AI Assurance for GxP

Assuring AI-enabled GxP solutions starts with a precise intended use, clear operating boundaries, and an explicit decision about what people—and the model—are responsible for. Assurance must address the full system, including data, model, software, infrastructure, workflows, users, and controls.

Core control areas:

• Establish data provenance, quality, representativeness, access, and versioning.

• Define meaningful performance metrics and acceptance criteria, including foreseeable failure modes.

• Apply independent challenge, validation, and testing commensurate with product and process risk.

• Preserve human oversight, review, escalation, and safe override where decisions can affect quality or patients.

• Control model, prompt, configuration, vendor, and infrastructure changes.

• Monitor drift, performance, incidents, security, and unintended use after deployment.

The European Commission consulted in 2025 on a draft GMP Annex 22 for artificial intelligence. Until finalized, label it clearly as draft and base compliance claims on requirements that are actually in force.