Less manual document work in chemicals, pharma and medtech, with a qualified person signing off

In chemicals, pharma and medical technology, much of the skilled work is reading and writing documents that must be right: adverse event reports, safety data sheets, regulatory updates, instructions for use and risk management files. AI changes how much of that reading and first drafting people do by hand. The responsibility stays where it is. A qualified person still reviews and signs off, but starts from a prepared record with sources instead of a blank form.

Use is growing fast, often through general tools. In exploratory, non-representative surveys of German chemical and pharmaceutical companies published by Daubenfeld, Hasselbach and Just in the Journal of Business Chemistry in 2025, AI use rose from 34% of companies in 2020 (66 respondents) to 76% in 2025 (57 respondents). In the open answers, generative AI was the most common use at 55.6%, including ChatGPT for creating and summarising documents. The leading obstacle in 2025 was IT security and data protection, at 88%, and mid-sized firms with 50 to 999 employees reported the greatest difficulty keeping up with digitalisation. In the ifo survey of May 2025, about every second chemical company used AI.

Medtech shows the same pattern. BVMed's 2026 seminar on technical documentation, titled "Von Word & Excel zum kontrollierten Einsatz von KI", notes that tools such as Copilot, ChatGPT or specialised AI applications are already used for translations, text drafts, reviews and research, and that uncertainty often leads companies to restrict AI heavily or not to use it at all. FORUM Institut held events in 2026 on AI in GxP, pharmacovigilance, Medical Affairs and regulatory intelligence. Dr Cornelia Hunke warned at one of them that unstructured processes do not get better through AI, at most chaotic faster. So we start with one defined process and its approval steps.

They are document flows with a clear structure, a clear owner and a review step that already exists. The companies named below were reported at trade events, by the press or by vendors. Cloudsail did not build these systems. Each use case has its own page, linked below.

• Pharmacovigilance case intake. Safety reports that arrive as emails or free text are turned into structured E2B(R3) cases, the standard format for exchanging individual case safety reports, and qualified staff review every case. At a FORUM Institut event in 2026, Reinhold Schilling of Wörwag Pharma described such a pilot, with its errors, correction loops and development effort. He gave no measured results and said that responsibility for assessment, quality and compliance stays clearly with people.
• Regulatory monitoring. The assistant monitors the regulatory publications you follow, groups and classifies them by product and topic, and summarises what changed with a link to the source, for your regulatory affairs team to assess. At a FORUM Institut event in 2026, Dr Rüdiger Faust of UCB Biosciences described regulatory intelligence in which AI monitors, groups, classifies and summarises, with human validation and audit logs, and said that this requires basic governance and oversight mechanisms.
• Technical documentation for medical devices. Drafts of instructions for use and risk management documents from your specifications and earlier versions, translations with post-editing, and checks of EUDAMED master data and UDI data against your own records, all released by your regulatory and technical writers. FORUM Institut's 2026 events covered these uses, and Dr Michaela Akermann of PAUL HARTMANN AG said there that AI can support companies in checking data quality.
• Safety data sheets. Handling, storage and classification data are extracted from supplier safety data sheets into your hazardous substance register or ERP, with each value linked to its place in the PDF. The Belgian chemical logistics company H.Essers reported in about February 2025 that it extracts handling and storage data from more than 30000 safety data sheets a year, with results "at least as accurate as human interpretations of the SDS". WEKA Media, as a vendor, reported in 2025 an AI import of safety data sheet PDFs into its EHS 360 plus software and called manual entry a time-consuming and error-prone process.
• Supplier certificates and internal procedures. Certificates of analysis and other supplier documents are read and checked against your specification, with deviations passed to quality assurance. Staff ask about SOPs and work instructions in their own words and get answers that cite the current approved version.

Some of this already exists as a product feature. If you run WEKA's EHS 360 plus for your hazardous substance register, its AI import of safety data sheets is the first thing to test. Translation tools and general assistants such as DeepL and ChatGPT are already used in medtech documentation, according to FORUM Institut's 2026 event reports. Large chemical and pharmaceutical groups often build in-house.

A custom build pays off for mid-sized manufacturers, the firms with 50 to 999 employees that the Journal of Business Chemistry survey names as struggling most. It pays off when the flow crosses systems such as an inbox, the safety database and the QMS, when documents with health data, formulations or design files must not leave your own servers, and when your quality system needs validation evidence that a general tool cannot provide. Process control and machine learning on laboratory or production data are specialist territory, and we do not build them.

