It did not arrive through a big project. A vendor update added an AI feature to your quality system. An analyst summarises deviations with Copilot. A department built an agent that sends emails. Nobody did anything wrong, but nobody checked whether a GMP document, record or decision now depends on a model that has not been assessed in its context of use.
Patero puts in place the governance that is missing: proportionate to risk, attached to your quality system, and designed so your teams keep using AI where it helps.
Your staff use ChatGPT or Copilot, and nobody knows exactly what for.
An AI feature appeared in validated software without going through change control.
Your AI policy covers emails and presentations, not batch records.
An assistant or an agent can read your GMP document sites.
You could not say, tomorrow morning, which AI uses touch your records.
The same assistant drafts an invitation in the morning and an investigation outline in the afternoon. Models drift, vendors swap them under the same name, and a changed prompt changes the output. Classifying the tool gets you nowhere. We classify each use by what the AI's output becomes.
AI helps with work that touches no GMP data or decision.
Email, presentation, research.
An approved tool and usage rules.
AI proposes, drafts or sorts. A qualified person checks against the source, decides and signs.
Draft investigation, change control summary, first draft of a URS.
Zone confirmed by QA, criteria signed before the trial, designed human review, change control.
AI decides, or writes into a GMP record, with no human in between.
Batch release, automatic entry into a batch record.
Out of scope, except as a separate full validation project decided by your AI committee.
The three zones are Patero's governance model, built on a risk-based reading of the texts below. They are not regulatory categories.
Every tool, at its subscription tier, and every real use, including those that arrived through an update.
Zone confirmed by QA, criteria signed before the trial, change control before go-live.
Admin settings recorded and dated. A feature switched on by default stays off until assessed.
A signature does not prove an error was caught. We check that your reviewers catch it.
Prompts for a recurring GMP use are versioned and tested. An agent recommends; it does not act alone.
Validation master plan, change control, supplier evaluation, training. No duplicate procedures. See our validation services.Keep approved uses under control as technology evolves.
A register of tools and uses, kept current.
A confirmed zone for every use, signed criteria, change control.
Tested human review, regular monitoring, a trail of every change.
Inventory of tools and uses, classification by zone.
Position, governance plan, roles, tool configuration.
The first two GMP uses brought on board through the method, net gain measured.
Risk-proportionate qualification of each use kept.
Monitoring, reassessment when the model or the prompt changes, regulatory watch.
We do not sell software. We work with the tools you already have: a platform gives you the system of record; we produce and maintain what goes in it — the boundaries, the risk, the evidence.
A Montréal team led by an engineer with 25 years in computerised system validation, working in English and French, in front of Health Canada, the FDA and European regulators.
and the GAMP® Guide: Artificial Intelligence
Artificial Intelligence — consultation draft
Computerised systems
and applicable FDA expectations
of Good AI Practice · ICH Q9(R1) · PIC/S PI 041
Our method is aligned with ISO/IEC 42001; Patero is not certified
Personal information and automated decisions
Start with the context of use. The right level of control follows from there.
In 30 minutes, we list the tools and uses in place with you, sort them into the three zones, and tell you which ones to bring under control first.
