Discuss your project

AI validation in GxP environments

Assessment and validation of AI systems in GxP environments

A documented basis for decisions on your AI use — from data quality and AI model testing through system validation to human oversight and operations.
Discuss your projectExplore our services

Typical project situation

Is your AI system suitable for GxP use?

AI model tests alone do not establish whether the overall system is suitable for your GxP process. We assess use, integration and risks, and agree the verification and validation scope required with you.

Illustrative scene: Two specialists discuss process documentation and system use.Use

What task should your AI perform in the GxP process — and what needs to be assessed?

We determine the testing and evidence required based on the task, its impact on patient safety, product quality and data integrity, and the potential consequences of errors.

Show detailsClose details: Use

Starting point

AI model tests or a supplier report do not yet demonstrate whether the overall AI-enabled system performs its task in your process. The conditions of use, potential errors and decisions influenced by the output need to be clarified.

QMVP’s contribution

We document the assessment of use and test results, including limitations of use and open risks, as a basis for your approval decision.

Abstract illustration: Three separate glass planes with different point patterns.Data

Are your data suitable for the task your AI needs to perform?

We assess data provenance, suitability and the independence of test data for the actual conditions of use.

Show detailsClose details: Data

Starting point

Information from a validated source system does not in itself show that all information needed for the task is available. Test data also need to cover relevant boundary cases and rare errors; their provenance and possible influence on training and optimisation need to be assessed.

QMVP’s contribution

We document the assessment of data suitability and test data independence, missing evidence, and the resulting actions and limitations of use.

Illustrative scene: Two specialists review documents against the original records.People

Can your staff actually identify relevant AI errors?

Human oversight requires appropriate information, expertise and the ability to intervene.

Show detailsClose details: People

Whether HITLHuman in the Loop: a person is involved in a specific decision or in reviewing an AI output. or HOTLHuman on the Loop: human monitoring with the ability to intervene. is appropriate and effective is assessed in the specific workflow.

Starting point

Human review does not automatically make a use case non-critical. Reviewers need access to the relevant original sources, sufficient time and the ability to correct or reject outputs. Omissions cannot be identified solely from the references displayed.

QMVP’s contribution

We specify reviewers’ tasks and use realistic error scenarios to assess how human oversight contributes to error detection. We document the test results and the limitations identified.

Abstract illustration: Teal paths pass through several glass frames and change direction.Operations

Will your AI application remain suitable when data or operating conditions change?

Changes can affect outputs even when the model remains unchanged.

Show detailsClose details: Operations

Appropriate monitoring and justified rules for repeat testing are therefore needed.

Starting point

A static model does not make the AI-enabled system unchangeable. New documents, modified retrieval logic, prompts, access rights or operating conditions can affect existing evidence of suitability.

QMVP’s contribution

We define responsibilities, monitoring and rules for changes and repeat testing — including criteria for restricting or stopping use and for responding to failures.

Perspective 1 of 4: Use

Drag or use the arrows to explore
Context and applications

What we assess

We assess the defined task and use of outputs (Intended UseThe defined task of the system and the use of its outputs in the specific process.) and the actual conditions of use (Context of UseThe specific conditions of use, including the process, data and people involved.). This includes data, the AI subsystem, interfaces, configuration, workflows, human oversight and operations.

AI model tests and supplier reports provide important foundations. They do not replace assessment of the integration or validation of the overall AI-enabled system in the process.

How we support you

Together, we determine requirements and risks, assess existing evidence, and plan and carry out the verification and validation activities within the agreed scope.

For your decision

We document test results, open risks and limitations of use. This provides a basis for your decision on use, as well as for measures, GuardrailsTechnical safeguards that restrict or check certain inputs, outputs or actions. Their effectiveness needs to be assessed in the specific use case. and appropriate human oversight — such as HITLHuman in the Loop: a person is involved in a specific decision or in reviewing an AI output. or HOTLHuman on the Loop: human monitoring with the ability to intervene..

Typical triggers

  • A new AI feature in an existing system
  • Introducing a knowledge assistant
  • Incomplete model or supplier evidence
  • A model update or change of supplier

Who we supportFor pharmaceutical, biotech and medical technology companies and their suppliers.

