Risk that actually flows into effort — not a document that sits on a shelf.
Every requirement is scored against an ICH Q9 lens for severity, probability and detectability. That score drives the test strategy, the traceability coverage and the inspection-readiness view — so risk stops being a compliance formality and starts sizing your actual work.
Risk assessment decides where validation effort goes. GxP Copilot produces an initial risk assessment aligned to ICH Q9(R1) and a per-requirement functional risk assessment, with the scoring computed from confirmed facts rather than generated. A qualified person reviews and owns the result — the AI is never permitted to decide a GxP-critical question.
Risk assessments that justify nothing
Many risk assessments are written after the test plan, to justify a scope someone had already decided. They are internally consistent and completely circular, and an experienced auditor can tell within a page.
The other common failure is a scoring scheme so elaborate that nobody applies it the same way twice. Five severity levels, five probabilities and five detectabilities give 125 combinations and no shared understanding of what any of them mean.
Both produce the same outcome: a document that exists because the procedure requires one, rather than a decision record that actually shaped the work.
Assessed before the scope, not after it
The initial risk assessment runs on the confirmed facts about the asset and feeds the validation plan, rather than being written to match a plan that already exists. The functional risk assessment then runs per requirement and determines the assurance activity each one receives.
Because the scope is derived from the assessment, the relationship between them is real. That is what an auditor is checking when they ask why a particular requirement was tested the way it was.
Where risk assessment sits in the lifecycle
Risk assessment is stage 2 of six. Select any stage to see what happens in it.
The system category from explainable rules, and a risk rating for each requirement from severity and probability, adjusted for detectability.
QA reviews and can change any rating; the reason is recorded.
Scored, not guessed
Scores are computed from the facts a person confirmed, so the same inputs always produce the same result. The AI contributes by establishing and quoting facts from your source material; it does not assign the risk. Under the draft EU Annex 22 and under any reasonable reading of current expectations, a model should not be deciding a question that determines how much evidence a patient-safety-relevant requirement receives.
The practical benefit is consistency. Two assessors working on similar systems reach the same place, which is rarely true when scoring is a matter of individual judgement applied to a five-by-five grid.
Alive to change
When a fact or a requirement changes, the assessment is re-derived and the downstream test strategy moves with it. Risk assessments that are correct at approval and stale six months later are the normal case elsewhere; here the assessment is a live property of the project rather than a document filed at the start.
What you get
What AI Risk Assessment delivers
AI Risk Assessment is part of the GxP Copilot platform — an AI-native, CSA-first validation system built for regulated Life Sciences. See how it fits with AI Classification Engine, Risk-Based Validation Scoping, Document Control & Versioning.
- Initial and per-requirement risk assessment
- ICH Q9-aligned scoring across severity, probability, detectability
- Auto-scales test rigor under CSA
- Human review and override with full audit trail
Common questions
Prefer to talk first? Chat with us on WhatsApp or book a call with an expert.
Does AI perform the risk assessment?
No. The AI establishes and quotes facts from your source material. The risk scoring is computed from those facts once a person has confirmed them, and a qualified person reviews and approves the result. A generative model deciding how much evidence a safety-relevant requirement needs is precisely what the draft EU Annex 22 is written to prevent.
Which risk framework does it follow?
The initial risk assessment is aligned to ICH Q9(R1). The functional risk assessment follows the per-requirement model that FDA's Computer Software Assurance guidance expects, assessing the consequence of failure and whether it would be detected, and mapping the result to an assurance activity.
What happens to the assessment when requirements change?
It is re-derived. The affected risk scores and the test strategy tied to them update, and the traceability matrix shows any coverage gap the change opened. The assessment stays a live property of the project rather than a document that was accurate on the day it was approved.
Related capabilities
All capabilitiesA guided intake — accelerated by AI, decided by your team — produces GxP impact, GAMP category and composite risk, along with the exact reasoning behind each result. Instead of week-long assessments, you get a classification you can defend to an inspector on the same day. The AI accelerates the input; the classification itself is transparent and controlled.
Learn more about AI Classification EngineRisk-Based Validation ScopingThe Strategy Engine picks the applicable deliverable set for each GAMP category and scales test rigor to per-requirement risk under CSA — choosing between scripted testing, unscripted verification, and leveraged supplier evidence. The output is a validation plan sized to reality, easy to defend, and quick to execute.
Learn more about Risk-Based Validation ScopingDocument Control & VersioningEvery document version is fingerprinted and tagged with its provenance and any AI assistance used. Data-driven sections stay canonical across every deliverable — so what you sign is what you keep, and what you keep is what you show an auditor.
Learn more about Document Control & VersioningAI Validation Document DraftingThe Documentation Engine drafts your validation deliverables in the style of the templates your organisation already uses — with confidence checks, review gates, and a fully functional fallback when the AI is unavailable. Your team stays in control; the platform removes the drudge work.
Learn more about AI Validation Document DraftingLive Traceability MatrixThe Live RTM is always up to date — coverage gaps, orphan tests and inspection-readiness are computed on the fly from the links between requirements, design, tests and results. No more spreadsheet upkeep, no more RTM-freshness debates before an audit.
Learn more about Live Traceability MatrixAI Test Case GenerationInstallation, Operational and Performance Qualification protocols are drafted from your requirements and design, right-sized by the risk engine, and structured for straightforward execution. Effort follows risk — high risk is scripted with an independent witness, medium is scripted or hybrid, and low risk can be unscripted with supplier evidence.
Learn more about AI Test Case GenerationSources
Primary documents referred to on this page, from their official publishers.
See risk assessment on your own requirements.
One real requirements document. We show you the draft package built from it, and you keep it either way.
- We reply within one business day
- We run your URS live on the call
- You get a clear plan for your system