GxP AI, IT Advisory,
and Compliance Built for
Life Sciences

To transition from traditional software validation to AI-driven systems, it is essential to understand the shift from deterministic to nondeterministic logic. Unlike conventional software, which relies on hard-coded “if-then” functions that remain static until manually altered, AI and Machine Learning (ML) performance is fundamentally tied to how data models are trained.

This creates a unique challenge: model drift. Because the behaviour of an AI model can evolve or degrade over time, it does not offer the same “set-and-forget” reliability as traditional code. Consequently, the standard periodic review cycles used for traditional software — which are risk-based and often span a year or more — are insufficient for AI. Instead, AI data models require more frequent, rigorous periodic checks to ensure they remain within their initial performance parameters.

Furthermore, while Computer System Validation (CSV) remains applicable for traditional applications, the industry is moving toward a Computer Software Assurance (CSA) approach for AI. CSA’s focus on critical thinking and risk-based assurance is far better suited to the dynamic nature of ML data models than the documentation-heavy requirements of traditional CSV.

Regulatory bodies are actively developing frameworks for AI implementation across GMP and related sectors. While several of these guidelines remain in draft form, their formal adoption is imminent.

The current regulatory focus primarily targets AI/ML integration and the validation of Data Models, with a significant emphasis on applying Computer Software Assurance (CSA) principles. Notably, while some documentation currently lists autonomous agents as “out of scope,” there is a viable path for their deployment in the GxP space — provided they are applied to non-critical processes and maintained under rigorous Human-In-The-Loop (HITL) oversight by trained personnel.

As AI in GxP and overall technology is evolving, most of the regulations/standards that are currently in Draft state will be finalized and implemented in near future. Here are some of the regulations/standards that can be referred/implemented:

• FDA 21 CFR Part 11
• FDA Guidance Computer Software Assurance Production Quality System (CSA)
• FDA General Principles of Software Validation
• FDA Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing (Draft)
• FDA Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products (Draft)
• EU AI Act 2024
• EU Annex 11 Computerised Systems
• EU Annex 22: Artificial Intelligence
• ICH Q9 Quality Risk Management
• ISO/IEC 42001:2023 (AI Management System Standard)
• ISPE GAMP AI Guide: Validation Framework for GxP Systems
• ISPE GAMP 5 Second edition Appendix D11
• ISPE Guide on Data Integrity

While the standard set of validation deliverables remains consistent for AI-driven GxP applications, the internal focus areas shift significantly. Success in this space depends on three primary pillars:

1. Criticality of Context of Use (COU)

Establishing a clear Context of Use (COU) is paramount. Because AI behaviour is data-driven, there must be absolute clarity regarding the application’s specific purpose and the exact boundaries of its decision-making authority.

2. Evolution of User Requirements

User Requirements (URS) for AI must account for the probabilistic nature of Machine Learning. Unlike traditional software with binary “pass/fail” outcomes, AI requirements are often defined by statistical performance thresholds.

• Example: A requirement might state that a model must predict potency within a ±5% error margin for 95% of batches.

3. Streamlined Testing via CSA

The testing phase leverages Computer Software Assurance (CSA) principles — utilizing unscripted testing, scripted scenarios, and error guessing. This approach offers several advantages:

• Efficiency: Significantly reduces documentation overhead and accelerates testing cycle times.
• Risk-Based Leveraging: Regulators encourage the use of existing vendor documentation, provided it is supported by a robust risk assessment.

Takeaway: Validating AI in GxP isn’t about changing what documents you produce but changing how you define success (statistical vs. absolute) and how you verify it (risk-based CSA vs. rigid CSV).

Validating AI applications for GxP is not necessarily more difficult than traditional software validation, but it does require a distinct shift in methodology regarding documentation and testing.

The primary difference lies in the nature of the software: traditional systems are predictable and logic-driven, whereas AI models are susceptible to performance shifts over time. This inherent variability makes regular revalidation an essential requirement for AI, rather than an occasional necessity.

Incorporating AI-Specific Concepts

A robust AI validation strategy must address specific concepts that are non-existent in traditional CSV, such as:

• Hallucination & Drift: Managing inaccurate outputs and performance degradation.
• Explainability: Ensuring the “black box” logic can be understood and audited.
• Orchestration & Behaviour: Mapping how the AI interacts with other systems and data.

Integrating these terms into the validation framework is crucial for maintaining clear traceability for every action the software takes.

Streamlining the Process

To manage this complexity without increasing the administrative burden, it is highly recommended to adopt Computer Software Assurance (CSA) principles. This approach simplifies the documentation lifecycle and encourages the leveraging of vendor documentation, provided it is supported by a comprehensive, application-specific risk assessment.

The Shift: We are moving from a “straight process” of hard-coded logic to a dynamic framework that accounts for behavioural drift. By using CSA, we can focus on these high-risk AI behaviours without getting bogged down in traditional, redundant paperwork.