GAWEL LEGAL

Pharma AI governance

GAWEL Legal advises pharmaceutical and biotech companies on the legal governance of AI use in research, development and business operations. The work covers internal policies, approval responsibilities, supplier contracts, data and confidentiality, and the Swiss and EU legal requirements relevant to each use.

Discuss AI governanceView scope

When legal and compliance teams need support

This service is for in-house counsel and compliance teams introducing AI tools, reviewing existing uses or deciding how responsibility should be shared across the business. It brings legal advice into the work of research, procurement, medical affairs, regulatory affairs, quality and information security.

Possible assignments include:

  • Reviewing an AI supplier's terms before an R&D team uses the service with unpublished research or proprietary compound data.
  • Revising an internal AI policy so employees know which tools and information they may use, who approves exceptions and when legal review is needed.
  • Assessing a proposed patient-information chatbot with the company's medical, privacy and technical specialists before deciding how it should operate.

Scope

Internal policies and approval responsibilities

Review selected AI uses and the decisions they support. Draft or revise permitted-use rules, approval responsibilities and escalation routes. The work can include rules for confidential information, review of generated material, guidance for staff and records explaining why a particular use was approved or restricted.

AI suppliers and contracts

Review and negotiate terms for AI tools, development services and research collaborations. Address permitted data use, reuse for model training, confidentiality, rights to use inputs and outputs, access to relevant documentation, subcontracting, service changes, liability and exit arrangements. Contract positions should reflect the proposed research or business use.

Data and confidentiality

Assess how patient, trial-participant and employee information, research datasets and unpublished findings may be used. Review data-sharing permissions, supplier roles, retention, access from other countries and confidentiality commitments. Where a data protection impact assessment is required, the work can include legal support for the assessment and its resulting measures.

Research and regulated workflows

Identify the legal questions raised when AI outputs enter research, clinical-trial, manufacturing, pharmacovigilance or regulatory-documentation processes. Coordinate those questions with the responsible scientific, quality and regulatory specialists, including the allocation of supplier responsibilities and access to records needed for review.

Patient-facing tools and communications

Review the purpose, audience and content of proposed chatbots, medical-information tools and AI-assisted communications. Consider applicable transparency duties, medicinal-product advertising rules, data protection and the boundaries between information, promotion and medical advice. Define the legal review and approval responsibilities for the intended use.

Changes after introduction

Assess changes to the tool, supplier terms, information used or intended purpose. Review whether a new use calls for different permissions, responsibilities or controls, and update the relevant policy or contract provisions. The work can also address legal questions arising from an incident or an unexpected output.

What the work can produce

An assignment can result in:

  • A written legal assessment of selected AI uses, identifying applicable requirements, unresolved questions and recommended actions.
  • Revised policy wording and an allocation of approval and escalation responsibilities.
  • A marked-up supplier agreement, proposed amendments and negotiation positions.
  • A record of legal decisions and matters requiring scientific, quality, privacy or technical review.

The review can start with one use, an existing policy or a supplier contract. Company-wide governance work can build on those assessments. Advice is available for defined assignments or as ongoing support on a retainer. See fee arrangements.

Questions

Is pharmaceutical research excluded from the EU AI Act?
Not automatically. The Act has exclusions for AI specifically developed and put into service solely for scientific research and development, and for certain activities before a system or model is placed on the market or put into service. Using an ordinary AI tool in research does not itself establish an exclusion. Real-world testing falls outside the latter exclusion. Art. 2(6) and (8) AI Act; recital 25 AI Act.
Can the EU AI Act apply to a Swiss pharmaceutical company?
Yes. Depending on its role, a Swiss company can fall within scope when it places an AI system on the EU market, puts one into service there, or provides or deploys a system whose output is used in the EU. The assessment concerns the relevant company and use, rather than the group's headquarters alone. Art. 2(1)(a)–(c) AI Act.
Can employees enter patient data or confidential research into generative AI tools?
That requires a review of the information, purpose, supplier terms and safeguards. An enterprise account or a commitment not to train on inputs does not settle the other data-protection and confidentiality questions. Removing names alone does not establish that information is anonymous. Art. 5(a) DSG; recital 26 GDPR. Internal rules should identify approved tools and permitted information, with a route for uncertain cases. See the Swiss authorities' workplace guidance.
Does every AI use require a data protection impact assessment?
No. The trigger concerns the likely high risk of the planned processing, not the AI label alone. Relevant considerations include its nature, scope, circumstances and purpose; processing sensitive personal data on a large scale is one important case. The assessment follows the applicable Swiss or EU rules. Art. 22 DSG; Art. 35 GDPR.
Must a patient chatbot or AI-generated communication carry a disclosure?
The answer depends on the system, content, audience and the company's role. AI Act interaction notices, machine-readable marking and visible disclosures have different conditions and exceptions. These duties must be assessed alongside the rules governing medicinal-product information and advertising; an AI disclosure does not replace that review. Art. 50 AI Act; Swissmedic's advertising guidance.
Does this service include technical or GxP validation?
The service covers legal assessment, policies, contracts and coordination with the responsible specialists. Scientific performance assessment, technical testing, GxP validation and certification are outside its scope. A policy or supplier agreement does not establish that a system is validated. EMA's reflection paper on AI in the medicinal-product lifecycle addresses the wider scientific and regulatory considerations.

Further reading

Discuss your AI governance needs

Describe the AI use or policy question and the legal support you need. Please leave confidential documents and sensitive details out of the initial enquiry.

Discuss AI governance