Veeva Systems

The fourth product scoped platform vendor in this index, and the grade is descriptive. What a life sciences company buys is Vault, the system of record across clinical, regulatory, safety, quality, and commercial. The AI agents are additions to that platform, shipping from December 2025 onward, and the company's framing of agents working seamlessly inside Veeva applications places them correctly as a layer. No customer selects Veeva for the agents.

Currently assistive by description, moving toward autonomy by stated intention, with no oversight design published for either state.

As shipped, the agents assist: one flags issues in call notes, one captures spoken input, one assembles context before a call, one screens promotional content ahead of the formal review, and one supports reviewers within it. A person remains the actor in each case, and the company's own framing places the agents inside existing applications rather than in place of the people using them.

The direction of travel is stated rather than inferred. A named customer describes the promotional review agent as moving toward a process in which parts of medical, legal and regulatory review could become automated, and the company has announced a separate platform explicitly described as standardised agentic labour covering document intake, safety case processing and health authority interaction, targeted at a later release and not indexed here as shipping. Both point at the same place: agents that act rather than suggest.

What is missing applies now and will matter more then. Nothing published describes what an agent may do without confirmation, whether any step can be configured to run unattended, what a reviewer sees about the agent's basis for a conclusion, or how an action taken by an agent is attributed in an audit trail. That last point is not merely good practice here. This platform's regulatory position rests on attributable, computer generated audit records, and an agent acting inside it must be distinguishable from a person acting inside it. Ask how that attribution works today, before the more autonomous products arrive.

The clearest model provenance disclosure among the platform vendors indexed here. The company states its agents are built on large language models from named providers including Anthropic and Amazon, hosted on Amazon Bedrock, while operating inside the Vault environment so customer data stays within the platform boundary.

Naming the underlying model providers and the hosting arrangement is materially more useful than an unattributed reference to proprietary AI, and it lets a buyer reason about model risk and data residency directly. Agents are also accessible by API and customizable through a published framework rather than being closed.

This is the clearest model provenance disclosure among the platform vendors in this index. The agents are stated to be built on large language models from named providers, hosted on a named managed model service, while operating inside the platform environment so that customer data stays within the platform boundary.

Naming both the model providers individually and the hosting arrangement is materially more useful than an unattributed reference to proprietary artificial intelligence, because it lets a buyer reason about model risk, provider terms and data residency directly rather than by inference, and it is the disclosure this axis exists to reward.

The agents are also reachable by interface and customisable through a published framework rather than being closed, so a customer can see and extend what runs. One residual should be obtained rather than inferred, and the reasoning generalises. Nothing located states whether content submitted to those models is retained by the model service, for how long, or whether any of it may be used to develop or improve models.

The commonly assumed answer for enterprise model services is that it is not, but that is the model provider's default posture rather than this vendor's statement about its own configuration, and a buyer should not accept an inference about a third party's terms as a commitment from the party it is contracting with. Ask for that in the agreement, along with whether prompts and outputs are logged and who can read those logs.

Platform adoption is exceptional and includes most of the largest pharmaceutical companies, but that is evidence for Vault rather than for the agents, and the agents are recent. Customer commentary is early and appropriately hedged, with one named customer describing the promotional content agent as moving them closer to a process where parts of medical, legal, and regulatory review could become automated, which is a statement of direction rather than a measured result. A vendor projection of 15 to 20 percent industry efficiency improvement is a forecast, not evidence.

The architectural claim is good and the data use position behind it is not published.

What is stated: the agents operate inside the platform environment so that customer data stays within the platform boundary, and the underlying models are named external ones running on a managed model service. Naming the providers is genuinely useful and is credited on the transparency axis.

What is not stated is the question every customer should ask first. Nothing located says whether content submitted to those models is retained by the model service, for how long, or whether any of it may be used to develop or improve models. The commonly assumed answer for enterprise model services is that it is not, but that is the model provider's default posture rather than this vendor's statement about its own configuration, and a buyer should not accept an inference about a third party's terms as a commitment from the party it is contracting with.

The content at issue is more sensitive than it first appears. Field representative call notes record interactions with named healthcare professionals and are exactly where an incidental mention of a patient case tends to appear, which is why an agent scanning them for issues is scanning for that kind of content by design. The voice capability adds recorded or transcribed speech to the same pipeline.

Ask for a written position covering retention and training use for agent interactions, whether prompts and outputs are logged and who can read those logs, and what handling applies when an agent surfaces something that constitutes an adverse event report.

