Every December, a compliance lead somewhere signs off on the annual training report. Completion is at 98%. Most representatives have completed the code of practice module, passed the ten question quiz at the end, and signed the attestation. The report goes to the board. And in the first quarter of the new year, a rep in a busy territory answers a specialist's question about an unapproved use with a sentence that would make the whole medical-legal review team wince.
Both things are true at once. The training was completed. The knowledge was not there when it mattered.
That gap is what this piece is about. Our view is that a large share of commercial compliance risk in pharma and MedTech sits in field readiness, and that this share should be measured with the same rigour as product knowledge. Field readiness supports compliance; it does not replace it. Legal review, approval procedures, transparency reporting, pharmacovigilance and audits are separate obligations that training cannot cover. With that in mind, here are five priorities we think commercial and compliance teams should put on the 2026 plan.
A note on scope. This is a perspective written in December 2025, not legal advice. It is framed mainly for teams working under EU and UK rules and European industry codes; other jurisdictions differ, and the rules cited below were checked as of that date. Your own legal and compliance teams should confirm what applies to you. Throughout, we try to keep three layers apart: the law, the industry codes your company has signed up to, and your company's own policies, which are often stricter than either.
Why the old compliance model is showing its age
A few years ago, the big compliance story was the speed of new rules during the pandemic and the scramble to interpret them. That moment has passed. What it left behind is more interesting.
The field now works across more channels than before: in-person calls, remote meetings, approved emails, webinars, messaging where it is permitted. Content comes from Marketing, Medical and Market Access, each through its own review. New launches arrive more often, with labels that expand and change. And a new category of tool, generative AI, is being put in front of employees faster than most policies can be written.
The standard compliance training model was not built for this. It assumes that rules change slowly, that one annual module per topic is enough, and that a completed course is evidence of understanding. None of those assumptions holds up well in a commercial organisation running several launches at once.
A signed attestation proves that someone saw the rule. It does not prove they can apply it in minute three of a difficult conversation.
Priority one: treat compliance knowledge as field knowledge
The riskiest compliance moments in a commercial team are not in the office. They are in the conversation with the HCP. A question about a patient population outside the indication. A request for a study that is not in the approved materials. An invitation to comment on a competitor's safety data. An offer of hospitality that sits close to the line.
In each of those moments, the rep has seconds to respond. What they say depends on whether the rule is available in memory, in a form that connects to the situation in front of them. A policy PDF they read in March does not help much in October.
That is why we think compliance content belongs inside the same readiness system as product and disease knowledge, not in a separate annual course. Practically, this means:
- Writing compliance questions as scenarios drawn from real conversations: the off-label question, the request for unapproved material, the grey zone around medical education support. Each scenario should say which layer the right answer comes from (law, industry code or company policy), because a rep who knows why the line is there handles the next variation better.
- Mixing them into regular product challenges, so a rep who is practising the new efficacy data also practises what they can and cannot say about a subgroup.
- Measuring knowledge per person and per topic, and tracking whether wrong answers are corrected on later attempts, not just whether a course was completed.
A scenario we see often: a team scores very well on the code of practice module in isolation, then does noticeably worse when the same principles are embedded in product questions. The rule is known in the abstract and forgotten in context. That is exactly the gap that matters, and it only shows up if you measure it in context.
Priority two: get ahead of AI governance before the field does it for you
Generative AI arrived in commercial teams quickly. Some of it is sanctioned: pilots of knowledge assistants, drafting tools, search across internal documents. Some of it is not: a rep pasting call notes into a public chatbot to get a summary, or asking a general-purpose model to explain a competitor's trial before a meeting.
The regulatory backdrop has also moved. In the EU, the AI Act entered into force on 1 August 2024. Its prohibitions and its AI literacy obligations, which require organisations that deploy AI to take measures to ensure a sufficient level of AI literacy among their staff, have applied since 2 February 2025. Obligations for general-purpose AI models followed in August 2025, with more to come. The picture is still moving: at the time of writing in December 2025, amendments had been proposed. Check the European Commission's current AI Act guidance before using this article for planning.
For commercial compliance, the practical questions are narrower than the regulation, and more urgent:
- What content can an AI tool used by the field answer from? Our answer is only approved material: label, approved visual aids, medical information responses, internal policies. Not the open internet, and not the model's general knowledge.
- What happens when the approved documents do not cover a question? The tool should say so and route the person to the right channel, often Medical Information or an MSL, rather than filling the gap with a plausible guess.
