Audit of ai systems used in biotech

Introduction

The audit of Artificial Intelligence (AI) systems used in biotechnology refers to the systematic examination of AI technologies, algorithms, datasets, automated decision-making processes and digital infrastructure employed in biological research, pharmaceutical development, genetic engineering, medical diagnostics and biotechnology manufacturing.

AI has become an important component of modern biotechnology. It is used for genomic analysis, drug discovery, disease prediction, protein structure analysis, vaccine development, laboratory automation and biological data processing.

However, the increasing dependence on AI creates legal and regulatory concerns relating to algorithmic accuracy, data protection, intellectual property, cybersecurity, scientific reliability, discrimination and institutional accountability.

AI audits are therefore necessary to determine whether biotechnology systems operate according to applicable legal requirements, scientific standards and ethical principles. They also help identify technical errors, unauthorised data processing, biased predictions and weaknesses in organisational governance.

Legal framework governing AI audits in biotechnology

1. Information Technology Act, 2000

The Information Technology Act, 2000, provides the principal legal framework for electronic records, digital transactions and certain cybersecurity-related offences in India.

Its provisions are relevant to biotechnology organisations that use AI-based laboratory systems, genomic databases and automated research platforms.

Important provisions include:

Section 43: Addresses specified unauthorised access, downloading, disruption and damage involving computer systems.

Section 66: Addresses certain computer-related acts when committed dishonestly or fraudulently.

Section 72: Addresses breach of confidentiality and privacy by persons obtaining access under powers conferred by the Act.

AI audits may examine whether biotechnology organisations have implemented appropriate access controls, cybersecurity safeguards and information security procedures.

2. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023, regulates the processing of digital personal data in India.

Biotechnology AI systems frequently process genomic information, medical records, clinical research data and other personal information.

An audit must examine whether organisations comply with applicable requirements concerning:

Lawful processing of personal data.

Consent and other permitted grounds for processing.

Security safeguards.

Data retention and deletion obligations.

Individual rights.

Responsibilities of data fiduciaries and processors.

The Act does not establish a separate comprehensive AI audit regime. Nevertheless, its data protection obligations are relevant when AI systems process personal data.

3. Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

These Rules were issued under the Information Technology Act, 2000.

They historically established requirements concerning the handling of sensitive personal data or information, including medical records and certain biometric information.

Their continuing application must be considered alongside the Digital Personal Data Protection Act, 2023, and its commencement and transitional provisions.

For biotechnology organisations, information security audits may examine whether appropriate technical and organisational safeguards are maintained.

4. Patents Act, 1970

The Patents Act, 1970, is relevant when AI systems are used to develop pharmaceutical compounds, biological inventions and biotechnology processes.

Section 3(k) excludes mathematical methods, business methods, computer programmes per se and algorithms from patentability.

Section 3(d) restricts patents for certain new forms of known substances unless the statutory requirements are satisfied.

AI audits may examine ownership of AI-generated inventions, documentation of human contributions, protection of proprietary algorithms and compliance with intellectual property requirements.

Objectives of AI audits in biotechnology

AI audits serve several important purposes.

1. Verification of algorithmic accuracy

Biotechnology AI systems must generate scientifically reliable results.

For example, an AI system used for disease diagnosis must be evaluated for its ability to identify relevant biological patterns accurately.

Auditors may examine:

Model accuracy and reliability.

False-positive and false-negative results.

Validation procedures.

Reproducibility of scientific findings.

Performance across different population groups.

2. Examination of training datasets

AI systems depend on the quality of their training datasets.

Incomplete, inaccurate or unrepresentative biological datasets can produce misleading results.

An AI audit should examine the origin, quality, relevance and lawful use of training data.

3. Algorithmic bias assessment

AI systems used in genetic research and medical diagnosis may produce unequal results because of differences in population representation.

For example, a genomic prediction model trained primarily on data from one population may perform less reliably when applied to another population.

Auditors should examine dataset diversity, performance disparities and corrective measures.

4. Cybersecurity assessment

Biotechnology AI platforms may contain confidential research information, patient records and commercially valuable biological datasets.

An audit should assess authentication procedures, access permissions, encryption, security monitoring and incident response arrangements.

