MHLW circulates considerations for AI and ML models in CMC

MHLW's Pharmaceutical Evaluation Division circulated a paper on the use of AI and machine learning models in drug manufacturing and quality control on November 5, 2026, as an administrative notice to prefectural health departments, with copies to the main industry associations and to PMDA. The version reposted by Shiga Prefecture carries an English translation of the annex, under the title "Considerations for the Use of Models, Including AI and Machine Learning, in Pharmaceutical Manufacturing and Quality Control (CMC)" (医薬品の製造・品質管理（CMC）領域におけるAI・機械学習を含むモデル活用時の考え方).

The paper was compiled under a fiscal 2024 AMED regulatory science project. It builds on the general principles of ICH M15 "General Principles for Model-Informed Drug Development" (Step 4, January 29, 2026). It sets out a six-step flow: define the Question of Interest (QOI), define the Context of Use (COU), assess model risk, establish and execute a verification and validation (V&V) plan, decide on model credibility, and document the result.

Scope is models whose parameters stay fixed throughout operation

The paper mainly covers models used in the CMC area, such as manufacturing process development, process control and quality testing. It takes in data-driven models such as machine learning, physics-based models (also called mechanistic models) and hybrid models combining the two, with chemometric models and residence time distribution models given as examples long in use. The limit is on how a model behaves in service. Only models whose parameters remain fixed throughout operation are in scope. Models whose parameters are continuously or automatically updated during operation through learning, or whose outputs or behavior cannot be adequately specified and verified in advance, are outside it.

GMP requirements such as computerized system validation (CSV) and data integrity are not covered here, and are to be taken from the relevant notifications and guidelines separately.

The flow starts with the question the model is meant to answer

QOI comes first, and it is simply the question the model is intended to answer. COU comes second, covering the role of the model and its scope. That means what is to be modeled, how the outputs are used, and who decides the next action on them. It also means the range of data the model was built on, and whether other information is used alongside the outputs or the outputs are the sole source of information.

Model risk is the third step, not the first. It combines Model Influence (MI), the intended weight of the outputs in a decision once other data and evidence are taken into account, with the Consequence of Wrong Decision (CWD), the potential adverse effects of a wrong decision judged on both severity and likelihood. Each is rated High, Medium or Low and the pair is combined on a matrix, which the paper offers as a general guide for normal circumstances, with the rationale for each rating to be documented. Where independent means of verification exist, in-process control tests and final product tests among them, the outputs are no longer the sole basis for the decision and MI may be assessed as relatively low.

A further adjustment by model complexity is something to consider, not a step that follows automatically. Upward adjustment is to be considered for black-box models such as deep learning, and downward adjustment may be considered for linear models such as PLS and for physics-based models built on first principles.

Model risk sets how far V&V goes, not whether it happens

Which V&V items apply is a selection, made according to the type of model, the COU, the model risk and the complexity of the model together. Model risk governs how far the work goes: when it is low, the scope and depth of V&V may be reduced, but the credibility assessment itself is performed for all models regardless of model risk and should not be omitted. The listed items are examples to consider, and not all of them are mandatory for every model.

The items reach from the model assumptions and the scientific rationale for the structure to code verification, the independence of the test data and the uncertainty of the predictions. Data-driven models add generalization performance by methods such as cross-validation; physics-based models add justification of the underlying laws and numerical stability. Where a validated computerized system is used, the software quality assurance requirements may be considered satisfied by that CSV, but the developer is still to show that the intended model was correctly implemented in it.

The credibility decision that follows is made against criteria set in advance: the technical criteria, a summary of V&V results and their conformance, the methods and results of uncertainty quantification (UQ), and how applicable that evidence is to the COU.

Documentation sorts models into three regulatory positions

Documentation states the regulatory position of the model, in one of three classifications. A model not used directly in manufacturing or decision-making, serving only process understanding and the exploration of conditions, is the first. Where the outputs are directly included as the basis of approved matters such as the control strategy or the design space, or are indispensable to justifying the control strategy, they go into the Common Technical Document; real time release testing and real-time process control are the examples given. A model that runs under GMP control at the site but is not directly included in approved matters, such as deviation investigation support or an internal quality control tool, generally has less need to go into the CTD, but the materials are to be kept available for presentation on request from the regulator.

Where model risk is High, the file also holds a plan to monitor deterioration of predictive performance over time, which is model drift. It holds the triggers, procedures and revalidation criteria for retraining or updating the model. It also holds a response plan for anomalies, covering criteria for discontinuing use, fallback to conventional methods, and coordination with deviation and change management. Drift monitoring is not reserved for High risk. The paper calls it desirable for Medium model risk too, when the model is applied to the manufacturing process over an extended period. Once drift is identified, performance is re-evaluated against the COU, and if the response changes the COU, model risk is assessed again.

What to settle for your own models

The starting point is whether QOI and COU exist as documents for each model in use, since the COU is one of the four things the selection of V&V items is made against. Next comes the regulatory position, which decides whether a model's package belongs in the CTD or has to be producible on request at the site.

On consultation, the paper notes that for models based on well-established methodologies a common understanding with the authorities already exists in some areas, so there may be cases where prior consultation based on a Model Analysis Plan (MAP) is not necessarily required. It adds that it does not address the timing of consultation and does not preclude it, so the absence of a requirement is not a reason to stay away.

The paper sits alongside, rather than inside, PMDA's basic principles for the use of AI in regulatory activities of November 2, whose primary focus is activities involving regulatory judgment and decision-making.