AI GxP Reference Library

AI GxP references for validation and quality governance.

This page organizes AI-related regulatory, standards, and industry references from the attached research update into a QA-focused reference library. It is intended to support pharmaceutical AI system validation, computerized system governance, data integrity assessment, regulatory submission planning, and quality-system oversight.

FDA

33 curated references in the attached research update.

EU / EMA

7 curated references in the attached research update.

Canada / MHRA

6 curated references in the attached research update.

Standards

7 curated references in the attached research update.

Total

66 curated references in the attached research update.

How to use this page

Use this page as a curated index for AI-enabled GxP systems. In a QA review, each reference should be assessed against the intended use, GxP impact, data lifecycle, predicate rule, system boundary, model lifecycle, and the specific decision or record supported by the AI system.

QA focus: AI does not remove the need for validated intended use, controlled requirements, documented testing, data-integrity controls, supplier assessment, procedural governance, change control, periodic review, and human accountability where required by the applicable GxP process.

33 references

Reference Source / Status GxP Area / Standard / Lifecycle QA Description and Validation Relevance
Computer Software Assurance for Production and Quality Management System Software U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding agency guidance
Guidance
2026-02-03
GMP manufacturing / quality systems
21 CFR Part 820 (QSR)
Development, Deployment, Maintenance
FDA final guidance offering a risk-based framework for computer software assurance (CSA) in production and quality management systems. It describes steps to identify intended use, determine appropriate assurance activities based on risk, and generate objective evidence to meet regulatory requirements

GxP validation relevance: Provides non-binding recommendations for validating automation software used in manufacturing and quality systems; emphasises focusing assurance activities on high-risk functions and reducing unnecessary testing.

Key controls: Risk-based assurance, objective evidence, documentation of intended use, scaled testing based on impact and risk.
Artificial Intelligence and Machine Learning in Drug Development U.S. Food and Drug Administration
United States
Regulator program / policy resource
Policy resource
2025-03-25
Drug development / regulatory submissions
Not specified (guidance refers to draft regulatory approach).
Development, Regulatory submission
FDA CDER page notes increasing use of AI/ML across the drug lifecycle. It references a January 2025 draft guidance on using AI to support regulatory decision-making and outlines FDA initiatives to provide transparent frameworks for safe and effective use of AI in drug development

GxP validation relevance: Highlights FDA’s recognition of AI’s role in drug development and points sponsors to draft guidances and programs addressing AI model credibility, risk assessment, and regulatory submission expectations.

Key controls: Risk-based credibility assessment for AI models, transparency and explainability, adherence to draft guidance for AI in regulatory decision-making.
Using Artificial Intelligence and Machine Learning to Support Regulatory Decision-Making for Drug and Biological Products U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding agency guidance
Draft guidance
2025-01-16
Drug development / regulatory submissions
Not specified (draft guidance).
Development, Submission
Draft guidance provides recommendations on using AI-generated data or models to support regulatory decision‑making for drugs and biological products. It outlines a risk‑based credibility assessment framework with steps such as defining the question of interest, context of use, assessing model risk, and evaluating credibility evidence

GxP validation relevance: Establishes expectations for sponsors who use AI to generate evidence supporting submissions, ensuring AI models are credible, transparent, and appropriate for regulatory decisions.

Key controls: Risk-based credibility assessment, documentation of model development and validation, defined context of use, transparency of data sources, performance metrics.
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning-Enabled Device Software Functions U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding agency guidance
Guidance
2025-08-30
Medical devices (SaMD / AIaMD)
PCCP concept under 21 CFR 820 and device premarket pathways
Development, Deployment, Post-market
Final guidance details how manufacturers should develop a Predetermined Change Control Plan (PCCP) for AI-enabled device software. It supports iterative improvement by describing planned modifications, methodologies for development and validation, and impact assessments within marketing submissions to ensure safety and effectiveness

GxP validation relevance: Informs manufacturers how to seek regulatory pre-approval for future AI model updates without resubmitting a new application, aligning AI software changes with risk management and lifecycle control.

Key controls: Define scope of changes, risk-based impact assessment, validation of modifications, performance monitoring.
Artificial Intelligence/Machine Learning Software as a Medical Device Action Plan U.S. Food and Drug Administration
United States
Regulator program / policy resource
Action plan
2021-01-12
Medical devices
Not specified (policy plan)
All lifecycle phases
The AI/ML SaMD Action Plan outlines a five-part strategy: update the regulatory framework via draft PCCP guidance, harmonise Good Machine Learning Practice principles, support transparency for AI-enabled devices, advance regulatory science methodologies including bias mitigation, and pilot real-world performance evaluation

GxP validation relevance: Provides context for FDA’s evolving regulatory approach to AI-enabled medical devices and frames future guidance and policies.

Key controls: Development of PCCP, harmonisation of GMLP, transparency initiatives, regulatory science research, real-world performance pilots.
Transparency for Machine Learning-Enabled Medical Devices: Guiding Principles U.S. Food and Drug Administration
International
International harmonization
Guiding principles
2023-06-00
Medical devices, Clinical decision support
Not applicable (guiding principles)
All lifecycle phases
The guiding principles define transparency as communicating information about intended use, development, performance and logic (explainability) of ML-enabled devices to stakeholders. They outline who needs information, why, what to communicate, where and when to provide it, and how to present it effectively. Transparency supports patient-centred care, identification of biases and performance degradation, and fosters trust

GxP validation relevance: Provides high-level guidance for developers and regulators on communicating AI model information to users, supporting safe and effective human-AI interaction.

Key controls: Human-centred design, disclosure of intended use, training and test data characteristics, performance metrics, risks and limitations, appropriate communication media.
Part 11, Electronic Records; Electronic Signatures — Scope and Application U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding agency guidance
Guidance
2003-08-00
GMP manufacturing, Clinical trials, Pharmacovigilance
21 CFR Part 11
All lifecycle phases
This guidance clarifies the scope and application of 21 CFR Part 11. FDA explains that it will interpret Part 11 narrowly and exercise enforcement discretion while re-examining the regulation. Part 11 applies to electronic records used to satisfy predicate rule requirements, but FDA will not enforce validation, audit trail, and record retention requirements of Part 11 for some records during this re-examination Underlying predicate rules still apply

GxP validation relevance: Establishes expectations for electronic records and signatures in GxP environments, impacting validation of AI systems that generate or manage regulated records.

Key controls: Ensure compliance with predicate rules, narrow interpretation of Part 11, risk-based enforcement discretion, continued adherence to underlying GMP/GCP regulations.
MFDS Korea: Revised Regulations on Classification and Designation of Digital Medical Products Ministry of Food and Drug Safety (MFDS)
South Korea
Trade / legal / consulting article
Trade article
2026-05-12
Medical devices and digital health products
Korea Digital Medical Products Act (DMPA)
All lifecycle phases
This article summarises the 2026 revision of Korea’s Regulations on Classification and Designation of Digital Medical Products (Notice 2026‑4). It notes that the Digital Medical Products Act (DMPA) entered its second phase on January 24 2026. Key changes include new labelling requirements, expanded definitions, formal recognition of digital health support products, clearer exclusion criteria for wellness technologies, improved treatment of hybrid products, and reinforcement that clinical purpose and risk profile determine regulatory status The revision allows pre‑approved change management plans for AI models, similar to PCCPs, and introduces digital quality management systems and cybersecurity obligations

GxP validation relevance: Provides industry perspective on Korea’s evolving digital medical product regulations, highlighting classification, AI change management plans, digital QMS, and cybersecurity obligations.

Key controls: Classification based on intended use and risk, digital quality management system requirements, pre-approved AI change management plans, cybersecurity obligations and software bill of materials.
Good Machine Learning Practice for Medical Device Development: Guiding Principles U.S. Food and Drug Administration
International
International harmonization
Guiding principles summary
2025-01-17
Medical devices
IMDRF GMLP
All lifecycle phases
FDA’s Good Machine Learning Practice (GMLP) page summarises the IMDRF final document identifying 10 guiding principles to support development of safe, effective and high‑quality AI/ML medical devices. It emphasises a risk‑based total product lifecycle approach and international harmonisation across regulators

GxP validation relevance: Provides a succinct overview of global consensus principles for AI medical devices, highlighting the importance of harmonised practices in design, development, validation and post-market monitoring.

Key controls: Ten GMLP principles including data quality, transparency, human oversight, risk management, performance monitoring, and lifecycle management.
Draft Guidance on Artificial Intelligence and Machine Learning-enabled Device Software Functions U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding agency guidance
Draft guidance summary
2025-01-06
Medical devices
FDA Device Regulations
Development, Submission
This draft guidance proposes lifecycle and marketing submission recommendations for AI-enabled device software functions. It outlines risk management considerations across the total product lifecycle and design and development issues that manufacturers should consider when preparing marketing submissions

GxP validation relevance: Provides early insights into FDA’s regulatory expectations for AI-enabled devices before the final guidance was issued.

