How we work
Four principles determine the order in which we approach a regulated undertaking. Two pieces of work show what that looks like in practice.
The regulations the principles rest on
EU-GMP Annex 11
in force since 30 June 2011
EU-GMP Annex 22
draft of 7 July 2025, no final version
ICH Q9(R1)
incorporated through Part III of the EU GMP guide
GAMP 5
ISPE industry guide, not a regulation
Working principles
For each principle the page states what it requires and what it rests on.
First the process is understood and specified, then the system that executes it, then — and only then — an AI function inside a step that is already specified. Reverse the order and the tool determines the process, leaving the evidence to be constructed afterwards.
What it rests on
Annex 11 requires that a quality-relevant decision in a computerised system remains traceable; that presupposes a specified flow. The principle can be read on the AI validation page and is taking shape in the orchestration showcase.
Validation is designed in from the first requirement, not checked after go-live. Who approves, at which point and on what basis, is settled before building — the evidence then arises directly from the flow itself, not from documentation assembled after the fact.
What it rests on
Compliance (CSV) is one of our core fields: the specification chain from URS through FS to DS, test documentation with IQ/OQ/PQ and a traceability matrix. Annex 11 requires the validated system state; GAMP 5 is the established framework in which it is produced.
How deep validation goes is decided by the risk to patient, product and data — not by one uniform depth for every system. The result is proportionate controls: strong evidence where the risk sits, no over-engineering where it does not.
What it rests on
The reference is quality risk management under ICH Q9, since July 2023 in its Q9(R1) revision, incorporated through Part III of the EU GMP guide.
No AI step decides on quality. Approval rests with a human, and it is technically enforced rather than agreed: the audit trail records who saw, assessed and approved which output, and when. An agreement that can be bypassed in operation is not oversight.
What it rests on
The requirement that a decision remain traceable comes from Annex 11, which is in force. The Annex 22 draft excludes generative AI and large language models from its scope — it indicates direction, it is not a binding obligation.
Evidence
Both predate this page. They are not asserted anew here but placed.
Evidence 1 · A worked-out position
The regulatory frame for AI in GxP processes, worked through: what the draft covers, what it expressly excludes, and which requirement already follows today from Annex 11. Three of the four principles appear there verbatim.
Not a reference, not a project report. A position — readable and open to challenge.
Evidence 2 · Showcase under construction
Significon is building a showcase on process-centric orchestration across system boundaries itself and in house. The page shows the architectural principle along a change management flow: BPMN 2.0 as the process model, Camunda 8 holding decision authority, n8n as the integration layer without decision logic of its own, AI steps each followed by an approval gate.
A demonstrator: not method documentation, not a client reference, no delivery statement.
A project where this order matters?
Together, we accomplish what doesn't get finished alone.