Most AI governance in life sciences is a policy document that nobody consults and a committee that approves whatever reaches it. That is not governance. It is the appearance of governance, and it is worse than nothing because it transfers accountability to a body that is not actually examining anything.
Governance that works is unglamorous: a register of what exists, a classification that determines what each thing needs, a gate that AI cannot pass without meeting it, and someone whose job it is to notice when behaviour changes.
This is the operating model we recommend on AI governance engagements.
Start with the register, because you do not know what you have
Nearly every organisation we work with underestimates how much AI is already in use. Not because anyone concealed it, but because AI arrived as features inside tools people were already licensed to use. A summarisation feature in a document platform, a transcription service, a coding assistant, an analytics tool with a prediction function.
Before any policy, build the inventory. For each entry: what it is, who uses it, what it touches, whether anything GxP-relevant depends on its output, and whether anyone assessed it. The exercise typically takes a few weeks and the result is usually uncomfortable, which is the point — a policy written without it governs an imaginary estate.
The question that matters per entry is narrow: does anything regulated depend on this output. Most entries will be no, and those can be governed lightly. The few that are yes are the whole programme.
Classify by what depends on the output
Classification is what makes governance proportionate, and getting the axis right matters more than the number of tiers.
The axis is not how sophisticated the model is, nor whether it is generative. It is what happens downstream. An AI drafting a document that a qualified person reviews line by line before it has any effect sits in a different tier from one scoring a deviation that routes an investigation, which sits in a different tier again from one influencing a release decision.
Three practical questions resolve most cases. What decision does the output influence and what happens if it is wrong. Does a human review every output before it takes effect, and is that review real rather than nominal. Can the model change after it was assessed — through retraining, or through a vendor API that updates underneath you.
That third question catches the case organisations miss most often. A fixed model evaluated once behaves like conventional software. A model reached through a service that updates without notice does not, and it needs monitoring and re-assessment triggers defined in advance. Model change and revalidation covers it.
The gate, and why committees fail
A monthly committee reviewing AI proposals fails for a predictable reason: it is a bottleneck with no capacity to investigate, so it approves on the basis of what it is told. Teams learn to present proposals in the form that gets approved, and the committee becomes a stamp.
What works better is a gate with explicit criteria that a proposal either meets or does not, assessed by someone competent, with the committee reserved for genuinely novel cases and for the ones the criteria say no to. The criteria carry the load; the committee handles exceptions.
Reasonable criteria for anything in a GxP-relevant tier: a stated intended use including what the system is not for, a documented risk classification, an evaluation approach with acceptance criteria defined before testing, a named human review role at a defined gate — Human-in-the-Loop reviews is what enforcing that looks like — a monitoring plan, and a working fallback. The AI intended-use statement covers the first of those, which is the one most often missing and the one everything else depends on.
Monitoring, which is where governance actually lives
Approval is a moment; the risk is continuous. Model behaviour drifts as inputs shift away from what it was evaluated against, as vendors update, and as the surrounding process changes.
Monitoring needs to be specific to be real. A defined measure, a defined frequency, a threshold that triggers review, and a named owner. Without a threshold decided in advance, monitoring produces a chart somebody looks at occasionally and nobody acts on, which is the most common state we find.
The uncomfortable part is deciding the threshold before you have operational data, which feels arbitrary. Do it anyway and revise it — an arbitrary threshold that triggers a review is more useful than no threshold, because it forces the conversation at a point of your choosing rather than after an incident.
Where the EU AI Act fits, and where it does not
Two framings get conflated and they are genuinely separate.
The EU AI Act classifies AI systems by risk and places obligations on high-risk uses regardless of whether the system is GMP-relevant. Its tiers follow the system's purpose, not the industry using it. One tool can therefore carry duties under both the AI Act and GxP at the same time, and satisfying one does not discharge the other.
ISO/IEC 42001:2023 specifies an AI management system at the organisational level — governance, roles, risk handling, lifecycle control. It is voluntary, no regulator expects certification, and it answers governance questions GxP validation does not reach. Organisations adopting AI at scale increasingly look at it, and it is increasingly raised in customer and supplier audits.
Neither replaces validation. A governance programme that addresses only GxP will be surprised by the AI Act; one that addresses only the AI Act will not satisfy an inspector. the GxP AI hub covers the regulatory picture, and AI CoE is how we help structure the function.
Who owns it
The common failure is giving AI governance to IT, which can assess the technology but not the regulatory impact, or to Quality, which can assess the impact but not the technology. Either alone produces decisions with a blind side.
What works is a named owner accountable for the register and the gate, with the authority to say no, drawing on both. Seniority matters less than authority — a governance owner who can be overruled by a delivery deadline is an administrator.
Then the honest resourcing conversation, which most organisations have deferred: monitoring is continuous, so somebody owns the condition of the AI estate the way somebody owns calibration or environmental monitoring. There is no point at which it is finished. book a demo if you want help building the register — it is the part that pays for itself fastest.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.
