Your AI Pilots Are Not Failing. Your Compute Contracts Are.

In July 2025, MIT's Project NANDA published one of the most-cited enterprise AI studies of the year. Across 150 leader interviews, 350 employee surveys and an analysis of 300 public deployments, it found that 95 percent of enterprise generative AI pilots deliver no measurable P&L impact. Only 5 percent achieve real revenue acceleration. The aggregate enterprise spend behind those failures is estimated at thirty to forty billion dollars.

The MIT authors are emphatic about what the failure is not. It is not model quality. It is not regulatory caution. It is what they call the learning gap. Integration. The inability of organisations to connect AI capabilities into the operational fabric of the business.

Pharma is not the exception to this curve. McKinsey's late-2024 survey of more than a hundred pharma and medtech leaders found exactly the same five percent. Every respondent had experimented with generative AI. Thirty-two percent had taken steps to scale. Only five percent reported AI generating consistent, quantifiable financial value. Two studies, twelve months apart, two different methodologies, two different scopes, the same number. Pharma is failing at the industry average rate despite having more procurement and quality maturity than almost any other regulated sector. That is the part nobody is naming.

Spend is accelerating into the same wall. McKinsey's February 2025 data shows the share of pharma and medtech companies spending more than five million dollars annually on generative AI rising from twenty percent in 2024 to a projected thirty-two percent in 2025. The investment curve is steepening. The conversion curve is not.

The diagnoses are familiar. Model maturity. Change management. MLOps gaps. Regulatory caution. Talent shortages. Each has a kernel of truth, and each has been written about exhaustively. None of them explain why pilots that demonstrably work in sandbox conditions stall the moment they cross the production boundary.

MIT names integration as the cause. That is correct, but in regulated industries it is one level too shallow. Integration in pharma fails for a structural reason almost nobody is naming.

Procurement.

Specifically, the cloud and compute contracts your organisation signed between 2019 and 2023, which still govern most of your AI workloads today, were not designed to support regulated production AI. They were designed to support elastic, generic, location-agnostic workloads. That distinction did not matter much for a customer-service chatbot. It matters enormously for an MLR review assistant, a pharmacovigilance triage model, or any inference workflow touching patient-level data.

What pilots never have to answer

A POC lives in a tolerated zone. Synthetic data, sandboxed environments, named-user access, no production traffic, no patient data, no regulator-facing audit trail. Inside that zone, a pilot can run on whatever GPU happens to be available in whichever region the platform team finds easiest. Nobody asks where the inference physically runs. Nobody asks under whose law. Nobody asks who has step-in rights if the provider fails.

Production cannot live in that zone. The moment a model touches real patient data, real adverse event signals, real promotional content destined for MLR review, it inherits the full weight of GxP, pharmacovigilance obligations, GDPR, the EU AI Act, NIS2, and the EMA's tightening position on cloud-based regulated systems. The EMA's Guideline on Computerised Systems and Electronic Data in Clinical Trials, effective September 2023, extended formal GxP validation expectations to cloud solutions, portals and trial recruitment databases, and embedded ALCOA++ data integrity principles into the cloud layer. The 2024 EMA Reflection Paper on the Use of AI in the Medicinal Product Lifecycle went further, requiring detailed and fully traceable documentation of data acquisition, processing and transformation in line with GxP throughout the AI pipeline. Each of those frameworks asks questions of the underlying compute layer that a typical pre-2023 hyperscaler contract was never structured to answer.

Where does this inference physically run today, and where will it run after the provider's next regional rebalancing. On whose hardware, and what is the chain of custody for the model weights. Under whose law, and what happens when those laws conflict. With what audit rights for the regulator and the sponsor. With what portability if you need to move the workload in ninety days. With what step-in rights if the provider misses an SLA at the moment a Type II variation is mid-submission.

These are not hypothetical questions. They are the questions your compliance, legal, and quality functions will start asking the moment a pilot is proposed for production scale-up. And the honest answer, in most pharma organisations, is that the existing contracts cannot answer them.

Compute is now the unit of procurement

The mental model the industry needs to retire is data centre as real estate. A cloud contract is no longer a lease on capacity in a building somewhere. It is a procurement of compute, governed by performance guarantees, refresh cycles, audit rights, sovereignty constraints and portability obligations. The contract is the asset. The hardware underneath it is interchangeable, increasingly leased rather than owned, and refreshed on three to five year cycles that often run shorter than the contracts themselves.

This is the shift to compute-first infrastructure. Capacity used to be measured in square metres and megawatts. It is now measured in tokens per second, latency under load, throughput under SLA, and the credit quality of the offtake contract that backs the underlying GPU fleet. Everything pharma cares about for production AI sits in that second list, not the first.

Clifford Chance's March 2026 briefing on AI compute infrastructure confirms how fast the supply side is moving. Take-or-pay compute offtakes, performance-backed capacity reservations, NVIDIA Cloud Partner execution discipline, sovereignty-by-design, and granular audit obligations are now standard features of the new generation of agreements being signed between operators, sponsors and lenders. The infrastructure layer is being rebuilt around exactly the requirements regulated industries will need to enforce. The legal and financial plumbing has moved. The pharma procurement plumbing has not.

The demand side has not moved

Most large pharma cloud agreements in force today were signed before the EU AI Act was finalised, before NIS2 transposition, before sovereignty became a procurement question rather than a policy debate, before take-or-pay compute offtakes existed as a contract category. The terms reflect a different commercial era. Generic capacity, broad regional flexibility, light audit rights, no portability guarantees, no compute-throughput SLAs, no sovereignty assurances beyond data residency at rest.

Those contracts will renew on three to five year cycles. The next cycle is the one that matters. If renewal terms continue to reflect the pre-AI procurement template, pharma organisations will lock themselves out of the production AI use cases they spent the previous five years piloting. Not because the technology is not ready. Because the contracts will not let the technology cross the production boundary.

Pharma already knows how to procure regulated outcomes from third parties. The industry contracts with CMOs, CROs, clinical trial vendors, MLR-adjacent agencies, and a long tail of GxP-regulated suppliers, with audit rights, quality agreements, change-control clauses, and step-in provisions that regulators recognise. None of that maturity has been transferred to compute procurement. The same function that would never accept a CMO contract without a quality agreement is signing cloud agreements with no equivalent.

What this means for the next twelve months

Three things are converging. The supply-side infrastructure is maturing into a regulated-production-ready stack. The regulatory frameworks are tightening in ways that make compute sovereignty and auditability board-level questions rather than IT questions. And the next compute renewal cycle for most large pharma organisations falls between now and 2028.

The window to get this right is the next twelve to eighteen months. Not because anything dramatic will break. Because the contracts signed in that window will determine which AI use cases the organisation can move into production for the rest of the decade.

The action is not glamorous. Audit your existing compute contracts against the production requirements your pipeline will impose by 2027. Identify which use cases are blocked not by technology but by contract terms. Bring procurement, legal, quality, and the AI function into the same room before the next renewal, not after. Treat the compute layer with the same procurement seriousness you give your CMO and CRO relationships, because it now sits in the same regulatory category.

POC purgatory has a structural cause that the industry has been talking around for five years. MIT named the symptom. Integration. The cause, in regulated industries, sits one layer below that. It is not the model. It is not the team. It is not the strategy.

It is the contract underneath all three.

Audit the contract.