INDUSTRIES · PHARMA AND LIFE SCIENCES
Document work done faster, with generative AI kept out of critical GMP.
SOP drafting, review support and audit readiness on your own network, with a person deciding and validation staying with you. Formulations and study data are designed to stay inside your perimeter.
IN SHORT
For pharma and life-sciences firms, AgentAnywhere is designed to run inside your own perimeter, on your own network. The EU's draft Annex 22 would keep generative AI out of critical GMP applications, and we keep it out too: our uses are documents, SOP drafting, review support and audit readiness, with a person deciding, and validation stays with you. Manthan reads long documents and drafts for review, Aavaran, our data-masking layer, masks personal data before a model reads it, Taksha works on software on your network, and every step is recorded.
01 · Validation is the gate
Revised Schedule M, clause 20.1, says GMP-related computerised systems shall be validated. Validation is the customer's work, and it takes the time it takes.
02 · Every change leaves a trace
Clause 20.4 asks for a record of any data change, with the previous entry, who changed it and when. An AI step has to leave the same kind of trace.
03 · The formula is the asset
Formulations, process know-how and study data are what a rival would most like to read. They belong inside your perimeter, not in someone else's service.
WHY IT FITS
Sovereign, our models, and the Trust Platform.
Three things, in the terms of pharma and life sciences: where it runs and who controls it, which models do the work, and the controls and the record around every call.
01 · Sovereignty
Your formulations, your process and your data run on your network.
- Inside your perimeter: your own cloud account in an Indian region, or your own hardware. Region-pinned, and designed to deploy air-gapped.
- Swaraj, the sovereign deployment, is designed to pin a deployment to the region you choose.
- It runs under your quality system. You decide which documents it reads and which people review what it drafts.
02 · Our models
The line we select, measure and serve, kept to documents and review.
- Manthan reads long documents, synthesises them and drafts text for a person to review, in English and Indian languages.
- Taksha works on laboratory and plant software on your own network, with an independent referee. Manthan and Taksha are built on open foundation models, measured and served by us.
- Generative AI stays out of critical GMP applications. You can bring your own open model.
03 · The Trust Platform
Controls around every call, and a time-stamped record you keep.
- Aavaran masks personal data before a model reads it, with a signed Trust Receipt for each masking call.
- Kavach is designed to screen each request for prompt injection and unsafe output. The Agent Gateway applies your policy at the point of the call.
- Every step is recorded, in a trail you can query and export as CSV.
INSIDE YOUR PERIMETER
What happens to one document.
Follow one request from the moment it arrives to the receipt an auditor can check. Raw values are designed not to cross the boundary.
One request · start to receipt
Illustration
Your perimeter · your cloud, your region, or designed to deploy air-gapped
Step 1 of 5
A request arrives
A question comes in. It carries a name, an account, a card number: the things that must not travel.
THE RULES
The rules that bind you.
What each instrument requires in plain words, where it stands today, and what it means for AI in pharma and life sciences. Dates that have not arrived are written as dates.
Revised Schedule M, Drugs Rules 1945, G.S.R. 922(E), 28 December 2023
Notified 28 Dec 2023
What it requires
Clause 20.1: GMP-related computerised systems shall be validated. Clause 20.4: a record of any data change, with the previous entry, who changed it and when.
What it means for AI
Validation of any computerised system stays with you. Our trail records each AI step with its time; whether a system meets clause 20.4 is for your validation, and we do not validate it for you.
What it requires
A draft. The consultation closed on 7 October 2025, and it has not been adopted as far as we read. The draft says generative AI and large language models should not be used in critical GMP applications.
What it means for AI
We keep generative AI out of critical GMP applications too. Our uses are documents, SOP drafting, review support and audit readiness, with a person deciding.
What it requires
Secure, computer-generated, time-stamped audit trails.
What it means for AI
If you work to US requirements, your quality team will read this against any system you validate. Our trail records each step with its time and exports as CSV; whether a system meets the section is for your validation.