Key controls: Risk-based lifecycle considerations, design documentation, submission requirements, performance monitoring.
HSA and Korea MFDS Guiding Principles for Clinical Trials of Machine Learning-enabled Medical Devices Health Sciences Authority (HSA) & Ministry of Food and Drug Safety (MFDS)
Singapore and South Korea
Regulatory guidance / non-binding agency guidance
Guidance announcement
2023-11-00
Clinical trials / GCP
HSA–MFDS Guiding Principles
Clinical evaluation
The HSA digital health page notes that HSA collaborates with Korea’s MFDS to release guiding principles for clinical trials of machine learning‑enabled medical devices, emphasising alignment of regulatory requirements and support for evidence generation

GxP validation relevance: Shows international collaboration to standardise regulatory expectations for clinical trials of AI medical devices, improving global harmonisation.

Key controls: Guiding principles for design and conduct of clinical trials for ML-enabled devices, cross-agency collaboration, evidence generation requirements.
Medical Devices; Quality System Regulation Amendments (QMSR Final Rule) U.S. Food and Drug Administration
United States
Regulatory law / final rule
Final rule
2024-02-02
GMP manufacturing / quality systems
21 CFR Part 820 (QMSR); ISO 13485:2016
Development; Manufacturing; Post-market
This final rule amends the device CGMP requirements in 21 CFR part 820 by incorporating ISO 13485:2016 and aligning it with FDA-specific provisions. It adds definitions and clarifications to avoid inconsistencies, harmonizes U.S. quality management system requirements with international standards, and reduces duplicative regulatory burdens. The rule emphasises global harmonization, risk-based QMS, and improved patient access. It becomes effective February 2 2026

GxP validation relevance: Provides legally binding requirements for medical device manufacturers’ quality management systems, forming the foundation for validating AI-enabled devices and ensuring their manufacture complies with international standards.

Key controls: Risk-based quality management system incorporating ISO 13485, control of records and complaint files, design and development documentation, harmonization with international standards.
Medical Devices; Quality Management System Regulation Technical Amendments U.S. Food and Drug Administration
United States
Regulatory law / final rule
Technical amendment
2025-12-04
GMP manufacturing / quality systems
21 CFR Part 820 (QMSR) and related parts
Regulatory compliance update
Technical amendments update 179 sections across 18 parts of the CFR to replace references to the Quality System Regulation with references to the Quality Management System Regulation, effective February 2 2026. They modify exemption provisions, design control references, and authority citations to ensure consistency, clarify terminology, and correct typographical errors. The amendments are non‑substantive and do not impose new regulatory requirements

GxP validation relevance: Ensures that all FDA regulations consistently reference the new QMSR, which is essential for medical device manufacturers implementing AI-enabled systems to maintain compliant quality records and design controls.

Key controls: Updates references to §820.35 (Control of Records), design control provisions, and authority citations; clarifies that amendments are editorial and non-substantive.
General Wellness: Policy for Low Risk Devices U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding agency guidance
Guidance
2026-01-06
Digital health / non‑GxP (wellness)
Section 3060 of 21st Century Cures Act; 21 CFR Part 820 (QMSR) not applied
Development; regulatory determination
This guidance clarifies the FDA’s compliance policy for low‑risk general wellness products that promote a healthy lifestyle. It notes that Section 3060 of the 21st Century Cures Act excludes software intended solely for maintaining or encouraging a healthy lifestyle from the device definition and states that CDRH does not intend to examine or enforce device regulations for such low‑risk products. General wellness products must be intended only for general wellness use and present a low risk to users; examples include exercise equipment, audio/video programs, and wellness apps. The guidance lists types of acceptable claims (weight management, fitness, relaxation, mental acuity, self‑esteem, sleep management, sexual function)

GxP validation relevance: Helps developers of AI‑enabled wellness applications determine whether their products qualify for enforcement discretion, reducing unnecessary validation burdens and focusing GxP efforts on higher‑risk medical devices.

Key controls: Defines criteria for exclusion from device regulation; clarifies enforcement discretion for general wellness products; emphasises that such products do not need premarket authorization or QMSR compliance if they meet the criteria.
Clinical Decision Support Software – Guidance for Industry and FDA Staff U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding agency guidance
Guidance
2026-01-29
Clinical decision support / digital health
Section 520(o)(1)(E) of the FD&C Act; 21 CFR Part 820 (QMSR) if classified as device
Development; classification; premarket
This guidance clarifies the types of clinical decision support (CDS) software functions that are not regulated as medical devices. To be considered non‑device CDS, a software function must meet four criteria: it cannot acquire, process, or analyze medical images or signals; it is intended to display, analyze, or print medical information; it supports or provides recommendations to a health care professional about prevention, diagnosis or treatment; and it provides sufficient information for the professional to independently review the basis for recommendations. If any criterion is not met, the software is considered a device. The guidance provides examples of non‑device CDS and device CDS functions

GxP validation relevance: Informs developers of AI/ML‑enabled clinical decision support tools about regulatory scope and classification, helping them determine whether their software falls under device regulation and requires formal validation.

Key controls: Ensure that CDS software avoids processing medical images or IVD signals, provides transparent rationale to clinicians, and allows independent review; if regulated as a device, follow QMSR and premarket requirements.
Technology-Enabled Meaningful Patient Outcomes (TEMPO) for Digital Health Devices Pilot U.S. Food and Drug Administration
United States
Notice / pilot program
Notice
2025-12-08
Digital health / post‑market & clinical use
21 CFR part 812; 21 CFR parts 50 & 56; FD&C Act
Real‑world evidence; pilot; premarket; post‑market
FDA’s Center for Devices and Radiological Health, in partnership with CMS’s CMMI ACCESS model, announced the TEMPO pilot to promote access to digital health devices while safeguarding patient safety. Beginning January 2 2026, manufacturers can submit statements of interest to participate. The pilot tests a payment option tied to patient outcomes and allows selected device manufacturers to request enforcement discretion from certain premarket and investigational requirements. Participants must collect real‑world data and work towards marketing authorization. The pilot targets devices intended to improve outcomes in four clinical use areas and limits participation to about ten manufacturers per area

GxP validation relevance: Offers AI‑enabled digital health device manufacturers a pathway to deploy products in clinical practice while collecting real‑world evidence under regulatory oversight; provides insight into post‑market monitoring and enforcement discretion.

Key controls: Collect and share real‑world data, meet patient safety criteria, request regulatory enforcement discretion, focus on specific clinical use areas, maintain records similar to IDE documentation.
Quality Management System Regulation – Frequently Asked Questions U.S. Food and Drug Administration
United States
Regulatory guidance / FAQ
FAQ
2026-02-02
GMP manufacturing / quality systems
21 CFR Part 820 (QMSR); ISO 13485:2016
Manufacturing; inspection; compliance
This FAQ page explains that the FDA’s final rule issued January 31 2024 incorporates ISO 13485:2016 into 21 CFR part 820 and renames the regulation to the Quality Management System Regulation (QMSR). It clarifies that the QMSR aligns U.S. device QMS requirements with international standards, promotes consistency, and provides safe, effective, high‑quality devices. The QMSR became effective February 2 2026, replacing the Quality System Regulation. The FAQ notes that FDA is updating inspection processes, training staff, and engaging stakeholders. It highlights that under the QMSR, FDA may review management review, quality audits, and supplier audit reports that were previously exempt, and that a new inspection program replaces the Quality System Inspection Technique

GxP validation relevance: Provides additional guidance to device manufacturers on implementing the QMSR, preparing for inspections, and understanding new requirements, which is crucial for validating AI‑enabled devices under the updated quality management framework.

Key controls: Highlights adoption of ISO 13485, clarifies QMSR implementation and inspection processes, emphasises management review and audit record availability, encourages comparative analysis of existing records to meet QMSR requirements.
Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding
Guidance
2026-02-03
GMP manufacturing / quality systems; design & development; post‑market
21 CFR Part 820 (QMSR); FD&C Act Section 524B; FDA cybersecurity guidance
Design; development; verification; validation; post‑market
This final guidance recognises that increasing network connectivity, portable media and information exchange heighten cybersecurity risks for medical devices. Past cyber incidents (e.g., WannaCry, URGENT/11 and SweynTooth vulnerabilities) have disrupted hospital operations and highlighted the potential for patient harm; therefore, robust cybersecurity controls are essential to ensure device safety and effectiveness The guidance applies to all devices containing software or firmware, including those without network capabilities, and covers all premarket submission types (510(k), De Novo, PMA, IDE, HDE, PDP, BLA and IND) as well as devices that do not require premarket review It emphasises a total product lifecycle approach, shared responsibility among manufacturers, healthcare facilities and users, adoption of a secure product development framework, and continuous risk management to mitigate vulnerabilities

GxP validation relevance: Provides essential cybersecurity requirements for AI‑enabled medical devices, ensuring secure design, risk management and documentation across the quality management system and premarket submissions.

