Use AI in regulated work without losing control of it
For teams adopting AI or LLM tools in regulated work who need them to hold up as GxP computerized systems. We apply GAMP 5 Appendix D11 so AI-enabled systems can be assured and governed like any other GxP system.
The problem
AI is arriving in regulated work faster than most quality organizations can assess it. Some teams avoid useful tools out of uncertainty. Others adopt them without the controls they need. Neither outcome serves patients.
AI also brings risks traditional validation wasn't designed for: outputs that aren't fully deterministic, model drift, vendor updates and hallucination.
And the first question, "is this tool GxP?", has no good answer on its own. The same AI tool can be outside GxP scope in one use and squarely inside it in another. What decides scope is the use, not the product.
Read: When does an AI tool become a GxP computerized system?
Three implementation tracks
We help you choose the track that fits your use case, along with its supplier, control and testing obligations.
Commercial platform
An established validation platform with AI features. The vendor carries much of the platform assurance; you assure your configuration and review process.
- Assurance burden
- Lower
- Data control
- Depends on vendor terms
- Customization
- Within vendor roadmap
Hybrid API
A commercial LLM accessed through a private deployment option, wrapped in a GxP governance layer you own.
- Assurance burden
- Moderate
- Data control
- Private deployment options
- Customization
- High
Custom build
Your own fine-tuned or purpose-built models. Justified for proprietary workflows or full data sovereignty, with the heaviest ongoing governance.
- Assurance burden
- Highest
- Data control
- Full
- Customization
- Unlimited
What the governance layer includes
The controls we design into every track, so the system can answer an inspector's questions.
Immutable interaction log
Prompt, model version, retrieved sources, output and reviewer captured for every interaction, in a tamper-evident log.
Grounded outputs
Retrieval from a version-controlled set of your SOPs and the applicable guidance, so outputs cite controlled sources.
Human review queue
Nothing becomes a GxP record until a qualified reviewer approves it, with an electronic signature meeting Part 11 expectations.
Controlled prompts
Prompt templates treated as controlled documents: versioned, approved, and changed only through change control.
Model version pinning
Production stays on an approved model version. Upgrades are change-control events with regression testing.
Ongoing monitoring
Reviewer rejection rate, flagged outputs and accuracy sampling, with defined triggers for re-assurance.
A spectrum, not a switch
The same LLM could sit behind every one of these uses. Each use needs its own determination.
| Use | Typical determination |
|---|---|
| Drafting an internal, non-GxP email or meeting summary | Outside GxP scope. Normal IT and information-security controls apply. |
| Finding relevant sections of approved SOPs | Usually low risk, provided users act on the controlled document and not the AI's paraphrase. |
| Drafting deviation or investigation narratives that QA approves | In scope. Review has to be designed to catch omissions and fabrications. |
| Classifying or triaging deviations, complaints or adverse events | In scope and higher risk. |
| Contributing to batch disposition or release-relevant decisions | In scope and high risk, with the most rigorous assurance and governance. |
Human review is a control only when it's designed to be one. A reviewer who skims a fluent, confident summary is relying on it, not verifying it. We design review that is defined, attributable, and able to catch the errors the AI is likely to make.
What you can expect
- A clear intended use and risk classification for each AI function
- An implementation track chosen on documented criteria
- An assured system with a signed Assurance Summary Report at release
- Governance SOPs your team can operate after we step back
Time to first value depends on the track and your environment. We'll give you a realistic estimate after scoping.
Have an AI use case in mind?
Tell us what you want AI to do. We'll help you decide whether it belongs in GxP scope and how to assure it.