AI playbook for pharmaceutical and biotech SMEs and start-ups

1Understand

Profile essentials

ManagementManagers

Typical situation

A small team, often without a dedicated IT department. Several activities are outsourced: CRO, contract manufacturer, pharmacovigilance provider, distribution depot.
Employees already use consumer AI tools, with personal accounts and no common rules.
The first needs are about writing and checking documents: regulatory dossiers, quality procedures, scientific monitoring, funding applications.
Budget and time are limited: each tool must be useful quickly and to several people.

Common mistakes

Pasting patient data, pharmacovigilance data or confidential information into a free tool.
Using AI-generated text in a regulatory or promotional document without review or approval.
Buying several tools that do the same thing.
Starting a custom development before making use of the tools already available.

The three priorities

Put rules around existing uses
A short AI usage policy, a secure business tool and an end to personal accounts for work.
Train the whole team and appoint an AI lead
A 2 to 3 hour basic training for everyone. The AI lead keeps the register of uses and answers questions.
Choose 3 quick-win use cases
Measure them before and after, then extend the ones that work.

To start in the next two weeks

List the AI tools used in the team (5-minute questionnaire).
Share the AI usage policy (template in chapter 3).
Choose an AI assistant under a business licence, with a contract that excludes the use of your data to train the models.
Appoint the AI lead and open the register of uses (a spreadsheet is enough).
Schedule the basic training for the whole team.

Role by role: what to do

Role	To do	Chapters
Management	Set three AI priorities for the year and the related budget. Appoint the AI lead and give them time for the role. Ask for a quantified review every quarter: use, time saved, costs, incidents.	4 8 13
Managers	Choose with the team two uses from the role sheet to test this month. Free up two to three hours per person for the basic training. Report every use case idea with the use case sheet.	7 8 12
All employees	Read the policy and complete the basic training. Use only the approved tool, with your business account. Try the prompts on your role sheet and share what works.	3 6 7
AI lead	Keep the register of uses and answer approval requests. Run a monthly sharing session with the team. Track the indicators and update the policy every quarter.	3 5 8 13
IT and security	Configure the approved tool: access, rights, logging. Control or block unapproved AI tools. Check every supplier against the ten control points.	5 9 10
DPO, legal and compliance	Approve the policy and the clauses in supplier contracts. Carry out the necessary data protection impact assessments. Check HR uses and promotional content prepared with AI.	3 4 9
Quality, regulatory and responsible pharmacist	List the AI tools used in GxP processes. Define risk-proportionate validation for these tools. Build the use of AI into the relevant procedures.	4 9 10

In chapter 7, every employee finds the sheet for their role: three uses to start this week, ready-to-use prompts and points to watch. In an SME, one person often holds several roles: the AI lead reads the whole playbook to drive the approach.

2Understand

Understanding AI

Everyone

To do

Identify which type of AI each planned use falls under.
Aim for level 2 first: team efficiency.
Review every output: a well-written answer is not necessarily a correct one.

Three families of AI coexist. They are not used for the same things and do not call for the same controls.

Classic AI

A person sets the question, the AI analyses data.

Input: Numerical and structured data
Output: Forecasts, scores and alerts that support a human decision
Autonomy: None: it informs a decision

Use it for

Analyse structured data
Predict an outcome or a value
Classify or score at scale
Spot trends or anomalies

Example

Forecasting demand for a medicine, spotting drift on a production line.

Generative AI

A person interacts with the AI, which produces new content.

Input: Text, images, documents, audio
Output: Drafts, summaries, translations, answers
Autonomy: None: it responds to a request

Use it for

Write new content
Summarise unstructured information
Answer from a document base
Interpret freely worded requests

Example

Writing the first draft of a procedure, summarising a scientific article.

Agentic AI

A person sets a goal and rules, the AI chains the steps needed to reach it.

Input: A goal, and access to tools, data and systems
Output: A sequence of actions and decisions across several systems
Autonomy: It acts on its own within set limits and adjusts to feedback

Use it for

Chain several steps without intervention at each one
Take on a whole process, with control points
Coordinate actions across tools, systems and people
Handle repetitive tasks in volume

Example

Preparing a dossier: gathering the source documents, drafting, checking the references, sending it for approval.

Automation or agent?

A scheduled task remains automation as long as a person has set the logic, the scope and the control points. It becomes an agent when the AI chooses its own steps and tools, and acts without review at each step. The difference changes the controls you need (chapter 9).

Automation

Every Monday, a sales summary is produced from validated data, using a fixed presentation template, then sent to an approved distribution list.

Agent

A program spots a sales trend, decides to adjust a campaign, prepares the actions in several systems and launches them.

The four levels of value

Value increases at each level, but each level rests on the ones below.

Products and patients

New products or services that include AI, for patients and healthcare professionals.

Business processes

Speeding up research, development, manufacturing, quality and commercialisation.

Team efficiency

Saving time on everyday tasks: writing, searching, summarising, analysing.

Foundations

Reliable and accessible data, secure tools, clear rules and skills.

For this profile: First year: consolidate levels 1 and 2, then one first targeted case at level 3.

What AI does well

Summarising, rewording and structuring a text
Comparing two versions of a document
Extracting information from long documents
Suggesting options, outlines, questions
Translating and adapting to an audience
Writing or explaining simple formulas and code

What calls for caution

Figures, units and calculations: always check
Bibliographic references: AI can make them up
Recent information: only if the tool is connected to up-to-date sources
Medical, regulatory or quality decisions: AI prepares, a person decides
Topics with no reliable source: the answer can be wrong and convincing

A well-written answer is not necessarily a correct one.

3Govern

The rules of the game

Everyone

To do

Share the policy and have every user accept it.
Put every new use through the “green light” test.
Declare to the AI lead any use that goes beyond personal efficiency.

Before you start

Read and accept the AI usage policy
It sets the approved tools, the prohibited data and the review rules. It also covers image creation and the recording or transcription of meetings.
Complete the basic training
Key concepts, benefits, risks and ethical questions. Access to the tools depends on it.
Declare your use case
As soon as a use goes beyond your own work (writing, summarising, searching for yourself). The test below tells you.

Green light test

Can this use start without approval?

Tick each condition that is met. All seven are needed to start without approval.

The tool is an AI tool approved by the company, used with a business account.The use is only for personal efficiency: writing, summarising, searching for yourself.The data used is internal and allowed in this tool, with no health data and no patient data.No GxP data is used: manufacturing, quality control, clinical trials, pharmacovigilance.The output does not commit other people and does not support a business, regulatory or medical decision.The company has the right to use the data given to the tool: licences, contracts, partner confidentiality.The output does not need intellectual property protection (patent, copyright).

The result appears here as soon as the first box is ticked.

A short process, run by the AI lead

Declare
One line in the register of uses or a short form: need, tool, data, people involved.
AI lead’s opinion
Within 48 hours. Together with the head of quality or regulatory affairs as soon as GxP or regulatory data is involved.
Decision
The CEO decides if a significant budget or risk is at stake.
Register update
The approved use is recorded with its conditions: tool, allowed data, mandatory review.

Fast track

No committee: the AI lead approves low-risk trials directly, then reports to the executive committee every quarter.

Good to know

In an SME, one person often holds several roles. The AI lead can be the head of quality, the CFO or the digital lead. The DPO can be external.

The more precisely the declaration describes the use case, the faster the approval.

Who does what

Role	Responsibilities
Executive management (sponsor)	Sets the ambition, decides priorities and budget, leads by example.
AI lead or head of AI	Runs the programme, keeps the register, advises teams, prepares decisions.
IT and security	Chooses and secures the tools, manages access, monitors use.
DPO	Checks GDPR compliance, carries out data protection impact assessments.
Quality, regulatory and responsible pharmacist	Assesses the GxP impact, approves tools used in regulated processes and content intended for external audiences.
Legal and compliance	Supplier contracts, intellectual property, communication rules, liability linked to agents.
Managers	Spot use cases, free up time for training, track results.
AI champions	Help their colleagues, share good practice, report needs.
Every employee	Follows the policy, checks the outputs, reports errors and incidents.

