PHARMA & MEDTECH · INDUSTRY HUB

AI for pharma and medtech: regulatory RAG, adverse-event triage and AI as medical device

How Swiss pharma and medtech companies use AI in regulatory research, adverse-event triage and literature synthesis – within HMG, Swissmedic, ISO 13485, MDR EU 2017/745 and the EU AI Act.

Researched & fact-checked by: DuneDive LLC · As of: 2026-05

Swiss pharma and medtech sector and AI

The Swiss pharma and medtech sector in 2026 is a central economic factor. Pharma is dominated by Novartis and Roche, plus Lonza, Vifor, Galenica and over 1,000 smaller pharma research, development and production companies. MedTech comprises around 1,400 companies with about 70,000 staff in total; the industry body is Swiss Medtech (formerly FASMED). Significant MedTech sub-sectors are orthopaedic implants (Mathys, Medartis), dental (Straumann), hearing aids (Sonova, Phonak), diabetes (Ypsomed) and diagnostics (Roche Diagnostics, Stratec).

AI in 2026 has two faces in this sector. First as an efficiency tool in regulatory affairs, pharmacovigilance, clinical-trial preparation, scientific literature synthesis and production monitoring – adoption is broad and growing. Second as an integral component of medical devices and diagnostics themselves – from AI-supported image analysis in radiology through insulin-pump algorithms to AI in hearing aids. The second category is regulatorily complex: every AI function in a medical device requires a CE conformity assessment under MDR EU 2017/745 or IVDR EU 2017/746, with corresponding class (typically IIa, IIb or III for AI software).

The supervisory authority is Swissmedic (therapeutic products and medical devices); since the Mutual Recognition Agreement (MRA) between Switzerland and the EU lapsed in May 2021, MedTech manufacturers with EU market must additionally be certified by an EU notified body. The EU AI Act Regulation 2024/1689, binding in Annex-III parts from February 2026, classifies AI in medical applications as high-risk and imposes additional duties beyond the MDR/IVDR.

Why a deliberate AI position for pharma and medtech is mandatory in 2026

Four pressure points hit the sector simultaneously.

First: regulatory volume. Pharma regulation covers HMG, AMZV, KlinV, Swissmedic guidelines, ICH guidelines (E, M, Q, S, V), EMA guidance and FDA rules for the US market. MedTech regulation covers HMG, MepV, MDR EU 2017/745, IVDR EU 2017/746, ISO 13485 (quality management), ISO 14971 (risk management), IEC 62304 (software lifecycle) and IEC 62366 (usability). A RAG knowledge base over product-relevant texts is a significant efficiency lever in 2026 – for junior staff and experienced RA managers alike.

Second: adverse-event and pharmacovigilance volume. Pharma companies process thousands of adverse-event reports annually from clinical trials, spontaneous reports, patient programmes and literature sources. The regulatory duty to triage, assess and report (Swissmedic, EMA, FDA) is time-critical. AI-supported triage can take over 70-80 percent of initial classification; the medical reviewer decides on the final steps.

Third: scientific literature depth. PubMed in 2026 records over 40 million entries with annual growth of around 1.5 million; specific therapy areas reach several thousand new publications per year. An RA or medical-affairs department doing this without AI support is structurally under-resourced in 2026. AI synthesis with clear source citation and a verification step by the scientist is industry standard.

Fourth: AI inside the medical device itself – CE class and EU AI Act. When a manufacturer builds an AI function into the product (image-analysis algorithm, classifier, recommendation engine), this function becomes part of the medical device. MDR Art. 8 and Annex VIII require class assessment; AI software is often IIa or IIb, class III for life-sustaining functions. Additionally, the EU AI Act classifies AI medical devices as high-risk – with its own duties on risk management, data quality, technical documentation and human oversight.

The point: AI efficiency tools on one side, AI-in-product on the other – both need careful governance in 2026, but with very different frames.

Where AI works productively in pharma and medtech in 2026

Five application clusters cover the bulk of realistically automatable work today. Important: AI efficiency tools must be clearly distinguished from AI-in-medical-device – the latter is subject to MDR/IVDR and the EU AI Act.

Regulatory research with RAG. Swissmedic guidelines, MDR annexes, ICH guidelines, ISO standards, FDA guidance documents and internal SOPs are indexed into a proprietary knowledge base. RA staff can ask "Which clinical data does MDR Annex XIV require for class IIb implants?" and receive grounded answers with citations. Important: ISO standards are copyrighted; access in a RAG system is permitted only for persons with a standard licence.