What it requires
Commenced by G.S.R. 843(E) of 13 November 2025. Section 8(5): protect personal data, including data with a processor, by reasonable security safeguards. Rule 7(2)(b): a fuller breach report within 72 hours. Rule 6(1)(e): logs and personal data kept one year.
What it means for AI
Study-participant, patient and employee data in your documents is personal data. Masking before a model reads it is one safeguard you can show.
What it requires
Report listed incidents within 6 hours of noticing. Keep ICT logs for a rolling 180 days within Indian jurisdiction.
What it means for AI
An AI system produces ICT logs. A recorded trail that stays in your deployment is the material for the log duty. Reporting stays with you.
This is what the rules say, not legal advice. Your compliance function owns the reading and the filing.
USE CASES · BY FAMILY
What runs inside a pharma company.
Each card opens the page for that family or machine. Tell us your setting and we will show you the closest demonstration.
WORK SCENES
What it looks like on a working day.
The problem, what runs, and what the person at the desk gets. Each scene is an illustration of how the work is designed to go, not a customer account.
Scene 01
An SOP revision
The problem
- A revision starts from a blank page and last year's version.
What runs
- Manthan drafts the revision from the text you give it, inside your perimeter.
What they get
- The author gets a draft to edit, and quality review approves it under your change control.
Scene 02
A deviation report against its procedure
The problem
- A reviewer reads a long deviation report beside the procedure it refers to.
What runs
- Manthan lists the places where the report and the procedure differ or leave a gap.
What they get
- The reviewer receives a list of points to check, and decides.
Scene 03
An inspector's question about the AI
The problem
- An inspector asks who used the AI, on what, and what it produced.
What runs
- Every AI step is recorded with its time, in a trail you can query.
What they get
- Quality assurance exports the trail as CSV and puts it beside your own controls.
Scene 04
Documents with names in them
The problem
- Adverse-event and study documents carry participants' names and contacts.
What runs
- Aavaran masks the personal data before the model reads the document.
What they get
- The reviewer works from masked text, with a signed Trust Receipt for each masking call.
Scene 05
Laboratory and plant software
The problem
- Your engineers maintain code that cannot be sent to an outside tool.
What runs
- Taksha works on your own network, and an independent referee checks each claimed success.
What they get
- Your engineers receive each change with the referee's verdict. Validation of any GMP-related system stays with you.
THE SOVEREIGNTY TEST
The sovereignty test, for pharma and life sciences.
If an AI system cannot answer these from its own records, you are renting it. Beside each question: what a rented AI service usually answers, and how we answer. Read the test.
01Where does the data run?
What a rented AI service usually answers
“In a region near you, per the contract.” The vendor decides when the model changes.
How we answer
On your network: your cloud in an Indian region or your own hardware, region-pinned and designed to deploy air-gapped. Your formulations are designed to stay inside your perimeter.
02Which model made that decision?
What a rented AI service usually answers
“The AI.” A model that changes under you without a change record.
How we answer
Model Hub is designed to register each model with an owner, lineage and evaluation history, so a model change can sit under your change control. Manthan and Taksha are built on open foundation models, measured and served by us.
03What did the model actually see?
What a rented AI service usually answers
The whole document, participants' names and emails included.
How we answer
Aavaran masks personal data before the model reads it, with a signed Trust Receipt for each masking call.
04What stops the agent doing harm?
What a rented AI service usually answers
A prompt asking the model to stay within its brief.
How we answer
A policy outside the model, and a rule of our own: generative AI stays out of critical GMP applications. Kavach is designed to screen each request, and the Agent Gateway applies your policy at the point of the call.
05Who approved the consequential step?
What a rented AI service usually answers
“The system.”
How we answer
A named person reviews and approves what the AI drafted, under your change control, and the step is recorded.
06What will you show the regulator?
What a rented AI service usually answers
A validation summary from the vendor.
How we answer
A recorded trail, time-stamped, queryable and exportable as CSV. Validation stays with you, and your quality team owns the reading of the rules.
