AI Regulation in Pharmaceutical Research and Development

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Artificial intelligence is already transforming the discovery of new drugs, but Brazil’s regulatory framework is still working to balance innovation and safety in this critical sector.

The Rise of Artificial Intelligence in the Pharmaceutical Sector

In recent years, the way the pharmaceutical industry conducts research and development of new drugs has changed profoundly. Machine learning algorithms are now used at nearly every stage of a drug’s life cycle, from identifying molecular targets to optimizing clinical trials. This technological revolution promises to sharply reduce the time and cost of bringing a new treatment to patients, a process that has historically taken more than a decade and consumed billions of reais in investment.

A look at the current landscape shows that AI systems can process enormous volumes of genomic, proteomic, and chemical data to predict which compounds are most likely to be therapeutically effective. Predictive models help simulate molecular interactions, identify potential side effects, and select the populations best suited to clinical trials. This analytical capacity, which outstrips the speed and scale of any human team working alone, raises complex regulatory questions that the legal system must address with urgency and precision.

In Brazil, the National Health Surveillance Agency (Anvisa) is the body responsible for authorizing clinical research and registering drugs. The use of AI tools in the processes submitted to the agency raises unprecedented questions about algorithm validation, transparency in decision-making, and civil liability in the event of failures. We need to understand how Brazilian law is positioning itself in the face of this reality so that we can advise companies, researchers, and health professionals who already use these technologies or plan to.

Brazil’s Regulatory Framework and AI in the Pharmaceutical Context

Brazil has been moving toward a legal framework for artificial intelligence, with legislative discussions aimed at establishing general principles of algorithmic governance. When we look at the pharmaceutical sector specifically, however, we find that there is still no consolidated sector-specific regulation addressing the use of AI in drug research and development. What exists so far is a set of general Anvisa rules on good clinical practice, drug registration, and pharmacovigilance, which must be interpreted in light of the new technologies.

The Collegiate Board Resolution (RDC) that governs clinical research in the country requires studies to follow rigorous safety and efficacy protocols, with detailed documentation of every methodological step. When an AI algorithm takes part in selecting candidate molecules or stratifying patients for clinical trials, it becomes necessary to document not only the results but also the logic underlying the model. This transparency requirement collides with the nature of many deep learning algorithms, whose internal decision-making processes are often described as “black boxes” that are hard to interpret.

Besides Anvisa, the National Research Ethics Commission (Conep) plays a key role in the ethical review of studies involving human subjects. When AI is used to determine which patients will be included in or excluded from a clinical trial, algorithmic bias takes on immediate ethical importance. A model trained on data drawn predominantly from one population may underrepresent certain ethnic or socioeconomic groups, undermining equitable access to innovative treatments. Regulation must meet this challenge without making innovation unworkable, by setting clear standards for auditability and for the representativeness of training data.

Regulating AI in the pharmaceutical sector calls for a delicate balance: protecting patient safety without creating barriers that block access to treatments developed with cutting-edge technology.

Internationally, agencies such as the FDA (United States) and the EMA (European Union) have already published specific guidance on the use of AI in pharmaceutical regulatory processes. These references matter for Brazil, since many drugs developed with the help of AI seek registration in multiple jurisdictions at the same time. International regulatory harmonization is a factor that Brazilian lawmakers and regulators must weigh to keep the country from becoming an obstacle to innovation or, at the other extreme, an environment with insufficient protection for the public.

Civil Liability and Legal Risks

One of the most sensitive issues in regulating AI applied to pharmaceutical development is civil liability when something goes wrong. Suppose an AI algorithm recommends a compound that, after regulatory approval and commercialization, causes unforeseen harm to patients. Who is legally responsible: the algorithm’s developer, the pharmaceutical company that used it, the health professional who prescribed the drug, or the regulatory agency that approved it?