AI usage policy template

Template to copy

Use only AI tools approved by the company, with your business account.
Never enter patient data, identifiable health data or pharmacovigilance data into a tool that is not approved for that data.
Do not enter confidential information (strategy, prices, partner data, unpatented inventions) outside the tools approved for that level of confidentiality.
Check every output before using it: facts, figures, units, product names, references.
Keep the decision human: AI proposes, a competent person approves, especially for medical, regulatory, quality and promotional content.
Send any content intended for external audiences through the usual approval process: promotional information, medical information, documents submitted to authorities.
Clearly disclose the use of AI when the law requires it: conversational agent, realistic image, audio or video, avatar, synthetic voice.
Declare any use that goes beyond personal efficiency (“green light” test).
Tell participants before recording or transcribing a meeting, and respect their refusal.
Report any error, data leak or abnormal tool behaviour to the AI lead.

Prohibited by the AI Act since 2 February 2025: inferring employees’ emotions from biometric data (voice, face), except for medical or safety reasons.

4Govern

The regulatory framework

ManagementAI leadsQuality and legal

To do

Train teams and keep a record of the training (AI Act, Article 4).
Disclose any conversational agent and any realistic content produced by AI.
Have any promotional content prepared with AI approved through the usual process.

European and French framework checked on 16 October 2026. This chapter gives practical guidance for action. It does not replace legal or regulatory advice.

Key dates

2 February 2025AI Act: prohibited practices and AI literacy obligation.In force
16 May 2026HDS (France): end of the transition to the new certification framework.In force
27 July 2026AI Act: entry into force of the Digital Omnibus on AI.In force
2 August 2026AI Act: transparency obligations (Article 50).In force
Date to be confirmedGMP: publication of the final version of Annex 22 on AI.Upcoming
2 December 2027AI Act: Annex III high-risk systems, including HR uses.Upcoming
2 August 2028AI Act: high-risk systems built into regulated products.Upcoming

For all healthcare companies

AI Act: the European regulation on AI

In force

Regulation (EU) 2024/1689, amended by the “Digital Omnibus on AI” Regulation (EU) 2026/1744, in force since 27 July 2026.

Already applicable: Prohibited practices since 2 February 2025. An example that concerns companies: inferring employees’ emotions from their voice or face, except for medical or safety reasons.
Already applicable: AI literacy (Article 4), rewritten by the Omnibus: the company takes measures to develop the AI skills of its staff and of people who use AI on its behalf. It does not have to guarantee a specific level, but must be able to show what it has put in place: training, materials, policy.
Since 2 August 2026: Transparency (Article 50): tell people they are interacting with an AI, disclose realistic images, audio and video produced or altered by AI (avatars, synthetic voices), and disclose texts published to inform the public on matters of public interest, unless there is human review under editorial responsibility.
2 December 2027: High-risk systems in Annex III. In a pharmaceutical or medical device company, this mainly concerns human resources: screening job applications, evaluating or monitoring employees.
2 August 2028: High-risk systems built into regulated products (Annex I), including medical devices assessed by a notified body.

To do

Keep a record of training, materials and the policy (Article 4).
Clearly state that it is an AI on any conversational agent open to employees, customers or the public.
List HR uses now (screening applications, evaluating employees) ahead of the 2 December 2027 deadline.

The company’s role changes its obligations. It is most often a “deployer”: it uses an AI system supplied by a third party. It becomes a “provider” if it develops an AI system or places it on the market under its own name.

GDPR and health data

In force

Health data is sensitive data. Using it in an AI tool follows the usual GDPR rules, with extra care.

Legal basis and data minimisation: Use only the data needed, anonymise or pseudonymise where possible, inform the people concerned.
Impact assessment: To be carried out with the DPO before large-scale processing of health data or a new high-risk use.
Contract with the supplier: Data processing agreement (Article 28), list of sub-processors, place of processing, retention period.
CNIL (France): The French data protection authority’s recommendations and practical guides on AI and GDPR are a reference for projects that use personal data.

To do

Have the DPO approve any use that involves personal data.
Anonymise or pseudonymise data before giving it to the tool, where possible.
Check the data processing agreement before signing with a supplier.

Health data hosting (HDS, France)

In force

In France, a provider that hosts health data on behalf of a third party must be HDS certified.

Current framework: Published in the French Official Journal on 16 May 2024: physical hosting of data in the European Economic Area, and transparency about the risks of access from a non-EU country.
End of transition: Hosts already certified had until 16 May 2026 to comply with this framework.
In practice: Before entrusting health data to an online AI tool, check the host’s HDS certification and the hosting location.

HAS good practice (France)

Recommendation

Guide “Premières clefs d’usage de l’IA générative en santé” (first keys to using generative AI in healthcare), published by the French National Authority for Health on 30 October 2025 for healthcare professionals.

A.V.E.C. method: Learn (understand the tool and its confidentiality rules), Verify (check every piece of content, especially figures, units and drug names), Estimate (track quality over time), Communicate (share practices and stay transparent).
Use: A shared basis that is useful for medical teams and for exchanges with healthcare professionals.

Specific to medicines

EMA: AI in the medicinal product lifecycle

Recommendation

Reflection paper adopted in September 2024.

Approach: Risk-based: the more AI influences a regulatory decision or patient safety, the stronger the requirements.
Responsibility: The applicant or marketing authorisation holder remains responsible for the data, models and tools used.
Dialogue: Plan early discussion with the agency when AI has a significant regulatory impact.

EMA and FDA: good AI practice principles

Recommendation

10 shared principles for AI in medicine development, published on 14 January 2026. Non-binding.

Content: Human-centred and risk-based approach, defined context of use, data governance, multidisciplinary expertise, management across the whole lifecycle, clear communication about AI systems.
Scope: From research to post-marketing surveillance, including clinical trials and manufacturing.

GMP: draft Annex 22 on AI

Draft

Consultation from July to October 2025. Final version not published as of 16 October 2026.

Critical uses: The draft only allows static, deterministic models for uses that directly affect product quality or patient safety. Generative AI would be excluded for these uses.
Other uses: Outputs supervised by qualified staff.
Related texts: Revisions of Annex 11 (computerised systems) and Chapter 4 of the GMP guide (documentation), carried out in parallel.

To do

List the AI tools used in GMP processes, with their validation status.
Do not hand a decision that directly affects product quality to generative AI.
Follow the publication of the final version and update the procedures.

Pharmacovigilance

In force

AI tools used to process cases or detect signals are part of the pharmacovigilance system.

Requirements: Tool validation, traceability, supervision by a qualified person, documentation in the pharmacovigilance quality system.
Service provider: If pharmacovigilance is outsourced, ask the provider which AI tools it uses and how it validates them.

Promotional information and medical information

In force

Content prepared with AI follows the same process as any other content.

Promotion: Charter on promotional information (France), internal procedures, approval under the responsibility of the responsible pharmacist, ANSM approval where required.
Medical information: Answers based on approved documents, reviewed by a qualified person, with no identifiable patient data outside an approved tool.

Sources consulted

5Govern

Choosing the tools

ManagersAI leads

To do

Choose an enterprise assistant under a business licence.
Reuse before buying, buy before building.
Check the ten control points before signing with a supplier.

Three families of tools

AI for everyone

For

All employees

What

Enterprise conversational assistants and ready-to-use agents: writing, summarising, searching, analysing a file, running in-depth research.

Access

No approval needed for personal use, with a business account.

AI built into business software

For

The users of that software

What

AI features added by the vendor to software already in use: CRM, document management, quality management system, IT service management, development tools.

Access

According to each software’s rules, with approval of the use case.

Custom AI

For

A team, a department

What

Tools or agents built for a specific process that existing tools do not cover.

Access

After approval, with a business owner and a technical owner.

The models of the major AI providers (OpenAI, Anthropic, Google, Mistral, Meta…) run inside these tools. Choose the tool and its guarantees first, then the model.

The rule: reuse, then buy, then build

Reuse
An approved tool already covers the need, or can be extended to close the gap.
The fastest solution, with little development.
Buy
No tool in place fits, but a proven market solution meets the need.
The function is not a competitive advantage. Known cost and speed matter more than customisation.
Build
No existing tool and no market solution does the job.
The use case gives a competitive advantage or will serve several teams over time, and control of the tool justifies the start-up and running costs.

