Veeva Systems

The agents are a layer on a platform whose value stands without them. What a life sciences company buys is Vault, the system of record across clinical, regulatory, safety, quality, medical and commercial work. Vault AI Agents are built into those applications and released with the platform three times a year, and the Study Builder Agent announced on 24 Sep 2026 comes with EDC at no additional license. Falcon, the company's separate agentic labor offering, is planned for early adopter availability from November 2026 (Falcon Router from January 2027) and is not yet something a buyer can run.

Access limits and logging are stated; what an agent may do without a person is not. Agents act only with the permissions the customer assigns and their actions are logged. As shipped they mostly assist: flagging call note issues, capturing voice input, preparing calls, screening promotional content before the formal review, and configuring study builds for a team to use.

The direction is stated too: the company describes Falcon as agentic labor in which standard agents do most of the work, with safety intake triage and health authority interaction among the planned uses. Nothing published says which steps an agent may take unattended, what a reviewer sees of its basis, or how an agent's action is distinguished from a person's in the audit trail beyond being logged.

The model providers and release cadence are named; the models and their versions are not. Vault AI Agents use large language models from Anthropic and Amazon hosted on Amazon Bedrock, with application-specific prompts and safeguards; custom agents can use Veeva-hosted models or customer-provided models on Amazon Bedrock or Microsoft Azure AI Foundry. Standard agents are upgraded and new ones released with the platform's three releases a year. Which model version runs each agent, and how a model change made by the provider between releases is detected and notified, are not published.

The party list is public and names the model layer, with a training term and no retention term. The sub-processor page, with update notices by subscription, names Amazon Web Services as cloud and AI services platform for all applications, Eleven Labs for speech in Veeva AI, Alibaba Cloud's Bailian models for agents in China CRM, and Anthropic, Google Gemini and OpenAI for the Ostro assistant, each with purpose and processing location.

The Vault AI page adds that standard agents use Anthropic and Amazon models on Amazon Bedrock. The trust page says customer data is never used to train or enhance those models. What the model services retain, for how long, and whether logs are kept are not stated.

Named customers and commentary, with no measured result for the agents. Platform adoption across most of the largest pharmaceutical companies (more than 1,500 customers) is evidence for Vault, not for the agents. Customer material is early: Corcept is featured using an agentic call report for commercial evidence, and Bayer and other customers speak to AI readiness rather than outcomes. No agent has a published accuracy, time or quality result with a method.

A categorical training commitment and named safety controls are published; retention at the model layer is not. The trust page says customer data is never used to train or enhance the third-party language models behind Vault AI, that agents run inside Veeva's security architecture with the customer's role and field permissions, and that system-level guardrails and additive content filtering defend against adversarial attacks and prompt injection, a rare statement of safety engineering.

Not stated: whether prompts and outputs are retained by the model service or by Veeva, for how long, and who can read them. The content is sensitive: call notes record interactions with named healthcare professionals and can contain incidental patient details, and voice capture runs through Eleven Labs for speech services.

A substantive privacy notice reaches customer data; the company's own business associate status is not stated. The privacy notice says customer personal information is processed under customer agreements, covers transfers through the Data Privacy Framework and standard contractual clauses, and describes HIPAA expert-determination de-identification in its marketing analytics products.

The trust page says suppliers sign business associate agreements where appropriate, which implies the role in some products without saying which. The agents mostly handle commercial, regulatory, quality and safety content, where pharmacovigilance and privacy law rather than HIPAA usually govern; the SiteVault products used by research sites are a different case.

Recognized certifications are named and audited; the artifacts are not open on the page. The security program overview says an accredited body audits the company at least annually against ISO/IEC 27001, 27017 and 27018, that it holds a SOC 2 Type II report under the security and availability principles, ISO 9001, and French health data hosting (HDS) certification, all for the products named in each certificate, and that third-party specialists run vulnerability and penetration tests annually.

Independent GxP audit reports on its quality system can be bought from Rx-360, USDM and Diligent Pharma. Encryption is TLS 1.2 or higher in transit and AES-256 at rest. The certificates, SOC 2 report and test results are not linked for download.