Adverse-event triage with classifier. Spontaneous reports, clinical-trial data and patient-hotline entries are classified by severity, suspected causality, regulatory reporting duty (Swissmedic, EMA, FDA) and temporal urgency. Suspect cases (serious, unexpected, trial-related) go immediately to the medical reviewer. Standard cases are bulk-confirmed by the reviewer. Mandatory: a validation study of classifier performance, a bias audit, a documented audit trail.

Scientific literature synthesis. PubMed, Embase, Cochrane Library and ClinicalTrials.gov sources are synthesised on specific questions. For medical-affairs answers, clinical-trial preparation, health-technology-assessment preparation. Every synthesis with clear source citation; the scientist verifies cited sources before use. Tools 2026: Elicit, scite.ai, in-house RAG pipelines with PubMed API.

Clinical trial preparation. From trial protocols, study reports and regulatory templates, protocol drafts, Clinical Study Report (CSR) drafts and Investigator Brochures are prepared. Important: every output is reviewed by the RA manager and medical-affairs owner. Hallucination risk is high, hence source duty in every output.

Production and quality monitoring. In pharma production (especially continuous manufacturing, Process Analytical Technology) and in MedTech production, sensor data are evaluated in real time. Deviations are classified and escalated to the responsible person. Sector-specific platforms (Werum PAS-X, Apprentice, ValGenesis) plus in-house ML models are common.

Across all applications: patient data and clinical-trial data are especially sensitive personal data under the revised FADP. EU/CH hosting with DPA, no-training, pseudonymisation where possible. For source-relevant applications (CSRs, regulatory submissions), source duty and documented human verification.

How a pharma or medtech company starts with AI – in 7 steps

01Classify: is this an efficiency application or an AI function in the medical device? This question decides project management, budget and timeline. AI-in-product triggers MDR/IVDR and the EU AI Act.
02AI inventory and SOP adjustment: capture all AI applications already deployed, with model, provider, data classification, hosting region. Adapt internal SOPs for AI workflows – for MDR/IVDR products additionally check ISO 13485 and IEC 62304 compliance.
03Start an efficiency pilot: regulatory RAG over Swissmedic guidelines, MDR annexes and internal SOPs. Eight to twelve weeks of implementation. Licence check for ISO standards and paid sources.
04Decide hosting architecture: EU/CH hosting with DPA and no-training for all patient and clinical data. For especially sensitive applications (adverse-event classification, clinical-trial data) local hosting (Llama 3.x, Mistral) on own servers as standard.
05Validated applications with documented performance: adverse-event classifier, literature synthesis with source duty, clinical-trial preparation workflows. Mandatory: a validation study, a bias audit, a documented SOP, an audit-grade trail.
06AI-in-product with MDR/IVDR compliance (if relevant): project management with notified body, CE class determination, technical documentation per MDR Annex II/III, clinical evaluation, post-market surveillance. Additionally EU AI Act duties (risk management, data quality, human oversight).
07Quarterly review and continuous improvement: performance metrics per AI application, model-drift monitoring, periodic re-validation. For AI-in-product additionally post-market surveillance reporting to Swissmedic and the notified body.

Where a pharma or medtech company should start in 2026

Three stages, in this order.

Stage 0 – Separate AI-for-operations from AI-in-product. Before any pilot, clarify: is this an efficiency application (regulatory research, pharmacovigilance triage, literature synthesis, production monitoring) or an AI function in the medical device itself? The second category triggers MDR/IVDR and the EU AI Act and requires a completely different project management with notified body and CE assessment.

Stage 1 – Efficiency applications as pilot. Realistic for pharma RA departments and MedTech RA teams: regulatory research with RAG over Swissmedic guidelines, MDR annexes and internal SOPs. Low risk (no patient data), high benefit (all RA staff gain research access). Eight to twelve weeks of implementation.

Stage 2 – Validated applications with documented performance. After a successful pilot: adverse-event classifier, literature synthesis with source duty, clinical-trial preparation workflows. Mandatory: a validation study per application, a bias audit, a documented SOP for the AI workflow, an audit-grade trail.

Stage 3 – AI-in-product with MDR/IVDR compliance. Only after success in stages 1-2: AI functions in the medical device itself. Project management with notified body, CE class determination, technical documentation per MDR Annex II/III, clinical evaluation, post-market surveillance. Additionally EU-AI-Act duties: risk-management system, data-quality review, technical documentation, human oversight, transparency notification. This stage typically requires its own software-as-medical-device team with RA, software-lifecycle and ML-engineering expertise.

