The short answer
None of the three regulators has written an AI rule for pharmacovigilance yet. What they specify is the case record, and Ecuador and Brazil have done it recently and in detail: E2B(R3) XML, MedDRA and WHODrug coding, clocks that start at first awareness, and a named person who signs. AI belongs wherever it makes that record faster and more complete, and nowhere near the signature.
What changed in 2025 and 2026
Ecuador (ARCSA). Resolution ARCSA-DE-2025-052-DASP was published on Feb 4, 2026 and takes full effect on Nov 4, 2026. Reports go through WHO-UMC's e-Reporting Industry platform, and E2B(R3) XML becomes mandatory in August 2027. You can't even open the platform account without MedDRA and WHODrug licenses. Serious cases are due in 15 calendar days and non-serious in 30, counted from the moment any employee first hears about the event. A reporting period with no cases still needs an affirmative zero report.
Brazil (ANVISA). RDC 967/2025 took effect in March 2026. Registration holders report through VigiMed in E2B(R3), coded in MedDRA and WHODrug Global.
Mexico (COFEPRIS). The rule is older (NOM-220-SSA1-2016). The volume isn't: the national pharmacovigilance and technovigilance center received 82,993 notifications in 2025.
The direction is clear: structured, coded, machine-readable cases on a clock. That's the work AI is good at, and the teams doing it were thin to begin with.
Where the regulators already decided for you
Ecuador's resolution is the one I build against, and four of its rules shape any AI design:
- The clock starts at first awareness, by anyone. So intake has to timestamp the first touch, including a WhatsApp message to a sales rep. An AI that sorts the inbox faster is a compliance control here.
- A case needs four minimum elements (identifiable reporter, patient, suspect drug and event). An AI check for all four at intake catches the gap while the reporter is still on the line.
- Duplicate detection is a required system function. This is pattern matching, which is what models do well, with a human approving any merge.
- The Responsable de Farmacovigilancia signs before submission. That signature never moves to a model. The AI drafts; the RFV decides.
Where AI fits, and where it doesn't
Good uses today: intake triage, the minimum-criteria check, duplicate candidates, MedDRA and WHODrug coding suggestions, narrative drafts, clock alerts, and literature screening (EMA already uses AI for that last one).
Keep it human: seriousness, causality, expectedness against the product's technical sheet, and the submission itself. Ecuador names the causality methods per event type (Vaca-Delasalas for therapeutic failure, for example). A model can prepare the inputs. A qualified person runs the method and owns the result.
Log everything in between. Every model call gets an input hash, a model version, a confidence score and the reviewer's name. When the regulator asks how a case was coded, you show the log.
The data question nobody budgets for
Patient and reporter confidentiality in Ecuador runs under the LOPDP, and Brazil has the LGPD. Two consequences for AI:
- No raw personal data to an external model without consent that names the processor, or a documented data-residency position. The safe default is redaction before any external call.
- External AI processing is a delegated activity. Under the Ecuadorian resolution, outsourced pharmacovigilance work needs a written contract kept in the pharmacovigilance master file. If a model provider touches cases, that contract has to exist before go-live.
The global frame
CIOMS Working Group XIV published "Artificial Intelligence in Pharmacovigilance" on Dec 4, 2025, with seven principles, human oversight among them. ANVISA was one of the regulators on that working group. FDA and EMA followed with 10 guiding principles for AI in drug development on Jan 14, 2026. Latin American regulators haven't written their own AI rules for pharmacovigilance yet. When they do, expect them to borrow from these two documents, and expect them to ask for the record.
What I'm building
A regional pharmacovigilance platform, built inside our ERP by Iris LLC, launching with Iris Global Ecuador ahead of the Nov 4, 2026 standard, with Iris Mexico next. The case record, clocks, roles and E2B(R3) export come first. AI comes after go-live, once the manual process is proven. It's built and tested, and no live adverse-event cases have gone through it yet. The architecture is in AI regulatory compliance for healthcare and pharma operations and the platform case study is Black box on the inside, glass box on the record.
Running pharmacovigilance in Ecuador, Brazil or Mexico and deciding where AI goes? Let's talk.