Track 03Operational GuardrailsLocked by prerequisiteRequired

Approved AI Systems

Establish the discipline of using only authorised AI systems, for authorised purposes, and of routing everything else through an exception process instead of around it.

4 lessons · 4 frameworks · 2–3 hours · 0/4 complete · 0/4 exercises recorded

Locked by prerequisite

This track opens once its prerequisites are complete. Prerequisites are sequenced deliberately: each one supplies a competency this track assumes you already hold.

Track 01 — AI Fundamentals
Track 02 — AI Governance & Regulatory Expectations

Orientation

Why this matters

The most common AI compliance failure in life sciences is not a bad model. It is a good person using an unapproved tool for a task nobody authorised, because it was faster and the approval route was unclear.

What you will be able to do (4)

Determine whether a tool is approved, restricted or prohibited for your intended purpose
Match a specific task to an authorised purpose before starting work
State your responsibilities as a user of an approved system
Raise an exception or new-use request through the correct route

Aligned with (4)

EU GMP Annex 11 — computerised systems21 CFR Part 11 — electronic records and signaturesGAMP 5 (2nd Edition) — risk-based system categorisationISO/IEC 42001 — AI management systems

Maps to published expectations. Competency demonstrated through assessment.

Regulatory alignment indicates that curriculum topics map to published regulatory expectations. It does not constitute agency approval, certification, legal advice or a determination of organizational compliance.

View source evidence, status and applicability

EU GMP Annex 11 — computerised systems

GMP requirementEuropean Union GMP

EudraLex Volume 4, Annex 11 — Computerised Systems ↗

Relevant provisions: Sections 1, 4, 7–9, 11–13 and 16–17
Status and date: Revision January 2011. Current Annex 11; came into operation 30 June 2011.
Why it maps: Supports the track's stated mapping to EU GMP Annex 11 — computerised systems without transferring duties beyond the source's scope.
Applicability limit: Applies to computerised systems used as part of GMP-regulated activities. Applicability follows the regulated process and intended use.

Primary source last verified 2026-08-24

21 CFR Part 11 — electronic records and signatures

Binding lawUnited States

21 CFR Part 11 — Electronic Records; Electronic Signatures ↗

Relevant provisions: §§ 11.10, 11.30, 11.50, 11.70 and 11.100–11.300
Status and date: Current electronic Code of Federal Regulations. Applies when predicate-rule records are maintained or submitted electronically and Part 11 scope is met.
Why it maps: Supports the track's stated mapping to 21 CFR Part 11 — electronic records and signatures without transferring duties beyond the source's scope.
Applicability limit: Part 11 does not make every electronic output a regulated record. Predicate rules and record use determine applicability.

Primary source last verified 2026-08-24

GAMP 5 (2nd Edition) — risk-based system categorisation

Industry guidanceInternational industry practice

ISPE GAMP 5 — A Risk-Based Approach to Compliant GxP Computerized Systems, 2nd ed. ↗

Relevant provisions: Lifecycle, intended use, critical thinking, supplier involvement and risk-based assurance
Status and date: July 2022. Non-binding unless adopted by an organisation, contract or authority.
Why it maps: Supplies a recognised management or assurance practice; it is identified as non-binding unless separately adopted.
Applicability limit: Widely used industry guidance. It must not be described as legislation or a regulator-issued mandate.

Primary source last verified 2026-08-24

ISO/IEC 42001 — AI management systems

Consensus standardInternational consensus standard

ISO/IEC 42001:2023 — Artificial intelligence management system ↗

Relevant provisions: Clauses 4–10 and Annex A controls
Status and date: December 2023. Voluntary unless adopted by contract, policy, certification scheme or applicable authority.
Why it maps: Supplies a recognised management or assurance practice; it is identified as non-binding unless separately adopted.
Applicability limit: Specifies requirements for an AI management system. Use of the standard does not itself establish regulatory compliance.

Primary source last verified 2026-08-24

Full source register and editorial method →

Credential

Approved AI Systems User Badge

Duration

2–3 hours

Audience

All personnel with access to AI tools
Line managers approving tool requests
Anyone handling GxP-relevant documents or data

Prerequisites

Track 01
Track 02

Behaviours practised (3)

UnderstandApplyEscalate

A supply-chain analyst pastes a supplier deviation report into a free public assistant to summarise it before a meeting in ten minutes. The tool is not on the approved list, the report contains confidential supplier data, and the summary will inform a decision about batch release. Every guardrail in this track was designed for that ten-minute moment.

Badge requirements (5)

Complete all four lessons and their knowledge checks
Achieve at least 80% across the final badge assessment
Answer every safety-critical question correctly
Produce a complete pre-use check record and exception request
Select the correct escalation route in every unauthorised-use scenario

Lessons (4)

Final badge assessment