Claude's Corner: Rhizome AI, The FDA Whisperer for Biotech

Rhizome AI turns 44 million FDA and EMA regulatory documents into instant, citation-backed answers for life sciences teams. Here's how they built the data moat, why it works, and how you'd replicate it.

May 17 at 11:07 AM8 min read

Claude's Corner: Rhizome AI, The FDA Whisperer for Biotech

TL;DR

Rhizome AI is a RAG-powered regulatory intelligence platform that lets life sciences teams query 44 million FDA and EMA documents with citation-backed, hallucination-free answers. Their 2.5TB proprietary corpus across 43 datasets is the moat, built by a solo founder who shipped inference infrastructure at EvolutionaryScale before turning his sights on biotech regulatory research.

6.0

Build difficulty

Regulatory affairs is one of the most painful jobs in biotech. You spend months, sometimes years, sifting through FDA guidance documents, EMA opinions, prior approval precedents, and clinical review letters, trying to reverse-engineer what a regulator will think before they think it. Get it wrong and your drug program gets delayed or killed. Get it right and you just saved your company a billion dollars and a few years of human life.

That's the market Rhizome AI is walking into with a deceptively simple pitch: always know what the FDA thinks. Under the hood it's a RAG system built on a 2.5TB proprietary corpus of regulatory intelligence spanning 44 million documents across 43 datasets and 10 countries. But calling it "just RAG" is like calling a Bloomberg Terminal "just a website." The data curation and hallucination-free output are the product, not the inference layer.

For once, the AI hype might actually be appropriate.

What They Build

Rhizome is a regulatory intelligence platform. You ask a question, "What clinical endpoints has the FDA required for similar rare disease programs?" or "How has the EMA evaluated HER2-targeting antibody-drug conjugates?", and within minutes you get a structured answer backed by citations to the exact pages of the exact documents that support every claim.

That last part is the whole game. Regulatory professionals can't use tools that hallucinate. A wrong precedent citation in an FDA submission doesn't just embarrass you, it can trigger a complete response requirement and set your program back 18 months. Rhizome reports zero hallucinations in production through a combination of fine-tuning and inference-time verification. They're reading up to 1,000 documents per query rather than the handful most general-purpose RAG pipelines process.

The target customer is a regulatory affairs manager, director, or VP at a clinical-stage biotech, mid-size pharma, or medtech company, or the consultant advising them. These people currently pay junior analysts and junior lawyers to do research that takes days. Rhizome compresses it to minutes.

Pricing runs from $400/month for project-based access up to $30,000/year for a five-seat business plan with monthly office hours, with custom enterprise tiers above that. The model is straightforward SaaS with seats; the stickiness comes from the corpus, not the interface.

Founder Signal

Chetan Mishra, the solo founder, is a genuinely unusual combination: deep AI infrastructure experience with domain-adjacent exposure to hard regulatory data problems. He was employee #15 at EvolutionaryScale, the protein design company spinning out of Meta AI, where he built and scaled their inference platform to billions of API calls across hundreds of GPUs. Before that, employee #16 at Instabase where he was technical lead on the company's $7M deal with banks and insurers for document and imaging processing workflows.

The through-line is: large-scale document processing, building inference infrastructure at frontier labs, and selling into risk-averse regulated enterprises. That's exactly the skillset this problem requires. A founder who'd never touched life sciences data would take two years to understand what data matters and why. Mishra understood it fast enough to build something people are paying for.

How It Works

The architecture is a purpose-built RAG pipeline, but the real engineering is in the data layer.

The corpus pulls from FDA premarket and postmarket databases, EMA EPARs (European Public Assessment Reports), regulatory guidance documents, clinical trial registries, real-world evidence datasets, and orphan designation filings, 43 datasets total, continuously synced, indexed through May 2026. At 2.5TB and 44 million documents, this isn't something you spin up on a weekend. The parsing and normalization work alone, PDFs of varying quality, tables embedded in regulatory review letters, scanned FDA advisory committee transcripts, would take a competent team months.

The retrieval layer uses dense vector search to pull candidate chunks, then a re-ranking step that weights regulatory-specific signals: the authority of the source document, the recency of the guidance, and the specificity match to the question. The system is explicitly designed to surface primary sources (FDA guidance documents, approval letters) over derivative commentary.

The hallucination prevention comes from two directions. First, fine-tuning on regulatory QA pairs teaches the model to answer "I don't have sufficient data to answer this with confidence" rather than confabulate. Second, every claim in the output is citation-grounded, the system won't generate a statement it can't map to a specific passage in the corpus. The source viewer UI lets users click directly to the exact page and paragraph, which means claims are verifiable in seconds rather than requiring a follow-up research session.

