The S.A.F.E.T.Y. framework for AI in pharmacovigilance

Why safety needs its own AI framework

AI is arriving in pharmacovigilance quickly. Vendors promise faster case processing, cleaner literature screening and earlier signal detection. Many of those promises are real. But a safety system is not an ordinary business system, for three reasons.

• The stakes are patient safety. A missed adverse event or a wrongly coded reaction can delay the detection of a real risk.
• Everything is inspectable. Regulators can ask, years later, how a case was processed and why a decision was made.
• The rules are specific. Reporting timelines, coding conventions and seriousness criteria are defined in regulation and in your own SOPs.

Generic AI evaluation frameworks focus on accuracy and cost. Those matter, but they do not cover traceability, validation, human oversight or regulatory defensibility. The S.A.F.E.T.Y. framework was designed to fill that gap, with one principle at its centre: patient safety comes first.

The six tests at a glance

S · Secure

Safety data contains personal health information about patients, often from many countries. Any AI that touches it must protect it by design, not as an afterthought. For executives, this is also a legal and reputational issue: a data incident in pharmacovigilance is a data incident involving patients.

Ask for evidence of:

• Encryption of data in transit and at rest.
• The hosting regions available, and whether you can choose yours.
• Role-based access, with every access logged.
• Security certifications, with the audit reports rather than just a logo.
• A written statement of how your data is used, including whether it trains models used by other clients.

A · Auditable

If you cannot explain a decision to an inspector, you cannot rely on it. An auditable AI records what it did, why it did it and who approved the result. This is what makes AI defensible, and it is often where early tools fall short.

Ask for evidence of:

• Every extracted value linked to the exact page, line or box it came from.
• AI actions recorded in the audit trail alongside human actions, including the model version used.
• The ability to reconstruct, months later, exactly how a specific case was processed.

F · Fit-for-purpose

A model that performs well in a demonstration may not perform well on your products, your sources and your languages. Regulators expect computerised systems to be validated for their intended use, and that expectation applies to AI. Fitness for purpose has to be shown, then maintained.

Ask for evidence of:

• A risk-based validation approach, for example aligned to GAMP 5, with documentation you can give to QA.
• Performance measured on a sample of your own data before go-live.
• Ongoing monitoring for drift, with alerts when accuracy falls.
• Model and rule changes released under change control, never silently.

E · Expert-in-the-loop

AI should do the work; qualified people should own the decisions. The right level of oversight is not the same for every step. Extracting a date from a form is low risk; assessing causality for a fatal case is not.

Ask for evidence of:

• Review gates configured from your SOPs, not fixed by the vendor.
• Automatic routing of low-confidence results to a person.
• Medical judgements such as company causality and benefit–risk staying with your experts.
• Every human decision attributable to a named person.

T · Trusted data

AI is only as good as the data it works on. Fragmented systems, inconsistent coding and duplicate cases undermine any model, and they also undermine signal detection and periodic reporting downstream.

Ask for evidence of:

• One consistent safety data model across case processing, literature, signals and reporting.
• MedDRA and WHODrug coding applied consistently with your conventions.
• Duplicate detection across all sources, not just within one channel.

Y · Yield

Finally, the AI has to deliver measurable value. Headline percentages from marketing material are not evidence: without a baseline, a method and a named context, they cannot be compared or relied on.

Ask for evidence of:

• A willingness to agree baseline measures with you before go-live.
• Results measured from platform data, on your cases.
• Gains in quality and compliance as well as speed: on-time submission, first-pass acceptance, QC findings.

Where does your organisation stand?

Most organisations adopt AI in stages. The S.A.F.E.T.Y. tests are what move you safely from one stage to the next.

How to use the framework

1. In vendor selection: score each vendor against the six tests and ask for the evidence listed above.
2. In validation planning: use the six tests as the structure of your risk assessment and validation plan.
3. With QA and inspectors: use them to explain how AI is controlled in your pharmacovigilance system.
4. In governance: review the six tests at least once a year, and whenever a model or major rule changes.

We built vGenix Ai around these tests. See how in our pages on compliance, vGenixOS and implementation.