Typical applicationsimage-based visual inspection · data-based process monitoring and analysis · knowledge assistance with RAGRetrieval-Augmented Generation: generative AI uses retrieved sources in its answer. Accuracy and completeness still need to be assessed separately. · generative document drafting

Our article on the context: AI in the GMP environment: What the Annex 22 conference means for practice

Scope of services

Assessment and validation for your AI use.

From an initial assessment of use through review of existing evidence to a validation project: the five offers bring together relevant services. We agree the scope based on the context of use, the system, its interfaces and the available documentation.

Service components

Our services at a glance

We assess your AI use, qualify data, review model and training evidence, or carry out an agreed validation project. Select an offer to highlight the associated services.

ServiceAI validation

GxP assessment of AI use

Assess the task, use of outputs and conditions of use, GxP relevance, model influence, consequences of decisions and open questions about data use.

Possible deliverable

A use-case profile, risk assessment and a justified evidence and action plan.

Focus areas: GxP assessment of AI use

We describe Intended UseThe defined task of the system and the use of its outputs in the specific process. and Context of UseThe specific conditions of use, including the process, data and people involved. and define the boundaries of the supported process. We identify open questions about data use for discussion with data protection specialists and legal advisers.

ServiceAI validation

Data qualification for AI systems

Review data provenance, Data LineageThe provenance and processing history of data., representativeness, Ground TruthExpert-defined reference data used to compare and assess model outputs. and the separation of training, tuning and final test data.

Possible deliverable

A data qualification report assessing data suitability, test data independence and additional needs identified. A test data concept can be agreed separately if needed.

Focus areas: Data qualification for AI systems

As part of data qualification, we document the space of possible input data, relevant subgroups and potential Data LeakageInformation overlap between development and testing that can bias the assessment.. A test data concept, including the specification of test data required, must be agreed separately. Metrics, sample size and test strategy need to be aligned with validation planning.

ServiceAI validation

Review model and training evidence

Review available development and training evidence, model versions, configurations and supplier documentation against the requirements of your use case.

Possible deliverable

Supplier assessment, Training Verification ReportA report documenting the review of training evidence. and an overview of missing or incomplete evidence. Depending on the assignment: a documented comparison of the deployed version with the tested version.

ServiceAI validation

Validation of AI-enabled systems

Plan and carry out risk-based verification of the AI subsystem, assessment of integration and validation of the overall system in the process.

Possible deliverable

URSUser Requirements Specification: the documented requirements of the users., validation plan, Traceability MatrixA matrix linking requirements to their supporting evidence., test protocols and validation report.

Focus areas: Validation of AI-enabled systems

Model performance, robustness, interfaces and process performance are tested against predefined criteria. We define which versions, results and test decisions need to be retained in a traceable form. Results, deviations and residual risks are consolidated in the validation report.

ServiceAI validation

Human oversight of AI systems

Specify human oversight tasks and use realistic error scenarios to test whether relevant errors can be identified and corrected.

Possible deliverable

A review strategy, SOP and documented test results on effectiveness and its limitations.

Focus areas: Human oversight of AI systems

We consider human review of individual outputs (HITLHuman in the Loop: a person is involved in a specific decision or in reviewing an AI output.) or monitoring with the ability to intervene (HOTLHuman on the Loop: human monitoring with the ability to intervene.), as appropriate for the task. This includes the information available, expertise, time, the ability to override system outputs and escalation.

ServiceAI validation

Assess generative AI, RAGRetrieval-Augmented Generation: generative AI uses retrieved sources in its answer. Accuracy and completeness still need to be assessed separately. and safeguards

Evaluate factual accuracy, completeness and grounding in sources; assess the knowledge base, retrieval and GroundingBasing an AI answer on supplied sources. The evidence needs to be checked to establish whether it supports each claim., and, for agents, tool permissions and limits on actions.

Possible deliverable

A guardrail test matrix with challenge-test results covering preventive measures, error detection and mitigation of harm.

ServiceAI validation

AI operations, monitoring and change management

Include the model, prompts, knowledge base, tools and process changes in controlled configuration and change management.

Possible deliverable

Monitoring of performance and DriftChanges in data or model performance., change and retest rules, and handover, incident/CAPA and fallback procedures.

Focus areas: AI operations, monitoring and change management

For a change of supplier or decommissioning, we plan data migration, access to archives and the shutdown of interfaces.

