Can You Show Your Work?

Can You Show Your Work?

AI is moving into regulated R&D and the plant floor faster than the proof that it is controlled.

Life Sciences CIO Weekly • Coverage: September 14 – 20, 2026

Last week the squeeze was mandate against budget. This week the word is proof. AI is arriving in the two places life sciences regulates most tightly, the discovery lab and the plant floor, and it is arriving faster than the evidence that any of it is under control. Novo Nordisk put frontier models and an autonomous lab inside its own R&D. The FDA, the UK, and the EU each moved the same week, and each one turns AI and data oversight into something you answer with lineage and validated records rather than assurances. The through-line is easy to say and hard to do. Can you show your work?

Reading something a colleague should see? Copy the section that fits their world and pass it along, or forward the whole edition. And if this reached you from someone else, you can subscribe free here to get it every week.

🤖 AI & Data

Novo Nordisk signs Anthropic to put Claude into drug discovery and development ↗

A frontier-AI vendor is now embedded in a top pharma's R&D, which puts model governance and data boundaries squarely on the CIO's desk.

On September 16, 2026, Novo Nordisk said it will deploy Anthropic's Claude and Claude Science across drug discovery, development, scientific reasoning, and its own software engineering, with CEO Mike Doustdar restating the goal of becoming the world's most AI-driven healthcare company (Unite.ai). Terms were not disclosed. Novo stressed data governance and human oversight, which is the tell that the hard part is control at scale, not access to a model. It also follows Novo's August pact naming AWS its preferred cloud and AI partner, so more than one frontier vendor now feeds the same R&D estate.

What to watch: Pin down where any frontier model may run against regulated or proprietary data, and get written terms on training rights, retention, and model change control before scope widens.

FDA, Sanofi, and Gilead spell out what "AI-ready" means in a regulated plant ↗

AI in a GMP plant now has to be provable, not just deployed, and the bar is data maturity and validation you can defend.

At the PDA/FDA Joint Regulatory Conference on September 14 to 16, 2026, Sanofi's Jack Prior presented a 0-to-100 model that scores manufacturing data on whether it exists and how well it is delivered, and Gilead's digital-quality lead spoke to the operating side. FDA speakers said digitalization is welcome but predicate CGMP rules and non-delegable quality-unit oversight do not move, and that validation should be proportional, full validation for anything touching a final quality decision and a lighter fit-for-use justification for investigative tools (Pharmaceutical Technology). They pointed back to the FDA's April warning letter over AI drafting specifications without quality-unit review.

What to watch: Score your manufacturing data on availability and delivery quality before funding an AI use case, and classify each tool by whether it informs a final quality decision so the validation depth holds up in an inspection.

Novo installs a Ginkgo autonomous lab at its new Waltham R&D site ↗

When the autonomous lab moves in-house, the validation, security, and data-lineage burden moves with it.

On September 15, 2026, Ginkgo Bioworks said Novo Nordisk selected it to build an autonomous laboratory at Novo's new Waltham, Massachusetts R&D site, pairing Ginkgo's reconfigurable robotics with its Catalyst software so instruments, sample movement, and results capture run as one environment (Securities.io). Ginkgo says the setup can connect to AI agents that draft protocols, run them, and design the next experiment. Buying the capability rather than outsourcing it shifts responsibility for integration, validation, identity, and provenance onto Novo's own technology organization.

What to watch: Treat an autonomous lab as scientific computing, informatics, and robotics under one owner, and settle who holds provenance and validation across research, IT, and quality before it goes live.

⚖️ Regulatory & Policy

FDA launches an Expedited IND Pilot with rolling pre-IND review ↗

Rolling review turns a single dossier into a stream of review-ready modules, which is a regulatory-information problem before it is a science one.

On September 15, 2026, the FDA opened applications for an Expedited IND Pilot that pairs a sponsor with a Qualified Research Institution and reviews IND components on a rolling basis during the pre-IND phase, aiming to cut first-in-human timelines that can run up to two years. Acting Commissioner Kyle Diamantas announced it with the CDER and CBER directors, the initial cohort is eight to ten pairs, and applications are open until October 30 (RAPS). It arrives alongside the draft PDUFA VIII commitments, which carry an America First fee reduction for US-anchored Phase 1 trials, so early-development economics are tilting onshore.

What to watch: If you might apply, confirm your regulatory-information and eCTD tooling can package and track partial submissions without losing lineage across iterations.

EU pharmaceutical reform leans on electronic submissions and regulator data reuse ↗

The overhaul turns faster approvals into a master-data and lineage job for sponsors.

