What Does AI Readiness Mean for a CDMO?

The short answer

For a CDMO, AI readiness means being able to put an AI tool into a GxP process and defend it in a sponsor audit: the data it reads is trustworthy, the process it touches is documented, a named person owns its validation, and the decision it influences has a human sign-off. Running pilots is not the measure. The measure is whether you can say yes, with evidence in hand, the next time a sponsor's contract asks what you are doing with AI.

There is a second test, and in my experience it is the one the CFO asks about: does the tool move a number the plant gets paid on? A contract manufacturer is a fixed-cost business, so an AI tool earns its place when it removes avoidable review cycles, shortens release or tech transfer, or lifts right-first-time. The first test gates the second. A gain you cannot explain to a sponsor's quality unit does not reach production, so the efficiency case runs through governance rather than around it.

For GxP-relevant workflows, AI has to operate within the existing expectations for electronic records, computerised systems and risk-based validation: 21 CFR Part 11, EU Annex 11 and GAMP 5 principles where they apply. In practice, readiness means turning AI policy into working practice: clear data rules, trained authors and reviewers, and a measured plan for improving one operational workflow.

Why is a CDMO's readiness question different from a sponsor's?

Three things make it different, and none of them is the technology.

The sponsor holds the veto. A pharma company adopting AI answers to its own quality unit. A CDMO answers to every client's quality unit, each with its own audit calendar and appetite for risk. The clients are already asking: in a January 2026 survey of more than 50 CDMOs, 92 percent said sponsors were raising digital requirements in negotiations (PharmaSource, Jan 2026). An AI tool a CDMO cannot explain to a sponsor auditor is a tool it cannot use.

The data belongs to several people at once. A CDMO's records sit side by side across clients in the same LIMS, MES and QMS, so prompting a model on them is a confidentiality question before it is a validation one. Most quality agreements are silent on AI today. FDA's first enforcement action on AI misuse ends that silence: a warning letter of 2 April 2026 cited a firm whose quality unit never reviewed the specifications, procedures and master records its AI agents had written, under 21 CFR 211.22(c) (FDA Warning Letter 722591).

Validation was designed for software that stands still. Computer system validation assumes a system behaves tomorrow the way it was tested today. A model that is retrained, or drifts as its inputs change, breaks that assumption without raising an error. Validation used to be something you finished and filed. Governing a model is something you keep doing for as long as it runs.

What this looks like in practice. At one mid-size CDMO we worked with, the new head of quality's first concern about AI was not speed. It was confidentiality: whether anything an employee typed into the tool, such as a client's product details or batch data, could be stored or seen outside the company. The site answered with two rules. The AI tool is never connected to the validated quality system, so nothing passes between them automatically. And when AI helps draft an investigation, the draft is reviewed, signed and attached to the quality record as a PDF, so an auditor can see exactly what the tool produced and who approved it. The same site's quality reviewer had also noticed that sponsors were sending back more comments on investigation reports than before, and suspected the sponsors were now using AI to review them. If the sponsor's reviewer is a model, the standard a CDMO has to meet rises every quarter.

Which readiness dimensions matter most for a CDMO?

Toerana's readiness assessment scores the same seven dimensions for every company. For a CDMO the weighting is lopsided, and governance comes first. The table is the order I would assess a contract manufacturer in, with the question each dimension has to answer for a sponsor.

Europe has already shown its hand on governance. The draft EU GMP Annex 22, out for consultation in 2025, covers static, deterministic models in critical GMP applications and says it “does not apply to Generative AI and Large Language Models (LLM), and such models should not be used in critical GMP applications.” In non-critical work, “personnel with adequate qualification and training should always be responsible” for the outputs (draft Annex 22). Either way, the first question an inspector or sponsor will ask is which AI systems you run and what each touches.

On talent, the gap is wider than most leadership teams assume: in McKinsey's 2025 workplace research, 92 percent of companies planned to increase AI investment while 1 percent of leaders called their organisation mature (McKinsey, Jan 2025). In a GMP environment, training is not a benefit. It is a control. Toerana measures it per person across five competency domains: AI literacy, prompt craft, workflow fit, quality judgment, and guardrails.

Across the CDMO pilot groups we have scored, quality judgment is the strongest domain and guardrails the weakest, which is why governance comes first and training starts with what never goes into a prompt.

What does “ready” look like in practice?

A CDMO is ready when a VP Quality can tick every line below without asking IT. The site I have scored in detail could tick one, the training line, and only for a quarter of its licensed users.