Which tool for which need

Need	Tool
A one-off question, a text to reword or summarise	Enterprise AI assistant
In-depth analysis: monitoring, report, dataset	Ready-to-use research or analysis agent
A recurring personal task that needs your own information: email sorting, standard meeting minutes, formatting rules	Personal agent built without code
One step of a process that runs in business software	AI feature of the business software
A complete business process, shared by a team	Custom agent or tool, after approval

Tools for this profile

Now

An enterprise AI assistant under a business licence for the whole team.
The AI features of the office suite and of the software already in place.

A searchable document base (procedures, approved dossiers), through the assistant or a specialist vendor.

Avoid: No custom development in the first year, unless there is a critical need, and then with a vendor or service provider.

Budget: Order of magnitude: a few tens of euros per user per month for an enterprise assistant. Check current prices.

For GxP teams, favour tools already validated in the quality environment (document management, quality management system, pharmacovigilance database) before adding an external tool.

Choosing a supplier: ten control points

List to copy

Data entered is not used to train the supplier’s models (written clause in the contract).
The hosting location is known, preferably in the European Union; HDS certification (France) if health data is processed.
A GDPR data processing agreement (Article 28) is signed, with the list of sub-processors.
Access is controlled: single sign-on, role-based rights, logging, encryption.
The models used are known, and the supplier gives notice of any model change.
AI-specific protections are described: content filtering, protection against prompt injection.
Exit is planned: export of data, prompts and agents.
The cost is predictable (per-user licence or usage-based), with spend tracking.
Connectors exist for the tools already in place: email, documents, CRM.
The supplier’s security assessment is done (questionnaire, references, certifications).

6Act

AI in everyday work

Everyone

To do

Start with the five basic uses.
Write each request with the six elements.
Apply the golden rules: learn, verify, estimate, communicate.

The five basic uses

Rewrite

Shorten a text, change its tone, adapt it to another audience.

Rewrite this paragraph written for doctors so that a patient can understand it: short sentences, simple words, no information removed. Then list the terms you simplified.

Summarise

Key points of a document, decisions and actions from a meeting, open points in an email thread.

Summarise the attached meeting transcript: points discussed, decisions taken, actions to carry out. For each action, give the owner and the deadline mentioned. Flag what is still to be decided.

Find ideas

Prepare the key points for a meeting, structure your thinking, test your arguments.

Play devil’s advocate. Here is our [initiative] project. List the 5 most likely objections from the executive committee and, for each one, the points to prepare in response.

Write

Emails, memos, first drafts from notes or reference documents, presentation slides.

Using the attached notes, write the first draft of a 2-page scoping note: context, objective, scope, timeline, risks, decisions needed. Factual tone. Flag any missing information.

Analyse

Compare two versions of a document, make use of survey results, spot trends.

Compare the two attached versions of this procedure. Present the differences in a table: section, version 1, version 2, type of change (substance, form, compliance). Then summarise the significant changes and their likely reason.

Writing a good prompt

A good prompt contains six elements. The most important: the data to use and the checks requested.

Element	Role	Example
Role	The point of view expected.	You are a medical affairs manager.
Context	The situation and the purpose.	Preparing an internal meeting on [condition].
Task	What to produce, with a precise verb.	Summarise the 5 attached articles.
Data	The sources to use, and only those.	Only the attached documents.
Format	The form and length of the output.	A table (reference, population, main result, limitations), then a 5-line summary.
Checks	What makes verification possible.	Cite the page for each statement, add nothing that is not in the documents.

Before

Write a summary on disease X.

After

You are a medical affairs manager. I am preparing an internal meeting on [condition]. Summarise the 5 attached articles, using only these documents. Present a table (reference, population, main result, limitations), then a 5-line summary. Cite the page for each statement and add nothing that is not in the documents.

Where AI saves the most time

First drafts
Emails, presentations, minutes, surveys, annual reviews.
Finding information
Finding a file, an email, a presentation, a piece of public data.
Handling email
Summarising a long thread, finding information, spotting actions to take.
Complex tasks
Analysing data in a spreadsheet, turning ideas into a structured document.
Meetings
Minutes, action lists, follow-up email from the transcript.

The gains are clearest when the assistant is connected to the company’s email, calendars and documents: it then works on the user’s real data.

The golden rules

Learn

Know the tool, what it does well, its limits and its confidentiality rules.

Verify

Review every output. Check figures, units, product names and references. Enter nothing confidential outside approved tools.

Estimate

Track quality over time: number of corrections needed, time actually saved.

Communicate

Share good practice with the team and be open about the use of AI.

Method based on the A.V.E.C. guide from the HAS, the French National Authority for Health (October 2025). Basic rule: AI proposes, a competent person decides.

Role-specific prompts are in the role sheets in chapter 7.

7Act

Role sheets

EveryoneManagers

To do

Open the sheet for your role.
Start the three suggested uses this week.
Propose a business use case with the use case sheet (chapter 8).

One sheet per role: three uses to start this week, ready-to-use prompts, use cases to propose and points to watch. Items marked DPL come from the Digital Pharma Lab use case library and client engagements.

Role sheets

Choose a role:

Management

This week

Have a 700-word summary of a file prepared before a committee meeting.
List the likely questions for a strategy meeting and prepare short answers.
Run a pre-mortem on an ongoing project: list the possible causes of failure.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Summary for the executive committee

Write a summary of no more than 700 words of the attached presentation for the executive committee: stakes, options, recommendation, decisions needed.

Project pre-mortemDPL

We are launching [project]. Imagine that, 12 months from now, the project has failed. List the 10 most likely causes, ranked by likelihood and impact, then propose for each one a preventive action to start now.

Competitive simulationDPL

Play the leadership team of a competitor that wants to counter our [project]. Describe its three most likely strategies, then propose our response to each one.

Anticipated questions

I am preparing a strategy meeting with [executive]. Based on the attached documents, list the likely questions on [3 topics] and propose short, executive-level answers.

Use cases to propose

Business unit assistant, fed with its strategic documentsDPL
Preparing a management meeting: short outline, anticipated questions, pre-read documentDPL
Managing the AI portfolio with the impact × feasibility grid

Assess each case with the grid in chapter 8 before launching it.

Points to watch

No confidential strategic information outside the approved tool.
Check every figure used in a summary.

Indicators to track

Time to prepare a committee meeting
Share of AI use cases with a measured result

Medical affairs and medical information

This week

Summarise five articles in a sourced table.
Prepare a discussion with an expert: priority questions and compliance rules.
Spot the biases in an article before citing it.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Literature summary

You are a medical affairs manager. Summarise the attached articles in a table: reference, study type, population, primary endpoint, main result, limitations. Add a 10-line summary. Use only the documents provided and give the page for each piece of information.

Check each reference in the source document.

Biases and limitations of an articleDPL

Analyse this article: possible biases, methodological limitations, points to check before citing its results. Present a table: item, risk, effect on interpretation.

Summary of an expert meetingDPL

Compile the anonymised feedback from the experts who met on [topic]: points of agreement, points of disagreement, key suggestions for the medical strategy, open questions.

Draft medical information answer

Using only the attached reference documents (SmPC, approved standard answers), draft an answer to the following question from a healthcare professional: [question]. Cite the source of each item. Flag if the question falls outside the scope of the documents.

Draft to be approved under the medical information procedure. No identifiable patient data.

Use cases to propose

Medical information sheets written from approved documentsDPL
Mapping of the experts in a field from their publicationsDPL
Draft medical information answers from standard answers

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Every answer to a healthcare professional follows the medical information procedure.
Check every reference: AI can invent them.

Indicators to track

Response time to medical information questions
Time spent per literature summary

Market access and public affairs

This week

Summarise the Transparency Committee opinions for a therapeutic area.
List the relevant comparators and justify each one.
Prepare a summary sheet before an institutional meeting.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Anticipate the HAS opinionDPL

Compare this study with previous opinions of the French National Authority for Health (HAS) in the same therapeutic area: relevance of the endpoints, transferability of the results, comparator chosen. List the points to watch and the elements to strengthen before submission.

Analysis of published opinionsDPL

Analyse the attached Transparency Committee opinions for products in the same field. Table: product, indication, actual clinical benefit, improvement in actual clinical benefit, arguments accepted, criticisms. Then 5 lessons for our dossier.

