudonymise where possible, inform the people concerned.
Impact assessment: To be carried out with the DPO before large-scale processing of health data or a new high-risk use.
Contract with the supplier: Data processing agreement (Article 28), list of sub-processors, place of processing, retention period.
CNIL (France): The French data protection authority’s recommendations and practical guides on AI and GDPR are a reference for projects that use personal data.

To do

Have the DPO approve any use that involves personal data.
Anonymise or pseudonymise data before giving it to the tool, where possible.
Check the data processing agreement before signing with a supplier.

Health data hosting (HDS, France)

In force

In France, a provider that hosts health data on behalf of a third party must be HDS certified.

Current framework: Published in the French Official Journal on 16 May 2024: physical hosting of data in the European Economic Area, and transparency about the risks of access from a non-EU country.
End of transition: Hosts already certified had until 16 May 2026 to comply with this framework.
In practice: Before entrusting health data to an online AI tool, check the host’s HDS certification and the hosting location.

HAS good practice (France)

Recommendation

Guide “Premières clefs d’usage de l’IA générative en santé” (first keys to using generative AI in healthcare), published by the French National Authority for Health on 30 October 2025 for healthcare professionals.

A.V.E.C. method: Learn (understand the tool and its confidentiality rules), Verify (check every piece of content, especially figures, units and drug names), Estimate (track quality over time), Communicate (share practices and stay transparent).
Use: A shared basis that is useful for medical teams and for exchanges with healthcare professionals.

Specific to medical devices

Devices that include AI: MDR/IVDR and the AI Act

Upcoming

MDCG 2025-6 guidance (June 2025) on the interplay between MDR/IVDR and the AI Act. Deadline for the obligations: 2 August 2028.

High risk: A device that includes AI is high-risk under the AI Act if it goes through a notified body: classes IIa, IIb and III, sterile class I, class I with a measuring function or reusable surgical instruments; IVDs in classes B, C and D, and sterile class A.
A single assessment: The notified body assesses the AI Act requirements as part of the MDR or IVDR assessment.
Integration: The requirements are added to the existing quality management system and technical documentation: risk management (including fundamental rights), governance of training and test data (quality, representativeness, bias), human oversight, cybersecurity, post-market performance monitoring.
Changes: A substantial modification of the AI requires a new assessment. Changes planned and described in the initial documentation do not.
SMEs: The Omnibus provides for simplified technical documentation for SMEs and small mid-caps, and a quality management system proportionate to company size.

To do

List the products that include AI, with their MDR or IVDR class.
Review the assessment timeline with the notified body.
Describe the planned changes to the AI in the technical documentation now.

AI used in the quality management system

In force

Even when AI is not in the product, it can be in the processes of the quality management system.

ISO 13485: Software used in the quality management system must be validated before use and after changes, with a risk-proportionate approach.
Examples: An AI tool that triages complaints, drafts a CAPA analysis or manages quality documents.

To do

List the AI tools used in quality processes.
Validate each tool before use, with effort proportionate to the risk.
Document this validation in the quality management system.

Vigilance and post-market surveillance

In force

An AI tool that helps detect incidents or trends must be validated, traced and supervised.

Responsibility: The manufacturer remains responsible for detection and reporting deadlines.
Practice: Document the tool’s role in the post-market surveillance plan.

Software as a medical device

In force

Code written with an AI assistant follows the usual software lifecycle.

Requirements: IEC 62304, code reviews, testing and change control apply as for any code.

Communication and documents given to healthcare facilities

In force

Content prepared with AI follows the usual approval process.

Practice: Regulatory, marketing and legal approval, under the responsibility of the person responsible for regulatory compliance (PRRC) for the matters within their remit.

Sources consulted

5Govern

Choosing the tools

ManagersAI leads

To do

Choose an enterprise assistant under a business licence.
Reuse before buying, buy before building.
Check the ten control points before signing with a supplier.

Three families of tools

AI for everyone

For

All employees

What

Enterprise conversational assistants and ready-to-use agents: writing, summarising, searching, analysing a file, running in-depth research.

Access

No approval needed for personal use, with a business account.

AI built into business software

For

The users of that software

What

AI features added by the vendor to software already in use: CRM, document management, quality management system, IT service management, development tools.

Access

According to each software’s rules, with approval of the use case.

Custom AI

For

A team, a department

What

Tools or agents built for a specific process that existing tools do not cover.

Access

After approval, with a business owner and a technical owner.

The models of the major AI providers (OpenAI, Anthropic, Google, Mistral, Meta…) run inside these tools. Choose the tool and its guarantees first, then the model.

The rule: reuse, then buy, then build

Reuse
An approved tool already covers the need, or can be extended to close the gap.
The fastest solution, with little development.
Buy
No tool in place fits, but a proven market solution meets the need.
The function is not a competitive advantage. Known cost and speed matter more than customisation.
Build
No existing tool and no market solution does the job.
The use case gives a competitive advantage or will serve several teams over time, and control of the tool justifies the start-up and running costs.

Which tool for which need

Need	Tool
A one-off question, a text to reword or summarise	Enterprise AI assistant
In-depth analysis: monitoring, report, dataset	Ready-to-use research or analysis agent
A recurring personal task that needs your own information: email sorting, standard meeting minutes, formatting rules	Personal agent built without code
One step of a process that runs in business software	AI feature of the business software
A complete business process, shared by a team	Custom agent or tool, after approval

Tools for this profile

Now

An enterprise AI assistant for everyone.
Research and analysis agents for advanced users.
The AI features of business software: CRM, quality, document management.

An internal knowledge base on approved documents, with sourced answers.
1 to 3 custom tools with a partner.
Tracking of use and costs.

Avoid: Avoid each department buying its own tool: go through the AI committee.

Budget: Plan a licence budget, a project budget per use case and a running budget (usage, maintenance).

For teams that develop software as a medical device, coding assistants speed up writing and testing. The code produced remains subject to the software lifecycle (IEC 62304) and the usual reviews.

Choosing a supplier: ten control points

List to copy

Data entered is not used to train the supplier’s models (written clause in the contract).
The hosting location is known, preferably in the European Union; HDS certification (France) if health data is processed.
A GDPR data processing agreement (Article 28) is signed, with the list of sub-processors.
Access is controlled: single sign-on, role-based rights, logging, encryption.
The models used are known, and the supplier gives notice of any model change.
AI-specific protections are described: content filtering, protection against prompt injection.
Exit is planned: export of data, prompts and agents.
The cost is predictable (per-user licence or usage-based), with spend tracking.
Connectors exist for the tools already in place: email, documents, CRM.
The supplier’s security assessment is done (questionnaire, references, certifications).

6Act

AI in everyday work

Everyone

To do

Start with the five basic uses.
Write each request with the six elements.
Apply the golden rules: learn, verify, estimate, communicate.