A scoping determination and it closes for the capabilities on this record.

The customers are life sciences companies rather than providers, and the agents indexed here operate on commercial and regulatory content: field representative call notes, spoken input from those representatives, pre call context assembly, promotional material screened against brand and regulatory guidelines, and safety and quality records. None of that is a provider's patient record, the company is not receiving identifiable health information on behalf of a covered entity, and a business associate agreement is not the operative instrument. Grading its absence as a gap would misdescribe the relationship.

Two boundaries should be understood rather than assumed away.

The safety agents work on adverse event and case material, which concerns identifiable individuals even though it reaches the sponsor through pharmacovigilance obligations rather than through a provider relationship. The governing framework there is pharmacovigilance regulation and the sponsor's own reporting duties, with privacy law applying to the personal data involved, and it is a different regime with different rules on retention, minimisation and cross border transfer.

Separately, the company operates a site facing product used by clinical research sites, which are providers. That product is not what this record indexes, and a buyer evaluating it is asking a different question with a different answer. Confirm which product line a proposal covers before applying this grade to it.

A strong and well documented programme, held one step below the top of this axis for a specific and instructive reason.

What is held and published: an information security management programme certified to ISO 27001, a SOC 2 Type II report the company publishes, hosting in data centres that are themselves ISO 27001 certified and SOC 2 audited annually by an independent third party, encryption in transit and at rest, enforced password policy with multifactor authentication and network restrictions, background checks on staff, logical separation of customer data by domain, fully redundant infrastructure across geographically separate locations, nightly backup on a thirty day rolling retention, and disaster recovery environments tested monthly. Detailed technical and operational security papers are published rather than gated.

One control statement is unusual and worth noting in the vendor's favour: the company states it does not have direct access to the servers, which are administered by the hosting or managed service personnel. A vendor that has removed its own standing access to infrastructure has done something structural rather than procedural.

Why this sits at B. The company states that the platform is regularly penetration tested by third parties. It does not publish the results. Another vendor assessed in the same pass publishes penetration test results and vulnerability scan summaries in its trust centre, which is what separates the two grades. Saying you test is not the same as publishing what the testing found, and on an axis about what a counterparty can verify, that difference is the whole point.

Ask for the penetration test summary and the SOC 2 scope section, and confirm specifically whether the AI agents are inside the audited boundary.

No device pathway applies and none is claimed. The grade reflects the framework that does apply, which is addressed here with artefacts rather than assurances.

The company states that it maintains its software in a validated state consistent with life sciences regulatory requirements, performs and documents infrastructure and operational qualification for each major release, develops and re executes validation scripts every release with third party validation testing experts, and produces a validation summary report customers can request. It enumerates the specific electronic records controls it has implemented, including encryption at rest for open systems, and the corresponding European computerised systems controls covering data storage, audit trails, incident management, electronic signatures and business continuity. Doing the qualification work and handing customers the documentation is a stronger position than describing compliance, because a sponsor's own validation burden falls rather than merely being reassured.

One question is unanswered and it is the most important one on this record, because this record is scoped to the AI capabilities rather than to the platform. A validated computerised system rests on reproducibility: the same input produces the same output, and scripts can demonstrate it release after release. A large language model agent does not behave that way. Nothing located states whether the agents sit inside the validated boundary, how a non deterministic component is qualified, whether agent behaviour is re tested each release alongside the deterministic platform, or what happens to the validated state when an underlying third party model is updated by its provider rather than by this vendor.

That last point deserves emphasis. The agents are built on models from external providers. A model version change originating outside the vendor's release cycle is a change to a qualified system made by someone who is not party to the qualification. Ask how that is controlled, notified and re tested.

No AI governance framework, model documentation, evaluation methodology, error analysis or applicability statement was located for the agents, on a record where the platform's compliance and security documentation is otherwise extensive.

The domain relevant risk here is specific and it is not demographic. One agent screens promotional content against brand and regulatory guidelines ahead of medical, legal and regulatory review. Promotional material in this industry is regulated speech, and a claim that reaches the market without adequate substantiation or fair balance is an enforcement matter. The failure mode that matters is therefore the miss rather than the false alarm: content the agent passes travels into a review process whose participants may, over time, come to treat a clean automated result as evidence that the obvious problems have already been caught. Nothing published states the agent's detection performance, the categories of issue it covers and does not cover, or whether reviewers are told what it did not check.