Key controls: Requires threat modelling, vulnerability assessments, security architecture design, software bill of materials (SBOM), patch and vulnerability management plans, incident response procedures, and postmarket monitoring to be documented in premarket submissions and integrated into the QMS.
Digital Medical Products Act and Subordinate Regulations for AI and Software-Based Devices (South Korea) Ministry of Food and Drug Safety (MFDS) – Presentation at IMDRF
South Korea
Regulatory presentation / guidance
Presentation
2025-09-00
R&D; clinical trials; manufacturing; post‑market
Digital Medical Products Act; ISO 13485; IEC 62304; IMDRF guidelines
Development; clinical investigation; manufacturing; post‑market
A presentation by South Korea’s MFDS summarises the Digital Medical Products Act (DMPA) and its subordinate regulations for AI‑ and software‑based devices. Six subordinate regulations are highlighted: (1) classification and designation of digital medical products; (2) approval, certification and notification processes that introduce software usability evaluation, Predetermined Change Control Plans (PCCP), exemptions for certain clinical decision support systems and enhanced AI‑specific labelling and evaluation frameworks for digital health technologies combined with pharmaceuticals; (3) Good Manufacturing Practice requirements based on ISO 13485 and IEC 62304 that incorporate AI‑specific controls; (4) regulations for protocol approval and conduct of clinical trials, enabling simplified data‑driven and decentralised trials; (5) a cybersecurity regulation covering the AI/software lifecycle aligned with IMDRF guidelines; and (6) special provisions establishing certification criteria for excellent governance systems and a conditional ‘use first, evaluate later’ regulatory sandbox The presentation notes that overlapping requirements between the DMPA and the Korean AI Act are deemed fulfilled when compliance with the DMPA is demonstrated

GxP validation relevance: Informs AI‑enabled medical device developers about South Korea’s comprehensive regulatory framework, covering classification, approval, PCCPs, QMS, clinical trials, cybersecurity and sandbox provisions, which are critical for AI validation and post‑market controls.

Key controls: Requires risk‑based classification and designation of digital medical products; mandates software usability evaluations and PCCPs; introduces AI‑specific labelling and transparency; requires QMS compliant with ISO 13485/IEC 62304; simplifies clinical trial protocols and allows use of real‑world evidence; mandates cybersecurity controls across the lifecycle; offers conditional approval pathways via a regulatory sandbox.
Considerations for the Development of Chimeric Antigen Receptor (CAR) T Cell Products U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding
Guidance
2024-01-00
GMP manufacturing; CMC; clinical trials (GCP)
21 CFR 312.23
Design & development; manufacturing; clinical investigation
This final FDA guidance clarifies that chimeric antigen receptor (CAR) T cell products are human gene therapy products where T cell specificity is genetically modified to recognize a desired antigen. It provides CAR T‑specific recommendations on chemistry, manufacturing and control (CMC), pharmacology/toxicology and clinical study design. The guidance also covers analytical comparability studies and notes that many recommendations apply to other genetically modified lymphocyte products such as CAR NK cells and T cell receptor‑modified T cells Sponsors are encouraged to communicate with CBER’s Office of Tissues and Advanced Therapies (OTAT) to discuss product‑specific considerations before submitting an IND

GxP validation relevance: Although not specific to AI, this guidance outlines regulatory expectations for development of genetically modified cell therapies like CAR T products. It highlights critical quality and clinical considerations that may interact with computational tools and data analysis in product design, manufacturing, and trial management, ensuring such tools align with GxP and regulatory standards.

Key controls: Provides detailed CMC and manufacturing control recommendations, pharmacology/toxicology requirements, clinical study design considerations, analytical comparability studies, and encourages early engagement with regulators to address product‑specific issues
Human Gene Therapy Products Incorporating Human Genome Editing; Guidance for Industry U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding
Guidance
2024-01-00
GMP manufacturing; clinical trials (GCP); research & development
21 CFR 312.23
Design & development; manufacturing; clinical investigation
This final FDA guidance provides recommendations to sponsors developing human gene therapy products incorporating genome editing. It advises on the information that should be included in an Investigational New Drug (IND) application to assess the safety and quality of investigational genome editing products, including product design, manufacturing and testing, nonclinical safety assessment and clinical trial design The guidance aims to help sponsors address potential off‑target effects and ensure that genome editing therapies meet regulatory standards.

GxP validation relevance: Relevant because CRISPR and other genome‑editing therapies rely on complex design, manufacturing and data‑analysis processes. Understanding regulatory expectations ensures that digital tools and AI‑driven workflows used in genome editing research, manufacturing and clinical development comply with GxP quality and traceability requirements.

Key controls: Recommends comprehensive documentation of genome editing product design and manufacturing processes, testing protocols, nonclinical safety studies and clinical trial design; emphasises risk management for off‑target effects and encourages early communication with FDA
Chemistry, Manufacturing, and Controls Flexibilities for Developing Human Cellular and Gene Therapy Products for a Biologics License Application; Guidance for Industry U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding
Guidance
2026-05-05
GMP manufacturing; CMC; quality systems
21 CFR Part 601
Manufacturing; BLA submission
This FDA guidance describes how the agency applies flexibility to chemistry, manufacturing and controls (CMC) requirements for human cellular and gene therapy products being developed for Biologics License Applications (BLAs). It explains that FDA uses a flexible approach to ensuring CMC requirements are met while expediting development and patient access to safe and effective CGT products for serious or life‑threatening conditions The guidance clarifies when CMC flexibilities may be appropriate, directs sponsors to consider this guidance alongside other CMC recommendations, and notes that it does not comprehensively address all CMC information required for licensure

GxP validation relevance: Important for developers of gene and cell therapies implementing advanced manufacturing technologies or computational tools. It highlights regulatory flexibility while maintaining compliance, ensuring that digital or AI‑supported manufacturing controls align with GxP and quality requirements.

Key controls: Encourages risk‑based, flexible CMC strategies for gene therapy products; emphasises documentation of manufacturing processes, quality controls, comparability studies and alignment with other CMC guidance
Safety Assessment of Genome Editing in Human Gene Therapy Products Using Next-Generation Sequencing; Draft Guidance for Industry U.S. Food and Drug Administration
United States
Regulatory guidance / non-binding (draft)
Draft guidance
2026-04-14
Preclinical studies; safety evaluation (GLP)
Not specified
Nonclinical development; preclinical safety evaluation
This draft FDA guidance provides recommendations on using next‑generation sequencing (NGS) methods in nonclinical studies to support initiation of clinical trials for investigational human genome editing products. The recommendations supplement the January 2024 guidance on genome editing gene therapy products and emphasise that development programs should address both gene therapy product risks and additional risks associated with genome editing, such as off‑target editing and unintended genomic changes The guidance aims to guide design of nonclinical studies using NGS and bioinformatics to evaluate potential safety risks for Investigational New Drug (IND) and Biologics License Applications

GxP validation relevance: Relevant for CRISPR and other genome editing therapies because it outlines regulatory expectations for evaluating off‑target editing and genomic integrity using NGS and computational analyses. Compliance with these recommendations supports safe and effective development of genome editing therapies and ensures data integrity in GxP preclinical studies.

Key controls: Recommends designing nonclinical studies that use NGS and bioinformatics to evaluate off‑target editing, chromosomal integrity and genome integrity; emphasises addressing genome editing‑specific risks alongside standard gene therapy product risks and integrating these assessments into IND and BLA submissions
Considerations for the use of the Plausible Mechanism Framework to Develop Individualized Therapies that Target Specific Genetic Conditions with Known Biological Cause; Draft Guidance U.S. Food and Drug Administration
United States
Regulatory guidance / non‑binding (draft)
Draft guidance
2026-02-25
Clinical development; regulatory submission
Not specified
Development and submission
Draft FDA guidance introducing a ‘plausible mechanism’ framework for individualized therapies targeting specific genetic conditions. The document explains that sponsors may justify effectiveness and safety by showing a scientifically plausible mechanism linking a genetic abnormality to disease and demonstrating that the therapy addresses that mechanism. It emphasises generating substantial evidence of effectiveness through well‑characterized natural history data, one well‑controlled clinical investigation, confirmatory evidence, and robust chemistry, manufacturing and controls (CMC) data. The guidance clarifies that nonclinical, clinical and CMC data must collectively demonstrate that the individualized therapy is safe, effective and can be manufactured to regulatory standards

GxP validation relevance: Although not specific to AI/ML, the guidance is relevant to gene therapy and biologics developers because it provides a regulatory pathway for bespoke treatments (which may include CRISPR‑edited or CAR T‑based products). Understanding how to generate evidence using a plausible mechanism framework can inform validation strategies and data requirements for highly personalised gene or cell therapies.

