AI in GxP: Governance to Operational Evidence | Key Insights

1.0. Introduction

An AI agent supports a deviation investigation. It retrieves procedures, reviews historical records, proposes a root cause, and drafts a CAPA. A qualified investigator reviews the recommendation, makes changes, and approves the final outcome.

Eight months later, an inspector asks a deceptively simple question,

What exactly did the AI see, what did it produce, what did the human change, and why was the final decision accepted?

Suddenly, the existence of an AI policy is not enough.

The harder question is whether the organization can reconstruct what actually happened.

That tension shaped the conversation between Evjatar (Evi) Cohen, and Nagesh Nama during xLM Continuous Intelligence’s LinkedIn Live discussion on AI in GxP. Rather than treating AI governance as another documentation exercise, the discussion pushed toward a more uncomfortable and practical question,

The answer begins with a shift in how we think about risk.

The event also generated strong organic engagement with 115 registrations, 236 video views and 1,669 minutes viewed.

What emerged from the conversation was not another AI governance checklist. It was a practical view of how organizations can move from AI policies and governance structures toward operational evidence, contextual risk management, continuous oversight, and human accountability.

2.0. AI Risk Is About Context, Not Labels

It is tempting to classify the problem simply, AI equals high risk. But that is not how risk actually works.

An AI assistant summarizing meeting notes is fundamentally different from an AI system recommending a quality decision. One may influence productivity; the other may influence a regulated outcome. Both use AI, but the consequences of their use are very different.

Evi’s point was that organizations should first understand the system itself, its potential impact on patients and the business, and how visible that risk is before considering what AI adds to the equation. In some cases, AI may actually reduce risk by improving consistency, identifying information, or supporting decisions.

This is where Context of Use (COU) becomes foundational. Context of Use simply means defining what the AI is intended to do, where it is being used, what decisions it influences, and what role it has in the overall process.

3.0. AI Adoption Is Already Happening, Assurance Must Catch Up

The industry is not waiting for every governance question to be resolved before experimenting with AI.

Evi described a landscape where major pharmaceutical organizations are already engaging with NVIDIA, Anthropic, OpenAI, Gemini, Claude, and Microsoft Copilot. At the same time, another large group remains uncertain about how to bring AI into the organization responsibly.

That divide matters because AI adoption is not one single phenomenon.

There is what Evi called “snackable AI” general-purpose productivity use where employees experiment with AI for everyday tasks. At the other end are sophisticated scientific applications supporting discovery. Between them sits the operational layer: clinical operations, regulatory activities, manufacturing, supply chain, distribution, and other processes where AI increasingly has the potential to influence GxP work.

The closer AI moves toward operational decision-making, the more important assurance becomes.

4.0. Qualifying AI Agents Like People in Roles

This may have been the most provocative idea in the conversation.

Traditional software behaves largely according to predefined logic. Agentic AI introduces something different: systems that can interpret goals, make decisions, retrieve information, interact with other systems, and potentially take actions.

Evi described the emerging approach as being closer to qualification than conventional validation. The analogy is surprisingly intuitive.

We do not “validate” a person. We qualify someone for a role. We define their responsibilities, access, expectations, boundaries, and performance, and we assess whether they can perform that role appropriately.

Agentic AI raises a similar question. The question is not whether the AI model works. It is whether the agent is authorized to perform this role, with these permissions, under these boundaries

The distinction matters because the same underlying capability could behave very differently depending on where it is deployed and what authority it has.

Evi pointed to the need to think about AI agents in terms of role, access, expected behavior, boundaries, and ongoing performance evaluation. The industry therefore faces a conceptual shift, instead of asking only whether the underlying technology has been assessed, organizations increasingly need to ask whether the agent performing the role remains appropriate for that role over time.

That is a fundamentally different assurance conversation.

5.0. AI Governance Needs an Operating Model, Not Just a Committee

The ownership question sounds straightforward until AI is embedded inside an enterprise application. Who owns it?

IT may own the application. Quality may own the regulated process. The business may own the outcome. AI capabilities may come from somewhere else entirely.

