What digitalising pharma is actually for: economics, patients, regulation and data

Digitalisation in the pharmaceutical industry is rarely sold badly. It is usually sold vaguely. This article tries to say precisely what it is for, in a sector where the answer differs from the one you would give in automotive or logistics.

This is part 3 of 3 of the “Pharmaceutical digital transformation” series; it follows part 2, from molecule to batch release. It covers how the sector got here, the four stakes that justify the investment, and where the technology is heading.

Forty years, four waves

The industry’s digital history is shorter than people tend to assume, and it came in four recognisable waves.

In the 1980s and 1990s, computing entered the laboratory: electronic databases, specialised software for molecular design, automated management of research data. Discovery and development started to speed up.

The 2000s brought the internet, and with it collaboration, information sharing and supply-chain management. Researchers on different continents could work on the same problem in the same week rather than the same year.

Then came connected devices, artificial intelligence and distributed ledgers, with traceability, medicine security and the first serious attempts at personalised treatment. Connected devices made remote patient monitoring and real-time data collection possible, which began to move medicine from reacting to anticipating.

The current wave is personalised medicine, gene therapies and patient-centred digital platforms. These change how medicines are made, and also how care is delivered and received.

Stake one: economics

The economic case is real but often misstated. New technology demands substantial up-front investment: the technology itself, training, regulatory compliance and ongoing maintenance. None of it comes back quickly.

Managed properly, it buys several things. Robotics and automation speed up production and remove manual errors, and real-time monitoring catches a drift during the batch instead of at batch review. AI and machine learning applied across the production cycle turn historical data into forecasts that planners can use. And digital supply-chain systems predict stock requirements, shorten lead times and cut losses in transport and storage.

The result is lower operating cost, better inventory management and less waste. The catch is timing. The cost is immediate and visible; the return is delayed and spread across departments that did not pay for it. More programmes fail at that seam than fail technically.

Stake two: the patient

The health case has two halves. In research and development, bioinformatics and systems biology make it possible to analyse genetic, molecular and clinical data at volumes no human team could handle, to find new therapeutic targets or support bespoke medicines. In silico modelling on high-performance computers simulates how molecules interact with their targets, cutting time and cost in the laboratory. AI can flag a molecule’s likely toxicity or efficacy well before clinical trials, and digital tools make adaptive trials workable, with protocols adjusted as data comes in.

In care delivery, large health datasets allow patients to be grouped by genetics or symptoms and offered better-matched treatment. Connected devices such as smart watches and tracking apps feed real-time information that helps adjust treatment, and digital platforms support follow-up, therapeutic education and teleconsultation.

So digitalisation can bring innovative medicines to patients sooner and shorten the distance between the clinic and the patient. It does neither automatically, and a programme that promises otherwise should be read with care.

Stake three: regulation, and what has changed recently

The industry is governed by rules designed to guarantee the quality and safety of medicines. In France the framework runs from the Code de la Santé Publique through Good Clinical Practice, Good Laboratory Practice, Good Distribution Practice and, at the centre for manufacturing, Good Manufacturing Practice.

For computerised systems the working set has long been EU GMP Annex 11, 21 CFR Part 11 and, as industry guidance rather than law, GAMP 5, which is aligned with Annex 11, ICH Q9 and PIC/S PI 011-3. GAMP 5 sorts computerised systems into categories that set the depth of qualification and validation testing; category 2 is no longer used.

Two developments have changed the picture since this series was first drafted.

GAMP 5 Second Edition (2022) did more than add chapters. It shifted the emphasis away from paper validation deliverables towards critical, risk-based thinking about the records produced across concept, project, operation and retirement. It added appendices on Agile development, on AI and machine learning systems and on distributed ledger systems, and substantially revised the sections on electronic batch records and the operation phase.

The European regulator is rewriting Annex 11. On 7 July 2025 the Commission released draft revisions for consultation, which closed on 7 October 2025. The size of the change says a lot: Annex 11 grows from 5 pages to 19, organised in 17 sections. The 2011 text is mostly about validation; the draft gives whole sections to Identity and Access Management (11), Audit Trails (12) and Security (15). The revised Chapter 4 on documentation grows from 9 to 17 pages and writes data-integrity principles into the text. And a new Annex 22 covers artificial intelligence: scope, intended use, acceptance criteria, test data and its independence, explainability, confidence and operation.

An OT engineer reading the draft will draw one conclusion. The European GMP regulator now treats access management, security and audit trails on a manufacturing system as quality requirements rather than IT preferences. The gap between a GMP inspection and a cybersecurity audit is closing from the GMP side.

Managing a system across its life

The lifecycle discipline around any GxP system is worth going through, because this is where most convergence projects meet their first real friction.