5. Human oversight and accountability

AI systems should not operate without appropriate institutional supervision where their outputs affect patient safety, scientific research or regulatory decisions.

Auditors should identify the persons responsible for reviewing AI-generated results and authorising important decisions.

Major areas of AI auditing in biotechnology

1. Audit of AI-based drug discovery systems

AI-based drug discovery platforms analyse chemical compounds, biological structures and molecular interactions to identify potential pharmaceutical candidates.

An audit should examine whether the models are scientifically validated and whether their predictions are supported by appropriate experimental evidence.

Important audit areas include data integrity, algorithm documentation, reproducibility, intellectual property rights and research quality.

2. Audit of genomic AI systems

Genomic AI systems analyse genetic sequences and identify relationships between genetic variations and biological characteristics.

Auditors should examine data provenance, patient consent where required, algorithmic reliability, privacy safeguards and access controls.

They must also consider the risks of re-identification and inappropriate disclosure of genetic information.

3. Audit of AI-based diagnostic systems

AI-based diagnostic software may identify diseases through medical images, laboratory results and biological data.

Where such software qualifies as a medical device, it may be regulated under the Medical Devices Rules, 2017.

Audits should examine clinical validation, software performance, intended use, quality management and post-market monitoring obligations.

4. Audit of AI in biotechnology manufacturing

AI is increasingly used in pharmaceutical production, biological quality control and automated laboratory operations.

An audit should examine whether automated systems operate consistently with approved manufacturing procedures and applicable Good Manufacturing Practices.

Important considerations include:

Data integrity.

Equipment validation.

Process monitoring.

Automated quality-control records.

Change management.

Documentation of system failures.

5. Audit of AI-based agricultural biotechnology

AI systems may be used to analyse crop genetics, predict plant diseases and support agricultural biotechnology research.

Audits should examine scientific reliability, environmental risk assessment, data quality and compliance with applicable biotechnology regulations.

Where genetically engineered organisms are involved, relevant requirements under the Environment (Protection) Act, 1986, and the 1989 Rules must also be considered.

International regulatory framework

1. European Union Artificial Intelligence Act, 2024

The European Union Artificial Intelligence Act establishes a risk-based framework for regulating AI systems.

Certain AI systems used in healthcare may qualify as high-risk systems depending on their intended purpose and their relationship with regulated products.

Applicable requirements may include:

Risk management systems.

Data governance.

Technical documentation.

Record-keeping.

Human oversight.

Accuracy and cybersecurity.

Post-market monitoring.

The Act is relevant to biotechnology organisations operating in or supplying regulated AI products to the European Union.

2. United States FDA framework

The US Food and Drug Administration regulates AI-enabled medical devices and certain software functions used in healthcare.

Its regulatory approach includes assessment of safety, effectiveness, clinical performance and software quality.

The FDA's January 2025 draft guidance on AI used to support regulatory decision-making for drugs and biological products also proposes a risk-based credibility assessment framework.

Biotechnology companies using AI in drug development must consider the reliability and relevance of AI-generated evidence submitted to regulators.

3. OECD AI Principles

The Organisation for Economic Co-operation and Development (OECD) has established principles for trustworthy AI.

These principles emphasise:

Transparency and explainability.

Robustness and safety.

Accountability.

Human-centred values.

Inclusive and sustainable development.

They provide an important governance framework for auditing biotechnology AI systems.

4. WHO guidance on AI for health

The WHO's 2021 guidance on Ethics and Governance of Artificial Intelligence for Health identifies ethical principles for the responsible use of AI in healthcare.

It emphasises human autonomy, safety, transparency, accountability, inclusiveness and sustainability.

These principles are relevant to AI auditing in biotechnology, particularly where AI outputs influence medical decisions and public health policies.

Important case laws and judicial decisions

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India, (2017) 10 SCC 1

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution of India and other constitutional freedoms.

The judgment recognised informational privacy as an important component of individual privacy.

It also established that restrictions on fundamental rights must satisfy constitutional requirements, including legality, legitimate purpose and proportionality.

Legal significance: Biotechnology AI systems process sensitive genomic information, medical records and biological data. AI audits must therefore examine whether personal information is collected and processed lawfully and whether appropriate privacy safeguards exist.

