Advisory and validation work that I lead myself. Each engagement is scoped with you before it starts, and the plan and timeline are agreed in writing.
Readiness Review
A fixed-scope review of your validation and inspection readiness over 2 weeks. I look at your validation records, your procedures and the way your systems are used day to day, then give you a written report you can act on and defend.
- Who it's for
- Quality, IT and validation leaders with an inspection on the horizon, a new AI use case to defend, or a validation approach they want tested by an outside expert.
- How long it takes
- 2 weeks, fixed scope, agreed with you before the review starts.
What we do
- Agrees the scope with you: the systems, sites or AI use cases to look at
- Reads the validation packages and governing procedures against the same yardstick an inspector would use
- Talks with the people who run and use the systems, so the review reflects day-to-day practice
- Rates each finding by risk and sets out the order to address them
What you get
- A written report with every finding tied to its evidence and the requirement it relates to
- A risk rating for each finding that you can defend in the room
- A plan in the order the risk calls for, sized to your team
- A closing discussion with your leadership on the report
The review comes from someone who has stood on the quality side of the inspection table, in front of FDA, EMA, MHRA, PMDA and other authorities, so the questions in it are the ones inspectors ask.
The report says which of the consulting services below would close each gap, if any are needed.
How the review runs Review outline (PDF)
AI QMS setup and monthly support
When AI enters a GxP process, your QMS needs procedures for it. TrustBridge has a ready AI QMS of 13 SOPs, 50 templates and 19 quick reference guides. I adapt it to your existing QMS and your own terminology, so it fits the procedures your people already use, and then stay on hand through a monthly retainer.
- Who it's for
- Companies using or planning AI in GxP processes, and QA and IT owners who need a procedure set an inspector can follow.
- How long it takes
- Setup is a one-time piece of work, sized to your QMS. After that, a monthly retainer for the term we agree with you.
What we do
- Reviews your current QMS and maps where AI governance needs to sit
- Adapts the SOPs, covering the AI validation lifecycle, use case intake and classification, risk assessment and testing, monitoring and drift response, retraining, generative AI use, data governance, supplier oversight, periodic review and retirement
- Adapts the templates and quick reference guides, and walks your owners through how each one is used
- Under the retainer, supports new use cases, change decisions, evidence reviews and inspection preparation
What you get
- 13 SOPs, 50 templates and 19 quick reference guides adapted to your QMS
- Procedures your team owns from day one
- My time each month under the retainer, for the decisions that need a second pair of eyes
The AI SOPs are added to your QMS and refer to your current procedures where the two overlap, so the rest of your QMS stays as it is. Pairs with Validating AI in GxP training and validation of AI applications.
How the AI in QMS work runs
Validation of AI applications
Each AI application is validated in proportion to its risk, inside a governance framework that decides who approves what. I design that framework with you using the AI Governance Stack, set the validation approach and sign off the evidence. Execution partners draft and execute the protocols on my framework.
- Who it's for
- Companies taking AI into deviations, CAPA, complaints, laboratory review or other GxP processes, and AI vendors whose customers need validation evidence.
- How long it takes
- It depends on the risk tier and the number of applications. You get a plan with dates after the first tiering session.
What we do
- Designs your AI governance with the AI Governance Stack: regulatory spine, reference architecture, four-tier risk classification, governance operating model, validation master plan and live monitoring
- Classifies each application by risk and intended use, and decides who is accountable
- Sets acceptance criteria and checks the data the model learned from, then drafts and executes IQ, OQ and performance testing sized to the risk tier
- Sets up drift monitoring, hallucination management for generative AI, periodic review and change control after go-live
What you get
- An AI governance framework with clear decision rights
- A risk classification record for each application
- A validation plan, executed protocols and a summary report an inspector can follow from intended use to the final decision
- Monitoring that keeps each system inside its validated state
This is work I have done in live operations. I have validated 20+ AI applications in live GxP use (deviations, queries and CAPA support among them), and took 9 of them through health-authority inspection, 6 FDA and 3 MHRA, with zero compliance observations.
Pairs with AI QMS setup and Validating AI in GxP training.
How the AI validation work runs AI readiness review outline (PDF)
CSV to CSA transformation
This is the consulting version of the CSV to CSA move, for companies that want the new method built into their own framework, procedures and templates and rolled out across their sites. I led this change across a global manufacturing network, and I use the same DRIVE framework here.
- Who it's for
- Heads of validation, QA and quality IT who want risk-based assurance as the way their company validates, across every site.
- How long it takes
- Scoped to the number of sites and systems. We agree the plan and timeline with you before work starts. A single site and a few systems make a good first phase.
