The 3 a.m. Question
Every generative AI project in a regulated industry eventually gets to the same interrogation. It usually happens in a room with compliance counsel, a chief medical officer, and an increasingly quiet team of engineers.
"Show me exactly where this sentence came from."
If the answer is "the model just knew it," the project dies. If the answer is a page number and a paragraph in a validated source document, the project lives.
That question is what killed most of pharma's first generation of GenAI experiments. It's also what a UK Pharmatech conglomerate hired us to solve — permanently.
Why "Just Use ChatGPT" Was Never on the Table
Pharmatech content — clinical summaries, patient education material, regulatory submissions, medical affairs briefs — sits inside a compliance stack that treats a single unverified claim as a legal event. Three regulatory regimes intersect at once:
- HIPAA governs any identifiable patient data touching the pipeline.
- GDPR applies to every EU citizen's information the moment it enters the system.
- The European AI Act now sits over all of it — with tiered risk classifications, mandatory transparency for generative systems, and enforcement teeth that arrived faster than most enterprises prepared for.
The client didn't need a chatbot. They needed a piece of infrastructure that could accelerate content velocity without shifting the risk curve by a single point.
That meant three constraints stacked on top of each other:
- Every claim traceable to an approved source, at the sentence level.
- No sensitive data ever crossing an external LLM boundary.
- A workflow a domain expert could inspect, override, and re-run — not a black box that spits out finished copy.
Every regulated industry has a content workflow generative AI can 2x. Almost none can accept the risk profile of a naive deployment.
Rebuilding the Newsroom, Agent by Agent
The instinct with generative AI is to treat it as a single author — one model, one prompt, one output. In a regulated domain that model is structurally wrong. Newsrooms don't work that way. Neither do medical writing teams.
So we rebuilt the workflow as a newsroom of specialized agents, orchestrated by LangGraph, each with a job a human on the team already recognized.
The Researcher
A retrieval agent that queries the vector index across the client's approved corpus — clinical trial documents, regulatory precedents, internal validated content. It doesn't write anything. It returns candidate passages, ranked, with citations attached.
The Drafter
A generation agent (Claude for regulatory reasoning; Llama and Mixtral for scoped extractions where cost and latency matter) that assembles the draft only from what the Researcher retrieved. Every sentence carries a citation reference from the moment it's born.
The Compliance Officer
A verification agent that runs the draft against explicit rules: PII scan, regulatory phrase library, disallowed claims, jurisdiction-specific redactions. It doesn't interpret — it enforces. Its output is a pass, fail, or annotated flag.
The Editor
A structural reviewer that checks the draft against style, section requirements, and cross-references. Anything below threshold routes back to the Drafter with a corrective note, not a full restart.
The Human at the Helm
The whole thing exists to serve a domain expert sitting in front of a Next.js portal, who can:
- Read the draft with every claim linked to its source paragraph.
- Override a citation, edit inline, or reject a section outright.
- Trigger a local regeneration — only the affected passage — without restarting the entire workflow.
That last capability is the one clients notice first. It's the difference between AI as a tool and AI as a colleague you can argue with.
The Engineering Underneath the Metaphor
The newsroom framing is deliberate. The substance is architectural.
Orchestration. LangGraph gives us deterministic, stateful routing across agents, with native checkpoints for human-in-the-loop review and durable execution traces. Every branch, retry, and human intervention is persisted — exactly what an EU AI Act audit demands.
Retrieval. The RAG layer isn't the standard chunk-and-cosine setup. We built line-level source anchoring, so a generated sentence can be walked back to a specific line span in the source document. Pinecone and Qdrant handle semantic recall; the citation layer sits above them and refuses to release a claim without a bound reference.
Data isolation. Custom middleware intercepts every LLM call. PII is scrubbed, PHI is tokenized, and jurisdiction-specific data — EU patient records, US clinical identifiers — never crosses a boundary it isn't allowed to. This is enforced at the runtime layer, not the prompt layer, because prompts can be bypassed and runtimes cannot.
Audit. PostgreSQL stores immutable logs of every prompt, agent decision, and human edit, timestamped and role-tagged. LangSmith carries deep telemetry on execution traces and token usage. Together they produce the artifact regulators actually ask for: a complete, replayable history of how a piece of content came to exist.
Serving. A Node.js/Express gateway fronts the domain-expert portal for throughput. Python/FastAPI microservices carry the ML and agent workloads. Docker and Kubernetes let us scale the interactive layer independently from the heavy inference layer — because a compliance reviewer clicking through drafts should never wait on a GPU grinding through a validation batch.
The Receipts
The system moved from architecture diagram to production over the engagement. What it delivered:
- 70% reduction in end-to-end drafting and review cycle time. Medical writers stopped losing days to manual research and formatting; they shifted to high-value analysis and final editorial judgment — the work they were trained for.
- 100% citation coverage. Every published claim maps to a validated source. No sentence ships without a receipt.
- Zero hallucinated claims in production output. The architecture makes them structurally impossible, not just statistically unlikely.
- Full audit posture across HIPAA, GDPR, and the European AI Act. When an audit request arrives, the answer is a query — not a scramble.
- A HITL workflow the domain team actually trusts. Confidence in the system was the softest metric to measure and the most important to earn.
What This Unlocks
The Pharmatech engagement was one specific application of a broader thesis we work from at ExecuteML: generative AI is deployable in regulated industries, but only if you build the compliance infrastructure first and the intelligence layer on top of it.
The architecture — deterministic orchestration, source-anchored retrieval, runtime data guards, complete audit trails, human authority at every decision boundary — generalizes. The same pattern now runs across financial services (KYC narratives, credit memos, investor communications), healthcare (clinical documentation, care plan drafting), and legal (regulatory filings, contract analysis).
The bet is simple. Every regulated industry has a content or reasoning workflow that generative AI can 2x. Almost none of them can accept the risk profile of a naive deployment. The teams that will win in the next five years are the ones who solved the compliance layer first and treated the intelligence layer as the easy part.
If that's the problem in front of you — content velocity without a corresponding rise in regulatory risk — we should talk. Explore our approach to enterprise-compliant AI agents and zero data retention deployments, or get in touch to map what a source-grounded, audit-ready system would look like inside your own compliance stack.