Key controls: Recommend documenting the biological plausibility linking genotype to disease, using well‑characterized natural history datasets, designing at least one well‑controlled study with confirmatory evidence, and ensuring CMC processes can reliably produce high‑quality individualized therapies
Expedited Programs for Regenerative Medicine Therapies for Serious Conditions; Draft Guidance for Industry U.S. Food and Drug Administration
United States
Regulatory guidance / non‑binding (draft)
Draft guidance
2025-09-25
Clinical development; regulatory submission
Section 506(g) of the FD&C Act
Development and submission
This draft guidance describes FDA programs that expedite development and review of regenerative medicine therapies for serious or life‑threatening conditions. It explains that under section 506(g) of the FD&C Act, products that meet certain criteria can receive a Regenerative Medicine Advanced Therapy (RMAT) designation. The guidance outlines how RMAT designation enables sponsors to access accelerated approval pathways, discusses eligibility criteria, and describes the range of expedited programs (fast track, breakthrough therapy and priority review) available for regenerative medicine products. It also provides considerations for clinical development and opportunities for sponsors to interact with CBER review staff

GxP validation relevance: Relevant to developers of gene and cell therapies because it clarifies how products such as CAR T cells, gene therapies or tissue‑engineered products can obtain expedited review and accelerated approval. Knowing the RMAT criteria and available programs helps sponsors plan regulatory strategies and align evidence generation with accelerated pathways.

Key controls: Identify whether a product qualifies for RMAT designation, engage early with CBER, design clinical programs that meet accelerated approval requirements, and document safety and efficacy to support conditional or accelerated approval
Postapproval Methods to Capture Safety and Efficacy Data for Cell and Gene Therapy Products; Draft Guidance for Industry U.S. Food and Drug Administration
United States
Regulatory guidance / non‑binding (draft)
Draft guidance
2025-11-04
Post‑market surveillance
Not specified
Post‑market (pharmacovigilance)
FDA draft guidance discussing methods to capture postapproval safety and efficacy data for cell and gene therapy (CGT) products. Because CGT products often have durable effects and are studied in small clinical trials, long‑term follow‑up and real‑world evidence are critical. The guidance recommends approaches to monitor safety and effectiveness after approval, including patient registries, observational studies, and active surveillance systems. It clarifies that the guidance does not address data collection for expanding clinical indications

GxP validation relevance: Important for validation professionals because it highlights regulatory expectations for post‑market monitoring of CGT products. Sponsors developing gene editing therapies or CAR T products must plan long‑term safety and efficacy surveillance, integrate real‑world data collection, and maintain data quality in compliance with GxP.

Key controls: Implement robust post‑approval monitoring plans using registries and observational studies; ensure data collection methods capture long‑term safety and effectiveness; use risk‑based approaches to determine duration and intensity of follow‑up
Innovative Designs for Clinical Trials of Cellular and Gene Therapy Products in Small Populations; Draft Guidance for Industry U.S. Food and Drug Administration
United States
Regulatory guidance / non‑binding (draft)
Draft guidance
2025-09-25
Clinical development; trial design
Not specified
Clinical trials (GCP)
This draft guidance provides recommendations for designing clinical trials of cell and gene therapy products intended to treat rare diseases or conditions affecting small populations. It advises sponsors on selecting appropriate trial designs (e.g., adaptive or Bayesian designs), choosing meaningful endpoints, and using innovative statistical methods to generate evidence of safety and effectiveness when traditional randomized trials are not feasible. The guidance emphasises early engagement with FDA and encourages sponsors to consider patient‑centric approaches to trial design

GxP validation relevance: Relevant for gene therapy and CAR T developers working on rare diseases, as it outlines regulatory expectations for innovative trial designs that maximise data from limited patient populations. These designs may incorporate real‑world evidence and adaptive elements, which influence data quality and validation strategies.

Key controls: Use adaptive trial designs, select clinically meaningful endpoints, engage early with FDA to discuss statistical methods, and ensure data integrity when using innovative designs
Frequently Asked Questions — Developing Potential Cellular and Gene Therapy Products; Draft Guidance U.S. Food and Drug Administration
United States
Regulatory guidance / non‑binding (draft)
Draft guidance
2024-11-21
Product development; regulatory strategy
Not specified
Development and submission
This draft guidance compiles answers to frequently asked questions (FAQs) about developing potential cellular and gene therapy (CGT) products. It addresses common regulatory, CMC, pharmacology/toxicology, clinical and clinical pharmacology issues faced by sponsors. The guidance is intended to facilitate development of safe, effective and high‑quality CGT products by clarifying the FDA’s expectations across multiple disciplines and pointing sponsors to relevant regulations and guidances

GxP validation relevance: Although not AI‑specific, the FAQ consolidates regulatory advice for CGT development, helping sponsors navigate complex requirements and improve GxP compliance. It is relevant for gene therapy and CAR T programmes using novel technologies such as CRISPR or viral vectors.

Key controls: Consult the FAQ to understand FDA expectations across CMC, nonclinical and clinical disciplines; ensure cross‑functional teams align processes with regulatory recommendations and maintain thorough documentation
Safety Testing of Human Allogeneic Cells Expanded for Use in Cell‑Based Medical Products; Draft Guidance U.S. Food and Drug Administration
United States
Regulatory guidance / non‑binding (draft)
Draft guidance
2024-05-15
Preclinical development; manufacturing
Gene Therapy CMC guidance (Jan 2020)
Development and submission
Draft guidance offering recommendations for safety testing of human allogeneic cells expanded in culture for use in cell‑based medical products. The FDA advises sponsors to perform a risk analysis when designing safety testing, considering the expansion potential of the cells, reagents used in culture and the number of patients the product may treat. Appropriate cell safety testing supports Investigational New Drug (IND) and Biologics License Application (BLA) submissions. The guidance complements existing CMC guidances for gene therapy and somatic cell therapy products

GxP validation relevance: Important for manufacturers of allogeneic cell therapies and gene therapy products because it outlines risk‑based testing strategies to ensure cell safety, identity and purity, which are critical for GxP compliance and product quality.

Key controls: Develop risk‑based cell safety testing strategies considering expansion potential and culture reagents; implement assays to detect contaminants; document testing procedures in IND/BLA submissions
Considerations for the Use of Human‑ and Animal‑Derived Materials in the Manufacture of Cell and Gene Therapy and Tissue‑Engineered Medical Products; Draft Guidance U.S. Food and Drug Administration
United States
Regulatory guidance / non‑binding (draft)
Draft guidance
2024-05-15
Manufacturing; CMC
CMC guidance for gene therapy and cell therapy products (Jan 2020)
Development and submission
FDA draft guidance advising manufacturers on using human‑ and animal‑derived materials in the manufacture of cell and gene therapy products and tissue‑engineered medical products. It highlights risks such as transmission of adventitious agents, lot‑to‑lot variability and material identity. The guidance provides recommendations to ensure the safety, quality and identity of materials of human or animal origin, including material qualification, supplier controls and testing. It also outlines the CMC information that should be included in IND submissions related to the use of these materials The guidance supplements existing CMC guidances for gene and cell therapy products

GxP validation relevance: Relevant to gene therapy and CAR T developers because controlling source materials is crucial for product safety and consistency. The guidance supports GxP compliance by detailing quality system considerations for procuring and qualifying human or animal‑derived materials.

Key controls: Establish robust material qualification processes, implement supplier controls, perform testing to detect adventitious agents, and provide detailed CMC documentation in regulatory submissions
Potency Assurance for Cellular and Gene Therapy Products; Draft Guidance U.S. Food and Drug Administration
United States
Regulatory guidance / non‑binding (draft)
Draft guidance
2023-12-28
Manufacturing; quality control
Not specified
Development and manufacturing
Draft guidance outlining recommendations for developing a science‑ and risk‑based strategy to assure the potency of cellular and gene therapy (CGT) products. The guidance defines a potency assurance strategy as a multifaceted approach incorporating manufacturing process design, process control, material control, in‑process testing and potency lot release assays. It emphasises that the goal of potency assurance is to ensure each released lot has the specific ability to achieve the intended therapeutic effect and highlights the need for assays and controls to mitigate potency risks

GxP validation relevance: Potency assurance is critical for gene therapies and CAR T products because it directly affects product efficacy and patient outcomes. The guidance provides a regulatory framework for designing potency assays and controls, which supports GxP manufacturing and validation.

