Sovereign AI for the pharmaceutical sector in Italy: infrastructure, compliance and full control

Why the pharmaceutical sector needs sovereign AI

Pharma is not just any sector when it comes to adopting AI. The data it handles — clinical trial results, adverse event reports, patented formulations, regulatory dossiers — carries an economic and regulatory value that makes it incompatible with hyperscalers' multi-tenant cloud architectures. A single data breach in pharma can mean regulatory penalties on top of lasting reputational damage.

Sovereign AI answers that need with a precise architectural principle: the AI infrastructure lives on-premise, under the organisation's control. Indexing, vector search, workflow orchestration, authentication and audit run inside the company perimeter; generation runs on a local model or, if the organisation chooses, on a replaceable EU endpoint.

For mid-market Italian pharmaceutical companies — those with revenue between €50 million and €500 million — the challenge is twofold: adopting enterprise-grade AI without the resources of big pharma, and doing so within a regulatory framework that gets stricter every year. That is exactly the segment Nexus MDS Core is built for.

The regulatory framework: AI Act, GDPR, Law 132/2025, NIS2

The Italian pharmaceutical sector is subject to several AI-related regulations at once. Understanding that framework is the prerequisite for any architectural decision.

The EU AI Act (Regulation (EU) 2024/1689), in force since August 2024 with obligations phasing in up to 2028, classifies AI systems by use, not by sector: AI that is a safety component of a medical device, or that falls in one of the uses listed in Annex III, is a high-risk system. That brings specific obligations: detailed technical documentation, risk management systems, verifiable data governance, mandatory human oversight, and registration in an EU database. After Regulation (EU) 2026/1744 they apply from 2 December 2027 for Annex III uses and from 2 August 2028 for medical devices; the transparency obligations of Article 50 have applied since 2 August 2026. For pharmaceutical companies using AI in pharmacovigilance or clinical trials, the first question is whether the system falls in those categories at all.

The GDPR remains the cornerstone of data protection. In pharma, where patient data runs through every process — from clinical trial recruitment to adverse reaction reporting — the minimisation principle and the need for a solid legal basis for every processing activity make it problematic to use cloud-based AI platforms where data leaves the company perimeter.

Law 132/2025 — Italy's first comprehensive national law on artificial intelligence — integrates the AI Act with national rules: in healthcare, the patient's right to be informed and a clinical decision that always rests with the doctor; in criminal law, the offences of its Article 26 and, through Legislative Decree 160/2026, the new Article 437-bis of the Criminal Code for omitting safety measures or human oversight in high-risk AI systems. For pharma, this translates into the need for complete audit trails and the ability to explain every algorithmic output.

The NIS2 Directive (transposed in Italy by Legislative Decree 138/2024) classifies the healthcare and pharmaceutical sector among the essential sectors, with stronger cybersecurity obligations: managing digital supply chain risk, notifying incidents within 24 hours, and direct accountability for management. Cloud-based AI infrastructure widens the attack surface and makes NIS2 compliance harder.

In short: the Italian and European regulatory framework of 2025-2026 makes sovereign AI less a technology preference than the most direct way to meet these requirements in the pharmaceutical sector: none of these laws mandates it, but each asks the company to show where its data goes and who can reach it.

Use cases: pharmacovigilance, clinical trials, supply chain

Sovereign AI in pharma is not an abstract concept. The use cases are concrete, measurable and have a high operational impact.

Automated pharmacovigilance. Adverse event reporting (individual case safety reports, ICSRs) generates growing document volumes. An on-premise RAG pipeline makes it possible to query report databases automatically, classify events by severity, identify emerging patterns and generate reports for AIFA (the Italian Medicines Agency) and the EMA — with patient data indexed inside the company perimeter and generation on a local model. The benefit is twofold: shorter analysis times and GDPR controls mapped by design.

Document management for clinical trials. A Phase III clinical trial generates tens of thousands of documents: protocols, informed consents, case report forms (CRFs), monitoring reports, correspondence with ethics committees. A sovereign AI system with semantic vector search lets regulatory teams find information through natural-language queries, instead of searching manually across legacy systems.

Pharmaceutical supply chain optimisation. The pharmaceutical supply chain is subject to unique constraints: cold chain, batch-by-batch traceability, serialisation, Good Distribution Practice (GDP). On-premise agentic workflows can automate temperature monitoring, demand forecasting based on historical and seasonal data, and the handling of non-conformities — integrating with existing ERP systems without exposing operational data to third parties.

Quality assurance and batch record review. Batch record review is one of the processes most demanding of qualified staff. An on-premise AI system can pre-review records automatically, flagging anomalies, deviations and incomplete fields before the QA specialist steps in. The result: faster batch release cycles with a higher level of accuracy.

The architecture of an on-premise AI platform for pharma: Nexus MDS Core

Nexus MDS Core is the Dynamics Consulting platform designed specifically for deploying sovereign AI in regulated sectors. It is not a SaaS product: it is a modular architecture of 27 containerised services on Docker, on-premise, moving to Kubernetes when scale calls for it.