The enterprise deployment option adds on-premise deployment and hardware-backed secure enclaves, important for big pharma companies that have strict policies about what data can touch third-party cloud infrastructure.

Difficulty Score

ML/AI: 7/10, RAG at scale with domain fine-tuning, inference-time grounding, and hallucination prevention is non-trivial. The protein design background shows up here.
Data: 9/10, This is the moat. 2.5TB, 43 datasets, continuous sync across 10 jurisdictions, PDF/table parsing of notoriously inconsistent regulatory documents. This is where months of engineering time disappear.
Backend: 6/10, Vector search, document chunking, re-ranking pipeline, citation tracking. Standard tools (Postgres + pgvector or a dedicated vector DB), but the regulatory-specific re-ranking logic is bespoke.
Frontend: 3/10, Clean search UI with a source viewer. Functional but not complex. The hardest part is the answer layout that surfaces citations inline without becoming a wall of footnotes.
DevOps: 5/10, Standard SaaS plus on-premise deployment option. The on-prem path with secure enclaves adds meaningful infra complexity for enterprise deals.

The Moat

The obvious answer is the data, and that's mostly right, but it's more nuanced than "2.5TB of documents." The raw data from FDA and EMA is technically public. The moat is in the operationalization: keeping 43 datasets continuously synchronized, correctly parsing inconsistent legacy PDFs, building domain-specific chunking and retrieval that works for regulatory document structures (which are nothing like typical web content), and fine-tuning on the kind of questions regulatory professionals actually ask.

A competitor starting today could replicate the corpus given 6-12 months of engineering effort. What they can't easily replicate is the production feedback loop. Every one of the 2,800+ answers Rhizome has served is a training signal. Which queries returned low-confidence answers? Which citations got clicked vs. ignored? Which answers did customers flag? That closed loop between production usage and model improvement widens the gap with every query served.

There's also a trust layer that's genuinely hard to accelerate. Regulatory professionals are paid to be conservative. A new entrant with a cleaner UI would still lose to Rhizome for 12-18 months simply because "we've never had a hallucination in production" is a claim that can only be earned, not promised. Once customers have shipped regulatory documents citing Rhizome-sourced precedents successfully, switching cost becomes real.

What's easy to replicate: the frontend, the basic RAG architecture, the pricing tiers, and the landing page copy.

What's hard: the corpus, the fine-tuning, the citation grounding, and the earned trust in a risk-averse buyer market.

Replicability Score: 58/100

This sits in the "real moat" territory but below the nuclear R&D or hardware categories. A well-funded team (think $5-10M and 18 months) could build a credible competitor, the underlying sources are public, the ML techniques are known, and the market is clearly validated. But the compounding corpus, the trust built through zero-hallucination production track record, and the specialized fine-tuning create genuine drag. This isn't something a solo developer or weekend project can meaningfully replicate, and any new entrant would be starting 12-18 months behind on the data quality flywheel.

The biggest long-term risk to the moat isn't a startup, it's the FDA itself publishing a better structured data interface, or a large enterprise like Veeva or IQVIA deciding this is a feature worth building into their regulatory platforms. Neither of those happens fast. For the next two to three years, Rhizome has a lane.

The Bottom Line

Regulatory intelligence is one of those B2B verticals where AI is unambiguously the right tool and the incumbents are laughably behind. Regulatory affairs teams today use internal wikis, expensive consultants, and glorified Ctrl+F searches through PDFs. The switching cost from "current process" to "Rhizome" is low; the ROI is enormous if a single query saves even one week of analyst time. At $4,000/year for a professional seat, the payback period is measured in hours.

Chetan Mishra picked one of the most defensible niches in enterprise AI, built the right data moat first rather than the flashy frontend, and found customers paying real money before raising a round. That's the playbook working as intended.

The risk, as always, is go-to-market velocity. Life sciences enterprises move slowly, legal holds up vendor contracts, and the AE hiring that converts a handful of design partners into a $3M ARR base takes time. But that's an execution problem, not a product problem. The product is already doing the thing it claims to do.

© 2026 StartupHub.ai. All rights reserved. Do not enter, scrape, copy, reproduce, or republish this article in whole or in part. Use as input to AI training, fine-tuning, retrieval-augmented generation, or any machine-learning system is prohibited without written license. Substantially-similar derivative works will be pursued to the fullest extent of applicable copyright, database, and computer-misuse laws. See our terms.

Build This Startup with Claude Code

Complete replication guide — install as a slash command or rules file

# Build a Regulatory Intelligence RAG Platform (Rhizome AI Clone)

A step-by-step guide to building a Rhizome-style regulatory document intelligence platform using Claude Code.

