9 AI Governance Questions Medical Affairs Teams Should Answer in Asian Markets

Medical affairs teams across Asia are using AI in more ways than most governance frameworks yet reflect: summarising literature, drafting medical information responses, preparing for scientific exchanges, theming field insights, translating materials, and analysing real-world data. Some of this is formally approved. Some of it happens quietly, through general-purpose tools on personal accounts.

At the same time, the rules are moving. Countries across the region are updating data protection laws, publishing AI guidance for healthcare, and in some cases passing dedicated AI legislation. Global companies must also consider rules with reach beyond their borders, such as the EU AI Act. For a regional medical affairs team, the challenge is not a single regulation. It is holding a consistent standard across many markets while respecting what each one requires. These nine questions help you do that.

Step 1

Map

1. What AI are we actually using, approved or not?

Governance starts with an honest inventory. List the AI tools and features in use across the function: dedicated platforms, AI built into existing systems such as CRM or literature databases, and general-purpose assistants. For each, note what it is used for, who uses it, and what information goes into it. Expect to find uses nobody formally approved; they usually reflect real needs that deserve a safe route.

2. Which rules apply in each market we work in?

For each market, you will usually need to consider three layers: data protection law, AI-specific laws or guidance (including healthcare-specific guidance), and medical device rules for software that could influence clinical decisions. On top of these sit your company's global AI and data policies, industry codes of practice, and any rules with international reach. The table below gives a starting point for some of the region's main markets.

Illustrative and not exhaustive, as of September 2026. Requirements change frequently; confirm the current position in each market.

‍

You are ready for step 2 when you have an inventory of AI uses and a market-by-market list of the rules that apply to them.

Step 2

Assess

3. Could any use count as a medical device or influence clinical decisions?

Most medical affairs uses of AI are not medical devices. But a tool that interprets patient data, supports diagnosis or recommends treatment for individual patients may fall under software medical device rules in some markets, even if it began as a patient support or educational tool. This question is worth asking early, because the answer changes the entire regulatory path.

4. What data goes in, and where does it go?

For each use, trace the data: whether it includes personal or health information, where it is stored and processed, whether it crosses borders, how long it is kept, and whether a vendor can use it to improve or train models. Health data is treated as sensitive in most of the region, and some institutions and governments expect it to stay in country. Pseudonymising data before it reaches an AI tool, or processing it in country, can remove many obstacles.

5. What could go wrong, and for whom?

Not every AI use needs the same level of control. A tool that helps staff summarise internal documents carries different risk from one that drafts content for healthcare professionals, and both differ from anything patients interact with directly. Sorting uses into tiers lets you apply proportionate controls: light for low-risk productivity, rigorous for anything external, clinical or patient-facing.

Controls grow with risk. Most uses sit in tier 1; the effort belongs in tiers 2 and 3.

You are ready for step 3 when each AI use has a risk tier, a known data flow, and a clear answer on regulatory status.

Step 3

Control

6. Who is accountable for each use?

Every significant AI use needs a named business owner who is accountable for how it is used, and a cross-functional group that sets standards and reviews higher-risk uses. In medical affairs, that group usually brings together medical, legal or compliance, privacy, pharmacovigilance, quality and IT. Clear accountability is what turns a policy into practice.

7. How do we handle human oversight and transparency?

Decide where a qualified person must review AI output before it is used, and what they are expected to check. Consider transparency too: whether healthcare professionals or patients should be told when content was drafted with AI or when they are interacting with an AI system, as some guidance and laws in the region expect. Oversight and transparency are also what allow you to explain decisions if they are questioned later.

8. How do we know it keeps working, for all our markets?

AI performance changes as models are updated, content changes and new types of input arrive. Performance can also differ by language and population: a tool tested in English may perform differently in Thai or Bahasa Indonesia, and models trained mostly on Western data may not reflect local clinical patterns. Monitoring should cover accuracy, errors reported by users, and performance across the markets and languages you serve.

9. What do we require of AI vendors?

Many AI uses depend on vendors, and their practices become your risk. Due diligence should cover where data is processed and stored, whether it is used for training, security certifications, how models are validated and updated, what audit trail is available, how incidents are reported, and whether the vendor can meet in-country requirements where needed. These expectations are best written into contracts, not assumed.

Your governance is in good shape when every significant use has an owner, an oversight standard, ongoing monitoring and a vendor who meets your requirements.

Where do you stand?

Use this table to check your current position. Most teams are further along on some questions than others, and that is a useful place to start.

How Jonda Health can help

Governance works best when it is designed alongside the way AI is actually used, and with a clear view of the data underneath. That combination of clinical, data and technology understanding is how our team works. You do not need to have every answer before talking to us. There are two ways we can support you.