What we do
- Builds the risk logic that decides testing depth, using the 5 DRIVE decisions
- Rewrites your CSV policy, SOPs and templates for risk-based assurance, and sets the rules for using supplier evidence and unscripted testing
- Plans and supports the rollout across sites, with training for reviewers and approvers
- Applies the new method to a first set of live projects so your team sees it work
What you get
- A CSA framework that fits your quality system
- Updated procedures and templates, ready for approval
- A rollout plan across your sites, with reviewers and approvers trained in the new method
- Worked examples from your own systems
I have worked on CSA since before FDA published its draft. I co-authored the ISPE GAMP India SIG whitepaper on Computer Software Assurance in July 2021, and later led the move to CSA across a global manufacturing network.
Pairs with Transitioning from CSV to CSA training and computer system validation.
How the CSV to CSA work runs
Computer system validation
Validation of the systems your GxP operations run on, across the full lifecycle, with data integrity built in from the first specification. I set the strategy and review the evidence, and execution partners working on my framework do the drafting and testing. I stay accountable for the evidence.
- Who it's for
- Companies implementing, upgrading or migrating LIMS, eQMS, MES, ERP or laboratory and manufacturing equipment.
- How long it takes
- Scoped per system or programme. We agree the plan and timeline with you before work starts.
What we do
- Validates LIMS, eQMS, MES, ERP and other GxP systems, including upgrades, migrations and system retirement
- Writes the URS, risk assessments, traceability and IQ, OQ and PQ protocols, and executes them
- Qualifies equipment with Modular Qualification Architecture: shared building blocks are qualified once, and each new site or unit is tested only for what differs
- Builds 21 CFR Part 11, Annex 11 and ALCOA+ data integrity controls into the design
What you get
- A complete validation package for each system
- Executed protocols and a summary report
- Less repeated qualification effort for equipment across sites
- Evidence an inspector can follow on their own
We use your templates and procedures where you have them, and bring ours where you need them. I know the main GxP platforms well, including Veeva Vault, TrackWise, MasterControl, LabWare, LabVantage, STARLIMS, Körber PAS-X, Siemens Opcenter and SAP S/4HANA.
Pairs with CSV to CSA transformation and Enterprise Paperless Validation.
How the CSV work runs System go-live review outline (PDF)
Enterprise Paperless Validation
A design for running the whole validation lifecycle on a validated electronic platform: specifications, risk assessments, test evidence, electronic signatures and the audit trail, all in one place. For a global pharmaceutical client I built the paperless validation platform that took 40+ sites off paper, removing about 6M paper records a year and improving validation cycle time by up to 45%.
- Who it's for
- Companies running validation on paper or hybrid records, and those choosing or rolling out a digital validation platform across several sites.
- How long it takes
- A programme scoped to your sites and systems. We agree the plan and timeline with you before work starts.
What we do
- Designs the digital validation lifecycle and the rules that govern it
- Sets requirements for the platform and supports its selection
- Validates the platform against 21 CFR Part 11 and Annex 11
- Moves templates and live projects onto the platform, and plans the rollout across sites
What you get
- A digital validation lifecycle your sites follow the same way
- A validated electronic platform with signatures and audit trail in place
- Evidence that's ready the moment an inspector asks for it
- A rollout plan across your sites
Reviews and approvals happen in the system, signatures are electronic and the audit trail is complete from the first specification, so your team can produce any piece of evidence on the day an inspector asks for it.
Pairs with computer system validation and quality digital transformation.
How the paperless validation work runs
Quality digital transformation with QMS 2.0
Moving deviations, CAPA, change control and complaints from paper or local tools into one eQMS, designed around the decisions those processes support. I have run this at enterprise scale, with an eQMS used by about 15,000 people and quality digitalisation programmes that reduced rejection and rework by up to 80%.
- Who it's for
- Quality leaders running paper or mixed quality processes, and companies bringing several sites onto one eQMS.
- How long it takes
- A programme scoped to your processes and sites. We agree the plan and timeline with you before work starts.
What we do
- Agrees one core process set for deviations, CAPA, change control and complaints, with any local variation named, given an owner and reviewed
- Designs the eQMS around that process set
- Builds one quality data layer so KPIs mean the same thing at every site
- Plans go-lives so every site stays inspection ready, and adds validated AI assistance where it helps
What you get
- One quality process set across your sites
- An eQMS design and rollout plan
- Quality KPIs your leadership can compare and act on
- A validated, inspection-ready quality system
QMS 2.0 puts a connected quality data layer at the base, the eQMS core for deviations, CAPA, change control, complaints and audit above it, then validated automation and AI for the high-volume steps, and quality KPIs that show trends early.
Pairs with AI QMS setup and Enterprise Paperless Validation.
How the QMS work runs Digital quality consulting
