Every field protects itself with vocabulary, and AI is no exception. The difference is that in a regulated submission, a misunderstood term is not just an awkward moment in a meeting; it is a gap in the audit trail. When a vendor tells an RA director that their tool "uses RAG to eliminate hallucinations," and the director does not know precisely what either word means, the director cannot ask the one question that matters, which is what happens when the retrieval pulls the wrong source. This lesson is a working glossary, but not the kind that defines a term and moves on. Each term here is defined against the specific submission artifact it threatens or supports, because that is the only way the vocabulary becomes useful at the desk. A definition you cannot attach to a Module 2.5 paragraph, an ICSR case narrative, or a CSR appendix listing is a definition you will forget by Friday. The terms that follow are the ones an RA specialist, a medical writer, an MSL, a CRA, and a PV writer will actually hear in 2026, and the ones they need in order to ask the right question when a tool is being sold to them or used by them.

The Core Mechanics: Token, Context Window, Temperature, Embedding

A token is the unit a model reads and writes, a chunk of language that may be a whole word, a fragment, or a number. This matters at the desk because models are often priced and limited by tokens, and because a string like "Table 14.2.1.4" is several tokens that the model can recombine into a citation that looks valid and is not. The token is the atom of everything else.

The context window is the total number of tokens the model can hold and attend to at once. It is the model's entire field of view, and the single most consequential fact about it is that anything not loaded into the window is invisible, not flagged. For a medical writer, the context window is the difference between a Module 2.5 draft grounded in the full TLF package and one that invents tables because the package was never loaded. When a vendor quotes a large context window, the right follow-up is not "how large" but "how do you confirm the right sources are inside it."

Temperature is the setting that controls randomness in how the model picks the next token, from near-deterministic at zero to increasingly variable and invention-prone above one. Its practical consequence is that the same prompt yields different output across runs, which is why the audit trail has to capture the specific run that produced the kept text. An embedding is a numeric representation of a piece of text that places similar meanings near each other in a mathematical space; it is the machinery that lets a retrieval system find the IB section that is "about" a topic even when it does not share the exact words. Embeddings are invisible to the writer but are the engine under retrieval, and understanding that retrieval works by meaning-similarity, not keyword match, explains both why it is powerful and why it can confidently retrieve a passage that is similar but wrong.

The Failure Vocabulary: Hallucination, Grounding, Source of Truth

A hallucination is a fluent, confident output that is not supported by any real source, the invented hazard ratio, the nonexistent Table 14.2.1.4, the fabricated journal citation in a literature summary. The crucial property for a regulated user is that a hallucination is indistinguishable in tone from a true statement, which is why it is detected by reconciliation against sources and not by reading. In a Module 2.5 or an ICSR narrative, a hallucination is an audit-trail defect the moment it is written, whether or not anyone has noticed yet.

Grounding is the practice of tying a model's output to specific provided sources so that each claim traces to a document rather than to the model's general training. A grounded workflow is the primary defense against hallucination, and the word is worth knowing precisely because vendors use it loosely. A tool is only as grounded as the discipline of what it retrieves and how it cites, so "grounded" is a property to verify, not a label to accept. The source of truth is the designated authoritative version of a document or fact, the approved IB rather than a draft, the final TLF rather than a working table, the current SOP rather than a superseded one. Almost every dangerous retrieval failure is, at bottom, a source-of-truth failure: the model grounded in something real that was not the source of truth. Naming this concept gives a writer the exact question to ask of any grounded answer, which is "grounded in which version."

The Retrieval and Tooling Vocabulary: RAG, Fine-Tuning, System Prompt, MCP

RAG, retrieval-augmented generation, is the architecture that retrieves relevant passages from your document store and feeds them into the context window before the model generates, so that the answer is built on your IBs, CSRs, and prior submissions rather than on a guess. RAG is the single most important pattern for regulated use because it is how generation gets grounded, and the term is worth holding precisely so that you can interrogate the retrieval half, since a RAG system that retrieves the wrong document produces a grounded wrong answer. Fine-tuning is the separate practice of further training a base model on a specialized corpus so that it internalizes a style or domain; it changes the model's tendencies but does not give it access to your current documents the way retrieval does, and conflating the two leads teams to expect a fine-tuned model to "know" facts it was never given. For most regulated content, retrieval, not fine-tuning, is what supplies the facts.