Key controls: Develop a potency assurance strategy integrating process design, material controls, in‑process testing and lot release assays; use risk‑based assessments to identify critical quality attributes and ensure each lot meets potency criteria
Flexible Requirements for Cell and Gene Therapies to Advance Innovation U.S. Food and Drug Administration
United States
Regulatory policy resource / program
Policy resource
2026-01-11
Development; manufacturing; regulatory submission
21 CFR 210 and 211
Clinical development and submission
FDA policy statement describing a more flexible approach to chemistry, manufacturing and control (CMC) requirements for cell and gene therapies (CGT). Announced January 11 2026, the policy notes that the agency’s flexibility helps expedite development and will guide evaluations for Biologics License Applications. Key flexibilities include: not requiring compliance with 21 CFR part 211 before investigational products are manufactured for phase 2 or 3 trials; permitting permissive product quality release criteria during early investigational studies; allowing minor manufacturing changes with comparability data; offering flexibility in commercial release specifications for CGT products due to small patient populations; and enabling concurrent process validation and fewer process performance qualification (PPQ) lots The policy encourages sponsors to consult with FDA review divisions and recognises the rapid pace of scientific advancement.

GxP validation relevance: While not AI‑specific, this policy resource informs developers of gene therapy and CAR T products that regulatory flexibility is available in CMC requirements. Understanding these flexibilities can accelerate development timelines and influence validation strategies, including how data are generated and reported.

Key controls: Plan CMC strategies that leverage FDA’s flexible requirements: defer full compliance with part 211 until later phases; set provisional release criteria for early clinical trials; justify minor manufacturing changes with comparability data; and discuss process validation plans with FDA reviewers
FDA Approves First Gene Therapies to Treat Patients with Sickle Cell Disease (Casgevy & Lyfgenia) U.S. Food and Drug Administration
United States
Regulatory announcement / press release
Press announcement
2023-12-08
Regulatory approval; post‑market surveillance
Not specified
Approval and post‑market
FDA press release announcing approval of two gene therapies, Casgevy and Lyfgenia, for the treatment of sickle cell disease in patients aged 12 years and older. Casgevy uses CRISPR/Cas9 genome editing to modify patients’ hematopoietic stem cells, making it the first FDA‑approved therapy that employs CRISPR gene editing technology. The modified cells engraft in bone marrow and increase fetal hemoglobin production, preventing sickling of red blood cells. Lyfgenia uses a lentiviral vector to modify stem cells to produce HbA^{T87Q}, a gene‑therapy derived hemoglobin, reducing sickling and occlusion. Both therapies involve one‑time infusion after myeloablative conditioning and will require long‑term follow‑up studies The press release highlights the significance of these approvals and notes that both products received Priority Review, Orphan Drug and Regenerative Medicine Advanced Therapy designations

GxP validation relevance: This milestone regulatory approval is notable for GxP practitioners because it demonstrates successful regulatory evaluation of gene therapies using genome editing and viral vectors. It underscores the need for robust CMC, safety and efficacy data to support approval and sets precedent for future CRISPR‑based therapies.

Key controls: Ensure comprehensive CMC and clinical evidence for gene therapy approvals, including detailed description of genome editing mechanisms, manufacturing processes, conditioning regimen, and long‑term follow‑up plans

7 references

Reference Source / Status GxP Area / Standard / Lifecycle QA Description and Validation Relevance
Regulation (EU) 2024/1689 on Artificial Intelligence (AI Act) European Union
European Union
Binding law / regulation
Regulation
2024-07-12
Medical devices, healthcare applications, pharmaceuticals
EU AI Act
Development, Deployment, Post-market
The AI Act establishes a uniform legal framework for AI systems across the EU, promoting trustworthy AI that respects health, safety, fundamental rights, and environment while preventing market fragmentation. It sets obligations for providers and users and classifies high‑risk AI systems, including medical devices, requiring risk management, human oversight, and conformity assessment

GxP validation relevance: Defines legal obligations and risk classifications for AI systems in the EU; high-risk AI systems like medical devices must meet strict requirements, impacting design, validation, post-market monitoring, and transparency.

Key controls: Risk management system, human oversight, quality management, data governance, documentation, monitoring and reporting obligations.
EudraLex Volume 4 Annex 11: Computerised Systems European Commission
European Union
Regulatory guidance / non-binding agency guidance
Guidance (Annex)
2011-06-30
GMP manufacturing / quality systems
EU GMP Annex 11
Development, Deployment, Maintenance
Annex 11 applies to all computerised systems used in GMP activities. It requires validated systems commensurate with risk, lifecycle documentation, supplier qualification, and roles and responsibilities of personnel. Risk management must be applied throughout the lifecycle, and documentation should cover specification, design, testing, and maintenance

GxP validation relevance: Provides EU expectations for validation, operation, and monitoring of computerised systems in GMP; forms basis for inspections and risk-based validation across the lifecycle.

Key controls: Risk management, validation and qualification, supplier management, change control, security and data integrity measures, periodic review.
EMA Reflection Paper on the Use of Artificial Intelligence in the Medicinal Product Lifecycle European Medicines Agency
European Union
Regulatory guidance / non-binding agency guidance
Reflection paper
2024-09-11
Drug development, Clinical trials, GMP manufacturing, Pharmacovigilance
EU legislation (AI Act, GDPR, Cybersecurity Act)
All lifecycle phases
This final reflection paper discusses regulatory considerations for using AI/ML throughout the medicinal product lifecycle. It stresses risk‑based approaches, minimising bias, ensuring trustworthy AI, and identifying when AI falls within EMA remit. Sponsors should ensure data sets, algorithms and processing pipelines are fit for purpose, align with legal, ethical and technical standards, and engage early with regulators for high‑risk AI. Sections cover data quality, training/validation/test separation, model development, performance assessment, interpretability, governance, data integrity and protection, and risk classification

GxP validation relevance: Provides comprehensive guidance on AI use across drug discovery, clinical development, manufacturing and post‑authorisation, establishing expectations for trustworthy AI and early regulatory dialogue.

Key controls: Risk-based assessment, bias mitigation, data governance, transparency and explainability, performance monitoring, early interaction with regulators.
Concept Paper for Revision of EudraLex Annex 11 Computerised Systems EMA & PIC/S
European Union
Regulatory guidance / non-binding agency guidance
Concept paper
2022-09-23
GMP manufacturing / quality systems
EU GMP Annex 11 (pending revision)
All lifecycle phases
The concept paper outlines the need to revise Annex 11 due to new digital technologies. It proposes including data integrity guidance for data in motion and at rest, digital transformation, cloud services, and clarifying scope and definitions. It emphasises risk-based qualification of commercial-off-the-shelf software, agile development processes, and updated classification of critical data and systems

GxP validation relevance: Signals regulatory intent to modernise Annex 11, highlighting areas where AI and digital transformation will require new guidance.

Key controls: Incorporation of data integrity, cloud service requirements, agile development acceptance, risk-based qualification and classification of critical systems.
Commission Guidelines on Prohibited AI Practices under the AI Act European Commission
European Union
EU Commission guidance (non-binding)
Guidance
2025-02-04
Cross‑phase (development and validation)
Regulation (EU) 2024/1689 AI Act Article 5
Development; risk management
The European Commission’s non‑binding guidelines provide an overview of AI practices prohibited under the AI Act. They explain that certain AI practices—such as harmful manipulation and deception, exploitation of vulnerabilities, social scoring, individual criminal risk assessment, untargeted scraping of facial data, emotion recognition in workplaces and education, biometric categorisation to infer protected characteristics, and real‑time biometric identification in public spaces—are unacceptable. The guidelines offer legal explanations and practical examples to help stakeholders understand and comply with these prohibitions, and stress that the Court of Justice of the EU provides authoritative interpretations

GxP validation relevance: Helps developers of AI‑enabled medical and GxP systems avoid incorporating prohibited practices (e.g., social scoring, real‑time remote biometric identification), ensuring that AI applications respect fundamental rights and avoid non‑compliant features.

Key controls: Highlights the AI Act’s banned practices and emphasises the need for early risk assessments and ethical reviews to ensure that AI systems do not exploit vulnerabilities or engage in manipulation or social scoring.
Commission Guidelines on the Definition of an Artificial Intelligence System European Commission
European Union
EU Commission guidance (non-binding)
Guidance
2025-02-06
Design and development
Regulation (EU) 2024/1689 AI Act Article 3
Development; classification; regulatory determination
These non‑binding guidelines explain the practical application of the AI Act’s definition of an ‘AI system’. They assist providers and stakeholders in determining whether a software product qualifies as an AI system by clarifying that AI systems are machine‑based systems with varying degrees of autonomy that infer outputs from inputs. The guidelines are designed to evolve over time and support early implementation of the AI Act; they accompany the guidelines on prohibited AI practices and highlight that, as of February 2 2025, the AI system definition, AI literacy and certain prohibitions have begun to apply

GxP validation relevance: Supports GxP software developers in determining whether their digital products fall under the AI Act, thereby guiding the appropriate regulatory pathway and documentation for AI‑enabled medical devices and digital health technologies.