The rules are demanding but workable. The lawyer Alexander Maur said at a FORUM Institut event in 2026 that the legal framework is complex but does not stand in the way of use. It does draw clear lines, and we stay on the right side of them.

GMP: no generative AI in critical applications. The draft of a new Annex 22 to the EU GMP guidelines, published in July 2025, covers static, deterministic machine learning models and says that generative AI and large language models should not be used in critical GMP applications. In non-critical uses, qualified staff must confirm that the output is fit for its purpose. It supplements Annex 11 on computerised systems. The consultation closed in October 2025, there was no final text as of 11 August 2026, and the EMA plans to hand a final text to the Commission in the fourth quarter of 2026 (PharmTech, 2026). We follow the draft now: we do not build generative AI into critical GMP applications, and every output in a non-critical use is confirmed by a qualified person.

MDR: no software with a medical purpose. Whether software is a medical device depends on its intended purpose (Johner Institut, 2026). Software that suggests a diagnosis or therapy, triages patients or changes medically relevant content would be a medical device and would make its maker a manufacturer under the MDR. We do not build such software. Our assistants support your internal documentation work, such as drafting technical files or checking master data, and your regulatory affairs team confirms their intended purpose in writing before we build.

The AI Act. AI that is part of a medical device is covered through Annex I, with high-risk obligations from 2 August 2028 after the Digital Omnibus. Internal assistants for safety reports, safety data sheets, regulatory monitoring and documentation are not part of your device and are not among the Annex III high-risk uses. The duty to take AI literacy measures for staff remains.

Health data, trade secrets and the works council. Safety reports contain health data about patients, which may be processed only under very narrow conditions (Gleiss Lutz, 2024). Formulations, specifications and design files are trade secrets. Both are reasons to run the system on your own servers or in your own cloud account, with access limited to the people who already work with these records. The audit trail records who signed off, because your quality system requires it. Usage logs are kept separately with pseudonymised IDs and agreed retention, ready for the works agreement. This is the technical side. You decide, advised by your data protection officer and lawyers.

We build where your data may go. On your own servers we use an open-weight model, which is a model whose weights you run yourself, and no data leaves the building. In your own cloud account, the models run in an EU region under your contracts. An LLM gateway, one controlled access point to all models with keys, budgets and logs, sits in front of every model. For validated processes we pin the model version and the prompt version, so the system you validated is the system that runs, and every change goes through your change control.

• Inboxes and safety database: safety reports from Outlook mailboxes and web forms, prepared as E2B(R3) cases and handed to your safety database for review, never submitted by the system.
• Quality and document management: SOPs, specifications, technical files and risk management documents from your QMS and from SharePoint, d.velop or ELO, indexed with their version and release status, so answers cite approved versions only.
• Substance and material data: values from safety data sheets into the hazardous substance register or EHS software, and material master data in SAP where the use case needs it.
• Regulatory sources: the authority and standards publications you follow, monitored and summarised with a link to each source.
• Audit trail: for every record or draft the system stores which sources it used, which model and prompt version produced it, what the reviewer changed and who signed off, in your own systems.

Testing before go-live is what GxP teams already call validation, and we deliver it as evidence you can file. We know of no published, measured case from a German mid-sized company in this industry, so we do not promise a number. We measure on your own cases instead: past safety reports with the E2B(R3) fields your staff entered, past supplier safety data sheets with the values in your register, or past documentation chapters with the reviewer's corrections, compared field by field.

You set the acceptance threshold with your quality assurance, for example the share of mandatory fields that must be right before a case enters the review queue, and the acceptance test report shows whether it is met, with every failing case listed. We also test what must not happen: a value without a source, a draft based on a superseded SOP version, a field filled in although the document did not contain it.

Before it takes over a step, it runs in shadow mode next to your team, and we compare. We measure hours per case and the share of fields reviewers had to correct, before and after. After go-live, the same tests run after every change to the model, the prompts or the sources, and the results go into your change control records.

Start with one document flow that costs qualified people hours every week, has a clear review step and many past examples: incoming safety reports, supplier safety data sheets, regulatory monitoring or one type of technical document. Bring a description of it to a free 30-minute first call with an engineer. The call needs no access to your systems or data.

After that we agree the first step and, with your quality assurance, its acceptance threshold. Each step has a fixed price, agreed in writing after the first call. If your teams already use ChatGPT or Copilot for drafts, the free AI usage review shows on one page what that costs and where it falls short, built from exports you choose to send.