The agents are scoped as enterprise and trial operations with no device claim made, and the validation work that does apply is documented. The company says it keeps its software in a validated state, qualifies infrastructure and operations for each major release, re-runs validation scripts every release with third-party validation testers, and provides a validation summary report on request; independent GxP audit reports on its quality system can be bought from Rx-360, USDM and Diligent Pharma.

The FDA device databases show no registration or clearance for the company. The agents are the unsettled part: the company does not say whether they sit inside the validated boundary, how a nondeterministic component is qualified, or what happens to the validated state when a model provider updates a model outside Veeva's release cycle.

AI safeguards are stated as controls; no evaluation of how the agents behave is published. The trust page lists four: customer data is not used to train the third-party language models, agents act only with the permissions the customer assigns, guardrails and content filtering defend against prompt injection and other adversarial input, and agent actions are logged.

Nothing describes how agents are evaluated before release or across releases, what they are not meant to be relied on for, or how results vary. The risks are specific. The promotional content Quick Check Agent screens regulated speech before medical, legal and regulatory review, where a miss matters more than a false alarm and a clean automated pass may come to be read as proof the obvious problems were caught. The call note agent decides what counts as an issue in free text, and if flagging varies by writing style, language or representative, the effect lands on people's compliance records.

Agent actions are logged and most outputs pass a person; nothing stands behind them. The trust page says agent actions are captured in system logs for traceability and that agents act only within the customer's permissions. The Quick Check Agent runs before the formal medical, legal and regulatory review rather than replacing it, and the Study Builder Agent builds EDC forms, visits and edit checks from the customer's own standards and the CDISC USDM model, which the company says makes builds more deterministic and audit ready.

No accuracy figure, coverage boundary or warranty, indemnity or remediation commitment is published for any agent. Call notes and voice capture are where an incidental patient case tends to appear; if an agent surfaces or misses something that is an adverse event report, a reporting clock applies to the sponsor, and nothing states the agent's recall on such content or the handling that follows.

No clinical record integration; the agents work inside the vendor's named systems. This is life sciences enterprise software, so the systems that matter are the ones its customers run. Vault AI Agents operate inside Veeva applications with direct access to their data and documents, through the Vault interface or API, and customers can configure them or build custom agents.

The Study Builder Agent configures Veeva EDC and Veeva DQS from a protocol using the CDISC Unified Study Definitions Model and is delivered as a Claude Cowork plugin from a Veeva-managed GitHub repository. Reach beyond Veeva's own applications is not evidenced.

Processing locations are published per service; the agents' inference region and isolation are left open. The public sub-processor page gives Amazon Web Services as the cloud and AI services platform for all Veeva applications with processing in the US, EU, China and Japan as applicable, Alibaba Cloud's Bailian models for agents in Veeva China CRM, and Eleven Labs speech services in the US and EU for Veeva AI.

The platform is multi-tenant software as a service with customer data separated logically by domain, and the privacy notice relies on the Data Privacy Framework and standard contractual clauses for transfers. Vault AI Agents run on Anthropic and Amazon models on Amazon Bedrock; which Bedrock region serves a customer's agents, and whether it matches the customer's data region, is not stated.

No price is published, and how the agents are sold is partly discoverable. Enterprise agreements with life sciences companies are scoped by application and users across the Vault suite. The Study Builder Agent is part of EDC and requires no additional license. Whether other Vault AI Agents carry incremental cost is not stated, and Falcon, planned for early adopter availability from November 2026, has no published terms.

Coverage is named with what is available separated from what is planned. Vault AI Agents cover commercial work (call notes, voice, pre-call, promotional content review) and agents in regulatory, safety and quality applications; the clinical Study Builder Agent is planned for early adopter availability in December 2026, and Falcon's agentic labor for clinical, regulatory, safety and MLR work from November 2026, with Falcon Router in January 2027. Named customer use supports the commercial agents only. Evaluate against what is generally available for your function.