Key controls: Encourages documentation of system autonomy, adaptiveness, training methods and outputs to justify classification; underpins risk categorisation (prohibited, high‑risk, or limited risk) and informs compliance with AI Act obligations.
Commission Implementing Regulation (EU) 2025/1234 on Electronic Instructions for Use of Medical Devices European Commission
European Union
Implementing regulation (EU law)
Regulation
2025-06-25
Manufacturing; labeling; post‑market
Regulation (EU) 2017/745 (MDR); Implementing Regulation (EU) 2021/2226
Labeling; post‑market
This implementing regulation amends the 2021 electronic instructions for use (eIFU) regulation to extend its scope to all medical devices and accessories intended for professional users, including devices without a medical purpose listed in Annex XVI of the Medical Device Regulation. The change follows a survey showing healthcare professionals prefer eIFUs over paper and aims to improve efficiency. The regulation clarifies that devices intended for professional use but also used by lay persons must still provide paper instructions Manufacturers must provide the internet address for eIFUs to the UDI database once device registration in Eudamed becomes mandatory It amends articles of Implementing Regulation (EU) 2021/2226 to allow electronic instructions in lieu of paper for professional users, updates definitions (e.g., fixed installed devices), and specifies that all issued versions of electronic instructions must remain accessible

GxP validation relevance: Ensures that AI‑enabled medical devices and software intended for professional users can provide electronic instructions, which affects labeling and user documentation processes in GxP environments and may streamline updates for AI‑driven functionality.

Key controls: Requires manufacturers to supply eIFUs via a web address, register that address in the UDI database, retain all versions of instructions, provide paper instructions when devices may be used by lay persons, and update labeling procedures accordingly.

4 references

Reference Source / Status GxP Area / Standard / Lifecycle QA Description and Validation Relevance
Health Canada Premarket Guidance for Machine Learning‑Enabled Medical Devices Health Canada
Canada
Regulatory guidance / non-binding agency guidance
Guidance
2026-04-01
Medical devices
Canadian Medical Devices Regulations
Development, Submission, Post-market
This comprehensive guidance defines machine learning‑enabled medical devices and outlines premarket requirements. It details device description expectations (algorithm type, training data, architecture, output, autonomy) and emphasises predetermined change control plans (PCCPs) for planned modifications. It advises risk management including hazards such as false outputs, bias, over‑/under‑fitting, model degradation and automation bias Data selection guidance covers dataset characteristics, inclusion/exclusion criteria, bias controls and augmentation Transparency sections outline labelling and post‑market monitoring requirements, including model cards and disclosure of performance, risks and limitations

GxP validation relevance: Sets expectations for design, development, validation, and documentation of ML‑enabled medical devices in Canada, aligning with global GMLP and PCCP concepts.

Key controls: Comprehensive device description, risk management (ISO 14971), dataset transparency, PCCP, performance evaluation, labelling and post‑market monitoring.
Guiding Principles for Predetermined Change Control Plans for Machine Learning‑Enabled Medical Devices FDA, Health Canada, MHRA
International (U.S., Canada, UK)
International harmonization
Guiding principles
2024-10-00
Medical devices
Not applicable (guiding principles)
Development, Submission, Post-market
This joint document defines five guiding principles for PCCPs: (1) focused and bounded—only pre‑authorised modifications within intended use; (2) risk‑based—ensuring modifications are commensurate with risk; (3) evidence‑based—requiring scientifically justified methods to measure performance before and after change; (4) transparent—clearly communicating data, testing, performance and monitoring; and (5) total product lifecycle—integrating risk management and stakeholder perspectives throughout the device lifecycle

GxP validation relevance: Provides harmonised expectations for designing PCCPs across regulators, enabling consistent and flexible management of AI model updates in medical devices.

Key controls: PCCP scope and boundaries, risk-based change assessment, evidence requirements, transparency and documentation, lifecycle integration.
Guiding Principles on Transparency for Machine Learning‑Enabled Medical Devices Health Canada
Canada
Regulatory guidance / non-binding agency guidance
Guiding principles
2024-10-00
Medical devices
Not applicable (guiding principles)
All lifecycle phases
These principles define transparency for ML‑enabled medical devices and emphasise human‑centred design. They outline who needs information, why, what to communicate, where and when to provide it, and how to communicate effectively. Transparency supports patient‑centred care, risk identification, informed decision‑making and detection of errors or degradation

GxP validation relevance: Encourages manufacturers to provide clear and accessible information about their AI models, enhancing trust and safety in ML‑enabled medical devices.

Key controls: Communication of intended purpose, data and model information, performance metrics and limitations, use of appropriate media and user‑focused design.
Health Canada Notice: Digital Health Technologies Including Software and AI Health Canada
Canada
Regulator program / policy resource
Notice
2018-07-18
Medical devices, Digital health
Canadian Medical Devices Regulations
All lifecycle phases
This notice announces the creation of a Digital Health Review Division to adapt Health Canada’s regulatory approach to digital health technologies including AI. It focuses on emerging areas such as wireless medical devices, mobile apps, telemedicine, software as a medical device (SaMD), AI, cybersecurity and interoperability, aiming to support innovation while ensuring safety and effectiveness

GxP validation relevance: Indicates Health Canada’s early commitment to regulating AI in medical devices and establishing specialised review capabilities.

Key controls: Creation of Digital Health Review Division, focus on cybersecurity and interoperability, collaboration with other regulators.

2 references

Reference Source / Status GxP Area / Standard / Lifecycle QA Description and Validation Relevance
MHRA AI Airlock: Regulatory Sandbox for Artificial Intelligence as a Medical Device Medicines and Healthcare products Regulatory Agency (MHRA)
United Kingdom
Regulator program / policy resource
Program description
2024-05-10
Medical devices
Not applicable (sandbox).
Development and early deployment
MHRA’s AI Airlock is a regulatory sandbox launched in Spring 2024 to explore challenges associated with AI as a medical device. Phase 2 involves testing complex regulatory challenges with participation from MHRA, NHS and other regulators. The program will inform future guidance and create sustainable regulatory pathways for AI-enabled medical devices

GxP validation relevance: Demonstrates MHRA’s proactive approach to regulatory innovation for AI medical devices, offering test environments and insights that will shape future guidance.

Key controls: Collaborative sandbox projects, identification of regulatory gaps, lessons for future guidance and standards.
Software and AI as a Medical Device Change Programme and Roadmap Medicines and Healthcare products Regulatory Agency (MHRA)
United Kingdom
Regulator program / policy resource
Roadmap and program description
2022-10-17
Medical devices
UK Medical Devices Regulations
All lifecycle phases
MHRA’s change programme outlines plans to reform regulation of software and AI as a medical device across the product lifecycle. It highlights adaptivity, explainability and transparency, risk management, and collaboration with other regulators to develop PCCPs and Good Machine Learning Practice

GxP validation relevance: Provides strategic direction for future UK regulations on AI medical devices, emphasising adaptability of AI models, post-market surveillance, and convergence with international guidance.

Key controls: Roadmap for regulatory reforms, early engagement, transparency principles, adoption of PCCPs and GMLP.

7 references

Reference Source / Status GxP Area / Standard / Lifecycle QA Description and Validation Relevance
ISO/IEC 42001:2023 Artificial Intelligence Management System International Organization for Standardization (ISO)
International
Consensus standard
Standard
2023-12-06
Cross-industry including life sciences
ISO/IEC 42001
All lifecycle phases
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system. It addresses ethical considerations, transparency, and risk management, providing structured governance to balance innovation with trustworthiness

GxP validation relevance: Offers organisations a framework to manage AI development and deployment responsibly, aligning with regulatory expectations for ethical AI and risk management.

Key controls: Organisational governance, risk management processes, transparency and accountability measures, continuous improvement.
ISO/IEC 23894:2023 Artificial Intelligence — Guidance on Risk Management International Organization for Standardization (ISO)
International
Consensus standard
Standard
2023-12-20
Cross-industry including life sciences
ISO/IEC 23894
All lifecycle phases
ISO/IEC 23894 provides guidance on AI risk management for organisations developing, producing, deploying or using AI products and services. It describes processes for identifying, analysing, evaluating and treating AI-specific risks and integrating risk management throughout AI-related activities

GxP validation relevance: Supports organisations in implementing risk management for AI systems, complementing quality management and regulatory requirements in life sciences.

