GxP validation for AI workflows, sized to the risk.

Not every AI workflow in a regulated company needs validation, and the ones that do need more than a standard test pack. We start by deciding where the GxP boundary sits. An AI that drafts a proposal for a person to edit sits outside it, while an AI step that creates or changes a GxP record sits inside it. For the workflows inside, we validate under your quality system with a risk-based approach in line with GAMP 5, and deliver the documents your QA team signs.

We assess each AI workflow for its intended use, the GxP impact of its output and how a person controls it. ISPE's GAMP 5 second edition and the FDA's computer software assurance guidance, written for medical device makers but useful by analogy, point the same way: put the testing effort where the risk to product quality, patient safety and data integrity is highest, and rely on supplier work where it can be trusted.

For AI we add what classic software validation leaves out. That means a fixed test set drawn from your own data, accuracy thresholds agreed with QA before testing, version control of the model and the prompts, monitoring for drift after go-live, and a rule that any model or prompt change is retested before it reaches users.

The same discipline applies under 21 CFR Part 11 for electronic records, Part 58 for GLP studies, EU GMP Annex 11 for computerised systems, and the OECD's advisory documents on computerised systems and data integrity in GLP. The draft EU GMP Annex 22 on AI keeps generative AI out of critical GMP uses, and EMA aims to publish the final text in early 2027. We use that line now.

Our part is the evidence and the controls. Your quality unit owns the validation decision and signs it.

We build one workflow at a time in your own tenant. Where it sits inside the GxP boundary, the validation documents are part of what we deliver and part of the acceptance tests you sign before we start. One workflow is $10,000, paid only after every test passes, and your QA review and approval run on your own schedule.

For 12 years we have been the technology partner to Arcondis, a life-science compliance consultancy, on work for large pharma, so GxP auditors and validation packs are familiar ground.

Does every AI tool in a GxP company need validation?

No. AI that drafts or searches for a person who then decides usually sits outside the GxP boundary and is controlled by policy and access rights. AI steps that create or change GxP records, or that decide whether something is released, need validation under your quality system.

What is different about validating AI?

Outputs vary from run to run, accuracy depends on the data, and models change with vendor updates. Validation therefore adds a fixed test set from your own data, accuracy thresholds agreed in advance, version control of the model and prompts, and monitoring after go-live.

Is IQ/OQ/PQ still the right structure for AI?

It still works as a frame for installation, operational and performance testing, but on its own it is not enough for AI. GAMP 5 and computer software assurance both encourage scaling the testing to the risk, with the AI-specific tests added where the output affects a record.

How should we handle model updates from the vendor?

Pin the model version where the platform allows it, retest on a held-back sample before switching, and record the change through change control. If a vendor cannot pin versions, keep that tool outside the GxP boundary.

Does EU GMP Annex 22 on AI apply yet?

Not yet. It was published as a draft for consultation in July 2025, and EMA aims to publish the final text in early 2027. Its line that generative AI stays out of critical GMP uses is a sensible one to adopt now.

Who signs off the validation?

Your quality unit. We prepare the plan, the tests and the evidence, and QA reviews, approves and owns the decision.