A second question applies to the call note agent, which flags issues in free text. What counts as an issue is a judgement encoded in a model, and if flagging varies systematically by writing style, by language, or by the individual representative, the consequence lands on people's compliance records rather than on a dataset.

The absence is more conspicuous here than it would be elsewhere. This company publishes validation summaries, qualification documentation and detailed security papers. It plainly knows how to document a system for a regulated audience, and none of that practice has yet been extended to the agents. Ask for the evaluation methodology, the coverage boundary, and what the agents are not intended to be relied upon for.

Two passes located no accuracy figure, no evaluation methodology, no published limitations and no warranty, indemnity or remediation commitment for any agent. The content these agents operate on makes that gap consequential in a way a generic platform gap would not be.

Field representative call notes record interactions with named healthcare professionals, and they are exactly where an incidental mention of a specific patient case tends to appear, so an agent scanning them for issues is scanning for that kind of content by design rather than encountering it by accident. A voice capability adds recorded or transcribed speech to the same pipeline. That creates a specific obligation nobody has described.

If an agent surfaces something that constitutes an adverse event report, a regulatory clock starts and a defined process applies, and the consequences of missing it fall on the sponsor rather than on the software vendor. Nothing published states what the agent does in that case, what recall it achieves on identifying such content, or whether a human reviews before the determination is made.

A missed detection here is not a workflow inconvenience, it is a reporting failure attributable to the licence holder. Ask for recall on adverse event identification, what handling applies when one is surfaced, what review sits between the agent and the determination, and what the vendor commits to when the agent misses one.

A scoping determination, and the domain equivalent is answered.

The platform is a life sciences enterprise system of record spanning clinical, regulatory, safety, quality, medical and commercial functions. It is not a clinical system, does not read or write a patient chart, and no electronic health record integration is claimed for the capabilities indexed here. Grading them against clinical interoperability depth would misdescribe the product.

The equivalent question for an enterprise agent layer is whether it reaches the systems and data the customer already runs, and the answer is documented. The agents operate inside the platform that already holds the customer's regulated content, which is the deepest possible position for this class of tool because there is no integration to build. They are reachable through the platform interface and through an application programming interface, and they are customisable through a published framework rather than being closed, so a customer can extend them against its own processes.

What is not evidenced is reach beyond the vendor's own platform. A customer running content, safety or regulatory processes partly outside this estate should establish what the agents can see and act on there, since operating natively inside one platform is a strength within it and a limit at its edge.

Clearly stated at platform level and requiring one clarification at the agent level.

The platform is delivered only as multi tenant software as a service with no on premises option, hosted in data centres in multiple regions with fully redundant infrastructure held in geographically separate locations, and customer data separated logically by domain with multiple domains and vaults available per customer. Backups run nightly on a thirty day rolling retention and recovery environments are tested monthly. For a regulated buyer that is a coherent and unusually well documented picture.

The clarification concerns the agents, and it is the same question this index raises wherever an architecture claim sits alongside a service description. The company states that the agents are built on large language models from external providers and hosted on a managed model service, while also stating that they operate inside the platform environment so customer data stays within the platform boundary. Both statements can be true, and how they are true is what a buyer needs. Establish whether inference runs inside the vendor's own tenancy of that model service, which region serves it, whether prompt content and returned output are logged by the model service and for how long, and whether the boundary claim covers the content sent for inference or only the storage of records.

Also ask what the residency position is for the agents specifically. A platform with regional hosting does not automatically mean a model endpoint in the same region, and for a customer with European or Japanese data residency obligations that gap is the one that matters.

No public pricing. Contact the vendor. Enterprise agreements with life sciences companies. As with other platform vendors indexed under the scope rule, establish whether agents carry incremental cost or are included in Vault licensing.

Note also that two significant announced capabilities, Falcon and Agentic Authoring, are not yet available and target late 2026 and late 2027 respectively; this index does not treat announced roadmap as shipping capability, and buyers should not price against it.

Announced breadth spans clinical, regulatory, safety, quality, medical, and commercial, but shipped coverage is narrower and the distinction is what matters. As of the December 2025 launch the available agents were commercial: CRM call notes, voice capture, pre call preparation, and promotional content review ahead of medical, legal, and regulatory sign off. Safety and quality agents are reported live, with clinical and regulatory tied to a later release. Buyers should evaluate against what is generally available for their function rather than the roadmap.