Key controls: Risk identification and assessment, mitigation strategies, integration into organisational processes.
NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0 National Institute of Standards and Technology
United States (voluntary)
International harmonization
Framework
2023-01-26
Cross-industry including healthcare and pharmaceuticals
NIST AI RMF
All lifecycle phases
NIST’s AI Risk Management Framework is a voluntary tool to assist organisations in designing, developing and deploying trustworthy AI systems. It helps manage risks to individuals, organisations and society, emphasises trustworthiness considerations, and was developed through a consensus-driven process with public input

GxP validation relevance: Provides a general framework for identifying and managing AI risks, informing governance and validation strategies in regulated industries.

Key controls: Core functions of “Map, Measure, Manage, Govern”; profiles for generative AI and critical infrastructure; stakeholder engagement.
TGA Guidance: Artificial Intelligence and Medical Device Software Regulation Therapeutic Goods Administration (TGA)
Australia
Regulatory guidance / non-binding agency guidance
Guidance
2026-02-15
Medical devices
Australian Therapeutic Goods Act and Regulations
All lifecycle phases
TGA guidance explains when and how AI is regulated as a medical device in Australia. Software or AI products are regulated if they diagnose, prevent, monitor, predict or treat disease. The guidance lists examples of AI-enabled devices, emphasises that adding features or changes to intended use can trigger regulatory reclassification, and warns against scope creep and off-label use. It also addresses synthetic data usage, requiring justification when real clinical data is available and notes that whole-of-government AI oversight and collaboration with other agencies will support alignment with the National AI Plan

GxP validation relevance: Provides clear regulatory expectations for AI software in Australia, emphasising classification, evidence requirements, and oversight for AI-enabled products.

Key controls: Evaluation of intended purpose, management of changes and scope creep, justification of data (including synthetic data), continuous performance monitoring, cross-agency oversight.
Evidence Requirements for Software Using Artificial Intelligence to be Included in the ARTG Therapeutic Goods Administration (TGA)
Australia
Regulatory guidance / non-binding agency guidance
Guidance
2025-09-01
Medical devices
Australian Therapeutic Goods Regulations
Submission, Post-market
This guidance outlines evidence required for AI software to be included in the Australian Register of Therapeutic Goods. Manufacturers must provide transparent evidence of what the AI model does, algorithm design, training and testing data (size and demographics), and justification for relevance to the Australian population. Risk management evidence must address AI-specific risks like overfitting, bias and data drift. Clinical evidence is needed for the intended population. The guidance aligns with Good Machine Learning Practice principles across design, data management, development, evaluation, clinical validation, transparency and risk management

GxP validation relevance: Clarifies documentation and data requirements for regulatory approval of AI software in Australia, aligning with international GMLP.

Key controls: Transparent model description, algorithm design documentation, dataset justification and demographics, risk management and bias mitigation, clinical evidence, good machine learning practice principles.
AI in Healthcare Guidelines (AIHGle 2.0) Update Ministry of Health, Singapore
Singapore
Regulatory guidance / non-binding agency guidance
Guideline update summary
2026-04-13
Healthcare delivery, medical devices
Singapore AIHGle
Development, Deployment
The MOH’s emerging regulatory policy page notes that AIHGle 2.0 was updated on April 13 2026. The guideline emphasises that AI should augment and empower healthcare professionals, with patient safety and clinical effectiveness as priorities. Key updates include strengthening accountability through clarity of roles for developers, deployers and users, improving trust via transparency guidance, and updated guidance on AI deployment with risk assessment and mitigation

GxP validation relevance: Provides updated national guidance for safe development and deployment of AI in healthcare, clarifying responsibilities and reinforcing transparency and risk mitigation.

Key controls: Defined roles and accountability, transparency principles, risk assessment and mitigation requirements, periodic updates.
TGA Guidance on Use of Synthetic Data for AI Software Therapeutic Goods Administration (TGA)
Australia
Regulatory guidance / non-binding agency guidance
Guidance (excerpt)
2026-02-15
Medical devices
Australian Therapeutic Goods Regulations
Development, Testing
Within the TGA’s AI and medical device software guidance, a section addresses the use of synthetic data for training or validating AI models. Manufacturers must justify why synthetic data is used, ensure it does not replace clinical data when real data is available, and assess whether synthetic data could introduce bias or misrepresentations

GxP validation relevance: Highlights regulatory expectations for handling synthetic data in AI model development, ensuring data quality and relevance for medical devices.

Key controls: Justification for synthetic data use, evaluation of representativeness, avoidance of replacing real clinical data, bias assessment.

5 references

Reference Source / Status GxP Area / Standard / Lifecycle QA Description and Validation Relevance
ISPE GAMP Guide: Artificial Intelligence – Summary Article Bioprocess Online / ISPE
International
Trade / legal / consulting article
Trade article
2025-01-10
GMP manufacturing / quality systems, Drug development
GAMP principles
All lifecycle phases
Article summarises the ISPE GAMP Guide on Artificial Intelligence released in 2025. The guide builds on GAMP 5 principles and provides a risk-based framework for evaluating, implementing and maintaining AI systems across pharmaceutical life cycles, including manufacturing, distribution and medical devices. It emphasises lifecycle management, data integrity, and ongoing performance monitoring and addresses various AI technologies from rule-based to generative AI, aiming to harmonise regulatory expectations while recognising local nuances

GxP validation relevance: Offers industry insights into the application of GAMP principles to AI, reinforcing risk-based validation, data governance, and lifecycle control within pharmaceutical operations.

Key controls: Risk-based lifecycle management, data integrity controls, performance monitoring, adaptation of GAMP categories to AI technologies.
Revised EU–PIC/S GMP: Draft Updates to Documentation, Computerised Systems and AI (Annex 22) NSF International
European Union / International
Trade / legal / consulting article
Trade article
2025-07-07
GMP manufacturing / quality systems
Draft EU–PIC/S Annexes (Chapter 4, Annex 11, Annex 22)
All lifecycle phases
This article summarises the July 7 2025 joint EU and PIC/S draft revisions to GMP Chapter 4 (Documentation), Annex 11 (Computer Systems) and introduces a new Annex 22 on Artificial Intelligence. It outlines expanded structures covering data governance, risk management, hybrid systems, cloud services, qualification, validation, audit trails, electronic signatures, periodic reviews, security, backup and archiving

GxP validation relevance: Provides early insight into forthcoming regulatory updates addressing digital technologies and AI in pharmaceutical manufacturing, highlighting expanded expectations for data integrity and computerised system validation.

Key controls: Data governance, risk management, documentation practices, validation and periodic review, identity/access control, cloud service qualification.
ISO 14971 and AI in Medical Device Risk Management Censinet
International
Trade / legal / consulting article
Trade article
2023-08-17
Medical devices
ISO 14971:2019
All lifecycle phases
This article explains how ISO 14971’s risk management framework applies to AI‑driven medical devices. It highlights AI-specific hazards such as data bias, model drift and cybersecurity issues and calls for robust data governance, continuous monitoring and human oversight. The ISO 14971 risk management process is summarised (planning, hazard analysis, risk evaluation, risk controls, residual risk assessment, post-production monitoring), extending concepts to AI-specific hazards

GxP validation relevance: Helps manufacturers apply established medical device risk management principles to AI technologies, identifying unique challenges and controls required.

Key controls: Robust data governance, risk analysis of data and model hazards, human oversight, continuous monitoring, documentation of architecture and model history.
Machine Learning, AI and Risk Management – AAMI TIR34971 Explained Greenlight Guru
International
Trade / legal / consulting article
Trade article
2023-08-01
Medical devices
AAMI TIR34971:2023, ISO 14971
All lifecycle phases
This article summarises AAMI TIR34971:2023, which applies ISO 14971 to machine learning in artificial intelligence. It explains that the report helps evaluate intended use, autonomy, and learning behaviour of ML components. Key considerations include data management risks (incorrect or incomplete data, outliers, biased or non‑normal data), multiple types of bias (implicit, selection, proxy variables), overtrust and adaptive system challenges requiring continuous validation and ability to roll back models

GxP validation relevance: Guides manufacturers on applying standard risk management processes to AI components, highlighting data quality and bias issues and the need for continuous validation.