The five basic uses

Rewrite

Shorten a text, change its tone, adapt it to another audience.

Rewrite these instructions for use so that a nurse can understand them in one reading: short sentences, one action per line, no information removed. Then list the terms you simplified.

Summarise

Key points of a document, decisions and actions from a meeting, open points in an email thread.

Summarise the attached meeting transcript: points discussed, decisions taken, actions to carry out. For each action, give the owner and the deadline mentioned. Flag what is still to be decided.

Find ideas

Prepare the key points for a meeting, structure your thinking, test your arguments.

Play devil’s advocate. Here is our [initiative] project. List the 5 most likely objections from the executive committee and, for each one, the points to prepare in response.

Write

Emails, memos, first drafts from notes or reference documents, presentation slides.

Using the attached notes, write the first draft of a 2-page scoping note: context, objective, scope, timeline, risks, decisions needed. Factual tone. Flag any missing information.

Analyse

Compare two versions of a document, make use of survey results, spot trends.

Compare the two attached versions of this procedure. Present the differences in a table: section, version 1, version 2, type of change (substance, form, compliance). Then summarise the significant changes and their likely reason.

Writing a good prompt

A good prompt contains six elements. The most important: the data to use and the checks requested.

Element	Role	Example
Role	The point of view expected.	You are a medical affairs manager.
Context	The situation and the purpose.	Preparing an internal meeting on [condition].
Task	What to produce, with a precise verb.	Summarise the 5 attached articles.
Data	The sources to use, and only those.	Only the attached documents.
Format	The form and length of the output.	A table (reference, population, main result, limitations), then a 5-line summary.
Checks	What makes verification possible.	Cite the page for each statement, add nothing that is not in the documents.

Before

Write a summary on disease X.

After

You are a medical affairs manager. I am preparing an internal meeting on [condition]. Summarise the 5 attached articles, using only these documents. Present a table (reference, population, main result, limitations), then a 5-line summary. Cite the page for each statement and add nothing that is not in the documents.

Where AI saves the most time

First drafts
Emails, presentations, minutes, surveys, annual reviews.
Finding information
Finding a file, an email, a presentation, a piece of public data.
Handling email
Summarising a long thread, finding information, spotting actions to take.
Complex tasks
Analysing data in a spreadsheet, turning ideas into a structured document.
Meetings
Minutes, action lists, follow-up email from the transcript.

The gains are clearest when the assistant is connected to the company’s email, calendars and documents: it then works on the user’s real data.

The golden rules

Learn

Know the tool, what it does well, its limits and its confidentiality rules.

Verify

Review every output. Check figures, units, product names and references. Enter nothing confidential outside approved tools.

Estimate

Track quality over time: number of corrections needed, time actually saved.

Communicate

Share good practice with the team and be open about the use of AI.

Method based on the A.V.E.C. guide from the HAS, the French National Authority for Health (October 2025). Basic rule: AI proposes, a competent person decides.

Role-specific prompts are in the role sheets in chapter 7.

7Act

Role sheets

EveryoneManagers

To do

Open the sheet for your role.
Start the three suggested uses this week.
Propose a business use case with the use case sheet (chapter 8).

One sheet per role: three uses to start this week, ready-to-use prompts, use cases to propose and points to watch. Items marked DPL come from the Digital Pharma Lab use case library and client engagements.

Role sheets

Choose a role:

Management

This week

Have a 700-word summary of a file prepared before a committee meeting.
List the likely questions for a strategy meeting and prepare short answers.
Run a pre-mortem on an ongoing project: list the possible causes of failure.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Summary for the executive committee

Write a summary of no more than 700 words of the attached presentation for the executive committee: stakes, options, recommendation, decisions needed.

Project pre-mortemDPL

We are launching [project]. Imagine that, 12 months from now, the project has failed. List the 10 most likely causes, ranked by likelihood and impact, then propose for each one a preventive action to start now.

Competitive simulationDPL

Play the leadership team of a competitor that wants to counter our [project]. Describe its three most likely strategies, then propose our response to each one.

Anticipated questions

I am preparing a strategy meeting with [executive]. Based on the attached documents, list the likely questions on [3 topics] and propose short, executive-level answers.

Use cases to propose

Business unit assistant, fed with its strategic documentsDPL
Preparing a management meeting: short outline, anticipated questions, pre-read documentDPL
Managing the AI portfolio with the impact × feasibility grid

Assess each case with the grid in chapter 8 before launching it.

Points to watch

No confidential strategic information outside the approved tool.
Check every figure used in a summary.

Indicators to track

Time to prepare a committee meeting
Share of AI use cases with a measured result

R&D and engineering

This week

Turn user needs into verifiable requirements.
Have test cases proposed, including edge cases.
Extract the requirements from a technical document.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Design requirements

Using the attached user needs, propose a list of verifiable design requirements: one requirement per line, with its verification criterion. Flag ambiguous needs.

Extract the requirements from a documentDPL

Extract all the requirements from this technical document: functional, technical, constraints, acceptance criteria. Table: identifier, category, text, source.

Test cases

Propose test cases for the function described below, including edge cases and error cases. For each case, give the input data and the expected result.

Code and tests subject to the software lifecycle (IEC 62304) and the usual reviews.

Initial hazard list

Using the attached device description, propose an initial list of hazards and hazardous situations to examine in the risk analysis (ISO 14971), sorted by stage of use.

Working basis for the team. It does not replace the risk analysis.

Use cases to propose

Coding and testing assistance for medical device software
Preparing technical reviews with the full history of exchangesDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Confidential design data: approved tool only.
Medical device software: IEC 62304 and the usual reviews.

Indicators to track

Time to write requirements and tests

Regulatory affairs

This week

Turn a guidance document or a standard into a checklist.
Compare a procedure with new requirements.
Summarise the week’s regulatory monitoring on one page.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Technical documentation check

Compare this draft technical documentation section with the attached test reports. Table: statement, value in the draft, value in the source, reference, status (consistent, discrepancy, not found).

The tool flags, the team decides.

Compliance checklistDPL

Using the attached regulatory text, create a checklist: one line per requirement, with the text of the requirement, the action required, the evidence expected and the owner.

Gap analysis

Compare our attached procedure with the requirements of the attached text [standard, MDCG guidance]. Table: requirement, coverage (yes, partial, no), evidence, action to plan.

Regulations by countryDPL

Compare the regulatory requirements of [list of countries] for [device] and identify the differences that change the documents to provide. Propose the adaptations for each country.

Use cases to propose

Gap analysis against new requirements
Question-and-answer assistant on regulatory procedures and toolsDPL
Impact assessments of a regulatory changeDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

No unpublished document in an unapproved tool.
Expert review remains mandatory before any submission.

