Every health company faces the same tension when it looks at modern technical tools: the pace of what's possible has moved far ahead of what most regulated businesses have built the structure to use safely.
At Epitheal, we've spent this year closing that gap deliberately, not by rushing to adopt whatever tool looks newest, but by building a governance framework in line with ISO 42001 first and letting the speed follow.
Why this mattered to us
Epitheal sits at the intersection of pharmaceutical-grade thinking and modern technology. That positioning only holds if both halves are genuinely true.
One option would have been to bolt new flashy tools onto existing processes and call it innovation. The other would have been to hold back altogether, given the compliance weight of operating in the EU health space, and lose the efficiency gains that are now standard for a company our size.
We chose a third path: build the internal capability properly, with GDPR and the EU AI Act treated as ground-zero starting requirements rather than an afterthought, and only then start accelerating growth and efficiency within those boundaries.
What actually changed
The clearest shift has been in pace. Work that used to take days of manual effort now moves substantially faster, and every output that matters still passes through a qualified person before anything is acted on. That's the principle we built around: technology accelerates the groundwork, but a person remains accountable for the judgement, every time.
That shift in pace has changed what's realistically possible to take on in a given month, without changing who is responsible for the outcome.
The guardrails, not as an afterthought
None of this was built without the compliance work happening in parallel, and in most cases first. Before any tool touched anything sensitive, we put a formal AI use policy and data handling policy in place, reviewed and signed off at the top of the company. Every third-party tool we use has gone through a Data Processing Agreement review.
Nothing classed as sensitive, personal, clinical, or regulatory in nature goes anywhere near a cloud tool; that boundary is enforced structurally, not left to individual judgement on the day.
We've also built our governance approach with GDPR and the EU AI Act's obligations in mind from the outset, including clear human-in-the-loop checkpoints on anything that feeds into a regulatory or clinical judgement. Outputs are treated as inputs to a review, never the review itself. That distinction sits at the centre of how the whole system works.
Bringing the whole team along, not just the technical people
The harder problem, honestly, wasn't the technology. It was making sure a team that isn't primarily technical could work confidently and safely alongside these tools, understand where the lines sit, and know what's appropriate to put into a technical system and what isn't.
That meant a structured walkthrough for the leadership team covering real scenarios, not abstract policy. It's an ongoing process: check-ins are built in as tools and use cases evolve, not treated as a box ticked once and forgotten.
The result is a team that's noticeably more fluent than it was even a few months ago, not because everyone became a technologist, but because the boundaries and the reasoning behind them are now well understood across the business.
Where this leaves us
The work is ongoing, and the regulatory environment around AI in health is still moving, but building the governance first means we can keep adopting what's genuinely useful without wondering whether we've compromised something we shouldn't have.
That's the discipline we think a pharmaceutical-led technology company should be judged on.
For more on how we approach this, watch our AI governance overview.