MedTech SMEs without in-house RA expertise should bring in specialist consultancies (notified-body experienced) and a software-as-medical-device advisory team for stage 3. The cost of a CE conformity assessment for class IIb AI software typically runs in the six-figure range.

Where AI does not belong in pharma and medtech in 2026

Three areas where reservation in 2026 is legally and ethically required.

AI function in a medical device without CE conformity assessment. An AI image-analysis function in a diagnostic tool, an AI algorithm in an insulin pump, an AI classifier in a hearing aid – all three are medical devices and require CE assessment under MDR. Placing on the market without a CE certificate is a breach of the therapeutic-products law with criminal and civil consequences. "We are only testing this internally" is no longer an excuse in 2026 – even clinical testing on patients requires authority approval.

Adverse-event classification without a human reviewer. Automatic severity classification of an adverse event may serve as triage – the regulatory reporting duty (Swissmedic, EMA, FDA) and the medical assessment stay human. Fully automatic reporting or non-reporting is not permissible in regulation and can trigger supervisory proceedings.

Clinical trial outputs (CSR, statistical analysis plan, regulatory submissions) without human verification. AI tools can generate drafts, build data tables, synthesise literature – the final scientific responsibility and the signature on the document belong to the qualified scientist. Hallucination risk is not academic here; it led to regulatory delays in 2024/2025.

Particularly delicate and not finally settled in 2026: AI-supported automatic study endpoints without human assessment. This holds in both the pharma and MedTech worlds. Regulatory authorities (Swissmedic, EMA, FDA) in 2026 typically require a human finding per AI classification in study endpoints.

Trade-offs

STRENGTHS

Regulatory research with RAG cuts RA first responses from days to hours
Adverse-event triage relieves medical reviewers from standard cases
Scientific literature synthesis aggregates thousands of publications no scientist reads daily
Clinical-trial preparation significantly accelerates protocol and CSR drafting
AI-in-product opens new therapy options (digital therapeutics, AI diagnostics) within strict regulation

WEAKNESSES

AI-in-product triggers MDR/IVDR and the EU AI Act – project management with notified body, six-figure assessment cost
Clinical-trial outputs require human verification – hallucination risk is regulatorily real
ISO standards are copyrighted – controlled hosting and licence check mandatory
Adverse-event classifiers need a validation study and periodic re-validation
MRA expiry forces additional EU notified-body certification for EU market

FAQ

When is an AI application in a medical device a medical device itself?

As soon as the AI function fulfils a medical purpose (diagnosis, therapy, monitoring, prediction of a health state) and meets the definition of a medical device or IVD under MDR EU 2017/745 or IVDR EU 2017/746. Software as medical device (SaMD) is governed by MDR Annex VIII classification rule 11 – AI software is typically IIa, IIb or III. Pure administrative or efficiency applications (regulatory RAG, internal search) are not medical devices. When in doubt: consult a notified body or Swissmedic.

How does the EU AI Act affect MedTech manufacturers?

The EU AI Act classifies AI in medical devices (Annex III, health area) as high-risk. High-risk AI systems are subject to additional duties beyond MDR/IVDR: risk-management system (Art. 9), data-quality requirements (Art. 10), technical documentation (Art. 11), transparency and user information (Art. 13), human oversight (Art. 14), accuracy and robustness (Art. 15). The conformity assessment can run jointly with the MDR CE assessment but does not simplify the project. Swiss manufacturers with EU market are affected.

How do we protect clinical-trial data in AI use?

Three layers. First: pseudonymisation before model call – patient identifiers are replaced by trial codes, re-identification possible only with restricted authorisation. Second: EU/CH hosting with DPA, no-training guarantee and documented data-flow trail. For especially sensitive trials (paediatric, psychiatric, oncologic) local hosting (Llama 3.x, Mistral) on own servers. Third: audit-grade logs per ICH-GCP, IEC 62304 and ISO 13485 – every data access is logged, periodic review by the quality owner. For revised FADP relevance additionally a DPIA. See dpia-für-ki-systeme.

What does Swiss Medtech say about AI in the sector?

Swiss Medtech follows the AI topic actively in 2026 with a focus on MDR/IVDR compliance, EU AI Act preparation and the consequences of the MRA expiry for EU market access. Events in 2025/2026 address AI in diagnostics, implants and digital therapeutics. The association recommends for AI-in-product an early consultation with the notified body and Swissmedic; for AI-in-operations standard compliance with the revised FADP and ISO 13485 for quality-relevant workflows.

Sources

FITS YOUR STACK?

What this looks like in your business – a 30-minute intro call.

Book a call