On September 17, 2026 at RAPS Convergence, European Commission and EMA officials detailed the pending overhaul of EU pharmaceutical law. They cited roughly 430 days to authorize a new drug today and wide access gaps across member states, and described cutting EMA's six committees to two, moving standard assessment from 210 to 180 days, and about 300 million euros in annual savings (RAPS). The digital provisions matter most: regulators could use hospital databases, registries, and biobanks for authorization and safety, and sponsors could file applications and product information electronically only. GSK's Claudia Dollins, speaking for EFPIA, warned of more than 100 implementation actions.

What to watch: Expect coordinated change across regulatory information management, safety, master data, electronic product information, and cross-border data governance, and start mapping which systems the electronic-only and data-reuse provisions touch.

A UK commission recommends a lifecycle AI medical-device regime ↗

A staged, lifecycle model would require monitoring and evidence built in from launch, not a one-time clearance.

On September 17, 2026, RAPS reported a UK commission's 44 recommendations for governing AI-enabled medical devices, shifting from one-off pre-market assessment toward a lifecycle approach. The proposals include function-based regulation focused on a product's medical-device capabilities, staged authorization that widens as safety and performance thresholds are met, financial penalties for non-compliance, and updated UK device rules with clearer software exemptions. It continues the UK's move toward an MHRA licensing regime for software and AI.

What to watch: Device makers should build postmarket monitoring, model change control, and evidence pipelines now, since staged authorization rewards sustained proof over a single clearance.

🔒 Cybersecurity & Risk

Rohto breach runs through cloud CRM and call recordings, not the plant ↗

A pharma breach centered on SaaS data is a direct test of whether you know where your sensitive data actually lives.

Rohto Pharmaceutical detected unauthorized access to its mail-order systems on September 10, 2026 and, in a September 15 update, said customer call recordings and customer-management data may have been taken, and reported the matter to Japan's data-protection authority (Rohto). A threat actor separately claimed 4.1 TB, including about 3.95 million Salesforce records and 850,000 call recordings, which Rohto has not verified, and no manufacturing disruption was reported. Call recordings can carry product-use and adverse-event information that ties back to pharmacovigilance, so this reaches past ordinary customer data.

What to watch: Map where sensitive data lives across your SaaS estate, including CRM and recorded calls, and confirm that access, logging, and exfiltration monitoring extend to those platforms and not just the network edge.

A maximum-severity VMware vCenter flaw is now a ransomware target ↗

The platform that sits under many validated systems is under active attack, where change control slows patching.

In mid-September 2026, CISA and several security firms confirmed active ransomware exploitation of CVE-2026-59310, a VMware vCenter Server flaw rated CVSS 9.8, with a China-nexus actor abusing the vCenter Syslog weakness for unauthenticated remote code execution (Infosecurity). Broadcom lists no workaround and only fixed releases. vCenter often runs beneath manufacturing execution, quality, laboratory, and serialization systems, where validated-state change control slows patching, which is exactly the gap attackers move into.

What to watch: Confirm where vCenter runs beneath validated or plant systems, verify patch status at build level rather than by attestation, and rehearse an emergency documented change so you can move fast and still show controlled change.

🎯 Leadership & Operating Model

Recursion says AI-platform integration cut its cost base by roughly 40% ↗

An AI-platform pioneer is now proving economics, not capability, which is where every big platform bet eventually lands.

On September 15, 2026 at the Morgan Stanley healthcare conference, Recursion management said integration after the Exscientia combination cut its pro forma cost base by roughly 40 percent, and framed the company as clinical-stage with programs rather than a platform story. It reported more than $525 million in partnership payments from Roche and Genentech and from Sanofi, and said it keeps the underlying data while partners receive defined work product (Seeking Alpha).

What to watch: For a big AI-platform bet, define the proof metrics now, dataset consolidation, experiment reuse, and time from computational proposal to lab result, and keep reusable platform data separate from contractual work product through enforceable access and lineage controls.

Legend Biotech names Novartis veteran Ingrid Zhang as CEO ↗

A CEO change at a CAR-T company is a reset point for the data and workflows that cell therapy runs on.

On September 15, 2026, Legend Biotech named Novartis veteran Ingrid Zhang chief executive, succeeding Ying Huang, as it moves into a new growth phase for its cell-therapy business (GlobeNewswire). CAR-T operations depend on complex manufacturing, chain of identity and custody, cold-chain logistics, and treatment-center coordination, so growth rests on integrated operational data as much as on corporate systems.

What to watch: Treat a leadership transition as the moment to map where manual handoffs, duplicate identifiers, or limited manufacturing visibility constrain growth, framed around the end-to-end patient and product journey.

Ready to move beyond the digest? The LS CIO Community is where these conversations continue.

Join the LS CIO Community →

How this is made: each edition is researched two ways in parallel, once with Perplexity and once with Claude, then reconciled into a single verified brief.

This digest is an interpretive summary of publicly available information and does not constitute legal, regulatory, cybersecurity, or investment advice.

Until next week,

Joe Miller

Founder, Leadership Inklings