Blogs
AI
Regulatory operations
MedTech
Why Enterprise AI in MedTech Regulatory Is 90% Foundation: The Iceberg Problem
The AI demo is the easy part. In MedTech regulatory operations, the features a team sees in a demo represent roughly 10% of the work required to run enterprise AI. The other 90% sits below the waterline.
Most regulatory leaders have now seen an impressive AI demo. A model drafts a submission summary, answers a question about market requirements, or flags a gap in a technical file. It looks finished. It is not.
What makes AI usable in a regulated environment is everything the demo never shows: the governance, data, and operational foundation that lets a regulatory team trust an output, trace it, and defend it in an audit. That foundation has to be built first, and it is where the real effort lives.
The 10% you can see
The functional layer is what users interact with: the context window, a generated draft, an answer or summary, and maybe a recommendation. It is what vendors showcase and what internal pilots usually build first.
This layer matters. But on its own, it answers only one question: can the model produce something useful? In regulatory work, the harder questions follow immediately. Where did that answer come from? Who approved it? Can we prove it was correct on the day we relied on it? How do we prove it to an auditor? Whatever the answer is, we can all agree it can't be "we stumbled across this Reddit thread."
The functional layer cannot answer any of those hard questions. The foundation underneath it has to, and it has to be trusted and defensible.
Below the waterline: trust and governance
So what does a trusted, defensible foundation look like? It is built from the controls that let a regulatory team stand behind every AI output, because "the model said so" will not hold up with an auditor or a quality system.
- Provenance and traceability. Every output links back to the source data and documents it drew from.
- Reasoning chain. Reviewers can see how the system reached a conclusion, not just the conclusion itself.
- Governed data. The AI works only from controlled, current, approved information.
- Validation. The system is validated for its intended use, and revalidated as models and data change.
- Security and isolation. Sensitive product and submission data stays protected and separated.
- Compliance frameworks. 21 CFR Part 11 for electronic records and signatures, ISO 27001 certification, SOC 2 Type II, ISO/IEC 42001 certification nearing completion, penetration testing, independent audits, and more.
None of these are features a user clicks. All of them determine whether a regulatory team can actually rely on what the AI produces.
Below the waterline: data and intelligence
A general-purpose model does not know your products, your registrations, or the nuances of more than 130 markets. Making it useful for MedTech regulatory work takes a dedicated intelligence layer.
- Regulatory corpus. A curated, maintained body of regulations, guidance, and requirements by market.
- Retrieval-augmented generation (RAG). Answers grounded in your own structured data and approved sources, not the model's general training.
- Embeddings and vectors. The indexing that lets the system find the right record or clause quickly and accurately.
- Prompt engineering. Tested, controlled instructions tuned to regulatory tasks.
- Ingestion and monitoring. Pipelines that keep data current and watch for drift or degraded output quality.
- Agents and orchestration. Coordination of multi-step tasks, with clear checkpoints for human review.
This is where domain specificity is won or lost. Generic AI layered on top of documents produces generic answers. AI built on a structured regulatory data model produces answers that reflect real requirements, country nuances, and product context.
Below the waterline: operations at enterprise scale
Even trustworthy, well-grounded AI fails if it cannot live inside the way regulatory teams actually work. The operational layer turns a capability into a system.
- Workflow management. AI output flows into review, approval, and change control, not a separate chat window.
- User access and permissions. The right people see the right data, across regions, partners, and in-country sponsors.
- Usage management. Visibility into how AI is used, by whom, and at what cost.
- Version control. A complete history of what changed, when, and why.
- Word processing. Drafts land where regulatory content is authored and finalized.
- APIs, change data capture, and MCP. Connections to ERP, PLM, QMS, and the rest of the enterprise stack.
- Infrastructure and scale. Performance that holds up across the most complex global portfolios.
This is the layer that separates a promising pilot from an operation a global regulatory team can run every day.
The build-it-yourself reality
For organizations considering an in-house build, the iceberg changes the math. The foundation comes first, and it can take months to years before anything useful runs.
The ownership does not end at launch, either. A team that builds its own regulatory AI also owns its validation, its audit defense, and its upkeep as models, regulations, and data evolve. That work lands on the same people who were supposed to be freed up by AI in the first place.
Building is not wrong for every organization. But it should be a deliberate decision made with the full iceberg in view, not just the 10% above the surface.
Five questions to ask before you build or buy
Whether the AI comes from an internal team or a partner, these questions surface what sits below the waterline:
- Can every AI output be traced to its source data, with the reasoning visible to a reviewer?
- Who validates the system, and what happens to that validation when the model or data changes?
- Is the AI grounded in a structured regulatory data model, or layered on top of documents?
- Does AI output move into governed workflows, with human review and approval built in?
- Is AI something your team can turn on when ready, or is it a prerequisite for using the platform?
If the answers are vague, the foundation probably is too.
Enterprise AI outcomes require enterprise infrastructure
The organizations getting real value from AI in regulatory operations are not the ones with the most impressive demos. They are the ones that invested in the foundation first: governed data, traceable outputs, validated systems, and workflows that keep human judgment firmly in control.
At Rimsys, that foundation is the platform. Rimsys AI runs on the same structured regulatory data model, governed workflows, and enterprise infrastructure that 6 of the top 12 global MedTech manufacturers rely on today. And because not every team is ready for AI at the same time, it is a configuration option: available when you are ready to accelerate, optional when you are not.
Want to see what sits below the waterline? Talk to our team about how Rimsys brings trusted AI to the heart of regulatory operations.