2. Shreya Singhal v. Union of India (2015)

Supreme Court of India, (2015) 5 SCC 1

The Supreme Court examined the constitutional validity of Section 66A of the Information Technology Act, 2000.

The Court struck down Section 66A because its vague and overbroad restrictions violated the freedom of speech and expression guaranteed under Article 19(1)(a).

Legal significance: The judgment demonstrates the importance of legal certainty when regulating digital technologies. AI governance and audit procedures must operate under clearly defined legal requirements and should not impose arbitrary restrictions on legitimate scientific research or technological development.

3. Google Spain SL v. Agencia Española de Protección de Datos (2014)

Court of Justice of the European Union, Case C-131/12

The case concerned the processing of personal information by a search engine and the relationship between privacy rights and online information.

The Court recognised circumstances in which individuals could request the removal of certain search results associated with their personal information.

Legal significance: This judgment is relevant to biotechnology AI audits because genomic and medical datasets may contain sensitive personal information. Auditors must examine data retention, lawful processing and mechanisms for addressing applicable individual privacy rights.

4. State of Maharashtra v. Dr. Praful B. Desai (2003)

Supreme Court of India, (2003) 4 SCC 601

The Supreme Court considered the admissibility of evidence recorded through video conferencing.

The Court recognised that technological methods could be used within legal proceedings, provided applicable procedural and evidentiary requirements were satisfied.

Legal significance: The judgment illustrates the legal acceptance of technology-assisted processes when appropriate safeguards exist. This principle is relevant to biotechnology AI audits because digital records, automated laboratory reports and electronic research documentation must maintain reliability and evidentiary integrity.

5. Eastern Book Company v. D.B. Modak (2008)

Supreme Court of India, (2008) 1 SCC 1

The Supreme Court examined copyright protection for edited judicial judgments and considered the originality required for copyright protection.

The Court adopted a standard requiring a minimum degree of creativity rather than mere labour or mechanical effort.

Legal significance: This decision is relevant when auditing AI-generated biotechnology research materials, scientific reports and computational outputs. It highlights the importance of identifying genuine human intellectual contributions when determining originality and intellectual property ownership.

Institutional responsibility for AI audits in India

Several Indian institutions may participate in the governance and oversight of biotechnology AI systems.

These institutions have different statutory and administrative responsibilities. None should be treated as a universal AI audit regulator.

Challenges in auditing AI systems used in biotechnology

1. Lack of specialised AI audit legislation: India does not currently have a single comprehensive law establishing mandatory independent audits for every biotechnology AI system.

2. Algorithmic complexity: Deep learning models may produce results that are difficult to explain, making independent verification challenging.

3. Data ownership disputes: Biotechnology datasets may involve researchers, hospitals, patients, universities and commercial organisations.

4. Rapid technological development: Frequent model updates can change system performance and create additional validation requirements.

5. Scientific uncertainty: AI-generated biological predictions may not always correspond to experimentally verified scientific results.

6. Accountability gaps: Responsibility may be distributed among software developers, research institutions, biotechnology companies and healthcare professionals.

7. Cybersecurity threats: Unauthorised access, manipulation of scientific datasets and compromise of research platforms may undermine the reliability of AI systems.

Conclusion

The audit of AI systems used in biotechnology is essential for ensuring scientific reliability, legal compliance, data protection and responsible technological development. As AI becomes increasingly integrated into genomic research, pharmaceutical development, medical diagnostics and biotechnology manufacturing, systematic auditing is necessary to identify risks and establish institutional accountability.

In India, the Information Technology Act, 2000, Digital Personal Data Protection Act, 2023, Copyright Act, 1957, Medical Devices Rules, 2017, and applicable biotechnology regulations provide important elements of the governing legal framework.

Judicial decisions such as Justice K.S. Puttaswamy v. Union of India, Shreya Singhal v. Union of India, Google Spain v. AEPD and Eastern Book Company v. D.B. Modak provide important principles concerning privacy, technological regulation, digital information and intellectual property.

Ultimately, effective biotechnology AI auditing requires independent validation, transparent documentation, reliable datasets, cybersecurity safeguards, human supervision and clear accountability. These measures can strengthen public confidence while ensuring that AI-driven biotechnology develops within a responsible legal and ethical framework.