An empty oak boardroom table under a low pendant lamp, a single leather chair pulled out at the head, a closed laptop and folder set in front of it.

    Series · Accountability in Regulated AI

    The named owner.

    Accountability in Regulated AI — most pharma AI deployments fail their first audit the moment someone asks who owns the decision. Not the function. The person.


    Mark Rhys Thomas · May 13, 2026 · 9 min

    Most pharma AI deployments fail their first audit the moment someone asks who owns the decision. Not the function. The person. The seat that, by name, authorised the model, accepted its output, and would carry the consequence if the recommendation caused harm. In most organisations that name does not exist on paper. There is a steering committee. There is a vendor relationship. There is a clinical lead whose role was extended without their authority being formally extended with it.

    73% of pharma leaders are now planning, piloting, or deploying agentic AI. 78% of health systems plan clinical AI inside twenty-four months. 23% have a governance structure to support any of it. 78% of hospital leaders cannot deliver an auditable AI explanation within thirty days of being asked. The deployment curve has steepened. The accountability curve has not.

    The gap between those two curves is where the named owner lives, or, in most organisations, does not yet live. This piece is about closing that gap before the first audit forces it closed in public.

    What an auditor actually asks

    Pick any live or piloted AI deployment inside a commercial pharma organisation today. A next-best-action engine pointing field teams at HCPs. A promotional review assistant suggesting copy edits to MLR. A KOL prioritisation system. An HCP segmentation model. A pricing analytics tool. Each is real, each is in production or close to it, each will at some point be the subject of an audit question.

    The question is not technical. The auditor will not begin with model architecture, training data, or hallucination rates. The auditor begins with a sentence. Show me the seat that authorised this output. Not the committee. Not the vendor. Not the platform team. The named individual who, on the date in question, accepted the recommendation, signed off the action, and would be answerable if the action had caused harm.

    If the answer is a steering committee, the next question is which member of that committee held the casting vote. If the answer is a vendor relationship, the next question is which seat inside the sponsor accepted the vendor's output. If the answer is a clinical lead whose remit quietly expanded to absorb the AI use case, the next question is which document formally extended their authority and on what date. The audit trail eventually pierces the structure and asks for a name.

    Most organisations have not written that name down.

    Why committees feel safer, and why that is the wrong reason

    Committees feel safer than names. They distribute discomfort. They convert a single point of accountability into a procedural one. They are, in most organisations, the default response to a decision that nobody wants to own personally.

    They feel safer for the wrong reasons. The audit trail does not stop at the committee. It pierces it. And when it does, the institution finds it has not protected itself; it has only deferred the question, and added the cost of the delay to the cost of answering it. A named owner challenged at audit can defend the decision in the moment. A committee challenged at audit triggers a discovery exercise across calendars, minutes and email threads to reconstruct who actually decided what, when, and on what basis. Every day of that exercise is a day the deployment sits under a cloud the organisation cannot quickly clear.

    Pharma already knows this. The industry runs on named accountability everywhere else. The Qualified Person who releases a batch is a person, not a function. The medical signatory on a piece of promotional material is a person. The pharmacovigilance Qualified Person for the EU is, by regulation, a person whose name is filed with the regulator. The structural authority to assign named owners to AI outputs already exists in the building. Most organisations have not yet used it.

    Mo Johnson, the cardiothoracic surgeon behind the MedicoVigilance newsletter, used the Wizard of Oz this week as a frame for clinical AI accountability. The Wizard projects authority from behind a curtain. Pull the curtain back and you find an ordinary man pulling levers. The frame translates straight across into pharma commercial. When the audit page pulls the curtain back on a live AI deployment, what gets revealed. A named owner with the authority and the documentation to defend the decision. Or a man pulling levers, which is to say, nobody at all.

    What the regulators are signalling

    The regulatory frame is moving in the same direction as the audit frame. NESC's recent report on AI in the Irish public and regulated economy is explicit that accountability cannot be delegated to the model and cannot be diluted into a committee. The 2024 EMA Reflection Paper on the Use of AI in the Medicinal Product Lifecycle requires detailed, traceable documentation of data acquisition, processing and transformation across the AI pipeline, in line with GxP. Traceability of that depth assumes a seat capable of being traced to. The EU AI Act, in its high-risk provisions, requires deployers to assign human oversight to a natural person with the competence, authority and resources to perform the role. Natural person is the operative phrase. The Act does not contemplate oversight by a committee.

    The direction of travel across NESC, EMA, EU AI Act and the EMA's tightening line on cloud-based regulated systems is consistent. Decisions made by or on the recommendation of an AI system require a named owner inside the deploying organisation. The regulatory question is no longer whether named ownership is required. It is how quickly organisations move from de facto ownership held informally by a committee to de jure ownership held by a seat with the authority and documentation to defend it.

    Three steps before the next audit cycle

    Three steps for senior commercial leaders who want to address this before the next audit cycle, not after.

    One. List every live or piloted AI deployment in the commercial function. Next-best-action engines. Promotional review tools. KOL prioritisation systems. HCP segmentation models. Pricing analytics. For each, write down the named seat that owns the output today. If the name is a committee, the seat is not yet named. If the name is a vendor, the seat is not yet named. If the name is the platform team, the seat is not yet named. The exercise is short. The honest answer for most organisations is that fewer deployments have a named owner than the org chart implies.

    Two. For any deployment where the seat is not named, identify the candidate role. The seat must sit inside the workflow, not above it. The medical signatory who already owns promotional sign-off is the candidate owner of the MLR assistant. The commercial lead who already owns the territory plan is the candidate owner of the next-best-action engine. The pricing director who already owns list price is the candidate owner of the pricing model. The principle is that AI ownership maps onto pre-existing decision authority, not onto the AI organisation.

    Three. Build the decision audit trail the named owner will need. Not the technical one. The decision one. What did the model recommend. What did the named owner decide. What was the basis. What was the date. The trail does not need to be elaborate. It needs to be defensible in front of an auditor who has thirty minutes and one question.

    What the supply side already understands

    The supply side has moved faster than the demand side here, as it usually does. Vendors selling regulated AI into pharma are increasingly building named-owner workflows into the product. Sign-off panels with seat-level authentication. Decision logs that record both the recommendation and the human acceptance. Audit exports designed for inspection rather than for internal MI. The product layer is being built around the assumption that a named human will own the output. The procurement layer in most pharma organisations is buying the product without having identified that human.

    That gap will close one of two ways. Either the deploying organisation closes it before the first audit, by assigning the seat, extending the authority, and building the decision trail. Or the audit closes it for them, in public, with the cost and reputational consequences that follow. The structural authority to take the first path already exists in pharma. The slippers are already on.

    The named owner is not a documentation exercise. It is the unit of accountability that the regulatory frame, the audit frame, and the product frame are all converging on. Organisations that name the seat now buy themselves the right to scale. Organisations that defer the question buy themselves a deferred problem at compounding cost.

    Name the seat.

    Sources referenced: National Economic and Social Council, Artificial Intelligence in Service of Society: Navigating Our Way Forward, April 2026. Mo Johnson, MedicoVigilance™ Issue 7, May 2026. HIMSS clinical AI deployment survey, 2026. Black Book Research, hospital AI explainability study, 2026. Elsevier Life Sciences, agentic AI in drug discovery, May 2026.