The Supplier Wrote the Rule
Frontier models now ship with governance attached. Regulators are still writing theirs, and the gap lands on pharma's quality function.
By Mark Rhys Thomas
The Lead
The most consequential AI governance change for pharma this month did not come from a regulator. It arrived as a setting in a cloud console.
AWS has confirmed how Anthropic's Claude Fable 5.1 runs on Amazon Bedrock. Anthropic designates it a Covered Model. Before a customer can call it, they must switch on a retention mode in which prompts and outputs are held for up to 30 days for human safety review by Amazon personnel. The data stays inside AWS and is not passed to Anthropic. Anthropic applies the same 30-day retention on every platform its covered models run on, and content flagged by its safety systems can be kept longer. Eligible customers can run with zero retention under a programme called Enterprise Frontier Safeguards. AWS has not said who qualifies.
None of this is unreasonable. A model capable enough to need safety review should get it. What matters is who wrote the rule, and how quickly it became binding.
Now look at the regulators. In January the FDA and EMA issued ten joint principles for good AI practice in drug development. Principle six asks that sensitive data stay protected across the technology's whole life cycle, with provenance documented in line with GxP. The principles are a foundation for future guidance, not binding rules. This summer the EU pushed the AI Act's high-risk obligations back to December 2027, and to August 2028 for AI embedded in regulated products.
So the shape of governance is changing from both ends, at very different speeds. Supplier terms arrive in weeks and bind on the first call. Regulatory terms arrive as principles and bind in years. In between sits the sponsor, accountable to the regulator for conditions set by the supplier.
This is where my conversations with pharma teams keep snagging. R&D wants the most capable model for protocol drafting or CMC analysis. Quality asks who can see the prompts. The honest answer is now a named third party, for a defined window, under terms nobody at the company negotiated. Then the next function asks the same question and gets a slightly different answer.
That is the case for hub and spoke. A covered model is a supplier to qualify once, centrally. The retention mode, the reviewer access, the route to zero retention and the evidence against principle six belong in one assessment that every spoke inherits. Leave it to each brand team or lab and the same terms get assessed a dozen times, a dozen ways.
The supplier has already written its half of the record. The hub is where you write yours.
Also on the Line
PROCESS
Eleven hours saved, thirteen percent better off. In McKinsey's 2026 State of AI survey, 80 percent say AI has lifted their own productivity, while 37 percent report any contribution to earnings, flat on last year. Glean's Work AI Index puts time saved at 11 hours a week, yet only 13 percent say their organisation performs significantly better, and 69 percent admit shipping work they have not verified. Both are cross-industry and self-reported, and Glean sells a work AI platform. Activity is up. Release is not.
DATA
Nine billion predictions, one provenance question. Google DeepMind's AlphaGenome Atlas, released on 8 September, precomputes the predicted regulatory effect of every possible single-letter change in the human genome, roughly a petabyte of output. It is free for non-commercial research and not validated for clinical use. For target discovery it is a gift. It also means predicted variant effects will enter evidence chains beside measured ones, and the FDA-EMA principles already ask for provenance that is traceable and verifiable. Label the source before it spreads.
COMPUTE
Cost arrives before value. One organisation in five in McKinsey's 2026 survey says AI operating costs, tokens included, already constrain its use, and 28 percent say AI now takes more than a tenth of the IT budget. Most still report no earnings impact. When the cost constraint lands ahead of the return, finance decides which programmes survive, not the capability case. Meter consumption by use case now, while the numbers are still small enough to argue about.
What Did Not Meet Spec
About 110 items came through this week's pull. Eight were read in full and eleven claims were checked against primary sources. Rejected by category: sponsored placements for compliance software, workflow platforms and a governance ebook; the extinction debate that followed a researcher's resignation; OpenAI's disputed mathematics claim; consumer product launches.
Three named rejections.
The claim that 30-day retention “may conflict” with regulated industries. This is Inside AI's reading of the AWS terms. It supports this issue's lead, and it is speculation: the same piece says it could not verify whether review is manual or how reviewers are chosen. Whether retention conflicts with a company's obligations is for its quality function to establish against its own data.
Meta's AI output, “220% higher but only 36% usable.” This is Mindstream's version. Reuters' reporting of Meta's internal data shows code changes up 220 percent and changes producing user-facing features up 36 percent. Thirty-six percent is a growth rate, not a usable share. The accurate figure still makes the point. The wrong one made it too well.
AI finding a cure for cancer within our lifetime. A forecast from Arm's chief executive, a chip supplier, with no method attached. Only the Institute of Cancer Research's point survives, that the constraint is the right medical data.
The Line
The first binding AI rule most pharma teams meet will be written by a supplier, not a regulator.
Sources
- 1. AWS, “Introducing Claude Fable 5.1 on AWS”, AWS Machine Learning Blog, September 2026. Covered Model designation, required retention mode, up to 30 days, human review by Amazon personnel, no sharing with the model provider, Enterprise Frontier Safeguards.
- 2. AWS, “AWS Weekly Roundup”, 7 September 2026. Confirms the same terms.
- 3. Anthropic, “Data retention practices for Covered Models”, Claude Help Center, policy effective 9 June 2026. 30-day retention on every platform; longer where flagged by trust and safety systems or legally required.
- 4. FDA and EMA, “Guiding Principles of Good AI Practice in Drug Development”, January 2026 (EMA release, 14 January 2026). Principle 6, data governance and documentation. Non-binding.
- 5. Regulation (EU) 2026/1744, Digital Omnibus on AI, published in the Official Journal 24 July 2026, in force 27 July 2026. High-risk obligations deferred to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- 6. McKinsey & Company, “The state of AI in 2026: On the road to ROI”, 25 August 2026. Online survey, 4 May to 8 June 2026, n=1,719, 97 nations, GDP-weighted.
- 7. Glean Work AI Institute, “Work AI Index 2026”, 10 June 2026. 6,000 digital workers, US, UK and Australia, fielded December 2025 to January 2026. Reported by the Financial Times and cited in McKinsey Perspectives, 9 September 2026; the figures originate with Glean.
- 8. Fortune, “The companies getting the most from AI are rethinking how work gets done”, 2 September 2026. The 28 percent IT budget figure is McKinsey's, reported by Fortune.
- 9. Google DeepMind, AlphaGenome Atlas, 8 September 2026, as reported by IEEE Spectrum and others.
- 10. Inside AI, coverage of Claude Fable 5.1 on AWS, September 2026. Rejected.
- 11. Reuters investigation into Meta's Project OT, August 2026, citing internal Meta posts; Mindstream, 6 September 2026. Mindstream's framing rejected.
- 12. BBC, interview with Arm chief executive Rene Haas, September 2026, via Mindstream, 9 September 2026. Forecast rejected.
The list
Subscribe to Batch Record
Weekly, every Monday. One issue, one layer, one line worth quoting.