AI Output Verification in Regulatory Compliance

AI can now do in minutes what regulatory scientists used to do in days. The real test is whether anyone can defend what it found.

In short: AI output in regulatory compliance is only as good as your ability to defend it. Verification that counts rests on four things: provenance back to the source, expert judgement before anything reaches a report, a named person accountable for each conclusion, and a record of what was accepted and rejected.

Every chemical compliance provider is now saying the same thing: AI needs expert oversight. It has become the industry's default reassurance. But a principle everyone agrees with is not yet a practice anyone can inspect.

The evidence that it matters is mounting. A recent Enhesa survey of senior compliance leaders found that 40% of teams act on AI-generated guidance without expert review, and that those teams were fined nearly three times as often. Most striking: 91% said source citation is critical, but only 32% were very confident they could defend the logic behind an AI-driven decision.

That gap between using AI and being able to defend it is the problem our sector now has to solve.

Why speed was never the hard part

Regulatory science has always been judged on its reasoning, not its throughput. A registration dossier, a classification decision or an endocrine disruption assessment stands or falls on whether the evidence was relevant, reliable and properly weighed. Regulators do not assess how quickly a conclusion was reached. They assess whether it holds.

AI changes how much evidence we can gather. It does not change what makes a conclusion defensible. If anything, it raises the bar: more candidate evidence means more to screen, more to justify including and more to justify leaving out.

Why "human in the loop" is becoming a slogan

The phrase is now everywhere. But a human who skims hundreds of AI results to approve them in bulk is not verification. It is a signature on someone else's work.

What does good verification of AI output look like?

Verification that counts is designed into the workflow, not added at the end. In our view it rests on four things.

Provenance. Every AI-found result should trace back to its original paper, page or record. If you cannot follow a finding to its source, you cannot assess it, and neither can a regulator.
Judgement at the point of decision. AI output is a shortlist, not a finding. A qualified scientist should decide what is relevant and reliable before anything reaches a report or dossier. A database hit is a starting point, not a conclusion.
Named accountability. Conclusions should belong to people, not systems. When a regulator or client asks "who decided this?", there should be a name, not a model version.
A record you can reconstruct. What was found, what was accepted and what was rejected, and by whom, should be kept. Defensibility often has to be shown months or years later, at a dossier update or an inspection.

Why does AI verification matter now?

Many regulatory teams are being asked to do more with less. Resources are being cut while the workload keeps growing. In that situation, it is tempting to let AI fill the gap and trust what it returns. But that is exactly when verification matters most: the shortcuts taken under pressure are the decisions most likely to be questioned later.

The firms that earn trust will not be the ones that use the most AI. They will be the ones that can show their working.

How does Penman verify AI output?

These four principles are how we built Active Steward™. AI-assisted results in the platform link to their sources, and anything the AI has generated is clearly marked as such. Our scientists review AI hits before they reach clients or dossiers. Substance Watch conclusions are signed off by named Regulatory and Scientific Leads. And everything is audited: what was found, and who accepted or rejected it, is recorded and can be viewed.

We use AI to help our scientists cover more ground. We rely on our scientists to make sure that ground is solid.

Frequently asked questions

What is AI output verification in regulatory compliance?

It is the process of checking AI-generated results before they inform a regulatory decision. It covers tracing each result to its source, having a qualified expert judge its relevance and reliability, recording who accepted or rejected it, and making a named person accountable for the conclusion.

Why isn't "human in the loop" enough on its own?

Because a human's presence is not the same as a human's judgement. Approving large batches of AI results without assessing each one adds a signature, not scrutiny. Verification needs a defined review step, the expertise to do it and a record that it happened.

Can AI-found evidence be used in a REACH dossier?

Evidence is assessed on its relevance, reliability and adequacy, not on how it was found. AI can help locate studies and data, but a qualified scientist still needs to evaluate each source and justify its use, as they would for evidence found manually. [Have a regulatory lead check this wording]

How can compliance teams make AI-assisted decisions defensible?

Keep the link from every finding to its original source. Make expert review a required step, not an optional one. Record what was included and excluded, and why. And make sure every conclusion has a named owner who can explain it.

Will AI replace regulatory scientists?

Not in our view. AI changes how much evidence can be gathered and how quickly. Deciding what that evidence means, and standing behind the conclusion, still needs scientific judgement and accountability.

How does Active Steward verify AI output?

AI-assisted results in Active Steward link to their sources, and AI-generated content is clearly marked. Penman scientists review AI hits before they reach clients or dossiers. Substance Watch conclusions are signed off by named Regulatory and Scientific Leads. Everything is audited, and the audit trail can be viewed.

Sources

How is your team verifying AI output today?

Talk to us about building defensibility into your regulatory workflow.