When Pharma Uses AI:
Who Owns the Risk?

Malaysia’s emerging AI and data-protection framework puts renewed focus on accountability when AI enters regulated pharmaceutical processes.

On 5 October 2026, Malaysia’s Personal Data Protection Department opened consultation on a proposed Artificial Intelligence and Personal Data Protection Framework. The proposed framework addresses personal-data processing across the AI lifecycle, including third-party AI systems, governance, risk management and accountability. It is not yet binding. However, it is a timely reminder for businesses to examine where AI already sits within their operations.¹

For pharmaceutical companies, the issue is especially relevant. AI is already being explored in areas such as adverse-event processing and regulated quality operations. A published Pfizer pilot tested AI-assisted adverse-event case processing, while pharmaceutical industry case studies describe AI applications in investigations, manufacturing and quality.²

Where AI becomes part of a regulated pharmaceutical process, a key question for Legal and Compliance is whether existing responsibilities, contracts and controls continue to work as intended.

Regulatory Responsibility Does Not Move to the AI

Malaysia’s pharmacovigilance framework requires Product Registration Holders (PRHs) to establish pharmacovigilance systems and addresses adverse-event reporting and other product-safety responsibilities.³

Consider a Malaysian patient-support programme where patient communications are initially screened by a call-centre provider for potential adverse events before escalation to Pharmacovigilance. The regional business subsequently introduces an AI platform into that screening process.

The change may appear operational, but it can alter the chain through which the PRH discharges its regulatory responsibilities. The call-centre provider may begin relying on the AI to decide which communications require escalation, while the AI itself is procured and controlled by a regional team. The Malaysian business may have limited visibility over how the system is configured or monitored. The technology provider may change the model without the Malaysian team being aware of the implications, or its standard terms may limit responsibility for inaccurate outputs. If the AI fails to identify a potential adverse event, it may also be unclear who has authority to suspend the system, retrieve earlier cases or obtain the records needed to investigate the failure.

The principle has already surfaced outside pharma. In Moffatt v Air Canada, an airline chatbot gave incorrect information concerning Air Canada’s bereavement-fare policy. Air Canada argued that it could not be held liable for information provided by the chatbot. The British Columbia Civil Resolution Tribunal rejected that argument and found Air Canada liable in negligent misrepresentation.⁴

The setting is different, but the accountability point is relevant: automation does not necessarily transfer responsibility away from the organisation using it.

What Should Legal Actually Do?

Regulatory, Quality and Pharmacovigilance should continue to determine whether the AI-enabled process meets the applicable pharmaceutical requirements. Where material personal-data processing is involved, the DPO or Privacy function should lead the data-protection workstream. Legal should not duplicate those functions. Its role is to address the gaps in responsibility, contractual protection and control created by the new operating model.⁵

Four questions provide a practical starting point.

1. What role does the AI perform in the process?

Legal needs sufficient understanding of the use case to identify where AI creates a new dependency between functions, group entities or external providers.

There is an important difference, for example, between a tool that transcribes a patient call and one that determines whether the call enters the pharmacovigilance workflow.

2. Do responsibility and contracts align?

Legal may need to address model changes, subcontracting, audit and information rights, regulatory cooperation and responsibility for technology failures. Where the DPO or Privacy function identifies requirements concerning patient data, model training or cross-border processing, those requirements should be reflected contractually.

If a call-centre provider must identify potential adverse events but relies on an AI provider that broadly disclaims responsibility for its outputs, Legal should consider whether that allocation of risk remains appropriate given the role the technology plays in the regulated process.

3. Can the business intervene when necessary?

If monitoring indicates that the AI is failing to flag potential adverse events, Pharmacovigilance should determine the safety and regulatory response.

If Pharmacovigilance determines that the AI-supported screening should be suspended, Legal should ensure that the Malaysian business can implement that decision, revert to manual review and obtain the information needed to investigate affected cases.

4. Can the company reconstruct and explain the decision-making process?

If concerns about an AI-assisted process emerge after deployment, the company should be able to reconstruct how earlier cases were handled, including the system used, its relevant inputs and outputs, any human review and any subsequent material changes to the system.

Legal should ensure that appropriate records are retained and that contracts provide access to vendor-held information needed for an investigation or regulatory response.

The Right Answer for the Wrong Jurisdiction

Regional use of AI creates a separate issue. A regional Medical Affairs team may use AI to prepare responses to HCP enquiries based on global product information. A response may be scientifically accurate but inconsistent with the indication or product information approved in Malaysia.

Medical and Regulatory should assess the substantive response. Legal and Compliance should ensure that the regional process preserves appropriate Malaysian review and does not allow automation to bypass local requirements.

Where Legal Fits

AI does not make Pharmacovigilance, Regulatory, Quality, Privacy or IT Legal functions.

Legal’s role is at the interfaces between them: ensuring that contractual arrangements reflect regulatory responsibilities, regional systems accommodate local requirements, the business can respond when specialist functions identify a problem, and the records needed to investigate a failure remain available.

The objective is not to add another layer of governance around every AI use case. It is to ensure that introducing AI does not weaken the accountability, controls and contractual protections that already support the regulated process.

As AI becomes more embedded in pharmaceutical operations, keeping regulatory responsibility, operational control and contractual protection aligned will become an increasingly important part of Legal’s role.