Almost anyone can advise on AI governance in theory. Very few have put AI into live GxP quality and taken it through a health-authority inspection with zero findings. That is the work this practice is built on, and it is the difference between a slide about AI and a system an inspector accepts.
For twenty-five years the discipline was data integrity: ALCOA++ on every record. AI adds a second layer. Every decision a model makes or shapes has to be traceable, explainable and defensible: what went in, what came out, who reviewed it, what they decided. Inspectors are already asking for exactly that record, and the FDA issued its first warning letter for uncontrolled AI in a GxP process in April 2026.
Governance precedes validation, and classification precedes both. The AI Governance Stack is the structure I built to put AI into regulated quality and bring it through inspection, six layers from the regulatory spine to live monitoring, with a four-tier risk model that decides how much rigour each use case carries.
The six-layer framework: regulatory spine, reference architecture, classify and risk-tier, governance operating model, validation master plan, and live monitoring.
See the framework →Where AI goes in your quality system: the highest-volume, lowest-judgment steps, every tool validated, audit-ready and reviewed by a human who owns the output.
Explore the service →Annex 22-aligned controls, the four-tier risk model, reclassification triggers, and the decision-integrity record inspectors ask to see.
Explore the service →