Pharma and life sciences agentic AI in 2026 inherits five regulatory regimes simultaneously (21 CFR Part 11, GxP under GAMP 5 Second Edition, EMA Annex 11 in 2025-2026 revision, the EMA Reflection Paper on AI in the medicinal product lifecycle, and the EU AI Act). The audit substrate that satisfies any one regime does not by default satisfy the others. The 2026 procurement gap is treating the regimes as substitutable. Four conditions materially constrain compliant deployment (validated computerised system status under GAMP 5 plus CSA; 17-field audit trail covering Part 11 + Annex 11 + Article 12 simultaneously; ALCOA+ data integrity with contemporaneous, original, enduring records; EU AI Act high-risk-system registration with Article 11 technical file plus Article 16 post-market monitoring). Three vendor postures emerge in market (pre-validated Category 4 packaging; general-purpose platform plus customer-validated wrapper; open-source stack plus customer-engineered audit substrate).

Sister piece to AM-053 (HIPAA-compliant agentic AI in healthcare). Verified primary sources: FDA 21 CFR Part 11 (text and §11.10 controls); FDA Computer Software Assurance for Production and Quality System Software draft guidance (Sept 2022, docket FDA-2022-D-0795); ISPE GAMP 5 Second Edition; EMA-PIC/S Annex 11 draft revision (published 7 Jul 2025, comments closed 11 Oct 2025, expected finalisation mid-2026, expanded from 5 to 19 pages with formalised ALCOA+, cybersecurity as core GMP requirement, alignment with GAMP 5/ICH Q9/ICH Q10); EMA Reflection Paper on AI in the medicinal product lifecycle (final, adopted by CHMP and CVMP September 2024, 1,300+ stakeholder comments). Cross-referenced existing publication coverage: AM-046 (Article 12 audit evidence), AM-053 (HIPAA), AM-029 (NHI), AM-042 (readiness diagnostic). 90-day review cadence because regulatory pieces age slower; trigger conditions include Annex 11 finalisation, FDA CSA guidance promotion to final, EU AI Act Aug 2026 enforcement window post-mortem, named pharma agentic-AI deployment failures.