ServiceAI validation

AI in the QMS and role-specific training

Extend existing QMS/CSV procedures to cover the AI inventory, roles, data responsibility, approval for use and SOPs.

Possible deliverable

Role-specific training with practical exercises for operational teams, QA and IT.

Discuss your project

Approach

How we work

01

Clarify the use case

Define the task and conditions of use, risks to patient safety, product quality and data integrity, and applicable requirements.

02

Prepare the evidence

Review data quality, training records, supplier evidence and responsibilities.

03

Define criteria and assess suitability

Agree metrics, acceptance limits, independent test data and a test strategy based on risk. Align verification of the AI subsystem, assessment of its integration and validation of the overall system in the process; include human oversight and technical safeguards.

04

Prepare for operation

Document limitations of use, handover, monitoring and change management.

Collaboration and boundaries

An agreed scope. Clear responsibilities.

We agree the scope and specialist resources required before preparing a proposal. We document the agreed test results, open risks and limitations of use — including where additional evidence is needed or suitability has not been demonstrated. Technical and quality approval for use remains your responsibility; auditors and competent authorities make their own assessments.

Model development and training are outside the scope of these services. For medical technology companies, the initial focus is on operational quality and production systems. AI as a medical device or product component requires a separate scope involving Regulatory Affairs. We consider EU GMP Annex 22 as a draft within its GMP scope. For other GxP processes, we determine the applicable framework separately.

Related services

Your contacts

M. Sc. Eugen Betche

CEO & Consultant

Eugen combines extensive experience in quality management and quality assurance with production equipment and laboratory instrument qualification, CSV, data integrity, and process and method validation.

More about M. Sc. Eugen Betche

Dr.-Ing. Franz Müller

Co-Founder & Consultant

Franz combines scientific and technical analysis and industrial process development with CQV and CSV/CSA.

More about Dr.-Ing. Franz Müller

FAQ

Frequently asked questions about AI use

Do we need to wait for the final Annex 22 before an initial assessment?

You do not need to wait for an initial assessment. Existing requirements already need to be considered within the GMP scope. Together, we assess the use case, risks and evidence required; we consider Annex 22 as a draft.

Can we reuse existing AI model tests and supplier documentation?

Existing evidence can be taken into account where it is relevant to the intended use and its significance can be assessed. When reviewing data, model and training evidence, we evaluate what can be used and what evidence is missing. This provides a basis for defining the remaining validation scope.

Do we need to generate new test data before the assessment?

New test data are not required in every case. We first assess the suitability and independence of existing data and identify missing evidence. From this, we determine additional testing needs for your use case.

Are Human-in-the-Loop and guardrails sufficient for critical GMP use?

These measures alone do not demonstrate suitability. When assessing generative AI, RAGRetrieval-Augmented Generation: generative AI uses retrieved sources in its answer. Accuracy and completeness still need to be assessed separately. and agents, we consider the evidence and limitations of use. The 2025 draft Annex 22 does not provide for generative AI and LLMs in critical GMP applications; HITLHuman in the Loop: a person is involved in a specific decision or in reviewing an AI output. or guardrails do not remove this limitation of the draft.

How does QMVP support the assessment of human oversight?

We support the review strategy and the agreed evidence of effectiveness for your workflow. The results document the contribution of human oversight and its limitations.

Is our RAG solution adequately safeguarded because it provides references?

References alone do not show whether an answer is factually correct and complete. We assess retrieval and answer quality in the specific workflow, together with existing safeguards. The result is a documented assessment with open risks and limitations of use.

What support do we need for updates or a change of supplier?

The evidence that needs to be renewed depends on the change and its impact on the specific use case. We support the impact assessment and the monitoring and change management concept. This documents evidence requirements, open risks and possible restrictions as a basis for your decision.

What do the results mean for our approval and a subsequent inspection?

QMVP provides a technical assessment and agreed evidence with documented open risks and limitations of use. Approval for use remains your responsibility. Auditors and competent authorities assess the evidence independently; we do not promise a particular audit or inspection outcome.

Knowledge

Articles on this topic

All articles

Next step

Discuss your project needs.

Tell us about your use case and the available system and supplier evidence. Together, we determine the assessment and validation scope required.Discuss your project