---

## Step 1: Design the Data Ingestion Pipeline

Build a multi-source document crawler and normalizer.

**Schema:**
```sql
CREATE TABLE regulatory_documents (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  source TEXT NOT NULL,           -- 'fda_guidance', 'ema_epar', 'fda_approval', etc.
  jurisdiction TEXT NOT NULL,     -- 'US', 'EU', 'UK', etc.
  document_type TEXT NOT NULL,
  title TEXT,
  document_date DATE,
  url TEXT,
  raw_text TEXT,
  metadata JSONB,
  indexed_at TIMESTAMPTZ DEFAULT now(),
  created_at TIMESTAMPTZ DEFAULT now()
);

CREATE TABLE document_chunks (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  document_id UUID REFERENCES regulatory_documents(id),
  chunk_index INTEGER,
  chunk_text TEXT NOT NULL,
  chunk_metadata JSONB,          -- page number, section heading, table context
  embedding VECTOR(1536),        -- pgvector
  created_at TIMESTAMPTZ DEFAULT now()
);

CREATE INDEX ON document_chunks USING ivfflat (embedding vector_cosine_ops) WITH (lists = 100);
```

**Data sources to start with:**
- FDA Drugs@FDA: `https://api.fda.gov/drug/`
- FDA device 510(k): `https://api.fda.gov/device/510k/`
- FDA guidance documents: `https://www.fda.gov/regulatory-information/search-fda-guidance-documents`
- EMA EPARs: `https://www.ema.europa.eu/en/medicines/download-medicine-data`

Write scrapers in Python using `httpx` for async requests and `pdfplumber` + `pymupdf` for PDF extraction. Handle scanned PDFs with `pytesseract` OCR fallback.

---

## Step 2: Build the Document Processing and Chunking Layer

Regulatory documents need domain-specific chunking, not naive 512-token splits.

```python
def chunk_regulatory_document(text: str, metadata: dict) -> list[dict]:
    """
    Split on section headers (numbered sections like '1.', '1.1', 'SECTION IV')
    rather than token limits. Preserve table context by keeping table + 
    surrounding paragraphs together.
    """
    sections = detect_regulatory_sections(text)
    chunks = []
    for section in sections:
        if is_table(section.content):
            # Include preceding paragraph as context
            chunk = {
                "text": section.preceding_para + "\n" + section.content,
                "metadata": {**metadata, "section": section.heading, "is_table": True}
            }
        else:
            # Sliding window with 20% overlap for long sections
            for window in sliding_window(section.content, size=800, overlap=160):
                chunk = {
                    "text": window,
                    "metadata": {**metadata, "section": section.heading}
                }
        chunks.append(chunk)
    return chunks
```

Embed using `text-embedding-3-large` (OpenAI) or `claude-3-5-sonnet` via Anthropic's embedding endpoint. Store in pgvector (Postgres extension).

---

## Step 3: Build the Retrieval and Re-ranking Pipeline

Two-stage retrieval: dense vector search + regulatory-aware re-ranking.

```python
async def retrieve(query: str, top_k: int = 50) -> list[DocumentChunk]:
    query_embedding = await embed(query)
    
    # Stage 1: vector similarity search
    candidates = await db.execute("""
        SELECT *, 1 - (embedding <=> $1) AS score
        FROM document_chunks
        ORDER BY embedding <=> $1
        LIMIT $2
    """, query_embedding, top_k * 3)
    
    # Stage 2: re-rank with regulatory signals
    reranked = rerank_regulatory(candidates, query, {
        "source_authority": {"fda_guidance": 1.0, "fda_approval": 0.9, "fda_label": 0.8},
        "recency_weight": 0.15,      # recent guidance > old guidance
        "specificity_match": 0.25,   # exact product class match boost
    })
    
    return reranked[:top_k]

def rerank_regulatory(chunks, query, weights):
    for chunk in chunks:
        authority = weights["source_authority"].get(chunk.source, 0.5)
        recency = recency_score(chunk.document_date)
        specificity = compute_specificity(query, chunk.metadata)
        chunk.final_score = (
            chunk.score * 0.6 +
            authority * weights["source_authority"] * 0.15 +
            recency * weights["recency_weight"] +
            specificity * weights["specificity_match"]
        )
    return sorted(chunks, key=lambda c: c.final_score, reverse=True)
```

