AI ASSURANCE · SPEQ SYNTHESIS

AI in GxP — the assurance hub

Regulated AI is a system to be assured, not a chatbot to bolt on. This hub brings together what SPEQ publishes on AI for GxP: the registry of AI system classes, the FDA/EMA principles that define quality AI, and a toolchain of deterministic assurance aids — every recommendation reproducible and explainable, because a validated assurance decision can’t rest on a model’s opinion of itself.

REGISTRY

AI System Registry →

The 9 AI system classes regulated firms deploy — copilots, agents, ML, vision, vendor AI — each framed for assurance: Context of Use, human oversight, risk tier, and the evidence it needs.

PRINCIPLES

Good AI Practice →

The 10 FDA (CDER/CBER) + EMA Guiding Principles of Good AI Practice in drug development, quoted verbatim and read through a GxP lens, with the “qualify quality AI” source shelf.

The AI-assurance toolchain

7 free, deterministic aids that walk an AI system from Context of Use to continuous monitoring. Each shows its method and is a scoping aid, not a validated assurance system.

CSA Assurance Strategy Workbench

Right-size the assurance a system needs from its process risk.

Turn per-dimension eval results into a deterministic release verdict.

OVERALL SCORE + PASS / CONDITIONAL / FAIL VERDICT AI Agent Configuration Readiness

Check whether an AI agent’s configuration is reconstructable and approvable.

RELEASE-READY / CONDITIONAL / NOT-APPROVED + MISSING ELEMENTS AI Change Impact Assessor

Decide the reassessment a change to an AI system requires.

REASSESSMENT LEVEL + EVAL-RERUN / EVIDENCE-STALE FLAGS AI Continuous Assurance Monitor

Turn monitoring signals into an assurance state and an action.

ASSURANCE STATE + BREACHES/WARNINGS + ACTION Evidence Health & Readiness Score

Score audit readiness from evidence status — missing never counts as compliant.

READINESS % + BAND + EVIDENCE GAPS Regulatory Change Impact Simulator

Trace a requirement change through a regulatory digital twin.

CONFIRMED VS POTENTIAL IMPACTED OBJECTS BY TYPE

How the assurance flow connects

Identify the system — Register it against a class in the AI System Registry, with its Context of Use.
Classify the risk — Decision consequence, model influence, data sensitivity, and change dynamics set the risk tier and the human-oversight floor.
Scope the assurance — The CSA workbench turns process risk into a verification method and the evidence it implies.
Evaluate it — Score the system against SPEQ’s benchmark; a critical-dimension failure blocks release — the model never grades itself.
Control change — A model, prompt, or tool change maps to a reassessment level; capability expansion needs human approval.
Monitor continuously — Live signals resolve to an assurance state; a safety- or policy-critical breach suspends the system.

Everything is connected — the dependency map

A regulatory requirement is never an island. This map is rendered live from SPEQ’s knowledge graph: the relationships shown are the graph’s own edges, and each object links to its canonical page — so a change here can be traced to everything it touches.

requirement · anchorEU GMP Annex 11 §12 — Security

→ is decoded by (1)

Data Integrity (ALCOA+)topic

→ is discharged by (3)

Give every user a unique, non-shared accountcontrol Provision access by authorised rolecontrol Review granted access periodicallycontrol

→ is exercised in (1)

Computerised System Validation (CSV)discipline

→ is harmonized with (3)

21 CFR 11.10(d) — Limiting system accessrequirement 21 CFR 11.10(g) — Authority checksrequirement 21 CFR 11.300 — Controls for identification codes and passwordsrequirement

→ is part of (1)

EU GMP Annex 11 — Computerised Systemsstandard

Rendered live from SPEQ’s knowledge graph — 9 connected objects across 5 relationship types. The links shown are the graph’s own relationships, not a hand-drawn diagram.