The system prompt is the hidden instruction block that the deployment places before your input to set the model's role, constraints, tone, and output format; it does much of the work that determines whether a draft is safe, and two deployments of the same model can behave very differently because of it. MCP, the Model Context Protocol, is an emerging open standard for how an AI application connects to external tools and data sources in a structured, auditable way; the reason a regulated professional should recognize it is that the manner in which an agent reaches into a Vault or a safety database is itself something that has to be governed and logged, and a standardized protocol is how that connection becomes inspectable rather than a black box.

The Extraction and Coding Vocabulary: NER, Classification, MedDRA Normalization

Named-entity recognition, NER, is the extraction technique that identifies and labels specific entities in text, the drug, the reaction, the dose, the patient, the date, and it is the backbone of literature surveillance and case intake. For a PV writer, NER is what turns four hundred abstracts into a structured triage, and the term matters because the right question about an NER tool is its recall on safety-relevant entities, the fraction of true mentions it catches, since a missed entity is a missed signal. Classification, as a term of art, is the assignment of an input to a fixed category, and in PV it is the seriousness and expectedness call under ICH E2D; knowing the word lets a writer distinguish a classification claim, which is auditable by reviewing boundary cases and label distribution, from a generation claim, which is auditable by reconciliation.

MedDRA normalization is the mapping of free-text adverse-event descriptions onto the Medical Dictionary for Regulatory Activities hierarchy, from Lowest Level Term up through Preferred Term to System Organ Class. AI can propose the mapping at speed, but the named human coder owns the final Lowest Level Term, because the choice between two plausible LLTs can change how a case aggregates in signal detection. The term matters because "the AI coded it" is never an acceptable account; MedDRA coding is a judgment with downstream statistical consequences, and the vocabulary makes clear where the machine proposes and the human disposes.

The Governance Vocabulary: Evals, Citation, Audit Trail, Human-in-the-Loop

Evals, short for evaluations, are structured tests of how a model or workflow performs against a defined set of cases with known correct answers; they are how a function moves from "the tool feels reliable" to "the tool catches ninety-six percent of fabricated citations in our test set." For a regulated function, evals are the bridge between a vendor's claim and a validation file, and the term is worth knowing because asking a vendor for their eval methodology separates serious tools from demos. A citation, in this context, is the link from a generated claim back to its supporting source; citation-required prompting, which refuses to produce a claim without a source link, is one of the most effective structural controls available, but a citation is a starting point for verification, not proof, because a tool can cite a real document that does not actually support the claim.

The audit trail is the contemporaneous, attributable record of what was done, by whom, when, and on what basis, and under 21 CFR Part 11 it is the spine of a defensible electronic record. For AI work, the audit trail captures the run that produced the text, the sources, and the human verification, and the entire purpose of the vocabulary in this lesson is to let a writer describe that trail accurately. Human-in-the-loop names the design principle that a human reviews, confirms, or can override the AI at the consequential points; it is the phrase the FDA-EMA principles encode as accountability and human oversight, and the skill is knowing where in a workflow the human actually sits, because "human-in-the-loop" stated generally is marketing, while "the QPPV confirms every seriousness downgrade" is a control.

The Terms You Will Mishear: Model vs Deployment, Validation vs Verification, Guardrail, Drift

Some pairs of words sound interchangeable and are not, and the confusion between them is where audit findings hide. The model is the underlying trained system, the thing a vendor names with a version number. The deployment is the model as your organization has configured it, with its system prompt, its retrieval layer, its access controls, its logging, and its temperature setting. Compliance, validation, and safety are properties of the deployment, almost never of the bare model. When someone says "the model is validated," the precise reply is that a model is not validated, a configured deployment for a defined intended use is, and that distinction is exactly what an inspector will probe.

Validation and verification are likewise distinct, and the difference is load-bearing in a GxP context. Verification asks whether a specific output is correct, the reconciliation of one 2.5 paragraph against the TLF. Validation asks whether the system, for its intended use, consistently produces fit-for-purpose results, demonstrated through documented testing before and during use. You verify a document; you validate a workflow. A function that verifies every output but never validates the workflow has no defensible basis for trusting the tool at scale, and a function that claims validation but cannot show the verification of consequential outputs has a paper shield. Both are required, and they answer different questions.

