https://stock.adobe.com
Computer system validation (CSV) has governed software compliance using best practices (GxP) for over three decades and works well on deterministic systems. But software powered by artificial intelligence (AI) presents a fundamentally different challenge. Machine learning (ML), neural networks, and adaptive decision engines do not behave the same way with all inputs, and many are designed to evolve over time. Applying traditional installation, operation and performance qualification protocols (IQ, OQ, PQ) to such systems only captures performance at a single point in time and does not provide a lasting guarantee of continued fitness for purpose. The industry must now close this validation gap.
A regulatory basis already exists. The US Food and Drug Administration (FDA) 2021 AI/ML Action Plan introduced the concept of a Predetermined change control plan (PCCP), a pre-approved framework that defines what changes a model is allowed to undergo without triggering a full resubmission (1). The International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use (ICH) Q9 guidelines provide a risk-based perspective for calibrating validation accuracy (2). ICH Q10 sets out the knowledge management and continuous improvement principles that support lifecycle-based validation (3). And the second edition of the Good Automated Manufacturing Practice 5 (GAMP 5) framework explicitly takes agile and iterative development into account (4). The scaffolding is up; What is needed is practical architecture.
Table of Contents
Building a practical framework
A practical framework for AI validation in GxP environments is based on three principles.
Risk stratification according to patient and product effects: Not all AI applications pose the same risk. An advisory tool that designs deviation narratives for human review is fundamentally different from a model whose output directly triggers a collective decision. Classify AI applications based on directness of impact and degree of human control, then apply proportional validation rigor. High-impact, low-oversight systems require strict controls; Low-risk advisory tools require a simpler, yet documented approach.
Life cycle integration via selective qualification: Establish basic performance metrics during initial validation – e.g. B. Precision, recall, false positive rate – and implement continuous monitoring to detect model deviations before they impact product quality or patient safety. Statistical process control methods and CPV (Continued Process Verification) principles from the FDA’s 2011 process validation guidelines can be implemented directly (5). For AI systems, validation is a program, not an event.
Specified change control limits: During initial validation, define which changes are allowed without triggering revalidation and which thresholds require partial or full validation. A documented PCCP for each AI application approved by the quality system provides both operational flexibility and an inspection-defensible regulatory posture. It prevents both overloading of the compliance function and under-control of the system.
Any AI governance framework must also address data integrity. Algorithmic decision logs that capture model version, input data, output and confidence values are GxP datasets and therefore must meet ALCOA+ requirements – meaning such logs do attributable, readable, at the same time, OriginalAnd Exactly (6, 7). Such an architecture should be integrated during validation planning and not retrofitted after deployment.
Validation experts are uniquely equipped to lead this work. Risk-based thinking, regulatory fluency and documentation discipline are exactly the skills that AI governance requires. Organizations that begin building structured AI validation frameworks now, based on existing regulatory principles and proportionate to risk, will be well-positioned for inspections, able to responsibly scale AI adoption, and prepared to stay ahead of those waiting for guidance that may take years to fully realize.
References
1 Action Plan for Artificial Intelligence/Machine Learning (AI/ML) Based Software as a Medical Device (SaMD).. US Food and Drug Administration: Rockville, MD, 2021; https://www.fda.gov/media/145022/download.
2 I Q9. Quality risk management. International Conference on the Harmonization of Technical Requirements for the Registration of Medicinal Products for Human Use: Geneva, Switzerland, 2005; https://database.ich.org/sites/default/files/Q9%20Guideline.pdf.
3 I Q10. Pharmaceutical quality system. International Conference on the Harmonization of Technical Requirements for the Registration of Medicinal Products for Human Use: Geneva, Switzerland, 2008; https://database.ich.org/sites/default/files/Q10%20Guideline.pdf.
4 GAMP 5 Guide 2nd Edition. International Society for Pharmaceutical Engineering: North Bethesda, MD, 2022; https://ispe.org/publications/guidance-documents/gamp-5-guide-2nd-edition.
5 Industry Guide – Process Validation: General Principles and Practices. US Food and Drug Administration: Rockville, MD, 2011; https://www.fda.gov/files/drugs/published/Process-Validation–General-Principles-and-Practices.pdf.
6 Good Manufacturing Practice: Medicinal Products for Human and Veterinary Use, Annex 11 – Computerized Systems. European Commission: Brussels, Belgium, 2011; https://health.ec.europa.eu/system/files/2016-11/annex11_01-2011_en_0.pdf.
7 Drug CGMP Data Integrity and Compliance Questions and Answers: Industry Guide. US Food and Drug Administration: Rockville, MD, 2018; https://www.fda.gov/media/119267/download.
Corresponding author Sivakumar Kalidoss is Associate Director of IT Delivery, specializing in Computer Software Assurance (CSA) and validation of GxP regulated systems, at Compliance Group, Inc.; 1512 Artaius Parkway, Suite 104, Libertyville, IL 60048; [email protected].
Please cite this article as: Kalidoss S. Beyond installation, operational and performance qualifications: A risk-based validation framework for AI-driven software in GxP environments. BioProcess Int. 24(7) 2026: 240702.
https://www.bioprocessintl.com/validation/beyond-installation-operational-and-performance-qualifications-a-risk-based-validation-framework-for-ai-driven-software-in-gxp-environments