Key controls: Evaluation of intended use and autonomy, data management risk analysis, bias identification and mitigation, monitoring and roll-back strategies.
Upcoming IEC 62304 Edition 2 – Implications for AI and Health Software IntuitionLabs
International
Trade / legal / consulting article
Trade article
2026-03-10
Medical devices software
IEC 62304 Edition 2 (draft)
Development, Maintenance
The article previews Edition 2 of IEC 62304, expected in 2026. It notes that the update simplifies safety classifications, expands scope to all health software, and introduces AI/ML development lifecycle requirements. It emphasises harm considerations (including property and environmental damage), alignment with ISO 14971 and ISO 13485, and dedicated AI process planning and validation steps. The revised standard will affect classification decisions, documentation effort and development practices for AI‑enabled devices

GxP validation relevance: Provides early insight into upcoming changes to the medical device software lifecycle standard, which will introduce explicit AI lifecycle requirements and broaden scope to general health software.

Key controls: Simplified safety classes, alignment with risk management (ISO 14971), AI process planning and validation, cybersecurity considerations.

8 references

Reference Source / Status GxP Area / Standard / Lifecycle QA Description and Validation Relevance
International Medical Device Regulators Forum: Good Machine Learning Practice (GMLP) for Medical Device Development International Medical Device Regulators Forum (IMDRF)
International
International harmonization
Guidance
2025-01-17
Medical devices
IMDRF GMLP
All lifecycle phases
The IMDRF final document outlines ten guiding principles for good machine learning practice in the development of medical devices. It emphasises that AI technologies can improve healthcare but pose risks due to their iterative, data-driven nature. The principles promote safe, effective, high-quality AI-enabled medical devices across the entire lifecycle and call for collaboration among regulators and standards bodies WG_GMLP_N88 Final.pdf#:~:text=Artificial%20intelligence%20,set%20of%20principles%20for%20the.

GxP validation relevance: Serves as a global reference for regulators and manufacturers on best practices for AI medical devices, including data quality, risk management, transparency, and ongoing performance monitoring.

Key controls: Ten GMLP principles (e.g., good data governance, transparency and explainability, human-centered oversight, total product lifecycle, performance monitoring).
ICH Q9(R1) Quality Risk Management International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH)
International
International harmonization
Guideline
2023-05-00
GMP manufacturing / quality systems, Drug development
ICH Q9(R1)
All lifecycle phases
The updated ICH Q9(R1) guideline provides principles and tools for quality risk management to improve product availability and protect patients. It clarifies the formality of risk management, risk-based decision-making, and subjectivity in assessments and emphasises integration of risk management throughout pharmaceutical quality systems

GxP validation relevance: Applies to pharmaceutical quality management systems, informing risk-based validation of AI and software systems by emphasising systematic identification, analysis, and control of risks.

Key controls: Risk assessment, risk control, risk review, and communication; alignment with GMP/ICH guidelines.
WHO–ITU Focus Group on AI for Health: Regulatory Considerations on Artificial Intelligence for Health World Health Organization / International Telecommunication Union
International
International harmonization
High-level considerations
2023-10-19
Healthcare and public health
Not applicable (guidance document)
All lifecycle phases
This working group paper provides a high-level overview of regulatory considerations and emerging good practices for AI in health. It outlines key considerations for developers, regulators, manufacturers and practitioners to facilitate safe use of AI, emphasising risk‑benefit assessments, evaluation and monitoring of AI performance, and continuous assessment across the lifecycle. It does not serve as a regulatory framework but lists best practices to support safe AI in health

GxP validation relevance: Offers global perspective on regulatory challenges for AI in healthcare, informing early-stage development and policy discussions.

Key controls: Risk-benefit assessment, performance evaluation and monitoring, stakeholder engagement, ethical considerations.
PIC/S PI 011-3: Good Practices for Computerised Systems in GxP Environments Pharmaceutical Inspection Co-operation Scheme (PIC/S)
International
International harmonization
Guidance
2007-01-01
All GxP domains (GMP, GDP, GCP, GLP)
PIC/S PI 011-3
All lifecycle phases
This guidance provides recommendations for computerised systems across GxP domains and assists inspectors and regulated users. It emphasises lifecycle management, planning, user requirements, testing, validation strategies, change management, system security, audit trails, electronic signatures, personnel training, and inspection considerations. It supports innovation while ensuring compliance

GxP validation relevance: Offers comprehensive global guidance for validation and inspection of computerised systems in GxP environments, forming the basis for regulatory inspections and industry practices.

Key controls: Lifecycle approach, user requirements specification, supplier management, testing and validation, change control, security and audit trail, training.
ISPE GAMP 5 Second Edition – Key Updates International Society for Pharmaceutical Engineering (ISPE)
International
Industry good-practice guidance
Article
2022-03-01
GMP manufacturing / quality systems, IT systems
GAMP 5 Second Edition
All lifecycle phases
This ISPE article summarises updates in the GAMP 5 second edition. It discusses patient-centric, risk-based approaches, modern IT practices, and emphasises critical thinking over prescriptive compliance. It covers new technologies such as AI/ML, blockchain and cloud computing, updates categories for cloud and SaaS, and emphasises agile and risk-based methodologies, continuous improvement, and updated appendices for SaaS validation and classification of systems

GxP validation relevance: Provides practitioners with updated best practices for validating modern computerised systems, including AI and cloud technologies, aligning with regulatory expectations and CSA concepts.

Key controls: Risk-based lifecycle, critical thinking, scalable validation for SaaS and cloud, agile development, continuous improvement.
PMDA Report on AI‑Based Software as a Medical Device Pharmaceuticals and Medical Devices Agency (PMDA)
Japan
Regulator program / policy resource
Report (translation)
2023-08-28
Medical devices
Japanese Medical Device Regulations
Development, Post-market
This PMDA report summarises trends and regulatory science issues for AI-based SaMD. It builds on a 2017 report and subsequent guidelines (revised March 2023). It analyses biases (data, analytical, cognitive), post-market learning, risk assessment of performance changes after marketing, and case studies of issues such as bias in radiological images and challenges in simulation data

GxP validation relevance: Highlights Japanese regulatory perspectives on bias mitigation, post-market monitoring, and risk management for AI-based medical software, informing global harmonisation.

Key controls: Assessment of data and analytical biases, evaluation of post-market learning and algorithm updates, risk assessment of performance changes.
HSA Digital Health: Regulatory Guidelines for Software and AI Medical Devices Health Sciences Authority (HSA)
Singapore
Regulatory guidance / non-binding agency guidance
Guidance summary
2018-12-31
Medical devices
HSA Software Medical Device Guidelines
All lifecycle phases
The HSA digital health page summarises regulatory guidelines for software medical devices, including AI. It notes that digital health consultations have become common and references the 2020 Regulatory Guidelines for Software Medical Devices, covering cybersecurity, data integrity and lifecycle management. It highlights the AI in Healthcare Guidelines (AIHGle 2.0) updates, clarifying responsibilities for developers, deployers and users, and emphasising transparency, risk assessment and mitigation

GxP validation relevance: Provides context for Singapore’s regulatory framework for AI and software medical devices, pointing to detailed guidelines and international collaborations (e.g., with Korea’s MFDS).

Key controls: Cybersecurity and data integrity controls, lifecycle management, clarity of roles, transparency and risk mitigation guidance.
South Korea AI Basic Act – High‑Impact AI Definition and Obligations Kim & Chang (law firm)
South Korea
National legislation & draft enforcement guidelines (analysis)
Analysis
2026-01-21
Development; manufacturing; post‑market
AI Basic Act; Digital Medical Products Act; Personal Information Protection Act
Development; risk management; post‑market
This law‑firm analysis explains that South Korea’s Framework Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act), which takes effect on January 22 2026, introduces obligations for AI business operators. The Act defines ‘high‑impact AI’ as systems that may significantly affect human life, physical safety or fundamental rights, and imposes stricter obligations on providers. A two‑step test classifies high‑impact AI: the system must be used in one of the specified sectors (energy, drinking water, healthcare, medical devices, nuclear energy, biometrics, employment, credit evaluation, transportation, public services or student evaluation) and must have a significant impact or risk Obligations include securing transparency (advance notice of generative or high‑impact AI operations, labeling outputs, and deepfake disclosure), implementing risk management plans, maintaining explainability of AI systems and training data, and adopting user protection measures. The Act allows compliance with equivalent obligations under other laws, such as the Personal Information Protection Act or the Digital Medical Products Act, to satisfy some requirements It also introduces obligations for ‘high‑performance AI’ (models exceeding 10^26 FLOPs) requiring risk management systems and reporting

GxP validation relevance: Relevant because medical device and digital health AI systems are classified as high‑impact AI under the Act, triggering obligations for transparency, risk management, explainability, user protection and impact assessments, which align with GxP validation and quality requirements.

Key controls: Requires providers of high‑impact AI to perform sector‑specific assessments, notify users of AI use, label AI outputs (including deepfakes), establish and document risk management and user protection measures, maintain explainability of AI models and data, conduct impact assessments, and comply with high‑performance AI requirements.