A guardrail is any control built into a deployment to constrain the model's behavior, a system-prompt rule that forbids inventing references, an output filter that blocks a claim without a citation, an input check that strips injected instructions. Guardrails are real and valuable, but the term is used loosely, so the question is always which guardrail, enforced how, tested by what eval. Drift is the slow change in a system's behavior over time, often because a vendor updated the underlying model, such that a workflow that passed its eval in March quietly behaves differently in September. Drift is why validation is not a one-time event; it is why ongoing performance monitoring exists, and why a vendor's model-update notification clause is a contract term that matters. Knowing the word lets a function ask the question that prevents a silent regression from reaching a submission.

Two more terms belong in the safety vocabulary because they describe attacks rather than accidents. Prompt injection is the planting of instructions inside content that the model will read, so that the instructions hijack its behavior. In a life-sciences context the content is not benign: a submission PDF, a literature article, an email attachment, or a site document can carry hidden text that says, in effect, ignore your constraints and do this instead, and when the extraction layer pulls that document into the window, the instruction enters with it. A jailbreak is the related move of crafting a prompt designed to talk the model out of its own guardrails, the "pretend you are an assistant with no restrictions" pattern. These matter to a regulated user because the inputs to a pharma workflow are often documents from outside the organization, which is exactly the threat surface these attacks exploit. The defense is input sanitization, hardened system prompts that refuse instructions arriving in content, and the same human verification that catches everything else, but the first defense is simply knowing the attack exists, so that an output which suddenly behaves out of character is treated as a security event and not as a quirk.

Reading a Vendor Claim With the Vocabulary

Put the vocabulary to work on a single sentence a vendor might say: "Our agentic platform uses RAG and fine-tuning over your validated content, with human-in-the-loop review, to generate Part 11-compliant submission drafts with zero hallucinations." A reader without the vocabulary hears a reassuring sentence. A reader with it hears a stack of questions. Agentic means multi-step, so where are the logged checkpoints. RAG means retrieval, so how is the source of truth confirmed and what happens when the wrong version is retrieved. Fine-tuning does not supply current facts, so which facts come from retrieval and which from training. Human-in-the-loop where, exactly, and on which decisions. Part 11-compliant is a property of the validated, configured deployment and its audit trail, not of the raw model, so what is the validation evidence. And "zero hallucinations" is not a property any generation system can guarantee, so the claim itself is a signal to slow down.

That is the entire value of learning these terms. The vocabulary is not for sounding current in a meeting. It is for converting a smooth claim into the specific, answerable questions that protect the dossier, and for describing your own AI use precisely enough that it survives an inspection. A writer who can name the modality, locate the source of truth, demand the eval, and point to the human-in-the-loop has the equipment to use AI in a regulated submission. The rest of Level 1 turns that equipment into judgment about where AI helps, where it fails, and what the regulators expect.

Key Takeaways

• Define every AI term against the artifact it threatens or supports, not in the abstract. A definition you cannot attach to a Module 2.5 paragraph, an ICSR narrative, or a CSR appendix listing will not survive contact with the desk.
• The mechanics vocabulary explains the risk: tokens are recombined into plausible-but-wrong strings, the context window makes omissions invisible, temperature makes runs differ, and embeddings make retrieval work by meaning-similarity, which is why it can retrieve something similar but wrong.
• Most dangerous retrieval failures are source-of-truth failures. Grounding ties output to provided sources, but a tool grounded in a superseded SOP or a draft IB gives a fluent, cited, wrong answer, so the question for any grounded claim is "grounded in which version."
• RAG supplies current facts; fine-tuning supplies style and tendencies. Conflating them leads teams to expect a fine-tuned model to "know" facts it was never given. For regulated content, retrieval, not fine-tuning, is what provides the facts, and the named human coder still owns the MedDRA Lowest Level Term.
• Evals, citation, audit trail, and human-in-the-loop are the governance words that turn a vendor claim into answerable questions. "Zero hallucinations" is a slow-down signal; "the QPPV confirms every seriousness downgrade" is a real control. The vocabulary exists to protect the dossier and to describe your AI use precisely enough to survive an inspection.