The main components relevant to pharma include:

• Local processing, generation of your choice on a local open-weight model (llama.cpp, Qwen by default) or on a replaceable EU endpoint
• RAG pipeline with Weaviate for semantic vector search over pharmaceutical documents, clinical protocols and scientific literature
• Agentic workflows with n8n to automate regulatory processes, pharmacovigilance and quality assurance
• Zero-Trust authentication with Keycloak OIDC/PKCE — single sign-on, multi-factor authentication, granular role-based access control
• Audit and operations — an encrypted, hash-chained record of every model call, healthchecks with automatic restart, scheduled backups
• API gateway with Kong for traffic management, rate limiting and secure integration with external systems (ERP, LIMS, EDC)

Every component was chosen for its enterprise maturity, its open-source licence and its ability to run on infrastructure the company controls. The architecture is designed to be auditable: every decision the AI system takes is traceable, every access is logged, every output is reproducible.

The risks of the cloud for pharmaceutical data

Hyperscalers' cloud AI platforms (Azure OpenAI, AWS Bedrock, Google Vertex AI) undeniably make deployment convenient. But for the Italian pharmaceutical sector the risks outweigh the benefits on several dimensions.

Data sovereignty risk. Even with data residency in an EU region, pharmaceutical data processed on cloud infrastructure remains subject to the provider's jurisdiction. The US CLOUD Act, for example, allows US authorities to request access to data held by American companies anywhere in the world. For an Italian pharmaceutical company with sensitive intellectual property, that is an unacceptable strategic risk.

Technology lock-in risk. The proprietary APIs of Azure, AWS and Google create a structural dependency. Migrating from one provider to another — or bringing workloads back on-premise — becomes a project in its own right, often with prohibitive cost and timescales. With a sovereign architecture based on open standards, control stays with the organisation.

NIS2 compliance risk. The NIS2 Directive requires organisations in essential sectors to manage digital supply chain risk. A cloud provider is, in effect, a critical link in that chain. Every security incident at the provider falls back on the client organisation, with notification obligations and potential penalties.

Economic risk. Cloud AI API costs are variable and often unpredictable. For high-volume workloads — such as pharmacovigilance processing thousands of reports a month — an on-premise platform has a fixed cost that does not grow with every request; whether and when it pays back against the cloud has to be calculated on the actual volumes.

Case study: Federfarma Lombarda

The project delivered for Federfarma Lombarda is a concrete example of sovereign AI applied to the Italian pharmaceutical sector. Federfarma Lombarda — the association of pharmacy owners representing more than 1,000 pharmacies in the provinces of Milan, Lodi and Monza Brianza — needed to modernise its information systems by adding AI capabilities for document analysis and the automation of its association processes, while remaining fully within the rules.

Dynamics Consulting designed and implemented an infrastructure based on Nexus MDS Core, with a RAG pipeline for querying the document base intelligently, agentic workflows to automate repetitive processes, and an intuitive user interface for staff. The project was led directly by the founder, Corrado Patierno, with an iterative approach: discovery, MVP, validation with end users, and progressive release.

The results: a significant reduction in document search time, automation of processes that used to take hours of manual work, and an AI infrastructure that Federfarma controls and governs on its own: indexing, retrieval, identity and audit run locally, personal data is excluded at ingestion, and only final answer generation runs on a replaceable endpoint in a European datacentre. The case shows that sovereign AI in pharma is not theory: it is operational, measurable, and already in production in Italy.

How to start: a roadmap for pharmaceutical companies

Adopting a sovereign AI platform in pharma is not a big-bang project. It is a structured path that Dynamics Consulting runs with a proven methodology.

Phase 1 — Discovery and assessment (2-3 weeks). Analysis of the existing IT infrastructure, mapping of the processes that are candidates for AI automation, assessment of regulatory readiness (AI Act, GDPR, Law 132/2025, NIS2). Output: an assessment document with prioritised recommendations and a quantified business case.

Phase 2 — Architecture and MVP (4-6 weeks). Design of the target architecture on Nexus MDS Core, selection of the LLMs best suited to the specific use case, deployment of the first service in a development environment. The MVP is validated with a small group of end users to gather feedback before rollout.

Phase 3 — Deployment and integration (4-8 weeks). Production deployment of the full platform, integration with existing systems (ERP, LIMS, EDC, pharmacovigilance systems), configuration of monitoring and alerts, training for technical staff and end users.

Phase 4 — Operations and continuous evolution. Post-deployment support, model updates, extension to new use cases, continuous adaptation to regulatory change. The Dynamics Consulting team stays alongside the organisation as a long-term technology partner.

Every phase is documented, every decision is traceable, every milestone is agreed. No surprises, no scope creep. The founder, Corrado Patierno, personally follows every pharma project from day one. Get in touch for an initial, no-obligation conversation.

Frequently asked questions