Indicators to track

Time for a gap analysis
Gaps detected before the notified body audit

Quality

This week

Prepare the checklist for an internal audit.
Analyse the findings of an audit by theme.
Analyse a change request: documents and tests affected.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Root cause analysis (5 whys)

Using the attached complaint and records (anonymised), propose a root cause analysis with the 5 whys method. Each answer must cite the record that supports it, otherwise “to be checked”. Propose corrective and preventive actions.

Proposal to be approved by the quality manager. Validated tool if it is used in the quality management system.

Audit findingsDPL

Analyse the attached audit findings: grouping by theme, probable causes, proposed corrective actions, priority. Present a table.

Prepare an internal audit

Prepare a checklist for the internal audit of the [process] process, based on the attached procedure and the requirements of ISO 13485.

Change request

Analyse this change request: documents affected, tests to repeat, possible regulatory impact, people to consult.

Decision within the change control process.

Use cases to propose

CAPA root cause analysis, with each step supported by evidence
Compliance dashboard built from audits and CAPAsDPL
Searchable quality document base, with sourced answers

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Software used in the quality management system: validation before use (ISO 13485).
The quality decision remains human.

Indicators to track

CAPA closure time
Repeat audit findings

Complaints, vigilance and PMS

This week

Complete a complaint: missing information and email to the reporter.
Sort the day’s complaints by criticality and completeness.
Prepare the comments for the post-market surveillance review.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Incomplete complaintDPL

Analyse this complaint: list the missing information essential to the assessment (product, batch, date, circumstances, consequences for the patient) and write an email to the reporter to obtain it.

Sorting the day’s complaintsDPL

Sort the complaints received today (attached, anonymised) by criticality, completeness and nature. Flag those that may require a vigilance report.

The reporting decision remains human and follows the regulatory deadlines.

Failure modesDPL

Based on this complaint, identify the possible failure modes, their probable causes and the preventive actions to consider.

Field safety notice (FSN)DPL

Write a clear draft field safety notice for users: product and batches concerned, risk identified, actions to take, contacts.

Regulatory and quality approval before distribution, in liaison with the competent authority.

PMS reviewDPL

Analyse the attached post-market surveillance data: trends, weak signals, comparison with the previous period. Propose the comments for the review.

Use cases to propose

Completeness check and sorting of incoming complaintsDPL
Risk and failure mode analysis from a complaintDPL
Preparing field safety notices and the PMS reviewDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Patient and complaint data: validated tool only.
Reporting deadlines remain the manufacturer’s responsibility.

Indicators to track

Time to complete a complaint file
Complaint handling time

Clinical affairs

This week

Summarise articles for the clinical evaluation, with the page for each data point.
Spot the biases in an article.
Review an investigation plan to spot inconsistencies.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Data for the clinical evaluation

Summarise the attached articles for the clinical evaluation report: device studied, population, endpoints, performance and safety results, limitations. Give the page for each data point.

Check each data point in the article.

Biases and limitations of an articleDPL

Analyse this article: possible biases, methodological limitations, points to check before citing its results. Present a table: item, risk, effect on interpretation.

Review of an investigation plan

Review this draft clinical investigation plan. List the inconsistencies between objectives, endpoints, sample size and timeline.

Use cases to propose

Literature review for clinical evaluation and post-market surveillance
Critical review of articles before citing themDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

No identifiable patient data.
Every data point cited is checked in the source.

Indicators to track

Literature review time

Market access and reimbursement

This week

Summarise the CNEDiMTS opinions for comparable devices.
List the relevant comparators and justify each one.
Prepare pricing scenarios.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

CNEDiMTS opinions

Analyse the attached CNEDiMTS opinions for comparable devices: expected benefit, improvement in expected benefit, data accepted, criticisms. Then 5 lessons for our dossier.

Check each assessment level in the original opinion.

Relevant comparatorsDPL

Identify the relevant comparators for [device, indication] based on current care and guidelines. Justify each choice.

Pricing scenariosDPL

Build three price and volume scenarios over 24 months for [device] from the attached assumptions. Calculate the revenue and margin for each.

Check the calculations. Assumptions approved by finance.

Use cases to propose

Preparing the reimbursement application dossier
Simulation of pricing scenarios and negotiation argumentsDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Price data in the approved tool only.
Every statement refers to a verifiable source.

Indicators to track

Time to prepare a dossier

Product marketing and communication

This week

Write a product sheet for buyers from the approved documents.
Compare the public documentation of three competitors.
Have a sales document checked for missing statements.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Product sheet for buyers

Using the instructions for use and the attached approved documents, write a product sheet for hospital buyers: use, demonstrated benefits, characteristics, conditions of use. No claim that is not in the documents.

Regulatory approval before distribution.

Check a sales documentDPL

Analyse this draft sales document: missing mandatory statements, claims without references, risky wording. Present a table: passage, issue, proposal.

Competitive analysis

Compare the attached public documentation of 3 competing devices: table of characteristics, claims, strengths and weaknesses.

Editorial calendarDPL

Using the attached emails and materials, create an editorial calendar: dates, themes, channels, owners, for the next three months.

Use cases to propose

Sales documents prepared for approval, with the mandatory statementsDPL
Centralised editorial calendar built from scattered informationDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

No claim that is not in the approved documents.
Regulatory approval before any distribution.

Indicators to track

Approval rounds per document

Sales and tenders

This week

Extract the requirements from a tender specification.
Condense the sales message into three sentences for a short meeting.
Prepare a meeting with a hospital department.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Tender responseDPL

Here is the specification for a hospital tender and our product documents. List each requirement, state whether we meet it with the document reference, and write a first draft of the response. Flag the requirements that are not covered.

Sales and regulatory review before submission.

Sales message in three sentencesDPL

Condense this approved sales message into 3 key sentences for a 5-minute meeting with [contact], without adding any claim.

Test your sales messageDPL

Here is my sales message for a key meeting. Play the role of the buyer: raise the 5 most likely objections, then propose a factual answer to each, taken from the attached approved documents.

Use cases to propose

Responses to hospital tendersDPL
Key account preparation with the history of exchangesDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Prices and terms of the offer in the approved tool only.
Review before any bid is submitted.

Indicators to track

Time to prepare a tender response
Requirements missed per response

Technical service and user training

This week

Create the outline of a training deck from the instructions for use.
Turn a training deck into a ten-question quiz.
List the most frequent faults and the checks to carry out.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Training deck

Using the attached instructions for use, create the outline of a 10-slide training deck for healthcare staff: preparation, use, cleaning, frequent errors, what to do in the event of an incident.

In line with the current instructions for use, approved before distribution.

Training quizDPL

Turn this deck into 10 multiple-choice questions, with an explanation of each correct answer.