No single function can answer the question in isolation.

Evi’s recommendation was practical, start by understanding where AI already exists. Organizations need an inventory of systems with embedded AI, followed by regular cross-functional discussions involving Quality, IT, and the business. A steering committee can then provide ongoing oversight and ensure that AI use is periodically evaluated rather than approved once and forgotten.

AI governance cannot be a one-time approval event. It needs to become part of the ongoing operating rhythm of the organization. That operating rhythm becomes increasingly important as AI capabilities change.

What happens when an application introduces a new AI capability? What happens when the agent’s role expands? What happens when the process changes around it?

Governance has to move with those changes.

The objective is not to create another committee that slows decisions. It is to establish clear ownership for understanding where AI is being used, what it is doing, and whether its use remains appropriate.

6.0. The Human Dimension Preserving Judgment

The final piece is often overlooked.

AI can automate the repetitive work through which people traditionally developed expertise.

Evi offered a powerful example, today, experienced professionals know what a good protocol looks like because they have written protocols, reviewed them, challenged them, and learned from mistakes. But if AI eventually drafts most protocols, where will the next generation develop that judgment?

The same question applies to deviation investigations, quality assessments, and other regulated work. As AI takes over more routine work, organizations risk losing the practical expertise required to judge whether AI-generated work is actually good.

Automation should remove unnecessary drudgery, but not the apprenticeship that teaches people how to recognize quality.

Human oversight only works when humans remain capable of exercising meaningful judgment.

7.0. The Shift From Governance to Evidence

The conversation ultimately comes down to a simple test.

Take one AI use case inside your organization and examine it from beginning to end, define its intended use and context, assess the associated risks, establish appropriate controls, understand what the AI actually did, document the human review and final decision, preserve the supporting evidence, and continuously monitor the use case for changes.

Then ask the uncomfortable question, If an inspector asked us to reconstruct this decision six months from now, could we?

If the answer is uncertain, that is not necessarily a failure. It is a signal that the organization has found the next piece of its AI governance journey.

“The future of AI in GxP will not be determined by how many policies an organization publishes. It will be determined by whether the organization can demonstrate what happened when AI was actually used.”

That is the real shift: from governing AI in principle to demonstrating, through operational evidence, that AI remained within its intended role, under appropriate human judgment, as the organization and the technology continued to change.

8.0. Join Us for Our Next LinkedIn Live

The conversation continues with our next LinkedIn Live, where we'll explore how continuous temperature monitoring is moving beyond periodic mapping studies toward real-time environmental intelligence.

Beyond Temperature Mapping: Continuous Intelligence for GxP Environments

📅 Date: Thursday, 29 October, 2026.
🕤 Time: 12:00 PM – 01:00 PM EST.
🤝 Speakers: Nagesh Nama, CEO, xLM Continuous Intelligence.
Vaishnavi Kamat, AI-ML Lead Developer, xLM Continuous Intelligence.

What happens when temperature monitoring moves beyond periodic qualification studies and becomes a continuous source of environmental intelligence? In this LinkedIn Live conversation, we'll explore how life sciences organizations can use real-time data, IIoT sensors, analytics, and AI/ML to gain deeper visibility into temperature-controlled environments.

Together, we'll explore how continuous temperature mapping can extend traditional mapping beyond periodic snapshots, using real-time temperature data, trends, heat maps, and analytics to identify anomalies, recognize emerging patterns, and detect potential temperature risks earlier.

The discussion will also examine the practical challenges and opportunities around implementing continuous environmental intelligence in GxP environments, including data integrity, validation, monitoring, compliance, and inspection readiness. We'll also look at how continuous monitoring can reduce the cost and manual effort associated with traditional temperature mapping approaches.

During the session, we'll showcase the actual working of the cTM application, demonstrating how temperature data moves from sensors and continuous monitoring into analytics, anomaly insights, visualization, and temperature-mapping reports.

Join us to discover how continuous temperature intelligence can help organizations move beyond asking whether a space passed a mapping study to understanding whether it remains in control.