AI Avatars for Pharma in Italy: 2026 Compliance Guide (Law 132 + EU AI Act)

How to implement AI avatars in pharma while staying compliant with Law 132/2025 and the EU AI Act, before it's too late.

Compliance isn't the problem. The absence of compliance is.

When we start an AI project in pharma, as we did with Linda, our AI avatar for HCP engagement, the first question isn't "how much will it cost?" but "how do we make it compliant?".

And that's where the real questions begin.

On August 2, 2026, the EU AI Act comes into force. But Italy has already moved. Law 132/2025 has already set the boundaries for artificial intelligence in the Italian context, especially where compliance isn't just a choice: it's an obligation.

In pharma, AI isn't new. What's new is the responsibility: it's no longer enough to say "we use AI to answer HCP questions". Now you have to prove that AI won't cause harm, that data is safe, that every answer is traceable.

1) The regulatory context

Law 132/2025: Italy moves first

Law 132/2025, passed by the Italian parliament, was a strategic move: to define an Italian regulatory framework before the EU AI Act became law. What does it require?

• Transparency and disclosure of use: anyone using an AI system must state it clearly. In pharma, if an AI avatar answers a medical question, it must declare itself as an "AI system" and not as a "human expert".
• Traceability: every interaction with an AI system must be logged. Who asked the question, when, what answer they received, who approved it (if there was a human gate). Logs must be retainable and auditable.
• Human-in-the-loop: not every AI system requires it. But in pharma, where answers touch HCPs' health, it's almost always mandatory: a qualified person must validate critical answers before they're published.
• Right to be forgotten and PII management: if a patient asks your AI avatar to delete the data they shared, you must be able to do it. Personal data can't circulate indefinitely in the system.

EU AI Act: the European standard (August 2, 2026)

The EU AI Act is broader, but it has one central element: risk classification. Not all AI systems carry the same risk.

High risk (Annex III): systems that directly impact health, safety and fundamental rights. An AI avatar in pharma? It's high risk. That means:

• Complete technical documentation: you must document the system architecture, the training data, the accuracy tests, the known failures.
• Periodic audits and testing: not once a year, but continuously. Monitor the system to detect anomalies, bias, drift in results.
• Compliance with technical requirements: robustness, cybersecurity, training-data quality, discrimination mitigation.

Pharma = Annex III = High risk

Because the answers an AI avatar gives to HCPs (healthcare professionals) can influence medical decisions. If Linda gets it wrong and suggests the wrong dose or a dangerous drug interaction, the damage isn't a data loss: it's potentially a human life.

Law 132 vs EU AI Act: the differences

If you're in Italy and also sell in the EU (like Media Engineering), you have to answer to both. The good news: if you're compliant with the EU AI Act, you're automatically compliant with Law 132.

2) AI avatar for HCP engagement

What is Linda?

Linda is an AI avatar developed by Media Engineering, specialized in HCP engagement in the pharma sector. It isn't a text chatbot: it's a 3D avatar, with a synthesized voice and conversational memory. The system knows an HCP's preferences if it has helped them before.

Why it works

Healthcare professionals (doctors, nurses, pharmacists) respond better to a system that:

• has a face and a voice: it builds trust and personalization;
• remembers context: it doesn't restart every conversation from scratch;
• is available 24/7: HCPs don't only work 9 to 5;
• doesn't judge: an HCP can ask "silly" questions without embarrassment.

Result (Alfasigma case): +45% engagement on new treatments compared with printed materials.

The compliance risks

But this is where the problems begin.

• Hallucination: Linda might invent a contraindication that doesn't exist. If an HCP believes it and changes a prescription, the harm is real.
• Data breach: if Linda stores that "Dr. Rossi asked about breast cancer" and that information leaks, it's a serious privacy problem.
• Unauthorized autonomy: if Linda autonomously decides to email an HCP to suggest a treatment, without human approval, it violates the regulation.
• Bias: if Linda was trained on data favoring certain HCPs or certain medical practices, it could discriminate unintentionally.

How Linda mitigates the risks

• Restricted actions: Linda can answer FAQs, explain mechanisms of action, suggest reading. It cannot prescribe, give specific dosages, or contact HCPs autonomously.
• Audit logs and traceability: every answer is logged with a timestamp, user, question text, answer text and who approved it.
• Human approval gates: answers to critical questions (dosages, interactions, contraindicated conditions) pass through a human gate before reaching the HCP.
• Fact-checking layer: every answer is validated against a knowledge base of official clinical data. If Linda says something not in the KB, it's flagged for human review.

