AI in regulatory submissions: what RAG changes for filings

A major biopharmaceutical company put a peer-reviewed paper out in 2025 describing a tool that uses large language models to draft the CTD Module 2.3 Quality Overall Summary on its own. The model does not make things up. It reads several thousand pages of Module 3 quality data and boils them down into the structured QOS narrative with retrieval-augmented generation. This is the clearest public sign yet that AI has entered GxP regulatory filing.

Why the quality overall summary is the right first job for AI

The Common Technical Document is the format regulators use to review drug applications in the major markets. Module 3 is where the raw quality evidence lives: the drug substance, the drug product, the analytical methods, the stability program. A typical filing runs to several thousand pages, written once and then referenced for years.

Module 2.3, the Quality Overall Summary, sits on top of that pile. It is a summary of a summary. Someone has to pull the right facts out of Module 3 and lay them into a fixed section format that reviewers expect. The structure is set. The source is set. The job is big and repetitive. That is exactly the shape of task a language model is built for, because it rewards extraction and formatting, not invention.

A team doing a QOS by hand repeats the same extraction pattern across dozens of sections. The slow part is not judgment. It is throughput. The model takes the source text and puts it into the target format, which is the part a person finds dull and mistake prone.

How the tool actually works

The design rests on one rule. Do not let the model write from nothing. Hand it the Module 3 content and ask it to condense that content into each QOS section. What comes out is a draft, and a regulatory writer still checks and signs it.

Design choice	What it does	Why it matters
Retrieval-augmented generation	The model reads supplied Module 3 text, not the open internet	Output stays grounded in the actual filing
Section-level prompts	Each QOS chapter has its own dedicated prompt	Precision beats a single generic instruction
Source mapping	Every QOS statement links back to a Module 3 section	Reviewers can trace each claim
Human review gate	A regulatory writer checks and signs the draft	The human keeps the final decision

Retrieval-augmented generation carries the whole thing. It decides where the answer is allowed to come from. The model cannot drift into invention, because it is locked to the Module 3 text it was given. Hallucination risk falls toward zero, and that is the one failure a regulator will not forgive in a quality document. A made-up specification in a QOS is worse than having no QOS.

The peer-reviewed paper is the real signal

Most companies that try AI for regulatory writing keep the method to themselves. A conference slide, maybe, or a vendor deck. This company went the other way. It wrote the method up, sent it to outside reviewers, and published it. That decision matters more than the tool.

Peer review is a public vote of confidence. Experts with no ties to the company judged the approach sound. For a regulator that beats an internal validation report, because the method survived people who had nothing to gain from it passing. It tells the agency the company expected the work to hold up.

Publication also lands in front of the regulators themselves. Staff at the US Food and Drug Administration and the European Medicines Agency can read the paper and see exactly how the QOS was built. The company is not waiting to be challenged on a filing before it explains itself. It explained first. That is a different posture from most AI use in regulated industry.

The third effect is broader. Once a method like this is in a peer-reviewed journal, other regulatory teams have something to point to. It gets easier to defend a similar approach inside their own organization, because someone else already took it public. That reference effect is how one paper turns into a standard.

The same company is building AI on both ends

There is a second track worth a look. The same company trains large language models on its own protein and antibody data, on cloud GPU infrastructure using generative AI platforms. Different goal. Those models predict biologics properties and speed up the design of hard molecules like multispecific antibodies.

One track makes submission faster and compliant. The other makes finding the next molecule faster. Both rest on the same bet: your own data, run through a model under tight constraints, beats prompting that pulls from everywhere. The regulatory side and the discovery side are separate problems, yet they share a design instinct.

What a regulatory team should take from this

Three moves carry over, whatever the company size or the therapeutic area.

• Start with the QOS. Fixed structure, known source. It is the cheapest place to get value from a model, and a team that already has Module 3 as an electronic file is most of the way there.
• Use retrieval-augmented generation, not open questioning. Feed the model the source and let it condense. Asking a model to answer from memory is precisely where regulatory writing breaks.
• Write one prompt per section. A single generic instruction gives generic output. Each QOS chapter wants its own prompt that names the inputs and the format it owes.

These are not ideas pulled from the air. They are the settings the published system actually used, and the ones a team can copy without proprietary infrastructure.

The limits of AI in regulatory submissions

The published case covers new drug applications and biologics license applications. A team filing somewhere else should not assume the format carries over. China’s National Medical Products Administration, for example, has its own QOS expectations, and those need checking before the method is reused. The model travels. The configuration does not.