Five-point practical sheetDPL

Write a 5-point practical sheet on [device] for users: preparation, use, maintenance, errors to avoid, contact.

Frequent faults

Using the attached service history, list the most frequent faults, their probable causes and the checks to carry out first.

Use cases to propose

Training decks, practical sheets and quizzes from the instructions for useDPL
Fault diagnosis support for technicians

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Every training material stays in line with the current instructions for use.
No patient data in service reports.

Indicators to track

Time to create a training deck
Average duration of a service call

Manufacturing, supply chain and procurement

This week

Compare supplier offers in a table.
Prepare a supplier meeting with the history of exchanges.
Spot products below the stock threshold.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Compare offers

Compare the attached offers in a table: price, lead times, terms, quality commitments, risks. Then propose a reasoned recommendation.

Stock analysisDPL

Analyse the attached stock extract: products below the threshold, grouped by warehouse and by product range. Propose a replenishment plan.

Prepare a supplier meetingDPL

Based on the attached exchanges with [supplier], list the open topics, the commitments made, the delays and the points to obtain during the meeting.

Analyse non-conformities

Analyse the attached list of non-conformities: group by type, workstation and supplier, identify repeats, then the three priority topics to address.

Use cases to propose

Analysis of non-conformities by supplier
Preparing planning meetings (S&OP) with the context of past exchangesDPL
Demand and spare parts forecasting

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Supplier prices and terms in the approved tool only.
The purchasing decision rests with authorised people.

Indicators to track

Time to compare offers
Stock-outs avoided

Legal and compliance

This week

Check a sales email before it is sent.
Compare two versions of a contract.
Remove sensitive information from a message before sharing it.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Check a sales emailDPL

You are a compliance manager. Analyse the email below: unapproved claims, promotional tone, missing mandatory statements. Propose a corrected, compliant version. Email: [text]

Check congress expensesDPL

Compare the attached congress expense report files and attendance sheets. For each healthcare professional, check that the amounts match between the files and that the signature is present. Present a table of anomalies with a recommendation.

Rules on benefits to healthcare professionals and transparency. Named data: approved tool, restricted access.

Remove sensitive informationDPL

Review this message before it is sent. Flag any confidential or personal information and propose a redacted version.

Standard clauses for an AI tool

Draft standard clauses for a contract with an AI tool supplier: no use of data for training, hosting location, sub-processors, security, incident notification, model changes, exit and data portability.

Reviewed by legal before any decision.

Use cases to propose

Checking expense reports and congress attendance sheetsDPL
Compliance check of sales emails before sendingDPL
Compliance checklist drawn from a regulatory textDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Named healthcare professional data: approved tool and restricted access.
Legal advice remains the responsibility of a qualified person.

Indicators to track

Anomalies detected before sending or before payment
Contract review lead time

HR and training

This week

Write a clear job advertisement.
Prepare a set of interview questions.
Turn a training deck into a ten-question quiz.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Job advertisementDPL

Write a job advertisement for the position of [title]: responsibilities, skills, profile sought, what the company offers. Clear tone, with no discriminatory criteria.

Interview questionsDPL

Prepare a list of interview questions for the position of [title]: technical, behavioural and situational questions, with the points expected in the answers.

Training quizDPL

Turn this material into 10 multiple-choice questions, with an explanation of each correct answer.

Onboarding bookletDPL

Summarise this document in two pages for new joiners: the essentials, useful contacts, first steps.

Use cases to propose

Five-point practical sheets and quizzes from training materialsDPL
Onboarding booklet for new joinersDPL
AI training tracks by role

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Screening CVs or evaluating employees with AI: high-risk uses (AI Act, obligations from 2 December 2027). Do not start them without a framework.
No employee or candidate personal data outside the approved tool.

Indicators to track

Time to publish a job advertisement
Pass rate on training quizzes

Finance

This week

Explain the budget-versus-actual variances for a month.
Prepare a financial presentation from a table.
Have a spreadsheet formula written or corrected.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Budget versus actual variancesDPL

Compare the attached budget and actuals: main variances, possible explanations to check, proposed actions. Present a table sorted by variance amount.

Check the calculations.

Contribution by product and by countryDPL

Analyse the margin contribution by product and by country from the attached data. Identify the five main improvement levers.

Spreadsheet formulaDPL

Write the formula that [need]. Explain it line by line and give an example of how to check the result.

Use cases to propose

Profit and loss analysis by product and by countryDPL
Preparing the monthly financial reviewsDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Unpublished financial data: approved tool only.
Check every calculation before sharing.

Indicators to track

Time to produce the monthly reports

8Act

Choosing and prioritising use cases

Managers and project owners

To do

Assess each idea with the grid before launching anything.
Start with the high-priority cases.
Fill in a use case sheet for each case selected.

Before: Explore

Open up access to the tools widely so that everyone can test them and suggest ideas.

Now: Choose

Access is in place. The task now is to focus efforts on a few selected use cases, measured and tracked.

In a mid-sized company, exploration has often already started in some departments. The work is to take stock, compare with a common grid and focus resources.

The six situations where AI adds the most value

Understand complex information

Large volumes of dense text: articles, contracts, reports, technical logs.

Extract what matters for analysis or decision-making.

Example

Test reports, complaint histories.

Generate and compare options

Hypotheses, scenarios, “what if” analyses.

Prepare the analysis; a person decides.

Example

Design options to compare.

Coordinate work

Route, delegate, manage handovers between tools, systems and people.

Reduce administrative effort in complex processes.

Example

Tracking a complaint across departments.

Improve frequent tasks

Repetitive but essential high-volume tasks.

Small gains that add up at scale.

Example

Complaint triage, tender responses.

Speed up a first draft

Writing, analysis or synthesis before human approval.

Shorten timelines while keeping control.

Example

Draft section of the technical documentation.

Explore a new field

Get your bearings fast, gather scattered or incomplete sources.

Understand faster when experience is lacking.

Example

New technology or new market.

Recommended AI use cases for this profile

Sorted by launch horizon. Impact, effort and risk scored from 1 to 3. The numbers refer to the six situations above.