Check each assessment level in the original opinion.

Negotiation scenariosDPL

Build three price and volume scenarios over 24 months for [product] from the attached assumptions. Calculate the revenue and margin for each, then summarise the arguments to prepare for the negotiation.

Check the calculations. Assumptions approved by finance.

Mapping of public stakeholdersDPL

List the public bodies and departments involved in [topic: funding, regulation, care pathway], with their role and level of influence, based on the attached sources.

Check each stakeholder on the official website.

Use cases to propose

Early assessment of how the HAS will perceive a studyDPL
Simulation of pricing scenarios and negotiation argumentsDPL
First drafts of position papers from public dataDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Price and negotiation data in the approved tool only.
Every statement refers to a verifiable source.

Indicators to track

Time to prepare a dossier or a negotiation

Regulatory affairs

This week

Compare two versions of a dossier section and list the differences.
Summarise the week’s regulatory monitoring on one page.
Turn a regulatory text into a checklist.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Consistency check against sources

Compare this draft document [module, package leaflet, SmPC] with the attached source documents. List in a table each quantified statement: value in the draft, value in the source, source page, status (consistent, discrepancy, not found).

The tool flags, the team decides.

Compliance checklistDPL

Using the attached regulatory text, create a checklist: one line per requirement, with the text of the requirement, the action required, the evidence expected and the owner.

Impact assessment of a changeDPL

Analyse the impact of this regulatory change on our products, procedures and dossiers: what changes, what needs to be adapted, priority (high, medium, low), deadline.

Draft answer to an authority

Here is a question from a health authority and the attached development documents. Write a structured draft answer, with each statement followed by the exact reference of the source document. Flag the points that have no source.

Reviewed and approved by the experts before sending.

Use cases to propose

Assisted drafting of marketing authorisation or variation dossier sections from existing dataDPL
Question-and-answer assistant on regulatory procedures and toolsDPL
Consistency check of documents against their sources

Assess each case with the grid in chapter 8 before launching it.

Points to watch

No unpublished document in an unapproved tool.
Expert review remains mandatory before any submission.

Indicators to track

Time to prepare a variation
Discrepancies detected before submission

Pharmacovigilance

This week

Review a procedure and spot the ambiguous steps.
Summarise the known adverse effects of a substance from public sources.
Prepare the standard outline of a safety report.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Known adverse effectsDPL

Using the SmPC and the attached public documents on [substance], summarise the known adverse effects by frequency and severity, with the reference for each piece of information.

Public sources only. No case data.

Literature pre-screening

In the attached article abstracts, identify those that mention an adverse effect related to [substance]. Table: reference, effect described, population, severity mentioned, exact quote. Draw no medical conclusion.

Only in a tool validated for pharmacovigilance. Assessment by a qualified person.

Procedure review

Review this pharmacovigilance procedure. Flag the ambiguous steps, unassigned responsibilities, unspecified deadlines and inconsistencies with the attached procedure template.

Use cases to propose

Literature pre-screening for pharmacovigilance
First drafts of the descriptive sections of safety reportsDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

No identifiable case data outside a validated tool.
Medical assessment and reporting remain human and follow the regulatory deadlines.

Indicators to track

Literature screening time
Discrepancies found during sample checks

Quality and manufacturing

This week

Write the first draft of a procedure from the template.
Prepare an inspection: likely questions and evidence to gather.
Analyse the findings of an audit by theme.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Root cause analysis (5 whys)

Using the attached deviation description (anonymised), propose a root cause analysis with the 5 whys method. For each “why”, cite the fact in the file that supports it, or write “to be checked”. Then propose corrective and preventive actions.

Proposal to be approved by quality assurance. It does not replace the investigation.

Audit findingsDPL

Analyse the attached audit findings: grouping by theme, probable causes, proposed corrective actions, priority. Present a table.

First draft of a procedure

Write the first draft of a procedure for [activity] following the attached template: purpose, scope, responsibilities, definitions, description, records, references. Flag the information still to be completed.

Prepare an inspection

Based on our attached procedures, list the 15 questions an inspector would probably ask about [process] and the evidence to prepare for each one.

Use cases to propose

Pre-analysis of deviations and CAPAs, with each step supported by evidence
Compliance dashboard built from audits and CAPAsDPL
Searchable quality document base, with sourced answers

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Tools used in a GxP environment: risk-proportionate validation.
The draft GMP Annex 22 excludes generative AI from critical uses in manufacturing.

Indicators to track

CAPA closure time
Time to write a procedure

Clinical development

This week

Summarise a protocol on one page for the sites.
Simplify a patient information leaflet.
List the feasibility questions for the sites.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Protocol summary for the sites

Summarise this protocol for the investigator site teams: objectives, inclusion and exclusion criteria, visit schedule, points of attention. One page at most.

Critical review of a protocolDPL

Analyse this protocol: consistency between objectives and endpoints, statistical assumptions, recruitment feasibility, weak points. List the questions to ask the team.

Patient information leaflet

Simplify this patient information leaflet to a general public reading level, without removing any mandatory information. List all the changes made.

Approval by the clinical team and the ethics committee according to the procedure.

Use cases to propose

Protocol summaries and documents for the sites
Critical review of protocols before review meetingsDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

No identifiable patient data.
Documents for patients go through the ethics committee.

Indicators to track

Time to prepare study documents

Marketing and communication

This week

Turn an approved message into three variants, without adding any claim.
Prepare the outline of a congress presentation.
Have a sales aid checked for missing mandatory statements.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Check a promotional documentDPL

Analyse this draft promotional document: missing mandatory statements, claims without references, risky wording. Present a table: passage, issue, proposal.

Review aid. Approval remains with the regulatory approval process.

Prepare the annual operating planDPL

You are a marketing manager. Propose how to organise the preparation of the annual operating plan for [product]: steps, meetings, contributors, deliverables and timeline up to the presentation to the executive committee.

Cross-functional workshop for the annual planDPL

Design the running order of a one-day workshop that brings together marketing, medical, market access and sales to build the annual operating plan: objectives, sessions, exercises, deliverables expected at the end of the day.

Variants from approved messages

Using the attached approved messages, propose 3 versions of an invitation email to [event] for healthcare professionals. Add no claim that is not in the approved messages.

Internal approval process, and approval by the French medicines agency (ANSM) when required.

Healthcare professional personasDPL

Using the attached aggregated data, propose 3 to 4 healthcare professional personas and, for each one, the most suitable messages and formats.

Aggregated data. No named data without a legal basis.

Use cases to propose

Preparing the annual operating plan and its presentation to the executive committeeDPL
Content prepared for the approval process, with the mandatory statementsDPL
Centralised editorial calendar built from scattered informationDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

No claim that is not in the approved documents.
Internal approval process, and approval by the French medicines agency (ANSM) when required.

Indicators to track

Approval rounds per piece of content
Time to produce a piece of content

Field force and KAM

This week

Prepare a meeting from your notes and the approved documents.
Condense the sales message into three sentences for a short meeting.
Turn your visit notes into a CRM call report.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Sales message in three sentencesDPL

Condense this approved sales message into 3 key sentences for a 5-minute meeting with a [specialty], without adding any claim.

Test your sales messageDPL

Here is my sales message for a key meeting. Play the role of the person I am meeting: raise the 5 most likely objections, then propose a factual answer to each, taken from the attached approved documents.

Regional action planDPL

Using the attached data for my territory, propose the outline of my regional action plan: priorities, targets, actions, timeline, indicators.

CRM call report

Turn my visit notes into a structured CRM call report: context, topics discussed, requests, follow-up actions. Remove any health information about a patient.

Use cases to propose

Preparing regional action plans with the company’s assistantDPL
Five-point congress summary for the teamDPL
Visit preparation and call reports in the CRM

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Use only approved promotional documents.
No patient health data in call reports.

Indicators to track

Time to prepare a visit
Time spent entering data in the CRM

Sales operations and data

This week

Summarise the month’s sales activity on one page.
Cross-reference sales and actions taken to estimate a simple return.
Have a spreadsheet formula written or corrected.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Sales activity summaryDPL

Using the attached extracts, produce a summary of the month’s sales activity: volumes, trend, variances against targets, 3 findings and 3 proposed actions.