The model also does not retire the regulatory writer. It produces a draft. A qualified person still reviews, corrects, and signs. That is not a flaw in the approach. It is the point. Accountability in a filing is not something an organization gets to automate away, and the teams that pretend otherwise are the ones that fail their first inspection.

Bottom line

AI in regulatory submissions is no longer an experiment hidden inside one company. A peer-reviewed paper turned a quiet internal tool into a public reference. For teams that file CTD documents, the takeaway is plain: take the QOS, lock the model to your own data, and keep a human at the signature line. The technology is ready. The discipline to use it without losing control is the part still earned.

FAQ

What is the CTD Module 2.3 Quality Overall Summary?

The Quality Overall Summary is Module 2.3 of the Common Technical Document, the standard format drug regulators use to review applications. It condenses thousands of pages of Module 3 quality evidence into a structured narrative covering the drug substance, the drug product, analytical methods, and stability. The QOS does not introduce new data. It reorganizes existing evidence into the summary regulators read first.

Why is the QOS a good task for large language models?

The QOS has a fixed section structure and a known source document. Those two properties make it a strong fit for a model. The model extracts information from Module 3 and renders it in the required format, which is repetitive work a human does slowly. Because the output format is prescribed and the input is defined, the task rewards precision and throughput rather than open-ended creativity.

How does retrieval-augmented generation keep the model honest?

Retrieval-augmented generation feeds the model the actual Module 3 text instead of letting it answer from training memory. The model can only summarize what was supplied. It cannot invent a specification or a stability result that was not in the source. That constraint is what pushes hallucination risk close to zero, which matters because a quality document with a fabricated claim is worse than no document at all.

What is the difference between RAG and asking a model directly?

Asking a model directly invites it to fill gaps from what it has seen elsewhere, which produces confident but wrong statements in a regulatory context. Retrieval-augmented generation removes that freedom by binding every output to supplied text. The model becomes a condenser, not an author. For a quality filing, the distinction is the difference between a draft you can defend and one you have to scrub.

Can AI write an entire regulatory submission?

No. The published work targets a single module, the QOS, and even there a qualified writer reviews and signs the result. AI does not replace the regulatory function. It shortens the distance between a finished Module 3 and a clean Module 2.3 draft. The human still owns the judgment, the corrections, and the final accountability for what gets submitted.

Do regulators accept AI-generated content in filings?

Regulators have not issued a blanket rule against AI-assisted drafting, and a peer-reviewed publication describing the method signals that the approach is open to scrutiny rather than hidden. The safer reading is that the content must be traceable, accurate, and human-verified. A QOS built from your own Module 3 data and signed by a reviewer meets that bar. The method, not the tool, is what gets judged.

Which regulatory document should a team automate first?

Start with the QOS. It has a fixed structure and a defined source, so a model can produce useful output with the least setup. A team that already keeps Module 3 as an electronic document is most of the way there. Deviation reports, annual product reviews, and other structured compliance documents are reasonable next steps once the section-by-section prompt pattern is proven.

Does AI remove the need for regulatory writers?

It changes the work, not the headcount argument. A model produces a first draft from source data, and a writer then checks accuracy, fixes structure, and takes ownership of the submission. The tedious extraction shrinks, and the review burden shifts toward judgment. Teams that adopt this keep their writers and point them at verification instead of transcription, which is where their training actually earns its keep.

How should a team validate AI-written regulatory content?

Treat the output like any other draft. Confirm each QOS statement maps back to a Module 3 section, because source mapping is the control that makes the method defensible. Run the document through normal technical review, check the formatting against the authority’s expectations, and keep the human sign-off as the final gate. The model’s draft is an input to review, never a substitute for it.

What are the limits of AI in regulatory submissions?

The published case covers new drug and biologics applications, and the format does not transfer unchanged across authorities. China’s National Medical Products Administration, for example, has its own QOS expectations that must be checked before reuse. The model also stops at draft stage. It cannot make regulatory decisions, and it cannot replace the qualified person who reviews and submits.

How does AI for filing differ between the FDA and the NMPA?

The underlying method is the same, but the document format is not. A QOS generated for a US or European application uses section conventions those reviewers expect. China’s National Medical Products Administration applies its own structure and detailed requirements. Teams must recalibrate the prompts and the formatting rules to the target authority. The model is reusable, but the configuration is local.

What does the future of AI in regulatory affairs look like?

The direction is clear. More companies will publish methods rather than hide them, because a peer-reviewed approach is easier to defend with regulators. The QOS is only the first module. Structured documents across the CTD, and eventually the review side, will absorb the same retrieval-and-review pattern. The constant will be a human sign-off, because accountability in a filing does not get automated away.