Use case	Functions	Situations	Launch
Meeting minutes and action trackingDPL	All functions	1, 5	0 to 3 months
First drafts of internal documents: procedures, work instructions, presentations	All functions	5	0 to 3 months
Regulatory and standards monitoring with gap analysisDPL	Regulatory, quality	1, 6	0 to 3 months
Compliance checklist drawn from a regulatory textDPL	Regulatory, quality	1, 5	0 to 3 months
Responses to hospital tendersDPL	Sales	1, 4, 5	0 to 3 months
Compliance check of sales emails and documentsDPL	Marketing, sales, compliance	4, 5	0 to 3 months
Training quizzes and practical sheets from existing materialsDPL	Training, service	5	0 to 3 months
Completeness check and triage of incoming complaints, with human approvalDPL	Quality, vigilance	1, 4	0 to 3 months
Question-and-answer assistant on procedures and toolsDPL	All functions	1, 4	3 to 6 months
Searchable quality document base, with sourced answers	Quality	1	3 to 6 months
Consistency check of technical documentation against test reports	Regulatory	1, 5	3 to 6 months
Drafting field safety notices (FSN) and preparing the PMS reviewDPL	Vigilance, regulatory	1, 5	3 to 6 months
Literature review for clinical evaluation and post-market surveillance	Clinical, vigilance	1, 6	3 to 6 months
User training materials based on instructions for use	Service, training	5	3 to 6 months
Coding and testing assistance for software as a medical device	Software R&D	4, 5	3 to 6 months
Risk and failure mode analysis based on a complaintDPL	Quality	1, 2	3 to 6 months
Post-market trend analysis	Vigilance	1, 4	6 to 12 months
CAPA root cause analysis (5 whys) by several agents, each step backed by evidence	Quality	1, 2, 3, 5	6 to 12 months
Plain-language questions on quality data, with the query shown	Quality	1, 4	6 to 12 months
Fault diagnosis support for technical service	Service	1, 4	6 to 12 months
Demand and spare parts forecasting	Supply chain	2, 4	6 to 12 months
Question-and-answer agent for employees during a change	HR, communication	1, 4	6 to 12 months

Cases marked DPL come from the Digital Pharma Lab use case library.

The use case sheet

Template to copy

One sheet per use case, filled in before the use case is declared. It is also used to report a need to the group.

Use case name:
In brief (one sentence):
Current problem: who is affected, at which step, how often, what happens if it fails?
Proposed solution: tool, type of AI (classic, generative, agentic), steps:
Expected results and indicators (baseline / target):
Link with company priorities:
Situations covered (1 to 6, chapter 8):
Target users:
Data used: source, sensitivity, owner:
Risks and measures (legal, security, personal data, quality and compliance, architecture):
Business owner:
Technical owner:
Decision requested:

9Act

Working with AI agents

ManagersAI leads

To do

Start at autonomy level 2: the agent proposes, a person approves.
Go through the checklist before launching an agent.
Name an owner for each agent.

An agent is an AI program that carries out a multi-step task on someone’s behalf. It can:

use tools and knowledge
reason about the task
plan the steps
act within tools
adjust based on feedback

Three ways to work with AI agents

Use

Ready-to-use agents

Supplied by the vendor of the assistant or of business software: in-depth research, data analysis, agents in a CRM or a service management tool.

Approval

No approval for personal use if the agent is approved. Use case approval for business use.

Build

Personal no-code agents

Created by an employee for their own repetitive tasks: preparing meetings, sorting emails, producing a standard report according to their own rules.

Approval

No approval for personal use or limited sharing (for example up to 5 colleagues). Beyond that, or if it supports a business process: approval.

Request

Custom agents

Built by the technical team, a vendor or a service provider when no existing solution meets the need.

Approval

Approval required before building or sharing. Designed with the business team.

For this profile: All three approaches, with one rule: an agent shared beyond a small group, or used in a business process, goes through the AI committee. Limit custom agents to 1 to 3 high-value cases in the first year.

When to build your own agent

Need	Tool
A quick or one-off request	The AI assistant
An in-depth, general analysis: report, dataset	A ready-to-use agent (research, analysis)
A repeated task that needs your own information or rules: your emails, your minutes format	A personal agent

Four levels of autonomy

Assistant
Answers a request. The person does everything else.
Supervised agent
Prepares and proposes. Every action is approved by a person.
Bounded agent
Acts alone on simple, reversible actions, from a closed list. Important actions are still approved.
Autonomous agent
Acts alone across the whole process. To be avoided in regulated processes.

Start at level 2. Do not go beyond level 3 for GxP, quality and vigilance processes, or for any exchange with external parties.

Guardrails

Closed list of permitted actions, minimum rights, read-only by default.
Human approval at key steps.
Log of every step (inputs, tools used, outputs, decisions) so that an action can be reconstructed.
Tests in an isolated environment and dry runs before going live.
Monitoring of behaviour drift over time.
Usage limits: number of steps, retries, budget.
A named owner, and any change of owner recorded in writing.

What changes from a legal standpoint

	Generative AI	Agent
What it does	Produces a draft, a summary or an answer.	Plans and carries out multi-step tasks on someone’s behalf.
Where it stops	At the output. Nothing happens without human action.	When the task is complete, or at a control point.
What it reaches	The content provided, in a single tool.	Tools, systems and connectors, with the access granted.
Who is exposed	The risk lies in how the output is used.	Its actions commit the company and the person responsible for the agent.
The trail	The output kept.	Requests, steps, calls and modified data: all of it can be produced in a dispute.
When legal steps in	Review the draft before sharing it.	Review the design before the agent can act.

An agent has no legal personality: what it does is attributed to the company and to the person responsible for it.
It cannot do more than its owner is authorised to do.
Every output is reviewed and checked before it is used.
Its records (requests, logs, outputs) are documents: retention, audit, disclosure in a dispute.
Drafting carries a low risk. Writing to a system, sending, buying or deciding requires a review.

Before launching an agent

List to copy

List every tool, connector and system the agent touches, and what it can do there.
Identify the data involved. Personal, patient or regulated data: legal and DPO review first.
Name the owner in writing.
If the agent consults websites: check the terms of use, intellectual property and personal data, and keep a list of the sources collected.
Define the human approval points.
Plan testing and monitoring (chapter 10).
With a service provider: settle from the start who owns the outputs, how each party’s data is used and confidentiality, and keep a record of the human contribution.
If in doubt: consult legal early.

10Act

Building a solution

AI leads and technical teams

To do

Validate the problem before choosing a technology.
Take the “Is AI the right answer?” test.
Estimate the cost at real volume, not pilot volume.

For a first custom project: follow the three steps in order, and hand development to a partner if the skills are lacking in-house.

	Enterprise solution	Personal solution
What is built	An application that serves a team or a department, with a risk profile to manage.	A boost to your own productivity, with low or no risk.
Where	Development environments, often with code.	No-code tools, with guardrails already built in.
For whom	A department, the organisation, risky cases.	Yourself, with limited sharing.

This chapter covers enterprise solutions.

The three-step framework

1
Need
What problem needs solving?
- The business need: the process or problem targeted.
- The choice of tool: the type of tool that meets the need.
2
Preparation
What must frame the development?
- Risk and security requirements.
- Cost: the most economical combination of models, tools and infrastructure for the target result.
3
Design
How should the tool be built?
- Architecture and orchestration.
- Data sources.
- AI model.
- System integrations.
- Evaluations (for agents).