- Who signs off on the content that goes in, and how are conflicts between documents handled? Two versions of the same slide with different wording should be flagged to an expert, not quietly averaged.
- Where is the data hosted, and can one client's or one brand's content leak into another's? For EU organisations, hosting location and tenant isolation are not technical footnotes.
- Do staff actually understand the tools they are using? Whatever the final shape of the legal literacy duty, AI literacy is in practice a knowledge topic like any other, which can be taught and measured.
The organisations that handle this well will not be the ones that ban AI in the field. They will be the ones that give the field a safe, useful tool early, so the unsafe shortcuts lose their appeal.
Priority three: extend the standard to everyone who speaks for you
Outsourcing used to be discussed mainly as a question about legal and compliance functions. In commercial teams, the more pressing version of that question is about the extended workforce: contract sales organisations, distributors, agencies running digital channels, speakers and consultants, and in MedTech, clinical specialists and independent reps.
From the HCP's point of view, all of them speak for the company. A contract rep who improvises on a label restriction creates exactly the same problem as an employee who does. Yet in many organisations, the extended workforce receives a lighter version of the training, on a different schedule, with no measurement beyond a signed form.
We would push for three things in 2026:
- The same core compliance scenarios for employees and partners who face HCPs, in their language.
- The same measurement: knowledge per person, gaps tracked to closure, results visible by partner and country.
- Contract terms that make participation and readiness a condition, not a courtesy.
It is less work than it sounds, if the content already exists in a format that can be shared, and it helps address a potential source of compliance risk.
Priority four: rethink risk around people, devices and data
Cyber risk from remote work and personal devices was the worry of the pandemic years. That risk has not gone away. It has become a normal part of commercial life. Reps work from cars, hotels and home offices. They carry customer data in CRM apps on their phones. They receive content through several channels, and they use messaging tools that are sometimes approved and sometimes not.
A fair objection here is that this is the IT security team's job, not the commercial team's. Partly true. The controls (device management, access rights, hosting) belong with IT. But the behaviours belong with the field. Whether a rep forwards a document to a personal address, photographs a slide for a colleague, or pastes customer details into an unapproved tool is a question of knowledge and habit.
That makes it a training topic, and a good one for short, frequent practice: realistic situations, one right answer, immediate feedback. It also makes it a procurement topic. Any learning or AI tool you bring into the field should answer, simply, where the data is hosted, who can see it, and how your content is kept separate from everyone else's.
Priority five: document what people know, not only what they were shown
When something goes wrong, the question from an auditor or regulator is rarely "did you have a policy?" It is closer to "what did you do to make sure your people understood it, and how do you know they did?"
Most organisations can answer the first half. They have the policy, the course, the completion records. Far fewer can answer the second half with evidence. Documented procedures remain essential. What has changed, in our view, is the standard of evidence people expect behind them.
A stronger record looks like this: for each rep, which compliance topics they were tested on, what they got wrong at first attempt, whether and when they corrected it, and which gaps are still open. For each team or country, where the persistent misconceptions sit. That record is also far more useful to the business than a completion rate. It tells a manager what to coach and a compliance lead where the knowledge exposure is. It is a record of knowledge within an assessment, not of conduct in the field, and it sits alongside the audits, monitoring and reporting that compliance already runs, not in place of them.
The objection we hear most
"Compliance training has to be formal. You can't gamify the code of practice." We understand the instinct. Nobody wants a serious subject to look trivial.
But the format and the substance are separate questions. The substance, the scenarios and the right answers, should be written and signed off by the same people who own compliance today, through the same review. The format decides only whether people engage often enough to remember it. A one-minute challenge against colleagues, three times a week, on realistic scenarios, is not less serious than a forty minute annual module. In our experience it is a better test of whether the rule is actually held, because it asks for the rule again and again, in context, over months.
The deeper point is that the annual module is built to produce a record, and the regular challenge is built to keep the rule in memory when it is needed. Neither proves what someone will do in a live conversation; that takes observation and monitoring. But in 2026, with more launches, more channels and new AI tools in play, knowledge that is actually held is the part training can move.
A question for your next planning meeting
At Atrivity we build these programs every day, with compliance and medical teams owning the content and signing it off: short scenario challenges between colleagues, Gap Fixing that sends each person the fix for their own mistakes, readiness by team, country and topic, and an assistant that provides answers based on approved documents, with EU hosting and tenant isolation. But whichever tool you choose, the question to bring to your 2026 compliance plan is this: if a regulator asked us tomorrow what our field actually knows about the rules, not what they completed, what would we show them?