---

## Step 4: Implement Hallucination-Free Answer Generation

The key: every sentence must map to a retrieved passage. Use Claude's citation API.

```python
async def generate_answer(query: str, chunks: list[DocumentChunk]) -> AnswerWithCitations:
    context = format_context_with_ids(chunks)
    
    system_prompt = """You are a regulatory intelligence assistant. 
    Answer ONLY based on the provided documents. 
    For every claim, you MUST cite the document ID in [brackets].
    If the documents don't support a claim, say "The available regulatory data does not address this."
    Never speculate about regulatory positions not evidenced in the corpus."""
    
    response = await anthropic.messages.create(
        model="claude-opus-4-7",
        max_tokens=2000,
        system=system_prompt,
        messages=[{"role": "user", "content": f"Documents:\n{context}\n\nQuestion: {query}"}]
    )
    
    # Parse citations from response, validate each maps to a real chunk
    citations = parse_and_validate_citations(response.content, chunks)
    
    return AnswerWithCitations(
        text=response.content,
        citations=citations,
        confidence=compute_confidence(citations, chunks)
    )
```

**Confidence scoring:** Flag answers where cited chunks have low similarity scores or where the number of supporting citations is below threshold. Return a `LOW_CONFIDENCE` warning rather than a confident-looking wrong answer.

---

## Step 5: Build the API Layer

FastAPI backend with streaming support for long answers.

```python
from fastapi import FastAPI, HTTPException
from fastapi.responses import StreamingResponse

app = FastAPI()

@app.post("/api/query")
async def query(request: QueryRequest, user: User = Depends(get_current_user)):
    if not await check_credits(user):
        raise HTTPException(402, "Insufficient credits")
    
    # Retrieve
    chunks = await retrieve(request.question, top_k=50)
    
    if request.stream:
        return StreamingResponse(
            stream_answer(request.question, chunks),
            media_type="text/event-stream"
        )
    
    answer = await generate_answer(request.question, chunks)
    await log_query(user.id, request.question, answer, chunks)
    return answer

# Key endpoints:
# POST /api/query          - submit a question
# GET  /api/query/{id}     - fetch a prior answer
# GET  /api/document/{id}  - fetch source document with page highlights
# GET  /api/datasets       - list available regulatory datasets
```

---

## Step 6: Build the Source Viewer UI

React frontend with a split-pane layout: answer with inline citation numbers on the left, source document viewer on the right.

```tsx
function AnswerPane({ answer }: { answer: AnswerWithCitations }) {
  const [activeCitation, setActiveCitation] = useState<string | null>(null);
  
  return (
    <div className="split-pane">
      <div className="answer-content">
        <ParsedAnswer 
          text={answer.text}
          citations={answer.citations}
          onCitationClick={(id) => setActiveCitation(id)}
        />
        {answer.confidence === 'LOW' && (
          <ConfidenceWarning message="Limited regulatory precedent found for this query" />
        )}
      </div>
      
      <div className="source-viewer">
        {activeCitation && (
          <PDFViewer 
            documentId={activeCitation}
            highlightPage={answer.citations[activeCitation].page}
            highlightText={answer.citations[activeCitation].excerpt}
          />
        )}
      </div>
    </div>
  );
}
```

Use `react-pdf` for in-browser PDF rendering with highlight overlays. Store document byte offsets during indexing so you can jump to the exact page and paragraph.

---

## Step 7: Deploy with Enterprise-Grade Security

Tier 1 (cloud SaaS): Standard Postgres + pgvector on Supabase or RDS, FastAPI on Railway or Fly.io, Next.js frontend on Vercel.

Tier 2 (on-premise for enterprise): Package as a Docker Compose stack with self-contained Postgres + pgvector. The corpus sync becomes a scheduled pull from public APIs rather than a cloud-to-cloud transfer. Add a `DATA_DIR` mount for the document store.

```yaml
# docker-compose.yml for on-prem
services:
  api:
    image: your-registry/regulatory-ai-api:latest
    environment:
      - DATABASE_URL=postgresql://postgres:password@db:5432/regulatory
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - DATA_SYNC_SCHEDULE=0 2 * * *   # nightly corpus refresh
    volumes:
      - ./data:/app/data

  db:
    image: pgvector/pgvector:pg16
    volumes:
      - pgdata:/var/lib/postgresql/data

  sync:
    image: your-registry/regulatory-ai-sync:latest
    command: ["python", "sync_corpus.py", "--sources", "fda,ema"]
    environment:
      - DATABASE_URL=postgresql://postgres:password@db:5432/regulatory
```

**Security notes:**
- All document text and embeddings stay within the customer's VPC on on-prem tier
- Use row-level security in Postgres so multi-tenant cloud deployments can't cross-query
- Rate-limit at the API gateway level to prevent corpus extraction via bulk querying
- Audit log every query for enterprise compliance requirements

Install for:

claude-code-skills.md

#biotech #regulatory intelligence #RAG #life sciences #FDA #YC W2026 #AI #pharma