Generative AI in pharma and banking: how to deploy it without compliance risk.

By the Pixels Trade team, Geneva · Reading time: 8 minutes

Every week, we hear the same question from medical, marketing and compliance teams: “Can we actually use generative AI here, or is it too risky?” Our answer is yes, but not the way consumer tools are used. In pharma and banking, an AI system has to keep data under control, show where every answer comes from, leave decisions to people and be validated like any other critical system. Built this way, it speeds up review, documentation and client work while staying inside GxP, FINMA and data protection rules. Here is how we approach it with our clients.

Why regulated industries are different

In most companies, a wrong AI answer is an inconvenience. In the projects we deliver for pharma and banking clients, it can be a compliance breach: an off-label claim in a promotional piece, an incomplete adverse event report, a missed money laundering alert, or client data processed abroad without a legal basis.

The obligations that apply are well known:

• Pharma and medtech: GxP and computerised system validation (GAMP 5), promotional review rules, pharmacovigilance, and the EU AI Act for systems placed on the EU market.
• Banking: FINMA supervision (including its guidance on governance and risk management for AI), outsourcing and operational risk requirements, banking secrecy and anti-money laundering rules.
• Both: the Swiss Federal Act on Data Protection (nFADP) and, for EU activities, the GDPR.

None of these rules forbids AI. What they require is control, traceability and accountability. In our experience, that is a project and engineering question, not a reason to wait.

Five principles of AI in a regulated environment

1. Data stays under control. Sensitive documents are processed on infrastructure you control, ideally in Switzerland, by a model that is not trained on your data.
2. Every answer is traceable. The assistant answers from validated sources (retrieval-augmented generation, or RAG) and cites the exact document and passage it used.
3. Humans decide. The AI proposes, a qualified person approves, and the system records who approved what and when.
4. The system is validated. It is tested on a documented set of real cases before go-live, and monitored afterwards, like any GxP or critical banking system.
5. Access follows existing rights. A user can only get answers from documents they are already allowed to see.

High-value use cases in pharma

• Medical, legal and regulatory (MLR) review: pre-check promotional materials against approved claims and references before they reach the review committee, so reviewers focus on judgement rather than proofreading.
• Medical information: draft answers to healthcare professionals’ questions from the approved product documentation, with sources, for validation by the medical team.
• Omnichannel content: adapt approved content across channels and markets, and migrate e-detailing presentations between CLM platforms such as Veeva and IQVIA.
• Regulatory documentation: summarise, compare and check consistency across large dossiers.

High-value use cases in banking

• KYC and onboarding: extract and check information from identity and company documents, flag inconsistencies, and prepare the file for the compliance officer.
• AML alert triage: summarise the context of an alert and the relevant transactions so analysts decide faster, with the decision remaining human.
• Internal policy assistant: answer staff questions on procedures and regulations, with the exact reference to the internal directive.
• Client correspondence: draft replies and summaries for relationship managers, in the client’s language, without client data leaving the bank’s perimeter.

The reference architecture

A compliant AI system has the same building blocks in both industries:

• a private model, hosted in Switzerland or on-premise;
• a knowledge layer that indexes only validated documents and respects access rights;
• a workflow layer where deterministic rules handle what must be exact (thresholds, mandatory checks) and the model handles language;
• a human approval step for any output with consequences;
• a complete audit log of questions, sources, answers and approvals.

This is what we call “deterministic where it must be, AI where it helps”. See how we apply it in AI governance & compliance and knowledge AI & RAG.

A 6-step roadmap

1. Choose one use case with measurable value, such as pre-checking promotional materials or preparing KYC files.
2. Map the data and the rules that apply to it, with your compliance and quality teams from day one.
3. Choose the hosting that matches the most sensitive data involved.
4. Build an evaluation set of 50 to 100 real cases and the expected answers, approved by your experts.
5. Build the governed workflow with sources, approvals and audit log, then validate it on the evaluation set.
6. Go live with a pilot team, measure time saved and error rates, then extend.

Common mistakes

• Letting teams use public AI tools on confidential documents because no approved alternative exists.
• Starting with the most ambitious use case instead of the most measurable one.
• Involving compliance and quality only at the end, when the design can no longer change.
• Skipping validation: without documented tests, the system cannot be defended in an audit or an inspection.

Where to start

If we had one piece of advice, it would be this: start small, start measurable, and bring compliance into the room from day one. The teams that succeed are not the ones with the biggest AI budget, but the ones that pick one clear use case and prove it works. At Pixels Trade, through Pixels Health and Pixels Banking, this is exactly what we build for pharma companies and banks: governed AI assistants, automated workflows and validated platforms, hosted in Switzerland, with human approval built in.

Have a use case in mind, or a process you would love to automate? Describe your project and a senior engineer from our Geneva team will get back to you within one business day.

Frequently asked questions

Can pharma companies use generative AI under GxP?

Yes, provided the system is treated as a computerised system: defined intended use, risk assessment, validation on documented test cases, access control, audit trail and human review of outputs that affect quality or patient safety.

Does FINMA allow banks to use AI?

Yes. FINMA expects banks to govern AI like other risks: clear responsibilities, an inventory of AI applications, data quality, testing, explainability and control of outsourcing. A governed, auditable system with human decisions meets these expectations.

Can AI review promotional materials for compliance?

AI can pre-check materials against approved claims, references and labelling, and flag potential issues. The final approval remains with the medical, legal and regulatory reviewers.

Is it safe to use ChatGPT with client or patient data?

Not with public versions. Sending confidential or personal data to a public AI service raises data protection, secrecy and confidentiality issues. A private model hosted in Switzerland avoids sending the data abroad.

How long does a first AI use case take in a regulated company?

Typically 8 to 12 weeks from scoping to a validated pilot, including data preparation, evaluation with your experts and user onboarding.