Sales and actions takenDPL

Compare sales with the actions taken (visits, action plans, projects) over the period. Calculate a simplified return by type of action and present a table and a chart.

A link between two figures is not proof of cause and effect: discuss the results with the teams.

Team size simulationDPL

Simulate the effect on sales of a 10% increase or decrease in the size of the field team, using the attached data, and comment on the limits of the calculation.

Use cases to propose

National performance summary by therapeutic areaDPL
Situation analysis that cross-references an external study and internal dataDPL
Question-and-answer agent on the sales reference data, shared with the teamDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Aggregated data. No named healthcare professional data without a legal basis.
Check the calculations on a sample.

Indicators to track

Time to produce the monthly reports

Supply chain and procurement

This week

Compare supplier offers in a table.
Prepare a supplier meeting with the history of exchanges.
Spot products below the stock threshold.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Compare offers

Compare the attached offers in a table: price, lead times, terms, quality commitments, risks. Then propose a reasoned recommendation.

Stock analysisDPL

Analyse the attached stock extract: products below the threshold, grouped by warehouse and by product range. Propose a replenishment plan.

Prepare a supplier meetingDPL

Based on the attached exchanges with [supplier], list the open topics, the commitments made, the delays and the points to obtain during the meeting.

Choose a distribution providerDPL

Based on the scores and presentations of the candidate distribution providers, produce a reasoned ranking: strengths, points to watch, recommendation, in line with our criteria.

Use cases to propose

Selecting a distribution provider using scoring gridsDPL
Preparing planning meetings (S&OP) with the context of past exchangesDPL
Demand and inventory forecasting

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Supplier prices and terms in the approved tool only.
The purchasing decision rests with authorised people.

Indicators to track

Time to compare offers
Stock-outs avoided

Legal and compliance

This week

Check a sales email before it is sent.
Compare two versions of a contract.
Remove sensitive information from a message before sharing it.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Check a sales emailDPL

You are a compliance manager. Analyse the email below: unapproved claims, promotional tone, missing mandatory statements. Propose a corrected, compliant version. Email: [text]

Check congress expensesDPL

Compare the attached congress expense report files and attendance sheets. For each healthcare professional, check that the amounts match between the files and that the signature is present. Present a table of anomalies with a recommendation.

Rules on benefits to healthcare professionals and transparency. Named data: approved tool, restricted access.

Remove sensitive informationDPL

Review this message before it is sent. Flag any confidential or personal information and propose a redacted version.

Standard clauses for an AI tool

Draft standard clauses for a contract with an AI tool supplier: no use of data for training, hosting location, sub-processors, security, incident notification, model changes, exit and data portability.

Reviewed by legal before any decision.

Use cases to propose

Checking expense reports and congress attendance sheetsDPL
Compliance check of sales emails before sendingDPL
Compliance checklist drawn from a regulatory textDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Named healthcare professional data: approved tool and restricted access.
Legal advice remains the responsibility of a qualified person.

Indicators to track

Anomalies detected before sending or before payment
Contract review lead time

HR and training

This week

Write a clear job advertisement.
Prepare a set of interview questions.
Turn a training deck into a ten-question quiz.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Job advertisementDPL

Write a job advertisement for the position of [title]: responsibilities, skills, profile sought, what the company offers. Clear tone, with no discriminatory criteria.

Interview questionsDPL

Prepare a list of interview questions for the position of [title]: technical, behavioural and situational questions, with the points expected in the answers.

Training quizDPL

Turn this material into 10 multiple-choice questions, with an explanation of each correct answer.

Onboarding bookletDPL

Summarise this document in two pages for new joiners: the essentials, useful contacts, first steps.

Use cases to propose

Five-point practical sheets and quizzes from training materialsDPL
Onboarding booklet for new joinersDPL
AI training tracks by role

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Screening CVs or evaluating employees with AI: high-risk uses (AI Act, obligations from 2 December 2027). Do not start them without a framework.
No employee or candidate personal data outside the approved tool.

Indicators to track

Time to publish a job advertisement
Pass rate on training quizzes

Finance

This week

Explain the budget-versus-actual variances for a month.
Prepare a financial presentation from a table.
Have a spreadsheet formula written or corrected.

Ready-to-use prompts

Replace the items in square brackets and attach the documents mentioned.

Budget versus actual variancesDPL

Compare the attached budget and actuals: main variances, possible explanations to check, proposed actions. Present a table sorted by variance amount.

Check the calculations.

Contribution by product and by countryDPL

Analyse the margin contribution by product and by country from the attached data. Identify the five main improvement levers.

Spreadsheet formulaDPL

Write the formula that [need]. Explain it line by line and give an example of how to check the result.

Use cases to propose

Profit and loss analysis by product and by countryDPL
Preparing the monthly financial reviewsDPL

Assess each case with the grid in chapter 8 before launching it.

Points to watch

Unpublished financial data: approved tool only.
Check every calculation before sharing.

Indicators to track

Time to produce the monthly reports

8Act

Choosing and prioritising use cases

Managers and project owners

To do

Assess each idea with the grid before launching anything.
Start with the high-priority cases.
Fill in a use case sheet for each case selected.

Before: Explore

Open up access to the tools widely so that everyone can test them and suggest ideas.

Now: Choose

Access is in place. The task now is to focus efforts on a few selected use cases, measured and tracked.

In an SME, the two phases can follow each other within a few months: a few weeks of supervised trials, then a clear choice of use cases.

The six situations where AI adds the most value

Understand complex information

Large volumes of dense text: articles, contracts, reports, technical logs.

Extract what matters for analysis or decision-making.

Example

Development dossiers, scientific literature.

Generate and compare options

Hypotheses, scenarios, “what if” analyses.

Prepare the analysis; a person decides.

Example

Development plan options.

Coordinate work

Route, delegate, manage handovers between tools, systems and people.

Reduce administrative effort in complex processes.

Example

Document approval workflow.

Improve frequent tasks

Repetitive but essential high-volume tasks.

Small gains that add up at scale.

Example

Call reports, standard responses.

Speed up a first draft

Writing, analysis or synthesis before human approval.

Shorten timelines while keeping control.

Example

Draft response to a health authority.

Explore a new field

Get your bearings fast, gather scattered or incomplete sources.

Understand faster when experience is lacking.

Example

New therapeutic area.

Recommended AI use cases for this profile

Sorted by launch horizon. Impact, effort and risk scored from 1 to 3. The numbers refer to the six situations above.

Use case	Functions	Situations	Launch
Meeting minutes and action trackingDPL	All functions	1, 5	0 to 3 months
First drafts of internal documents: memos, procedures, presentations	All functions	5	0 to 3 months
Scientific, regulatory and competitive monitoringDPL	Medical, regulatory, marketing	1, 6	0 to 3 months
Compliance check of promotional emails and documents before approvalDPL	Marketing, sales, compliance	4, 5	0 to 3 months
Checking expense reports and congress attendance sheetsDPL	Operational marketing, compliance	1, 4	0 to 3 months
Training quizzes and practical sheets from existing materialsDPL	Training, HR	5	0 to 3 months
Funding applications and investor documents	Management	5	0 to 3 months
Preparing the annual operating plan and its presentation to the executive committeeDPL	Marketing, business units	2, 3, 5	3 to 6 months
Preparing short sales calls and objection-handling practiceDPL	Field force	2, 5	3 to 6 months
Question-and-answer agent on a document repository, shared with the teamDPL	All functions	1, 4	3 to 6 months
Searchable document base on approved documents, with sourced answers	Quality, regulatory, medical	1	3 to 6 months
Consistency check of regulatory documents against their sources	Regulatory	1, 5	3 to 6 months
Summary of Transparency Committee (HAS) opinions and value argument planDPL	Market access	1, 2, 6	3 to 6 months
Early assessment of how the HAS will view a study, and negotiation scenariosDPL	Market access	1, 2	3 to 6 months
Draft medical information responses based on approved standard responses	Medical affairs	1, 4, 5	6 to 12 months
Call preparation and call reports in the CRM	Sales	4, 5	6 to 12 months
Draft responses to health authority questions, with cited sources	Regulatory, development	1, 5	6 to 12 months
Pre-analysis of deviations and CAPA (5 whys), each step backed by evidence	Quality, manufacturing	1, 2, 5	6 to 12 months
Literature pre-screening for pharmacovigilance	Pharmacovigilance	1, 4	6 to 12 months
Research support: hypotheses, analysis of existing data, experiment preparation	Research	2, 6	6 to 12 months

Cases marked DPL come from the Digital Pharma Lab use case library.