3) Compliance implementation

Phase 1: Risk assessment

Before launching Linda, we classified the system under the EU AI Act.

• Input: what does Linda do? Who uses it? What's the risk if it gets it wrong?
• Output: Linda = Annex III (high risk).

This determines everything else: if it had been a marketing avatar (low risk), the requirements would be different. But pharma = high.

Phase 2: Technical documentation

We created complete technical documentation:

• System architecture: how Linda is built, which components (LLM, retrieval, validation, logging).
• Training data: what Linda was trained on (official clinical data, case studies, historical HCP Q&A).
• Testing results: accuracy on pharma FAQs, hallucination rate, false positive rate for contraindications.
• Known limitations: what Linda can't do and in which cases it might fail.
• Mitigation strategies: if Linda hallucinates, how we detect it and what the rollbacks are.

Phase 3: Data governance

• PII handling: if an HCP says "my patient has X", Linda doesn't store the patient's name, only the clinical context. No named medical data in memory.
• Traceability: every log has a timestamp (UTC), a user ID (not a name), a question hash, an answer hash, and the person who approved.
• Right to be forgotten: if an HCP asks "delete everything about me", we have a process: we identify all logs with that user ID, anonymize them, and keep only statistical aggregates.

Phase 4: Human oversight

Every question receives a risk score (low, medium, high).

• Low (standard FAQ): auto-approved answer.
• Medium (technical question): human review within 5 minutes.
• High (dosage, contraindication): escalation to an MD pharmacologist.

• Approval dashboard: the pharmacologist team accesses a dashboard, sees the queue of pending answers, and approves, rejects or rewrites in under 30 seconds.
• Escalation rules: if a question stays in the queue for more than 30 minutes, it's automatically escalated to the head pharmacist.

Phase 5: Audit & monitoring

• Anomaly detection: continuous monitoring to detect rising hallucination rates, shifts in question types (possible bias) and abnormal response times (possible attack).
• Periodic audits: every quarter, a manual review of 100 random logs. Accuracy? Appropriateness of approvals? Regulatory compliance?
• Drift monitoring: if Linda's behavior changes significantly, an automatic alert.

Case study: Alfasigma, from low engagement to +45% in 3 months

The problem

Alfasigma, an Italian pharma company, was launching a new treatment for a rare disease. The target: specialist physicians. The problem: very low engagement. Printed materials couldn't keep up with the complexity of the new drug, and specialists couldn't easily find the answers they were looking for.

Before: only 12% of target physicians had engaged with the launch materials after 6 weeks.

The solution

We deployed Linda to answer questions about the new drug's mechanism of action, dosage, interactions and contraindications. Not as an autonomous agent, but with a full human gate: every answer went through an MD pharmacologist before reaching the physician.

Setup time: 6 weeks. Training data: over 200 Q&A created by Alfasigma experts. Risk assessment: compliant with Law 132 + EU AI Act.

The results

• Engagement: from 12% to 57% of physicians engaging with Linda in 3 months.
• Compliance: zero violations over the 3 months.
• Audit trail: 100% of answers human-approvable, 0 significant hallucinations.
• Adoption: physicians asked for more access to Linda, not less.

Learnings

The first 2 weeks? Pure overhead: implementing governance, training the pharmacologist team, testing on a real case. After that? Fast. Governance doesn't slow things down, it structures them. With well-designed human gates, the approval flow is smooth.

Conclusion

Pharma compliance isn't a cost added to AI. It's the foundation without which AI couldn't even exist in the sector.

Law 132/2025 and the EU AI Act (from August 2, 2026) aren't "rules to get around". They're the opportunity: companies that build strong governance now will have a huge advantage when the regulation becomes stringent.

Linda wasn't conceived design-first and compliance-after. It was designed compliant from day one. That's how it could operate, scale and generate real value.

If you're evaluating AI avatars for your pharma business, whether it's HCP engagement, patient education or regulatory affairs, the right question isn't "how much?". It's "is it compliant?".

For a deeper look at digital twins in healthcare and the A.N.N.A. / Alfasigma case, read also the article published by AboutPharma: Digital twin e formazione in sanità: dalla simulazione alla competenza reale (Helyx-AboutPharma, in collaboration with Media Engineering).