Your CDMO Bought AI Tools. What Has to Change Before They Pay Off?

The short answer

A contract development and manufacturing organisation (CDMO) gets value from AI tools only after three things change around them: people, process and systems. That means named roles for who uses AI and who checks it, written procedures that say where AI sits in the work, and clear rules for what data it may read and how its output reaches the official record.

You bought the AI tools. People have access, and the usage report shows them logging in. Yet the work that drives your revenue looks the same: batches still wait on paperwork, sponsors still send reports back for another round, and the backlog has not shrunk. So why hasn't anything changed? It is the question I hear most often from leaders who run CDMOs, and the answer is almost never the tool.

Most of this is work a well-run quality organisation already knows how to do. It just has not been pointed at AI yet.

Why the tool alone was never going to pay off

Every big new technology goes through the same awkward phase, and factories show it most clearly. In 1899, nearly two decades after the first power stations opened, electric motors still supplied under 5 percent of the mechanical drive in American factories. Many owners simply bolted motors onto the old belts and shafts and carried on as before. The economist Paul David found that electrification had no visible effect on productivity until the early 1920s, once plants were redesigned around the motor (Paul David, American Economic Review, 1990). AI at a CDMO is in that bolted-on phase now. Give people a tool and leave every workflow as it was, and you get a little speed in a few places and nothing you can show a sponsor or a CFO.

Most of the value sits outside the technology. BCG's rule of thumb is that about 70 percent of the value from AI comes from people, process and the operating model, 20 percent from data and algorithms, and 10 percent from the technology itself (BCG, 8 Jun 2026). That 70 percent is the part nobody sells you.

People

Four roles before AI touches a regulated record

At a CDMO, much of the paperwork is a regulated record: documents an inspector or a sponsor (the drug company that hired you) can ask to see under good manufacturing practice (GMP) rules. Before an AI tool goes near one, four roles need to exist:

1. 1.The author, who knows what the tool may and may not be given.
2. 2.The reviewer, trained to check AI output rather than skim it.
3. 3.The owner, who answers for how the tool is used and how well it works.
4. 4.The decision group, a small group with quality represented, that can approve a new use or stop one.

Most companies have not set this up yet, in any industry. In US Census Bureau research on how firms adopt AI, 64 percent of businesses using AI had made no institutional adjustments to use it; training staff and creating new workflows, the most common changes, each applied to only about 15 percent (US Census Bureau, Apr 2026). Among small and mid-sized firms using generative AI in seven countries, the OECD found that 28.6 percent had guidelines for staff on its use and 23.6 percent had employees in AI training (OECD, Nov 2025). In a Gartner survey of 360 IT leaders involved in rolling out generative AI, only 23 percent were very confident in their organisation's ability to manage security and governance when rolling out those tools (Gartner, Oct 2025). CDMOs are no exception. At most sites I see, none of the four roles is documented as yet, or if it's documented, it's not being practised.

One rule holds for every document, process and result the AI touches. The person who drafts is never the person who gives final approval, and nothing the AI produces moves to the next step until a trained person has reviewed it.

Banks have already lived this. When their regulator set expectations for the models banks rely on, in 2011, it asked for the same building blocks: someone accountable for “model use and performance,” validation “by people who are not responsible for development or use,” and “ongoing monitoring” (SR 11-7). That middle phrase is the review rule above, written for a different industry fifteen years ago. The rule is easy to write down. What makes it real is a trained person in each role.

Here is what that looks like on a real site. When something goes wrong in manufacturing, the supervisor of that area writes an investigation report: what happened, why, and what will stop it happening again. A quality reviewer checks it, then it goes to the sponsor for approval. If the sponsor finds gaps, the report comes back and the clock keeps running. At one site I worked with, a single investigation took four days to write and review internally, then waited 88 days on sponsor review rounds.

At the CDMO I know best, the quality reviewer had started running investigation drafts through the site's approved AI tool, which sits inside its controlled environment, to find those gaps before the report went to the sponsor. It was a good idea used at the wrong point. By the time a report reached the reviewer it had already used up a review round, and the supervisors who wrote the reports had no such check. The fix is to move the check to the people who write the reports, train them to use it, record that training, and name one person who owns how the tool is used. Gaps then get caught when the report is written, before a round is spent.

In training, authors learn to give the tool structured inputs and check their own draft before it leaves them. Reviewers learn to check AI output against a checklist instead of reading it like a colleague's work, and every draft says whether AI helped, so the reviewer knows which check to run. Role-based training pays: Gartner found organisations offering persona and role-based guidance were two times more likely to report higher levels of value from generative AI (Gartner, Nov 2025). In a regulated plant, log it like any other GMP training, because here training is a control.

Process

Decide where AI sits in the work, and measure before you start

The process questions are ones your quality team already knows how to answer. Does the tool act at the start, before a draft exists, or at the end, after a review round has already been used? Does every author give it the same inputs? What do your written procedures say about disclosing AI help, about recording when AI contributed to an error, and about a vendor's model update? And how well did the process perform before the tool arrived, so you can prove it helped?

That same site shows why the workflow has to be settled before the tool goes in. Investigations there were written outside the quality management system on purpose. Staff drafted the report in Word with the supporting documents beside them, then copied the text back into the system field by field, because the system logged them out if they were called away mid-entry. Add AI to that flow as it stands and it inherits all the copying: the time saved in drafting is lost again in pasting. Decide first where the AI acts, write that into the procedure, and treat the copy-and-paste step as a separate systems question.