The use case sheet

Template to copy

One sheet per use case, filled in before the use case is declared. It is also used to report a need to the group.

Use case name:
In brief (one sentence):
Current problem: who is affected, at which step, how often, what happens if it fails?
Proposed solution: tool, type of AI (classic, generative, agentic), steps:
Expected results and indicators (baseline / target):
Link with company priorities:
Situations covered (1 to 6, chapter 8):
Target users:
Data used: source, sensitivity, owner:
Risks and measures (legal, security, personal data, quality and compliance, architecture):
Business owner:
Technical owner:
Decision requested:

9Act

Working with AI agents

ManagersAI leads

To do

Start at autonomy level 2: the agent proposes, a person approves.
Go through the checklist before launching an agent.
Name an owner for each agent.

An agent is an AI program that carries out a multi-step task on someone’s behalf. It can:

use tools and knowledge
reason about the task
plan the steps
act within tools
adjust based on feedback

Three ways to work with AI agents

Use

Ready-to-use agents

Supplied by the vendor of the assistant or of business software: in-depth research, data analysis, agents in a CRM or a service management tool.

Approval

No approval for personal use if the agent is approved. Use case approval for business use.

Build

Personal no-code agents

Created by an employee for their own repetitive tasks: preparing meetings, sorting emails, producing a standard report according to their own rules.

Approval

No approval for personal use or limited sharing (for example up to 5 colleagues). Beyond that, or if it supports a business process: approval.

Request

Custom agents

Built by the technical team, a vendor or a service provider when no existing solution meets the need.

Approval

Approval required before building or sharing. Designed with the business team.

For this profile: Use the ready-to-use agents of the chosen assistant and build personal agents for repetitive tasks. For a business agent, go through a vendor or service provider, after the AI lead’s opinion and management’s agreement.

When to build your own agent

Need	Tool
A quick or one-off request	The AI assistant
An in-depth, general analysis: report, dataset	A ready-to-use agent (research, analysis)
A repeated task that needs your own information or rules: your emails, your minutes format	A personal agent

Four levels of autonomy

Assistant
Answers a request. The person does everything else.
Supervised agent
Prepares and proposes. Every action is approved by a person.
Bounded agent
Acts alone on simple, reversible actions, from a closed list. Important actions are still approved.
Autonomous agent
Acts alone across the whole process. To be avoided in regulated processes.

Start at level 2. Do not go beyond level 3 for GxP, quality and vigilance processes, or for any exchange with external parties.

Guardrails

Closed list of permitted actions, minimum rights, read-only by default.
Human approval at key steps.
Log of every step (inputs, tools used, outputs, decisions) so that an action can be reconstructed.
Tests in an isolated environment and dry runs before going live.
Monitoring of behaviour drift over time.
Usage limits: number of steps, retries, budget.
A named owner, and any change of owner recorded in writing.

What changes from a legal standpoint

	Generative AI	Agent
What it does	Produces a draft, a summary or an answer.	Plans and carries out multi-step tasks on someone’s behalf.
Where it stops	At the output. Nothing happens without human action.	When the task is complete, or at a control point.
What it reaches	The content provided, in a single tool.	Tools, systems and connectors, with the access granted.
Who is exposed	The risk lies in how the output is used.	Its actions commit the company and the person responsible for the agent.
The trail	The output kept.	Requests, steps, calls and modified data: all of it can be produced in a dispute.
When legal steps in	Review the draft before sharing it.	Review the design before the agent can act.

An agent has no legal personality: what it does is attributed to the company and to the person responsible for it.
It cannot do more than its owner is authorised to do.
Every output is reviewed and checked before it is used.
Its records (requests, logs, outputs) are documents: retention, audit, disclosure in a dispute.
Drafting carries a low risk. Writing to a system, sending, buying or deciding requires a review.

Before launching an agent

List to copy

List every tool, connector and system the agent touches, and what it can do there.
Identify the data involved. Personal, patient or regulated data: legal and DPO review first.
Name the owner in writing.
If the agent consults websites: check the terms of use, intellectual property and personal data, and keep a list of the sources collected.
Define the human approval points.
Plan testing and monitoring (chapter 10).
With a service provider: settle from the start who owns the outputs, how each party’s data is used and confidentiality, and keep a record of the human contribution.
If in doubt: consult legal early.

10Act

Building a solution

AI leads and technical teams

To do

Validate the problem before choosing a technology.
Take the “Is AI the right answer?” test.
Estimate the cost at real volume, not pilot volume.

In an SME, this chapter is mainly used to brief a vendor or service provider: ask the right questions, require the right guarantees, check the costs.

	Enterprise solution	Personal solution
What is built	An application that serves a team or a department, with a risk profile to manage.	A boost to your own productivity, with low or no risk.
Where	Development environments, often with code.	No-code tools, with guardrails already built in.
For whom	A department, the organisation, risky cases.	Yourself, with limited sharing.

This chapter covers enterprise solutions.

The three-step framework

1
Need
What problem needs solving?
- The business need: the process or problem targeted.
- The choice of tool: the type of tool that meets the need.
2
Preparation
What must frame the development?
- Risk and security requirements.
- Cost: the most economical combination of models, tools and infrastructure for the target result.
3
Design
How should the tool be built?
- Architecture and orchestration.
- Data sources.
- AI model.
- System integrations.
- Evaluations (for agents).

Step 1. Define the problem clearly

The problem

Which user, process or decision is affected?
Where does the process get stuck? What triggers the problem, and how often?
What does failure look like: delay, wrong decision, workaround?

The current process

Are all the steps necessary? Can steps, or tools, be removed?
Would redesigning the process be enough to solve the problem?
Is the process going to change significantly in the short term?

The target situation

What outcome does the solution enable? Is it measurable: time saved, quality?
Is the impact broad enough to last?

If an answer is missing, review the problem and the expected value with the business team before choosing a technology.

Test

Is AI the right answer?

Question 1. Does the case have at least one feature that AI is built for?Unstructured or mixed inputs (text, images, audio, documents) that conventional tools cannot handle.A need to interpret, write or reason, beyond a search, a calculation or rules.Ambiguity or edge cases that rules do not cover.A sequence of steps to coordinate across several systems.

Question 2. Are the conditions in place for AI to work?The data needed is available, accessible and of sufficient quality.An expert is available to validate the outputs and give feedback.The decisions and outputs of the process are compatible with AI support.The expected value exceeds the planned cost (build and run), estimated with the product owner.

Tick the boxes that apply: the result appears here.

Reuse, buy or build

Step 2. The five families of risk

Family	Scope	Questions to ask
Legal and regulatory	Comply with the rules, contracts and intellectual property.	How do you frame a service provider that builds the tool? Which internal and external data can be used to feed or train the tool?
Security	Protect tools and data against unauthorised access and attacks.	Who has access to what, and how is access managed? How does the tool withstand AI-specific attacks: jailbreaking, prompt injection? How are the connections between systems secured? How is security monitored throughout the tool’s life? Which models are approved?
Personal data	Process data according to its sensitivity.	Which sources can the tool use, and which are excluded? How is sensitive data protected? Where are the tool and its data hosted? How long is the data kept?
Quality and compliance	Ensure the accuracy and reliability of outputs for the decisions they inform.	How are accuracy and traceability ensured? How is performance monitored over time? Where does human approval come in?
Architecture	Follow standards and control long-term costs.	Why are these technical choices necessary? Are they aligned with the company’s standards?

Security

AI-specific attacks

Data leakage through prompt injection: instructions hidden in a document or web page hijack the tool.
Reconstruction of training data or sensitive data from the answers.
Corrupted training data (poisoning), manipulation of outputs, hidden access in the model (backdoor).

