AI you can defend under audit
Most AI tools arrive with a demo. Mine arrive with the evidence your quality unit needs. I build GxP tools with their validation package, and I help pharma and biotech teams validate the AI systems they already have.
Two ways to work together
GxP tools, delivered with their validation package
Local apps and AI systems built to an approved URS and delivered onto your own hardware, with the full validation package produced alongside the software rather than after it.
- Built and documented to the same requirements
- Deterministic core, with any model given a declared role
- Delivered inside your environment, ready for your quality unit
Validation for the AI systems you already have
Built in-house or bought from a vendor, an AI system still has to be shown fit for its intended use. I help your QA, IT and data teams write the validation plan and produce the evidence to hold the system to it.
- Validation plans for agentic and model-based systems
- Risk-based test strategies, including AI-specific testing
- Coaching for QA and IT on what validation means for AI
What a validation package contains
The exact contents follow your own CSV/CSA framework and the risk of the use case. A typical package for an AI system includes:
- Validation plan. Scope, intended use, approach and acceptance criteria, agreed before any testing starts.
- User Requirements Specification. Drafted from your requirement and approved by your subject-matter expert.
- Risk assessment. A declared context of use and a critical or non-critical status for every AI function, with testing proportionate to the risk.
- Functional and design specifications. What the system does and how it is built, including where the deterministic core ends and any model begins.
- Traceability matrix. Every requirement traced to the test that proves it.
- Test protocols and executed evidence. Installation and operational qualification, executed with recorded evidence, and performance qualification protocols ready for your team to run in your environment.
- AI-specific testing. Determinism measured by repeated runs on the deployed hardware, model performance against expert-reviewed reference data kept independent of training data, and checks that flags and figures survive any generated summary.
- Data residency verification. Confirmation at the network level, on the deployed hardware, that data stays inside your environment.
- Validation summary report. The evidence brought together for your quality unit to review and approve.
- Change control and periodic review. Procedures for updates, model retraining and hardware changes, each treated as a controlled change.
See a sample validation package
A 23-page sample built around the Ligant Antigen Density Calculator, an open-source tool: validation plan, user requirements, risk assessment and regulatory applicability, specifications, traceability matrix, installation and operational qualification with executed results, a performance qualification protocol and change control. Enter your email and I’ll send it to you as a PDF.
How a validation engagement runs
Intended use
We agree what the system is for, who relies on it, and the decisions it may and may not make.
Plan and risk
The validation plan and risk assessment set the context of use, the critical or non-critical status, and the depth of testing.
Specify and trace
Requirements and specifications are written and traced, so every claim about the system has a test behind it.
Test and evidence
Testing is executed and documented on the deployed environment, including the AI-specific checks.
Review and approve
Your quality unit reviews the package, executes what is theirs to execute, and approves. Change control takes over from there.
The standards behind the work
How the ten FDA and EMA principles shape a validation plan: read my interpretation of the ten principles.
- EU GMP Annex 11 and cGMP for computerised systems.
- Your own CSV/CSA framework, so the package fits the way your quality unit already works.
- Readiness under the draft Annex 22 on artificial intelligence. Nothing can be validated under a draft, but its direction is clear enough to design for now.
- Aligned to the FDA and EMA Guiding Principles of Good AI Practice in Drug Development (January 2026): a risk-based approach and a clearly defined context of use. They are principles, not a validation standard, so the work aligns with them rather than being validated under them.
Who does what
I produce the validation evidence. Your quality unit executes and approves it. I do not certify systems, approve on your behalf, or stand in for your quality organisation.
Have a system that needs validating?
Send me the system and its intended use. I’ll tell you what validation looks like for it, even if you’re only at the idea stage.
Get in touch →