STATED PLAINLY
What this is not.
- Generative AI stays out of critical GMP applications. The EU's draft Annex 22 would keep it out, the draft is not adopted as far as we read, and we follow its direction anyway.
- Our uses are documents, SOP drafting, review support and audit readiness, with a person deciding. We do not make batch release, deviation or quality decisions.
- Validation stays with you. Nothing here is validated for you. Schedule M clause 20.1 says GMP-related computerised systems shall be validated, and that work sits with you.
- A model's draft supports a reviewer. Quality review approves under your change control.
- Masking reduces what a model reads. It does not take data outside any law, and your compliance function owns that view.
THE OFFER · THE SOVEREIGN PILOT
Bring your hardest workload. We come to your data.
Pick the one workload your risk committee keeps deferring because the data cannot go anywhere. We run the pilot where the data already sits, with our architects beside your team, and you decide at the end whether it goes live.
For pharma and life-sciences firms: bring the document-heavy workload, such as an SOP revision cycle, deviation review or audit preparation. A person decides, and validation stays with you.
What the pilot is
- One workload, one team, six to ten weeks.
- A sovereign environment by default.
- Solutions Architecture paired with your team for the duration.
- It ends with one agent in production under your governance, or a documented decision not to proceed.
What we add
- The Trust Platform is on from the first call: data masking, policy screening, the Agent Gateway and a recorded trail.
- The record stays with you and is exportable as CSV.
- You can bring your own open model.
- A reply within one business day.
A risk committee has no reason to refuse, because the data does not have to go anywhere to find out. The pilot ends one of two ways: one agent in production under your governance, or a documented decision not to proceed, with the record behind it.
OTHER INDUSTRIES
Other industries
FAQ
Frequently asked questions.
- Can generative AI be used in GMP manufacturing?
- Not in critical GMP applications, if the EU's draft Annex 22 is followed. The draft says generative AI and large language models should not be used in critical GMP applications. It is a draft: the consultation closed on 7 October 2025 and it has not been adopted as far as we read. We keep generative AI out of critical GMP applications too.
- What can AI do in a pharma company, then?
- Documents, SOP drafting, review support and audit readiness, with a person deciding. Manthan drafts and compares text for a reviewer, Aavaran masks personal data first, and every step is recorded. Validation stays with you.
- Who validates the AI system?
- You do. Revised Schedule M, clause 20.1, says GMP-related computerised systems shall be validated. Nothing we provide is validated for you, and we keep generative AI out of critical GMP applications.
- What does Schedule M say about records of data changes?
- Clause 20.4 of Revised Schedule M (G.S.R. 922(E), 28 December 2023) asks for a record of any data change, with the previous entry, who changed it and when. Our trail records each AI step with its time and exports as CSV; whether a system meets the clause is for your validation.
- Does 21 CFR Part 11 apply to AI tools?
- It is a US rule. Section 11.10(e) calls for secure, computer-generated, time-stamped audit trails. If you work to US requirements, your quality team will read it against any system you validate. Our trail is time-stamped and exportable as CSV.
- Can formulations and study data stay inside our network?
- AgentAnywhere is designed to run inside your perimeter, on your network, region-pinned and designed to deploy air-gapped. Aavaran masks personal data before a model reads it, and the record stays with you.
- Is personal data in study documents protected before the model reads it?
- Aavaran detects names, contacts, email addresses and the fields your policy designates on each call and masks them before the model reads the raw value, with a signed Trust Receipt for each masking call. Masking reduces what a model reads; it does not take data outside any law.
- What does the Sovereign Pilot involve for a pharma company?
- One workload, one team, six to ten weeks, in a sovereign environment, with Solutions Architecture paired with your team. The Trust Platform is on from the first call, the record stays with you and is exportable as CSV, and it ends with one agent in production under your governance or a documented decision not to proceed.
Bring your hardest workload.
We come to your data. One workload, one team, six to ten weeks, in a sovereign environment. Tell us the workload and a solutions architect will reach out within one business day.