What security checks

A full description of the data used, the source systems and the guardrails.
Architecture diagrams showing data flows and their protection at each point.
Use of verified and approved models.
Supplier assessment and security clauses in the contract.
Data encryption (in transit and at rest), key management, role-based rights, monitoring, source validation, hosting location, where human approval sits.

Common mistakes

Diagrams or files that lack detail.
Proposed measures that do not fix the identified weakness.
Moving from a trial to production without an evaluation.
Data sources with no owner and no access control.

Cost

The cost of AI is mostly variable: it increases with every use. The choices that weigh most on cost are made at the design stage.

Model and compute

The model tier and the price paid for each use (different prices for input and output).

Volume per exchange

The amount of text sent (instructions, context, retrieved documents) and produced with each call.

Orchestration

The number of calls to the model and tools per task, chained steps, retries.

Usage

The number of users, how often they interact, load peaks.

Data and infrastructure

Indexing and storing documents, data preparation, hosting.

Operations

Monitoring, evaluations, guardrails, maintenance.

What is a token? A token is a fragment of a word. Models read and write in tokens, and every token is billed, for input as well as output. Output usually costs more, because producing an answer takes more computing.

Cost of one exchange = input tokens × input price + output tokens × output price (prices quoted per million tokens).

The model chosen sets the price. The architecture sets the volume: amount of context sent, number of calls per task. An overly heavy design can cost several times more than a lean design, for the same result.

Cost calculator

Assistant that answers from a document base

Example values, to be replaced with your volumes and the prices of your supplier.

Requests per month

Default design

Most powerful model. All available context.

Tokens sent per requestTokens generated per requestInput price (€ per million tokens)Output price (€ per million tokens)

Cost per request€0.0875

Cost per month€4,375

Lean design

Model suited to the task. The 10 most relevant passages.

Tokens sent per requestTokens generated per requestInput price (€ per million tokens)Output price (€ per million tokens)

Cost per request€0.0080

Cost per month€400

The lean design costs 11 times less, a difference of €3,975 per month, for the same service.

Reducing cost without losing quality


Model	Choose an approved model suited to the task. Give simple sub-tasks (classifying, extracting) to lighter models. Check that a frontier model really improves the result before adopting it.
Volume	Send the model only useful information. Ask for the shortest answer that is still useful. Remove anything that consumes tokens without adding value.
Orchestration	Choose the simplest execution pattern. Limit any loop. Avoid redoing work already done.
Usage	Estimate the cost per exchange early and project it to real volume, not pilot volume. Set usage limits before a broad rollout. Track costs continuously.
Data	Use standard connectors rather than custom ones. Batch calls to databases.

Step 3. Design principles

Architecture and orchestration

Start with a single agent and its tools. Move to several agents only if the task splits into truly independent sub-goals.
For regulated processes (GxP, quality, vigilance): a fixed, predictable flow, where AI only steps in at specific points and the rest follows written rules.
Use the components provided by the platform before building your own.

Data

Leave data where it is and access it through controlled connectors, rather than copying it.
Keep the model in the same hosting region as the data.
No direct access from an agent to a database: everything goes through a controlled connector.

Model

Use approved models, never an uncontrolled model.
Route all model calls through filters: content, personal data, compliance.
Record and approve any model change in production.

Integrations

Connect agents to tools through a standard protocol (for example MCP), via a single gateway, with no direct point-to-point connections.
Use an agent-to-agent standard (A2A) when several agents work together.
No shared or hard-coded credentials: each agent has its own identity and acts with the user’s rights.

Require these principles from the vendor or service provider, in writing.

Evaluating an agent

Why

An agent does not always give the same result: the same request can follow different paths.
Quality is not only about the final answer: it also depends on the tools used and their order.
A single non-compliant action can be enough to create a GxP or quality issue.
A change of model, instructions or tool can degrade performance.

Three types of evaluation

Rule-based tests

A program checks the output: expected format, mandatory field, exact value.

The output is right or wrong and the score must be reproducible (compliance, GxP).

Evaluation by another AI

A model different from the one tested scores each run against a rubric.

Quality is more subjective (tone, reasoning), or there are several good ways to do it.

End-state check

The system is checked to confirm the expected effect happened: document created, status changed.

Success shows up in a tool and must be reproduced identically.

Build a set of test cases at design stage, and rerun it with every change of model, instructions or tool.

A single agent or dedicated agents

A single agent that learns skills

Strengths

Extensible: no new agent to create
A single governance interface

Limitations

Less predictable flow
Identical behaviour harder to guarantee

Best for: Broad uses and productivity.

A dedicated agent per process

Strengths

Predictable and auditable
Identical flow on every run

Limitations

Higher cost per process
Risk of agent proliferation

Best for: Regulated processes (GxP, quality, vigilance) and risky situations.

Commitments of the solution owner

Use approved platforms and tools first.
Follow the company’s reference architectures.
Have the use case approved and incorporate the reviewers’ comments.
Follow the development lifecycle and standards: testing, reviews, releases, computerised system validation in a GxP environment.
Assess and maintain the legal, quality, personal data, security and compliance requirements.
Manage the whole lifecycle: development, testing, deployment, maintenance.
Track the cost-to-value ratio at scale.
Record the tool or agent in the company register.
Know chapters 1 to 9 of this playbook.

11Act

Practical examples

Everyone

To do

Find the example closest to your activity.
Reuse its structure to describe your own case.
Reuse its points to watch as well.

Examples described with the same sheet as in chapter 8. Examples marked DPL come from the Digital Pharma Lab use case library and client engagements, in anonymised form. The others describe industry practice. “Typical cases” are scenarios built for this profile.

Preparing the annual operating plan

DPL

A marketing team prepares its annual operating plan faster: organising the exercise, a cross-functional workshop, the presentation to the executive committee.

Problem: Preparing the annual operating plan takes many meetings and scattered documents, and the presentation to the executive committee must fit in a few slides.
Solution: The assistant proposes how to organise the exercise (steps, contributors, deliverables), designs the agenda for a one-day cross-functional workshop, then prepares a short presentation outline, the likely questions and a pre-read document.
Users: Marketing, business units, management.
Results: A clear organisation from the start.
A decision-focused cross-functional workshop.
A shorter, better prepared presentation to the executive committee.
Situations: 2 · Generate and compare options3 · Coordinate work5 · Speed up a first draft
Points to watch: Market and strategy data in the approved tool. Figures checked before presenting.

Checking promotional content before the approval process

DPL

Before entering the approval process, an email or a sales aid is reviewed by the assistant: missing mandatory statements, unreferenced claims, promotional tone.

Problem: Content often comes back from the approval process for simple omissions, which lengthens timelines.
Solution: The assistant compares the content with internal rules and mandatory statements, lists the issues in a table and proposes a corrected version.
Users: Marketing, field force, compliance.
Results: Fewer back-and-forths with the approval process.
More consistent content.
More time for the substance of the message.
Situations: 4 · Improve frequent tasks5 · Speed up a first draft
Points to watch: A review aid: regulatory approval remains mandatory, with ANSM approval where required.

Anticipating the HAS opinion and preparing the price negotiation

DPL

The market access team compares a study with previous opinions, then prepares price scenarios and negotiation arguments.

Problem: The HTA dossier and the negotiation require cross-checking many opinions, studies and price data.
Solution: The assistant summarises the Transparency Committee (HAS) opinions in the therapeutic area, flags the study’s weak points, suggests comparators, then calculates three price and volume scenarios.
Users: Market access, public affairs, finance.
Results: Weak points identified before submission.
Costed scenarios ready for internal discussion.
Arguments backed by sources.
Situations: 1 · Understand complex information2 · Generate and compare options6 · Explore a new field
Points to watch: Calculations checked, assumptions approved by finance, price data in the approved tool.

Preparing a short call with a doctor

DPL

A medical sales rep condenses the approved key messages into three sentences and practises handling objections before a key call.

Problem: Calls are getting shorter and the full detailing story does not fit into a few minutes.
Solution: The assistant condenses the approved key messages, plays the doctor to raise the likely objections and suggests answers drawn from the approved documents.
Users: Medical sales reps, KAMs, regional managers.
Results: A key message ready for a five-minute call.
Prepared answers to frequent objections.
More confidence during the conversation.
Situations: 2 · Generate and compare options5 · Speed up a first draft
Points to watch: No claim that is not in the approved documents. No patient health data.