Under Brazilian law, the Consumer Defense Code establishes the strict liability of the supplier for defects in products and services. Under this rule, the pharmaceutical company is liable for harm caused by defective drugs regardless of fault. But when part of the development decision was delegated to an AI system, additional layers of complexity arise. The company may argue that it followed the best practices available and that the error stemmed from a limitation inherent in the algorithmic model, something that could not have been foreseen with the reasonable diligence the current regulations require.

The concept of the “state of the art” takes center stage in these discussions. The manufacturer’s defense under the Consumer Defense Code allows liability to be excluded when it is shown that the defect could not have been identified with the technical knowledge available at the time. When AI takes part in the development process, assessing the “state of the art” comes to include the sophistication of the computational models used, the quality of the training data, and the robustness of the algorithm validation processes. These technical elements will require courts to develop an ever deeper understanding of the technologies involved.

Another relevant issue is intellectual property. Molecules identified or optimized by AI systems raise questions about patentability. The National Institute of Industrial Property (INPI) requires an invention to involve an inventive step, meaning that it must not be obvious to a person skilled in the art in light of the prior art. When an algorithm screens millions of compounds and identifies promising candidates, the human creative contribution may be called into question, which has direct implications for patent protection and the return on R&D investment.

Data Protection and Privacy in AI-Driven Pharmaceutical Research

The use of AI in pharmaceutical research depends fundamentally on data, much of it sensitive personal data about patients. The General Data Protection Law (LGPD) classifies health-related data as sensitive, imposing a stricter legal regime on how it is processed. The LGPD provides specific legal bases for processing data in health research, including studies carried out by research bodies, provided the data is anonymized whenever possible.

The practical challenge arises because AI models often need large volumes of clinical data for training, including medical records, test results, genetic information, and prior treatment histories. Effectively anonymizing this data is not always straightforward, especially with genomic data, which is by nature highly identifiable. Techniques such as differential privacy and federated learning have been proposed as technical solutions for reconciling the need for robust data with the protection of individual privacy.

The National Data Protection Authority (ANPD) has not yet issued specific regulations on the use of personal data to train AI models for the pharmaceutical sector. This regulatory gap creates legal uncertainty for companies and research institutions that need to determine, for example, whether consent obtained for a specific clinical study also covers the use of the data to train algorithms that will be applied in future research for different purposes. Interpreting the purpose limitation principle, which is central to the LGPD, becomes particularly complex when a single dataset can feed multiple models with different applications over time.

Outlook and Paths Toward Adequate Regulation

Given this landscape, it is clear that Brazil needs to move forward in building a regulatory framework that addresses the specific features of AI applied to the pharmaceutical sector. That progress should occur on multiple fronts, involving Anvisa, the ANPD, Conep, the INPI, and the National Congress, in a coordinated effort that avoids overlapping or contradictory rules.

Several guidelines can steer this regulatory process. First, algorithmic transparency requirements should be proportional to risk: the greater the potential impact of an automated decision on patients’ health, the greater the degree of explainability that should be required of the AI model used. Second, regulators could create regulatory sandboxes, controlled environments in which companies can test innovative technologies under Anvisa’s supervision, without having to comply fully with every regulatory requirement that applies to products already established on the market.

Another promising path is stronger international regulatory cooperation. Brazil’s active participation in forums such as the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) allows the country to help shape global standards while benefiting from the experience other jurisdictions have accumulated. This cooperation is especially relevant because much of the data used to train AI models is collected in international multicenter studies, which calls for harmonized data protection requirements and ethical standards.

Finally, building up specialized technical staff at regulatory agencies is an indispensable condition for effective regulation. Anvisa and the other bodies involved need professionals who can critically assess the AI models submitted to them and who understand their technical limitations and potential biases. Without that institutional capacity, any regulatory framework, however well designed, risks becoming a dead letter in the face of the technological complexity involved.

This topic is directly related to artificial intelligence regulation, which we cover in a dedicated article.

This topic is directly related to AI regulation in the financial sector, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.