• Supplier qualification: a risk-based assessment, by audit or questionnaire, with a specific approach for cloud services.
• User requirements specification: start-up, security, data management, documentation.
• Qualification plan: strategy, roles across engineering, IT, OT, cybersecurity and quality assurance, scope, deliverables (IQ, OQ and PQ protocols and reports), references, and how qualified status is maintained through periodic requalification.
• Risk management: hazards identified, risks estimated for probability, frequency and severity, evaluated qualitatively or quantitatively, and managed across the product lifecycle.
• Qualification and validation: qualification shows that an item is correctly installed, works correctly and is fit for purpose. Validation shows that a process consistently produces its intended result. The difference decides what evidence you owe.
• Change control: any change in a qualified environment is assessed. A major change affecting qualified status triggers requalification; a change that does not, justified by a non-regression assessment, needs only a functional test.
• Periodic review: a regular check for drift, untraced modifications or altered parameters, configuration, user accounts and access rights included.
• Decommissioning: system backup, data archiving, retention of the operating software, a decision on preserving the hardware, and destruction of media holding sensitive data.

That last step is routinely forgotten and is a real security exposure. An old supervision PC sold off with its disk intact carries the network plan, the accounts and sometimes the passwords of the line it used to run.

Stake four: the data

Data is the backbone of this industry. It underwrites R&D, it is the evidence for manufacturing and quality control compliance, and it makes pharmacovigilance possible. Decisions taken on wrong information end up as harm to patients.

Collection. ERP, electronic batch records, MES, serialisation and aggregation, the data historian, the environmental monitoring system. Collecting data in real time means it reaches a central, secured system at the moment it is created, which protects it from alteration, intentional or accidental, and gives continuous visibility of the process. That needs a direct connection between the production equipment and the collection system, with as few intermediaries as possible, and it is exactly where IT and OT infrastructure have to meet.

The benefits are concrete: quality control against real-time parameters, batch-level traceability for compliance and recall, visible bottlenecks, energy management, and maintenance driven by the real condition of the equipment rather than by a calendar.

Integrity. Regulators expect data to meet the ALCOA principles, now usually extended to ALCOA+: attributable, legible, contemporaneous, original and accurate, and also complete, consistent, enduring and available. Those requirements have to be written into the URS at design time, because retrofitting integrity into a system that was not built for it is expensive and often impossible. For an existing estate, the work starts with a detailed inventory and a clear assignment of responsibility: a named system owner accountable for the applications and procedures, and users with defined roles, access levels and recorded training.

Security, and how it differs from integrity. Access control, backup and restore, physical security of server rooms and confidentiality are data-integrity measures that are also cybersecurity measures. The two disciplines still differ. Data integrity protects the data produced: against loss and against alteration, and it has to be possible to show at any moment that the record is genuine — attributable, legible, contemporaneous, original and accurate, and also complete, consistent, enduring and available. Cybersecurity defends systems, installations, networks and data against attack, unauthorised access and damage. Treat one as a subset of the other and you end up with excellent audit trails on a network anyone can reach.

Exploitation. Raw data has no value on its own. The usual five Vs (volume, value, variety, velocity, veracity) apply here too, but veracity weighs far more in a regulated plant than in retail analytics. Used well, predictive analysis can anticipate side effects, find new uses for existing medicines or spot deviations during manufacture, testing and storage.

What comes next

Artificial intelligence is already in the workflow. DeepChem, an open-source library, applies deep learning to drug discovery. PubMed ranks search results with a machine-learning relevance model. Deep-learning models have been used to predict the antimicrobial activity of molecules. In manufacturing and quality control, AI supports traceability and authentication; in trials, it helps select participants. The regulatory question, how to validate a system whose behaviour is learned rather than specified, is the one GAMP 5 Second Edition and the draft Annex 22 set out to answer: define the boundaries of the model and its intended use, and use agreed performance metrics as the acceptance criteria.

Blockchain appeals to the sector for one property, immutability. A distributed ledger combines encryption, chained blocks, a decentralised network and a consensus algorithm, so that altering a record would mean rewriting every later block on every node. For an industry whose central worry is whether a record has been changed, the attraction is obvious, and it has real potential against counterfeit medicines. The caveat is that an immutable ledger says nothing about whether what was written into it was true. Blockchain guarantees that nobody changed the number afterwards. It does not guarantee the number was right when the operator typed it.

The sector came late to digitalisation and is now moving fast, pushed by competition and by new regulation. The risk in that combination is adopting technology faster than the governance that makes it defensible.

A nine-part EUCALEX series turns to the engineering problem underneath all of this: the convergence of OT and IT, and how to achieve it without breaking either.

References

• European Commission, Stakeholders’ consultation on EudraLex Volume 4: Chapter 4, Annex 11 and new Annex 22, 7 July to 7 October 2025.
• ISPE, *GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems*, Second Edition, 2022.
• PIC/S, *Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments*, PI 041-1, 2021.