What is the FDA's draft AI guidance for sponsors?

In January 2025, the FDA released its first draft guidance dedicated to artificial intelligence used to support regulatory decisions about drug safety, effectiveness, or quality. The document, titled Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products, remains a draft as of October 2026. No finalization date has been published. Even so, the seven-step credibility framework at the center of the document is already the working standard FDA reviewers apply when an AI model appears in a submission.

Two developments in 2026 raised the stakes further. In January, the FDA and the European Medicines Agency jointly released ten Guiding Principles of Good AI Practice in Drug Development, echoing the same vocabulary of context of use, model influence, and life cycle management. In June, the FDA issued ICH M15 on model-informed drug development as final guidance. Sponsors that wait for the final AI guidance will build credibility packages that already lag behind the convergent expectations now shared across the United States, Europe, and the broader ICH region.

This piece walks through what the draft actually asks of sponsors, what it does not cover, and the documentation that regulatory, clinical, and quality teams should begin assembling now.

What the guidance covers, and what it does not

The draft applies to AI models whose outputs produce information or data that support regulatory decisions on the safety, effectiveness, or quality of a drug or biological product. The reach is intentionally broad. It extends across nonclinical, clinical, postmarketing, and manufacturing phases. Examples the FDA names include predictive pharmacokinetic modeling, AI-derived digital endpoints, integration of real-world data to characterize disease progression, pharmacovigilance signal detection, and manufacturing process control.

Two categories sit outside the draft. The first is AI used in drug discovery, where no regulatory decision depends on the output. The second is AI used for operational efficiencies, such as internal workflows, resource allocation, or drafting a submission document, provided the use does not affect patient safety, drug quality, or the reliability of a nonclinical or clinical study. The boundary is drawn by impact, not by function. A generative AI tool that drafts a clinical study report is operational. A tool that codes or extracts adverse events feeding a safety analysis is in scope.

The draft also does not decide whether an AI model is itself a medical device. The FDA points sponsors to the Center for Devices and Radiological Health for that determination. Combination products, companion diagnostics, and AI-enabled digital health technologies may therefore sit under both the drug and device tracks at the same time.

For sponsors already navigating AI across study design and recruitment, our overview of how AI is reshaping study design and patient recruitment covers the operational layer that sits alongside this regulatory conversation.

The seven-step credibility framework at a glance

The draft's core contribution is a seven-step, risk-based credibility assessment framework. The depth and formality expected at each step scale with how much the model influences a regulatory decision and how severe the consequences of an incorrect decision would be.

The seven steps are: define the question of interest; define the context of use; assess the AI model risk; develop a credibility assessment plan; execute the plan; document results and any deviations; and determine whether credibility is adequate for the stated context of use.

The FDA has been explicit that this is a graded framework. For low-risk models, the agency says it may request only minimal information. For high-risk models, it may ask for the full plan, a credibility assessment report, performance acceptance criteria set in advance, and evidence that the credibility exercise was executed under change control. Credibility, in the FDA's framing, is trust in a model's performance for one specific use. The same algorithm can be low risk in one context and high risk in another.

This graduated approach mirrors a broader movement toward risk-based quality management under ICH E6(R3), where oversight intensity follows the risks that genuinely matter to participants and to data integrity.

Context of use and model risk: the two levers that set your burden

Two definitions decide almost everything that follows in a credibility package.

Context of use describes the specific role and scope of the AI model, including what is being modeled, how outputs are used, and whether any other evidence sits alongside the model output. A context of use statement for the same algorithm can read very differently depending on whether the model is the sole determinant of a trial decision or one input that an investigator reviews before acting.

Model risk is the product of two independent judgments. Model influence captures how much the AI evidence contributes relative to other evidence sources. Decision consequence captures the severity and probability of an adverse outcome if the model is wrong, judged independently of the modeling. The resulting rating, low, medium, or high, drives the stringency of the credibility work.

The FDA offers two illustrative examples. In a clinical case, an AI model decides which participants can be discharged for outpatient monitoring after dosing a drug with a known life-threatening adverse reaction. Model influence is high because the model is the sole determinant, consequence is high because the risk is serious, and overall model risk is high. In a manufacturing case, AI visual inspection of vial fill volume runs alongside representative-sample release testing. Consequence remains high because fill volume is a critical quality attribute, but influence falls because release testing provides corroborating evidence. Overall model risk is medium.

The practical lesson for sponsors is that the fastest way to reduce credibility burden is to change the context of use. Adding a human review step, requiring corroborating evidence, or retaining established release testing lowers model influence, which lowers the Step 3 rating, which lowers the documentation the FDA will expect.