Step 1. Define the problem clearly

The problem

Which user, process or decision is affected?
Where does the process get stuck? What triggers the problem, and how often?
What does failure look like: delay, wrong decision, workaround?

The current process

Are all the steps necessary? Can steps, or tools, be removed?
Would redesigning the process be enough to solve the problem?
Is the process going to change significantly in the short term?

The target situation

What outcome does the solution enable? Is it measurable: time saved, quality?
Is the impact broad enough to last?

If an answer is missing, review the problem and the expected value with the business team before choosing a technology.

Test

Is AI the right answer?

Question 1. Does the case have at least one feature that AI is built for?Unstructured or mixed inputs (text, images, audio, documents) that conventional tools cannot handle.A need to interpret, write or reason, beyond a search, a calculation or rules.Ambiguity or edge cases that rules do not cover.A sequence of steps to coordinate across several systems.

Question 2. Are the conditions in place for AI to work?The data needed is available, accessible and of sufficient quality.An expert is available to validate the outputs and give feedback.The decisions and outputs of the process are compatible with AI support.The expected value exceeds the planned cost (build and run), estimated with the product owner.

Tick the boxes that apply: the result appears here.

Reuse, buy or build

Step 2. The five families of risk

Family	Scope	Questions to ask
Legal and regulatory	Comply with the rules, contracts and intellectual property.	How do you frame a service provider that builds the tool? Which internal and external data can be used to feed or train the tool?
Security	Protect tools and data against unauthorised access and attacks.	Who has access to what, and how is access managed? How does the tool withstand AI-specific attacks: jailbreaking, prompt injection? How are the connections between systems secured? How is security monitored throughout the tool’s life? Which models are approved?
Personal data	Process data according to its sensitivity.	Which sources can the tool use, and which are excluded? How is sensitive data protected? Where are the tool and its data hosted? How long is the data kept?
Quality and compliance	Ensure the accuracy and reliability of outputs for the decisions they inform.	How are accuracy and traceability ensured? How is performance monitored over time? Where does human approval come in?
Architecture	Follow standards and control long-term costs.	Why are these technical choices necessary? Are they aligned with the company’s standards?

Security

AI-specific attacks

Data leakage through prompt injection: instructions hidden in a document or web page hijack the tool.
Reconstruction of training data or sensitive data from the answers.
Corrupted training data (poisoning), manipulation of outputs, hidden access in the model (backdoor).

What security checks

A full description of the data used, the source systems and the guardrails.
Architecture diagrams showing data flows and their protection at each point.
Use of verified and approved models.
Supplier assessment and security clauses in the contract.
Data encryption (in transit and at rest), key management, role-based rights, monitoring, source validation, hosting location, where human approval sits.

Common mistakes

Diagrams or files that lack detail.
Proposed measures that do not fix the identified weakness.
Moving from a trial to production without an evaluation.
Data sources with no owner and no access control.

Cost

The cost of AI is mostly variable: it increases with every use. The choices that weigh most on cost are made at the design stage.

Model and compute

The model tier and the price paid for each use (different prices for input and output).

Volume per exchange

The amount of text sent (instructions, context, retrieved documents) and produced with each call.

Orchestration

The number of calls to the model and tools per task, chained steps, retries.

Usage

The number of users, how often they interact, load peaks.

Data and infrastructure

Indexing and storing documents, data preparation, hosting.

Operations

Monitoring, evaluations, guardrails, maintenance.

What is a token? A token is a fragment of a word. Models read and write in tokens, and every token is billed, for input as well as output. Output usually costs more, because producing an answer takes more computing.

Cost of one exchange = input tokens × input price + output tokens × output price (prices quoted per million tokens).

The model chosen sets the price. The architecture sets the volume: amount of context sent, number of calls per task. An overly heavy design can cost several times more than a lean design, for the same result.

Cost calculator

Assistant that answers from a document base

Example values, to be replaced with your volumes and the prices of your supplier.

Requests per month

Default design

Most powerful model. All available context.

Tokens sent per requestTokens generated per requestInput price (€ per million tokens)Output price (€ per million tokens)

Cost per request€0.0875

Cost per month€4,375

Lean design

Model suited to the task. The 10 most relevant passages.

Tokens sent per requestTokens generated per requestInput price (€ per million tokens)Output price (€ per million tokens)

Cost per request€0.0080

Cost per month€400

The lean design costs 11 times less, a difference of €3,975 per month, for the same service.

Reducing cost without losing quality


Model	Choose an approved model suited to the task. Give simple sub-tasks (classifying, extracting) to lighter models. Check that a frontier model really improves the result before adopting it.
Volume	Send the model only useful information. Ask for the shortest answer that is still useful. Remove anything that consumes tokens without adding value.
Orchestration	Choose the simplest execution pattern. Limit any loop. Avoid redoing work already done.
Usage	Estimate the cost per exchange early and project it to real volume, not pilot volume. Set usage limits before a broad rollout. Track costs continuously.
Data	Use standard connectors rather than custom ones. Batch calls to databases.

Step 3. Design principles

Architecture and orchestration

Start with a single agent and its tools. Move to several agents only if the task splits into truly independent sub-goals.
For regulated processes (GxP, quality, vigilance): a fixed, predictable flow, where AI only steps in at specific points and the rest follows written rules.
Use the components provided by the platform before building your own.

Data

Leave data where it is and access it through controlled connectors, rather than copying it.
Keep the model in the same hosting region as the data.
No direct access from an agent to a database: everything goes through a controlled connector.

Model

Use approved models, never an uncontrolled model.
Route all model calls through filters: content, personal data, compliance.
Record and approve any model change in production.

Integrations

Connect agents to tools through a standard protocol (for example MCP), via a single gateway, with no direct point-to-point connections.
Use an agent-to-agent standard (A2A) when several agents work together.
No shared or hard-coded credentials: each agent has its own identity and acts with the user’s rights.

Include these principles in the specifications of every project.

Evaluating an agent

Why

An agent does not always give the same result: the same request can follow different paths.
Quality is not only about the final answer: it also depends on the tools used and their order.
A single non-compliant action can be enough to create a GxP or quality issue.
A change of model, instructions or tool can degrade performance.

Three types of evaluation

Rule-based tests

A program checks the output: expected format, mandatory field, exact value.

The output is right or wrong and the score must be reproducible (compliance, GxP).

Evaluation by another AI

A model different from the one tested scores each run against a rubric.

Quality is more subjective (tone, reasoning), or there are several good ways to do it.

End-state check

The system is checked to confirm the expected effect happened: document created, status changed.

Success shows up in a tool and must be reproduced identically.