A pattern that works at most sites has three parts. A structured intake (context, task, format, constraints) that every author fills in before asking the tool anything. A self-check the author runs before submitting, built around the questions a reviewer would ask. And a tag on each record when AI contributed, so you can trend where it helps and where it causes errors.

Underneath all of it sits the baseline. If nobody measured review cycles, cycle time and backlog before the pilot, nobody can show it worked afterwards. Europe's draft GMP rules for AI expect the performance of the process being replaced to be known before a model is accepted (draft Annex 22).

And keep the controls in proportion, because pharma has overcorrected before. By 2003, FDA was recording concerns that some interpretations of Part 11, its electronic records rule, would “unnecessarily restrict the use of electronic technology” and “significantly increase the costs of compliance.” In the same guidance it noted that “validation would not be important for a word processor used only to generate SOPs” (FDA, Part 11 Scope and Application, 2003). Scale controls to what the tool touches: a drafting aid whose output a trained person reviews is a different thing from a batch release system.

Systems

You do not need to connect AI to your quality system to get value

Less has to change in your systems than you might fear, at least at first. The one part that cannot wait is the data rule. Banks show what happens when data is left until last: the Basel Committee set principles for risk data in 2013, and in 2023 it still reported that “additional work is required at all banks” it assessed (BIS, 28 Nov 2023). Settle what data may go where before anyone scales the tool.

1. 1.

   Close the door on shadow AI. Shadow AI means tools people adopt on their own, outside your controlled environment (the systems your company has approved, secured and can audit) and outside what your client agreements allow. A simple Green/Yellow/Red rule closes that gap. Anything carrying a product name, lot number or sponsor identifier is Red, and Red data goes only into the approved tool inside your controlled environment, within what each sponsor's quality agreement permits. Never into a personal or public AI tool.

2. 2.

   Keep the record where it already lives. The approved report goes into your quality system the way it does today, with AI help disclosed on it, and the tool's output is kept with the working papers like any other draft. Nothing about that requires connecting the AI tool to your validated system.

3. 3.

   Connect only when it is worth it. Integration, meaning a direct link between AI and a validated system, is a later decision with its own validation. For language models in critical manufacturing decisions, Europe's published draft rules say they should not be used, though regulators are now discussing it (EMA, Oct 2026).

For most of what a quality team wants from AI today, the goal is adoption (people using approved tools well inside today's systems) rather than integration. Most CDMOs are not starting from a digital base anyway: in a benchmarking survey of more than 50 CDMOs, only 27 percent had integrated electronic batch records (PharmaSource).

Where CDMOs use AI first, and what changes in each

The examples above come from investigations, but the same three changes apply wherever a CDMO is likely to start.

• Batch record review. Reviewers know what the tool checks and what it can miss; the procedure says the tool may flag issues but never clears a record on its own; batch data is classified before it goes near a prompt.
• Procedures and controlled documents. Authors disclose AI help and the document owner approves; the AI drafting step sits inside document control; the approved version lives in the document system, not the AI tool.
• Corrective actions and change control. Owners judge AI-suggested root causes rather than accept them; records note when AI contributed; nothing connects to the quality system until it is validated.
• Tech transfer and sponsor reports. Sponsor-facing staff know what client data may go in; AI use on a sponsor's work is agreed in that sponsor's quality agreement; each client's data is kept separate.

How to know it is paying off

Pace depends on you. Every company sets its own goals, and how far and how fast it uses AI and automation should follow its strategic roadmap, not a vendor's timetable. What does not change is where the payoff shows up and how to measure it. Take these before the pilot and track them monthly:

• Review rounds per report, internal and sponsor
• Days from first draft to final approval
• Right-first-time rate on the documents AI helps with
• Staff hours per document
• Errors where AI contributed, from the tag on each record

Fewer rounds, shorter cycles and more productive people reach the business as more output, more revenue and lower cost. Measurement itself is part of the gain: Gartner found organisations that regularly assess their AI systems' performance and compliance were over three times more likely to report high value from generative AI (Gartner, Nov 2025).

When to hold off

Some sites should wait before scaling AI. Hold off if nobody can say who owns the tool, if staff are already using personal AI accounts on client work and nobody has stopped it, if a sponsor's quality agreement does not yet allow AI on its records, or if you cannot measure the process today. Each of those is fixable in weeks, and each is cheaper to fix before the pilot than after it.

What to do on Monday

Start with people: name an owner and a small decision group that includes quality, write a one-page policy, and train one group of authors and reviewers. Then process: set the intake, the self-check and the procedure, and take your baseline. Leave systems until last: put the shadow-AI rule in place and record AI help in your existing quality system, and that is enough to run a real pilot. The 90-day plan in What Does AI Readiness Mean for a CDMO? lays this out in three 30-day stages.

In Toerana's seven-dimension assessment, people maps mainly to Talent and Culture, process to Process and Governance, and systems to Data and Technology, with Strategy deciding where to start. If you want to know which part is holding your site back, take the AI Readiness Assessment. It takes a few minutes and works best with your VP Quality in the room.

Frequently asked questions