• An inventory exists of every AI-assisted tool in use, including the ones individuals adopted on their own, each classified by GxP impact
• Each tool has a named owner who can explain, in one page, what it does, what data it reads and what decision it influences
• Client data is segregated at the point the model reads it, and the segregation is documented well enough to show a sponsor
• The process the tool touches has a current SOP, and a deviation or CAPA category exists for an AI-caused failure, distinct from a human or equipment one
• The acceptance criteria for the tool are metrics with thresholds, not a column of expected results, and someone monitors them after go-live
• A retraining or vendor model update goes through change control before it reaches production
• Every person who uses the tool has completed role-based training that covers when not to trust it, and the training is logged as GMP training
• Overrides are recorded, counted and reviewed, so automation bias shows up in a trend rather than in an inspection
• One sponsor has been shown the above and accepted it

Three of those lines are the ones CDMOs fail most often, in my experience.

Data segregation fails first. At one site, pilot users were pasting sponsor batch data into the tool with no classification step. The site had an AI usage policy and a hallucination policy; nobody using the tool referred to either. Toerana's Green/Yellow/Red rule is taught in an hour: classify before you type, and anything carrying a product name, lot number or sponsor identifier is red.

Trained reviewers fail silently. Not one of nine pilot users had told their reviewer that a draft was AI-assisted. The QA reviewer who signed all of their work had never used the tool, and one author described the review as skim and sign. The same group later met a fabricated ICH Q2(R1) citation in a draft. Toerana trains reviewers separately from authors, with the VERIFY checklist as their tool, and puts disclosure of AI assistance in the SOP.

Acceptance metrics fail because nobody has a baseline. When we asked a quality leadership team for investigations per month, the open backlog and the hit rate against their 25-day commitment, nobody in the room could answer. The numbers existed, in a monthly KPI pack nobody had thought to pull. One investigation record at that site showed four days of internal review, then 88 days waiting on sponsor review rounds before approval. That is the number a baseline exists to surface, and the draft annex requires acceptance criteria at least equal to the process a model replaces, so the baseline comes first.

Where do CDMOs stall?

Contract manufacturers start further back than most: in the same survey, nearly 80 percent were in a preliminary AI phase and 27 percent had electronic batch records (PharmaSource, Jan 2026). Three reasons recur.

1. The pilot was chosen for the demo, not for the sponsor. The first use case is usually the one a vendor could show quickly: a document search, a deviation summariser. It impresses internally, means nothing in a client audit, and never gets the budget to become production. The use cases that survive are tied to a decision a sponsor already cares about: batch disposition, deviation closure, release testing, tech transfer.

2. Validation was attempted the old way. The team writes an IQ/OQ/PQ package against a model, the model updates, and the package is wrong the day it is signed. The draft annex describes the alternative: metrics for the intended use, acceptance criteria at least as good as the current process, independent test data, monitoring in operation. Quality teams are rarely given the time to work this way, so the safe answer becomes no.

3. Human-in-the-loop was declared, not designed. “A person checks every output” is the control everyone writes down and few can sustain, because review fatigue turns the human into a rubber stamp within weeks. The draft annex does not accept the declaration on its own: where a model feeds a human decision, the operator's “training and consistent performance should be monitored like any other manual process.” A review step nobody designed, measured or staffed is not a control.

None of these is a technology failure. All three are readiness failures, which is why buying a better platform does not fix them. Factories learned the same lesson with electricity, where productivity moved only once the plant was rebuilt around the motor (Paul David, American Economic Review, 1990); what has to be rebuilt in a CDMO is the subject of Your CDMO Bought AI Tools. What Has to Change Before They Pay Off?.

What should a CDMO do in the first 90 days?

Connecting an AI tool to the validated quality system is a later decision with its own validation. The first 90 days should establish who governs AI, which use case is worth pursuing, and what must be true before it enters routine work. A site with suitable tools, data and controls may also complete a limited pilot in that time. A site starting earlier should leave with the governance foundation, trained participants and a funded implementation plan. The next step follows the evidence gathered at each review.

What a site has at day 90. A named owner and a policy every user has been trained on. A list of every AI tool in use and what each one touches. One workflow with a baseline, written controls, and trained authors and reviewers. Either a measured pilot or a funded plan to run one. That is what a sponsor's auditor will ask to see, and it is what AI readiness means for a CDMO: not a platform, but a quality organisation that can show how AI is used, who checks it, and what it changed. If you want to know which of those pieces is missing at your site, the AI Readiness Assessment takes a few minutes and is best run with the VP Quality in the room.

Frequently asked questions