Build a set of test cases at design stage, and rerun it with every change of model, instructions or tool.

A single agent or dedicated agents

A single agent that learns skills

Strengths

Extensible: no new agent to create
A single governance interface

Limitations

Less predictable flow
Identical behaviour harder to guarantee

Best for: Broad uses and productivity.

A dedicated agent per process

Strengths

Predictable and auditable
Identical flow on every run

Limitations

Higher cost per process
Risk of agent proliferation

Best for: Regulated processes (GxP, quality, vigilance) and risky situations.

Commitments of the solution owner

Use approved platforms and tools first.
Follow the company’s reference architectures.
Have the use case approved and incorporate the reviewers’ comments.
Follow the development lifecycle and standards: testing, reviews, releases, IEC 62304 for software as a medical device, validation of quality management system software.
Assess and maintain the legal, quality, personal data, security and compliance requirements.
Manage the whole lifecycle: development, testing, deployment, maintenance.
Track the cost-to-value ratio at scale.
Record the tool or agent in the company register.
Know chapters 1 to 9 of this playbook.

11Act

Practical examples

Everyone

To do

Find the example closest to your activity.
Reuse its structure to describe your own case.
Reuse its points to watch as well.

Examples described with the same sheet as in chapter 8. Examples marked DPL come from the Digital Pharma Lab use case library and client engagements, in anonymised form. The others describe industry practice. “Typical cases” are scenarios built for this profile.

Completing and triaging incoming complaints

DPL

Every morning, the assistant checks that new complaints are complete, drafts the emails to the reporters and proposes an order of handling.

Problem: Incomplete complaints hold up the assessment and follow-ups are done by hand, with a risk of delaying a vigilance report.
Solution: The assistant lists the missing information (product, batch, date, circumstances, consequences for the patient), drafts the email to the reporter and ranks the day’s complaints by criticality, completeness and type.
Users: Quality, vigilance, customer service.
Results: Complete files sooner.
Critical complaints handled first.
Less manual data entry and follow-up.
Situations: 1 · Understand complex information4 · Improve frequent tasks
Points to watch: Tool validated for the quality management system. The reporting decision remains human and follows the regulatory deadlines.

Analysing the risks of a complaint and anticipating failures

DPL

For a given complaint, the assistant prepares the risk analysis: possible causes, effects on patients and users, failure modes, actions.

Problem: Risk analysis often starts from a blank page and depends on each analyst’s experience.
Solution: The assistant proposes possible causes, impacts, failure modes to examine and preventive actions, based on the complaint history and the product’s risk analysis.
Users: Quality, engineering, vigilance.
Results: A structured first draft in a few minutes.
More consistent analyses between analysts.
Failure modes overlooked less often.
Situations: 1 · Understand complex information2 · Generate and compare options
Points to watch: Proposal to be approved by the quality manager. Consistent with the risk management file (ISO 14971).

Drafting a field safety notice and preparing the PMS review

DPL

The vigilance team prepares its field safety notices and its post-market surveillance review comments faster.

Problem: Field safety notices must be clear and fast, and the PMS review requires analysing large volumes of data.
Solution: The assistant drafts a structured field safety notice (product, batches, risk, actions, contacts) and analyses PMS data to spot trends and weak signals.
Users: Vigilance, regulatory affairs, quality.
Results: Draft notices ready for approval.
Trends spotted earlier.
A better documented review.
Situations: 1 · Understand complex information5 · Speed up a first draft
Points to watch: Regulatory and quality approval before any release, in liaison with the competent authority.

Responding to hospital tenders

DPL

The assistant extracts the requirements from the tender specifications and prepares a first draft response from the approved documents.

Problem: Each tender means reading long specifications and finding the evidence across many documents.
Solution: The assistant lists the requirements, finds the response elements in the approved documents, writes a first draft and flags requirements that are not covered.
Users: Sales teams, sales administration.
Results: A faster first draft.
Fewer missed requirements.
More time for pricing and response strategy.
Situations: 1 · Understand complex information4 · Improve frequent tasks5 · Speed up a first draft
Points to watch: Commercial and regulatory review before submission.

An assistant for questions about procedures

DPL

Teams ask their questions about a process or a tool and get an answer that cites the procedure in force.

Problem: The same questions keep coming back to the quality and regulatory teams.
Solution: An assistant queries only the approved procedures and work instructions, answers by citing the document and section, and refers to an expert when no answer exists.
Users: All teams, quality, regulatory.
Results: Fewer repetitive requests.
Answers consistent with the procedures in force.
Documentation gaps spotted.
Situations: 1 · Understand complex information4 · Improve frequent tasks
Points to watch: Document base kept up to date. Tool validated if it is used in the quality management system.

Stress-testing a strategic decision before making it

DPL

A division head tests a project before launching it: possible causes of failure, competitor reactions, preventive actions.

Problem: Project risks are often examined too late, once the decisions have been made.
Solution: The assistant runs a pre-mortem (the project failed a year from now: why?), simulates a competitor’s likely strategies and proposes preventive actions.
Users: Division heads, executive committees.
Results: Risks identified before the decision.
Prepared responses to competitor reactions.
A more robust action plan.
Situations: 2 · Generate and compare options6 · Explore a new field
Points to watch: Strategic information in the approved tool only.

Analysing the root causes of a complaint with three agents

Three agents work together to prepare the CAPA root cause analysis using the 5 whys method, from quality management system data.

Problem: Root cause analysis by hand is slow, varies from one author to another and often stays superficial, so problems come back.
Solution: A first agent gathers the context (procedures, classifications). A second retrieves the records and attachments. A third works through the 5 whys and writes the summary.
Users: Quality teams, CAPA owners.
Results: Much less time spent documenting root causes.
Each “why” backed by a record.
A human review, refined with follow-up questions.
Situations: 1 · Understand complex information2 · Generate and compare options3 · Coordinate work5 · Speed up a first draft
Points to watch: Validated tool (ISO 13485). Fixed flow, human approval.

Managing documents and tracking regulatory changes

AI compares internal procedures with new requirements and tracks regulatory notifications.

Problem: Analysing the gap between a new requirement and hundreds of documents takes weeks.
Solution: The tool compares the documents with the requirements, flags the gaps and prepares an action plan.
Users: Regulatory, quality.
Results: Much shorter gap analysis time.
Better compliance with each country’s regulations.
More complete monitoring.
Situations: 1 · Understand complex information6 · Explore a new field
Points to watch: The tool flags, the team decides.

Testing software or a platform

Agents write the test materials and generate the test code.

Problem: Testing large volumes of functions and data by hand is slow, costly and lets defects through.
Solution: One agent writes the first drafts of the test materials, another generates the code. Testing starts earlier, in parallel with development.
Users: Software development teams.
Results: Defects spotted early.
Test scripts that adapt to changes.
A faster launch.
Situations: 4 · Improve frequent tasks5 · Speed up a first draft
Points to watch: For software as a medical device: IEC 62304, human review of the tests.

