Notes from the intersection of quality and regulation

What ISO/IEC 42001 means for pharmaceutical quality teams

ISO/IEC 42001:2023 is the first international management-system standard for artificial intelligence, and it is starting to appear in supplier questionnaires, tender requirements and internal governance policies across regulated industries — including pharma and biotech, where AI is increasingly used in areas like manufacturing analytics, pharmacovigilance signal detection and quality-data review.

For a quality department, the standard is easiest to understand as a cousin of ISO 9001: it asks an organisation to define the scope of its AI use, assess AI-specific risks (bias, data quality, explainability, human oversight), and run that through a documented management system with clear accountability — the same discipline already familiar from GMP-style quality systems, applied to a new object.

The practical starting point is rarely a full certification project. It is usually a scoped gap assessment: which AI systems are already in use or planned, who owns the risk for each, and how far current documentation is from what an ISO/IEC 42001 auditor would expect to see. That assessment is also the fastest way to find out whether the NIST AI RMF and EU AI Act's risk-tiering applies to any of those systems, since the two frameworks overlap significantly in practice.

Have a concrete AI use case in your quality or regulatory function? Get in touch for a scoped conversation.

The ISO 7101:2023 Opportunity

ISO 7101:2023, the first international standard dedicated specifically to quality management in healthcare organisations, has been available for certification since 2023 — yet Lead Auditor training and certification pathways for it remain largely absent from Portuguese training providers, who instead route interested professionals to international bodies.

That gap matters because hospital and clinical providers are under growing pressure to demonstrate structured quality management, not only clinical outcomes, to insurers, accreditation bodies and increasingly to patients themselves. EN 15224, the earlier European quality-management standard for healthcare, has seen limited uptake for similar reasons: certification and audit capacity has not kept pace with demand.

For organisations weighing whether to pursue ISO 7101 now or wait, the practical consideration is less about the standard's content — which builds logically on ISO 9001 principles most quality teams already know — and more about audit capacity: providers that move early are likely to face far less competition for auditor time as international interest in the standard grows.