Regulatory intelligence requires critical thinking, actionability to be valuable, experts say

BARCELONA – A panel of experts said that while technologies such as artificial intelligence (AI) can help aggregate and process vast amounts of regulatory information, regulatory professionals and human relationships are still needed to translate intelligence signals.

Taking action

The experts, who spoke at the opening plenary of the RAPS Regulatory Intelligence Conference Europe, agreed that the purpose of regulatory intelligence to identify trends and ensure compliance with rapidly changing laws, and that its value comes from interpreting and acting upon that information.

Angela Logue, head of global oversight programs at BSI in the United Kingdom, said that her organization uses regulatory intelligence to maintain visibility across multiple sectors. She added that regulatory intelligence can be a tool to develop a market strategy and maintain state-of-the-art capabilities.

Alice Forde, senior director for global regulatory affairs at Bausch + Lomb in Ireland, said her company has a regulatory intelligence team that tracks developments and holds a monthly forum to engage their regulatory experts globally. These monthly forums, she said, are particularly useful for highlighting regulatory trends that can be evaluated under their quality management system and escalated to the leadership level if needed.

"We bring them to a business unit governance board or to our quality review," said Forde. "Why is that important to do? Because it's all very well to sit around and talk about it, but if we can't take that item and translate it into what it means for the business and why they may need to change a strategy or an approach, then it's dead information."

Human in the loop

Several speakers noted that new technologies, like AI, may help professional perform job functions such as regulatory surveillance and inform decision-making; however, the responsibility for taking regulatory actions will ultimately fall on people. Logue said that compliance can only be within a human's purview.

"We are in the world of AI. I think everyone, alongside myself, probably has some reservations on what that could mean," said Logue. "AI can help you identify the risks, AI can help you assess the risks, AI can help you write some beautiful recommendations on how to manage the risk, but AI cannot own the risk."

From an industry perspective, Forde said, part of the struggle is knowing when to bring a human into the loop. While some within her organization are more open to granting AI greater autonomy, Forde said she insists that certain tasks remain within the purview of human professionals.

Mariana Oliveira, a researcher for Complear and a PhD fellow at the University of Lisbon, said that the issue isn't always up for debate, and under the Medical Device Regulation (MDR), the person responsible for regulatory content (PRRC) is accountable for maintaining compliance.

"That does not mean we cannot automate things, and automation does not equal AI. We've been automating things for a long time, and we have already replaced a lot of the burden that comes with compliance with automated tools," said Oliveira. "That does not mean we are already offloading our cognitive abilities to it.

"What has been the reality for us is that there are new requirements; we analyze them, we train our clients, but if they do not have someone taking ownership over that, it gets lost in a way," she added.

Despite the growing use of AI, Oliveira said she still hears about regulatory news first from LinkedIn posts.

"I think we still trust this human signal and peer sharing, and that's still our reliable source of changes," she said. "Then, of course, we go to the source, and we check what changed, and we can use our own scraper or our tool to confirm that."

Guardrails and accountability

Logue said stakeholders need to be logical about the controls they apply to the AI they use and consider the scope of the framework they plan to use.

"Change is the only constant thing right now, and [we have to consider] have we put in sufficient modes of control in place to protect the business because we're a business just as much as everybody else," said Logue. "We're getting the same questions from our regulatory authorities on how AI is being used. What are you using it for? How are you communicating that?

"There's also some nice comfort to know that we're also under the same scrutiny, and just making sure that we're not being frivolous," she added. "We just need to make sure that the decisions that are being made are fact-based and evidence-based, rather than AI just told me so."

Oliveira echoed those sentiments, saying that while AI can make regulatory intelligence work faster and more efficient, it can also lead regulatory professionals to the wrong answer more quickly and be the most efficient way to reach non-compliance.

"It's always a matter of accountability and transparency," said Oliveira. "If we can have that dedicated oversight, and if we can understand which sources were used and how that information was transformed, generally speaking, I think it can help, but it really depends on what kind of [AI] technology we're talking about."

Logue also noted that it's important to ensure the regulatory intelligence gained isn't wasted and is ultimately used to help companies and organizations do their work. As examples, she noted that regulatory intelligence helps BSI gain market insights into potential new markets where they may want to offer certification services or shift their strategy. She said it is also used to foreshadow potential regulatory audit trends that they need to prepare for.

"Intelligence isn't intelligence for the sake of intelligence," said Logue. "What are you doing with it? How have you built your framework?"

Forde noted that staying on top of regulatory intelligence is a struggle, especially in Europe, where there is a lot of horizontal legislation to account for. Regardless of how good the regulatory intelligence system is, she highlighted that regulatory professionals will undoubtedly miss information because not everyone will put the same emphasis on the same piece of information.

"All you can do is your best," said Forde. "You can have the best intention, and the best plan to scope as far as you can and identify the areas that are the most important.

"If you are sitting in the audience today and you are thinking, 'I really struggle with this. It's very difficult. What if I miss something? What if it's not correct?' You're not alone," she added. "There's a whole bunch of us all here together, and if you have the magic formula, please share."

Logue said that BSI has key indicators in its processes that address important types of risk such as designation risks, accreditation risks, and business continuity risks that are important to the company's management. The indicators help make risks more tangible for management when making strategic decisions.

"How we adapt with regulatory intelligence and our change management framework is crucial to how we bring value back to the business and the organization," she added.

Value proposition

Forde noted that expressing the value of regulatory intelligence isn't always easy. She said that for her company and many of its commercial partners, the key concerns are financial, whereas regulatory affairs professionals have a different regulatory and compliance perspective. Sometimes, she said, when a new requirement comes out, companies may ask whether it makes financial sense to comply or whether to deal with being noncompliant.

"When we try to demonstrate the value of regulatory intelligence, we use our metrics, and we tailor those specifically to the audience that we're speaking to," said Forde. "We have a variety of different metrics in terms of the cost of compliance or non-compliance, time to compliance, time to market, time to change."

While regulatory intelligence should, by definition, add value to the company or organization, Oliveira said that some regulatory professionals may only be conducting regulatory monitoring, meaning companies aren't acting on the intelligence and are lagging.

When asked if companies still need regulatory intelligence professionals in a world of AI and automation tools, the panelists said that professionals are still needed because the tools are often incapable of understanding nuance. Forde said regulatory professionals need to demonstrate to their companies that their expertise is really where the value of regulatory intelligence lies. She said regulatory professionals have human contacts and relationships with sources such as advocacy groups that can provide information that automated tools don't have access to.

"If you have a blended solution where you have good tools, good insight through advocacy, good conversations with all functions across your organization, it gives you a better chance to scrape and pull that information together, and also a broader conversation in terms of what it means and how you can apply curation of the information that you received," said Forde.

"We have really established strong people in industry, even in my industry, that honestly I don't think AI or even some automation could replace," she added. "Being able to sound something with a human is often more tangible than trying to sound something with a [Microsoft] Co-Pilot or a different version of an AI tool."

Oliveira, however, highlighted that regulatory professionals who can use AI and other tools more proficiently may end up replacing those who aren't as technologically proficient.

"In the long run, it's not about who adopted it first, but who adopted it best, in the sense that who gets to spot when their AI is wrong and who just does not oversee it properly," said Oliveira. "That will be the distinction, not if you adopted it right when it came off, and you're very proficient, but if you still keep your critical spirit and you're still able to think and audit your own AI."

"Taking it back to its most simplest terms, interpretation, compliance, and accountability, those things right now can't be effectively done by an agent, in my perspective," said Forde.