Preparing the clinical evaluation

Typical case

AI helps screen and summarise the literature for the clinical evaluation report and post-market surveillance.

Problem: The literature review ties up scarce experts for weeks.
Solution: The assistant pre-screens the abstracts and extracts performance and safety data into a table, with the page for each data point.
Users: Clinical affairs, vigilance.
Results: Faster screening.
Consistent extraction tables.
More time for expert analysis.
Situations: 1 · Understand complex information6 · Explore a new field
Points to watch: Every data point checked in the source article.

12Deploy

Training and engaging teams

ManagementManagersHR

To do

Make the basic training mandatory for everyone.
Organise one hands-on workshop per role.
Keep a record of the training completed.

Learning tracks

Track	Who for	Content	Format
Foundation for everyone	All employees	Basic concepts, company rules, simple uses, risks and ethics.	2 to 3 hours, online or in a workshop. Mandatory before access to the tools.
Role-based tracks	Each department	Use cases and prompts for the role, exercises on real documents, mistakes to avoid.	Half a day to a full day, as a hands-on workshop.
Managers and executives	Executive committee, managers	Steering the programme, choosing priorities, managing risks and ethics, supporting teams.	Half a day, then regular check-ins.
AI champions	Volunteers appointed in each team	Advanced uses, personal agents, community management, reporting needs.	A programme over several weeks, with recognised dedicated time.
Solution builders	Technical teams, AI leads	Building, security, agent evaluation, cost control (chapter 10).	Technical track, partly with the vendors.
Cross-functional innovation workshops	Several departments	Working together on shared problems and surfacing use cases.	One-off workshops, once or twice a year.

For this profile: In a mid-sized company: a mandatory foundation, role-based tracks and a network of AI champions, with recognised dedicated time.

Formats that work

Hands-on, collaborative workshops by role, on real documents
Short on-demand online modules
Regular question-and-answer sessions
A shared prompt library, kept up to date
An internal assistant that answers questions about the policy and this playbook
Upskilling objectives built into annual reviews

Four formats tested by Digital Pharma Lab with clients

Short webinars on the company’s tool

45 minutes of demonstration and 15 minutes of questions. A first one on the interface, email and meetings, a second one on content creation (presentations, spreadsheets) applied to the teams’ action plans.

Hands-on workshops by role

Participants work on their own documents and leave with prompts and use cases adapted to their role.

Learning by doing for a team

Half a day on the basics, then a day of practice. The team leaves with its own agents and roadmap, after a short demonstration to its peers.

One-to-one session for an executive

Strategic scoping, pre-mortem, competitive simulation, and a custom assistant for their business unit.

Engaging teams

Communicate

A message from management: why, which rules, what support.
Concrete examples by role and internal testimonials.
A single channel for questions and feedback.

Address concerns

“AI is going to replace my job”

Present AI as a first-draft tool: the person keeps the analysis and the decision.

“I’m afraid of making a mistake”

Clear rules, a “green light” test and an AI lead to ask.

“I don’t have time”

Dedicated time for training, and use cases chosen to save time quickly.

Keep a record of training, materials and awareness actions: these are the measures expected under Article 4 of the AI Act.

13Deploy

Roadmap and indicators

ManagementAI lead

To do

Tick off the roadmap actions as you go.
Measure before launching each use case.
Review the portfolio every quarter.

Indicators to track

Family	Indicators
Adoption	Share of employees trained Monthly active users Uses per department
Efficiency	Time saved per task, measured before and after on a sample Process lead times: complaint handling, CAPA closure
Quality	Share of AI outputs corrected before use Errors found during review
Compliance	Incidents: data leak, non-compliant use Share of uses declared in the register
Value and costs	Cost per user and per use case Estimated value compared with cost Use cases in production

Measure before you launch: without a baseline, no gain can be proven.

14Appendices

Glossary

Everyone

The 50 terms used in this playbook. Each term links to its definition, on the glossary page.

15Appendices

Going further with Digital Pharma Lab

Digital Pharma Lab supports pharmaceutical companies and medical device manufacturers with their AI programme, from scoping to rollout.

AI diagnostic

Review of uses, tools, governance and compliance, then prioritisation of use cases with the grid in this playbook.

Talk to our team

Training and workshops

Hands-on, collaborative workshops by role, from the foundation for everyone to advanced tracks, with a diagnostic before and an impact measurement after.

See DPL Academy

AI Compass

AI strategy and governance platform for pharmaceutical companies: regulatory compliance audit, continuous strategy steering, tracking of tool rollout and return on investment measurement.

Discover AI Compass

70+clients supported

12+experts

9years of experience

150+innovation projects

Deployment of the playbook in the company

Deployment of the playbook in the company with DPL support.

Ask about the use case & prompt kit

Contact

Lilian Reversat, Digital Healthcare Manager

lreversat@digitalpharmalab.com

Talk to our team

Digital Pharma Lab

4/6 Cité Monthiers, 75009 Paris, France

AI playbook for mid-sized medical device manufacturers

Profile essentials

Typical situation

Common mistakes

The three priorities

Set up simple governance

Roll out a company AI assistant for everyone

Move 3 to 5 cases into production within the year

To start in the next two weeks

Role by role: what to do

Understanding AI

Classic AI

Generative AI

Agentic AI

Automation or agent?

The four levels of value

Products and patients

Business processes

Team efficiency

Foundations

What AI does well

What calls for caution

The rules of the game

Before you start

Read and accept the AI usage policy

Complete the basic training

Declare your use case

Can this use start without approval?

An AI committee, a fast track and a standard track

Declare

Business review

Expert review

Clearing reservations

AI committee decision

Who does what

AI usage policy template

The regulatory framework

Key dates

For all healthcare companies

AI Act: the European regulation on AI

GDPR and health data

Health data hosting (HDS, France)

HAS good practice (France)

Specific to medical devices

Devices that include AI: MDR/IVDR and the AI Act

AI used in the quality management system

Vigilance and post-market surveillance

Software as a medical device

Communication and documents given to healthcare facilities

Sources consulted

Choosing the tools

Three families of tools

AI for everyone

AI built into business software

Custom AI

The rule: reuse, then buy, then build

Reuse

Buy

Build

Which tool for which need

Tools for this profile

Choosing a supplier: ten control points

AI in everyday work

The five basic uses

Rewrite

Summarise

Find ideas

Write

Analyse

Writing a good prompt

Where AI saves the most time

First drafts

Finding information

Handling email

Complex tasks

Meetings

The golden rules

Learn

Verify

Estimate