Checking congress expenses

DPL

After a congress, the assistant compares the expense reports with the attendance sheets of the invited healthcare professionals.

Problem: Checking several files by hand takes a long time and discrepancies easily go unnoticed.
Solution: The assistant cross-checks the files, verifies for each healthcare professional that the amounts are consistent and the signatures present, then presents a table of anomalies.
Users: Operational marketing, compliance, assistants.
Results: A full check instead of a sample.
Anomalies spotted before the transparency disclosures.
Less time spent on checks.
Situations: 1 · Understand complex information4 · Improve frequent tasks
Points to watch: Rules on benefits to healthcare professionals and transparency. Named data in the approved tool, with restricted access.

Answering a health authority on time, with cited sources

A development team answers an authority’s questions from several years of documentation, with answers in which every statement points to its source.

Problem: Answering within a short, fixed deadline means searching years of R&D documents by hand, putting them back in context and writing fast.
Solution: A generative AI tool queries a closed set of source documents. It produces summaries and draft answers that cite the documents precisely.
Users: R&D, regulatory, quality.
Results: Less manual effort to meet the deadline.
Faster synthesis of the documentation.
Clear traceability from each question to the scientific evidence.
Situations: 1 · Understand complex information5 · Speed up a first draft
Points to watch: Every draft is reviewed and approved by the experts. The document scope is closed and up to date.

Checking regulatory documents before submission

The tool checks a document’s numerical statements against internal and external source documents.

Problem: Checking the figures in a dossier by hand takes a long time and discrepancies are missed.
Solution: For each numerical statement, the tool finds the value in the source and flags discrepancies or values that cannot be found.
Users: Regulatory affairs, medical writing.
Results: An exhaustive check instead of a sample.
Discrepancies spotted earlier.
Review time focused on the real problems.
Situations: 1 · Understand complex information5 · Speed up a first draft
Points to watch: The tool flags, the team decides. Tool validated before use in production.

Moving faster from hypothesis to experiment

A research team works with an AI assistant that analyses the literature, formalises the method and prepares analysis tools.

Problem: Taking an idea to a lab test requires months of coordination between researchers, writers and engineers.
Solution: The assistant analyses the literature, formalises the method and turns ideas into ready-to-use analysis tools.
Users: Researchers, especially small teams.
Results: A single researcher can prototype and test more ideas.
Old data reused for new analyses.
New angles of analysis.
Situations: 2 · Generate and compare options6 · Explore a new field
Points to watch: Results confirmed by experiment. Confidential data in an approved environment.

12Deploy

Training and engaging teams

ManagementManagersHR

To do

Make the basic training mandatory for everyone.
Organise one hands-on workshop per role.
Keep a record of the training completed.

Learning tracks

Track	Who for	Content	Format
Foundation for everyone	All employees	Basic concepts, company rules, simple uses, risks and ethics.	2 to 3 hours, online or in a workshop. Mandatory before access to the tools.
Role-based tracks	Each department	Use cases and prompts for the role, exercises on real documents, mistakes to avoid.	Half a day to a full day, as a hands-on workshop.
Managers and executives	Executive committee, managers	Steering the programme, choosing priorities, managing risks and ethics, supporting teams.	Half a day, then regular check-ins.
Solution builders	Technical teams, AI leads	Building, security, agent evaluation, cost control (chapter 10).	Technical track, partly with the vendors.

For this profile: In an SME: the foundation for everyone, one workshop per role and an AI lead trained in more depth are enough in the first year.

Formats that work

Hands-on, collaborative workshops by role, on real documents
Short on-demand online modules
Regular question-and-answer sessions
A shared prompt library, kept up to date
An internal assistant that answers questions about the policy and this playbook
Upskilling objectives built into annual reviews

Four formats tested by Digital Pharma Lab with clients

Short webinars on the company’s tool

45 minutes of demonstration and 15 minutes of questions. A first one on the interface, email and meetings, a second one on content creation (presentations, spreadsheets) applied to the teams’ action plans.

Hands-on workshops by role

Participants work on their own documents and leave with prompts and use cases adapted to their role.

Learning by doing for a team

Half a day on the basics, then a day of practice. The team leaves with its own agents and roadmap, after a short demonstration to its peers.

One-to-one session for an executive

Strategic scoping, pre-mortem, competitive simulation, and a custom assistant for their business unit.

Engaging teams

Communicate

A message from management: why, which rules, what support.
Concrete examples by role and internal testimonials.
A single channel for questions and feedback.

Address concerns

“AI is going to replace my job”

Present AI as a first-draft tool: the person keeps the analysis and the decision.

“I’m afraid of making a mistake”

Clear rules, a “green light” test and an AI lead to ask.

“I don’t have time”

Dedicated time for training, and use cases chosen to save time quickly.

Keep a record of training, materials and awareness actions: these are the measures expected under Article 4 of the AI Act.

13Deploy

Roadmap and indicators

ManagementAI lead

To do

Tick off the roadmap actions as you go.
Measure before launching each use case.
Review the portfolio every quarter.

Indicators to track

Family	Indicators
Adoption	Share of employees trained Monthly active users Uses per department
Efficiency	Time saved per task, measured before and after on a sample Process lead times: medical information response, CAPA closure
Quality	Share of AI outputs corrected before use Errors found during review
Compliance	Incidents: data leak, non-compliant use Share of uses declared in the register
Value and costs	Cost per user and per use case Estimated value compared with cost Use cases in production

Measure before you launch: without a baseline, no gain can be proven.

14Appendices

Glossary

Everyone

The 46 terms used in this playbook. Each term links to its definition, on the glossary page.

15Appendices

Going further with Digital Pharma Lab

Digital Pharma Lab supports pharmaceutical companies and medical device manufacturers with their AI programme, from scoping to rollout.

AI diagnostic

Review of uses, tools, governance and compliance, then prioritisation of use cases with the grid in this playbook.

Talk to our team

Training and workshops

Hands-on, collaborative workshops by role, from the foundation for everyone to advanced tracks, with a diagnostic before and an impact measurement after.

See DPL Academy

AI Compass

AI strategy and governance platform for pharmaceutical companies: regulatory compliance audit, continuous strategy steering, tracking of tool rollout and return on investment measurement.

Discover AI Compass

70+clients supported

12+experts

9years of experience

150+innovation projects

Deployment of the playbook in the company

Deployment of the playbook in the company with DPL support.

Ask about the use case & prompt kit

Contact

Lilian Reversat, Digital Healthcare Manager

lreversat@digitalpharmalab.com

Talk to our team

Digital Pharma Lab

4/6 Cité Monthiers, 75009 Paris, France

AI playbook for pharmaceutical and biotech SMEs and start-ups

Profile essentials

Typical situation

Common mistakes

The three priorities

Put rules around existing uses

Train the whole team and appoint an AI lead

Choose 3 quick-win use cases

To start in the next two weeks

Role by role: what to do

Understanding AI

Classic AI

Generative AI

Agentic AI

Automation or agent?

The four levels of value

Products and patients

Business processes

Team efficiency

Foundations

What AI does well

What calls for caution

The rules of the game

Before you start

Read and accept the AI usage policy

Complete the basic training

Declare your use case

Can this use start without approval?

A short process, run by the AI lead

Declare

AI lead’s opinion

Decision

Register update

Who does what

AI usage policy template

The regulatory framework

Key dates

For all healthcare companies

AI Act: the European regulation on AI

GDPR and health data

Health data hosting (HDS, France)

HAS good practice (France)

Specific to medicines

EMA: AI in the medicinal product lifecycle

EMA and FDA: good AI practice principles

GMP: draft Annex 22 on AI

Pharmacovigilance

Promotional information and medical information

Sources consulted

Choosing the tools

Three families of tools

AI for everyone

AI built into business software

Custom AI

The rule: reuse, then buy, then build

Reuse

Buy

Build

Which tool for which need

Tools for this profile

Choosing a supplier: ten control points

AI in everyday work

The five basic uses

Rewrite

Summarise

Find ideas

Write

Analyse

Writing a good prompt

Where AI saves the most time

First drafts

Finding information

Handling email

Complex tasks

Meetings

The golden rules

Learn

Verify

Estimate

Communicate