Privacy and Governance Must Be Architectural

A theme that kept resurfacing during the privacy-first DTC discussion at Fierce Pharma Week 2026: governance cannot be something bolted onto AI afterward. It needs to be part of the architecture from the start.

If agents are going to work continuously across data, content, audiences, and workflows, every agent needs context about more than just the customer. It needs to understand what data can be used, what actions are permitted, what content is approved, what requires human approval, what needs to be logged, and what should never happen autonomously.

That is why the future AI stack in a regulated industry has to be more than a language model plus data. It requires identity, context, permissions, policy, observability, auditability, and human control, built in as first-class components rather than an afterthought layered on top once something has already gone wrong.

The more capable the AI becomes, the stronger this control plane needs to be — not as a brake on transformation, but as what actually allows transformation to scale safely. Responsible AI done correctly doesn't slow an organization down; it's the reason the organization can move faster with confidence.

For technology and compliance leaders evaluating an agentic AI platform, the architecture questions to ask up front are the same ones that get asked far too late in most deployments: who approved this action, what data informed it, and can we prove it after the fact?

This piece draws on the privacy-first DTC panel at Fierce Pharma Week 2026, featuring Alison Tapia (Sun Pharma), Nataliya Andreychuk, Nimi Patel (Astellas), Patrick Sullivan (The Trade Desk), and Andrew Witriol (Bristol Myers Squibb).