These are the same questions sponsors and partners increasingly ask about third-party algorithms. The checklist that applies when evaluating an AI-assisted patient matching model is close to the one the FDA formalizes for in-scope regulatory uses.

Documentation sponsors should prepare now

Step 4 of the draft lists what a credibility assessment plan should contain, scaled to risk. A sponsor's internal AI inventory should capture, for every in-scope model, the following elements.

Model description, including inputs, outputs, architecture, features, parameters, and the rationale for the modeling approach. Development data, including how training, tuning, and test sets were created, how data were collected, annotated, and controlled, and whether the data are fit for use. Fitness is defined as both relevant, meaning representative populations or process conditions, and reliable, meaning accurate, complete, and traceable. Training details, including the learning methodology, performance metrics with confidence intervals, measures against overfitting, hyperparameters, any pre-trained or foundation models used, and software version control. Evaluation details, including an independent test set, the reference standard, how performance holds under data drift, uncertainty quantification, and evaluation of the human and AI team together where a human review step is present.

Sponsors that use AI to curate or link real-world data for regulatory analyses, including the growing practice of patient tokenization that connects trial data to real-world outcomes, inherit the FDA's existing expectations for real-world data relevance and reliability on top of the credibility framework.

Life cycle maintenance is often overlooked. Most drug regulatory uses rely on locked model outputs from a single point in time, so life cycle work matters most where models continue to operate, as in manufacturing and in some postmarketing contexts. The FDA expects sponsors to integrate model monitoring, retest triggers, and change controls into the pharmaceutical quality system under ICH Q10, and allows ICH Q12 tools, such as established conditions and postapproval change management protocols, to agree in advance which changes require submission.

Where models come from vendors, sponsors remain accountable for credibility evidence they may not fully control. Contract terms should secure access to training data descriptions, performance results, and version history, and sponsors should plan for independent verification on their own data. The FDA has flagged third-party models as an open issue in its own 2026 summary of docket feedback.

Engagement pathways and how to use them

The FDA strongly encourages early engagement. Steps 1 through 3 and a high-level Step 4 plan give the agency enough to react to. The draft names several routes: INTERACT and pre-IND meetings for early scientific discussion, Type C and Type D meetings for product-specific questions, and a set of specialized programs for particular use cases. These include the Complex Innovative Trial Design program for AI in novel designs, the Model-Informed Drug Development Paired Meeting Program for exposure-response and dose-selection models, Drug Development Tool qualification and the ISTAND pilot for AI tools that evaluate patients or adjudicate endpoints, the Digital Health Technology program for AI-enabled measures, and the Emerging Drug Safety Technology Program for AI in pharmacovigilance.

Early meetings are often where sponsors learn that reducing model influence, rather than adding more evidence, is the right path. FDA reviewers have publicly asked whether training data reflect the population a sponsor intends to enroll, and have suggested explainable AI techniques for high-influence prognostic uses. These are precisely the questions the credibility framework was built to structure.

Operational AI use cases, such as predictive feasibility models applied to enrollment planning, usually sit outside the draft's scope because no regulatory decision rides on the output. Sponsors should still document that scoping call, because the same algorithm might cross into scope if its output starts to influence a protocol-level eligibility decision.

What this means for sponsors in 2026

The FDA has told industry audiences that its Center for Drug Evaluation and Research has now received more than 1,500 submissions with AI components, up exponentially since 2016, with the majority being investigational new drug applications. The draft guidance is non-binding, and the final version may change on third-party models, generative AI, and the risk matrix itself. The direction, however, has stabilized. A credibility package built around a documented context of use, an explicit model risk rating, a graded assessment plan, pre-specified acceptance criteria, and life cycle controls will meet the expectations the FDA, the EMA, and ICH are converging on today.

Sponsors do not need to wait for finalization to act. The practical work is to inventory every AI model with potential regulatory impact, draft a one-page scoping memo for each one, bring high-risk uses to an early FDA meeting, and build vendor contracts that preserve the sponsor's ability to document credibility on request.

Platforms that touch sponsor operations, including DecenTrialz, which combines AI-assisted participant matching with registered-nurse-led pre-screening before a referral reaches the research site team, are typically operational rather than evidence-generating. The research site team continues to own final eligibility determination, informed consent, study walk-through, and enrollment. Even so, sponsors evaluating any AI tool, internal or vendor-supplied, should ask the same credibility questions the FDA framework formalizes: what is the context of use, what is the model influence, what is the decision consequence, and what evidence would support trust in the output for that specific use.