Methodology and standards
The Academy is designed for a field where a missing qualifier can be as misleading as a wrong citation. This page explains how curriculum content is sourced, translated, reviewed, versioned and corrected.
Development process
STEP 01
Start with the decision or behavior the learner must perform in a regulated context, not a list of facts to memorize.
STEP 02
Separate jurisdiction, regulated activity, actor, system classification, effective date and conditions before assigning a source.
STEP 03
Use official legal text and regulator publications first. Standards and industry guidance are identified as separate authority types.
STEP 04
A recommendation remains a recommendation. A draft remains prospective. Conditions and qualifiers stay attached to the duty.
STEP 05
Lessons require a decision, practical response or evidence artifact that can be judged against stated criteria.
STEP 06
Assessment rules test knowledge, safety-critical judgment, documentation and escalation rather than attendance alone.
STEP 07
The curriculum owner reviews substance, links, dates and internal consistency before a version is released.
STEP 08
Material source changes trigger review. Confirmed errors are corrected, dated and recorded under the corrections policy.
Source hierarchy
Authority labels
Each source is labelled as binding law, a GMP requirement, regulator guidance, draft guidance, a harmonised guideline, a voluntary framework, a consensus standard or industry guidance. “Must,” “should,” “may” and “consider” are not blended.
Applicability
Mappings retain jurisdiction, role, regulated activity, system classification, context of use and effective date. Conflicting authorities are shown separately. An evidence gap remains a gap rather than becoming a confident composite rule.
Review accountability
Brian J. Drapeau is the curriculum owner and accountable editor. A page or module is not described as independently reviewed unless a qualified reviewer has actually completed that review and can be named or documented.
Independent review is scoped to the reviewer's expertise and recorded separately from author review. Disagreements are preserved until adjudicated. Anonymous or AI-generated review is not represented as qualified human review.
Use of AI in content development
AI tools may support outlining, comparison, formatting, code development or quality checks. They are not treated as legal authorities, named reviewers or evidence that a statement is correct. Published regulatory claims require an identified source and human accountability.
Sensitive client material, protected health information and confidential regulated records should not be entered into public AI systems. Client-specific AI use is governed by the applicable engagement, approved tools and data-handling requirements.
Regulatory source register
Status checked August 24, 2026. Each track shows the particular provisions and the reason for its mapping.
Draft regulatory guidance · United States
U.S. Food and Drug Administration
Applies to AI used to produce information or data supporting FDA regulatory decisions for drugs and biological products. It is not a general AI-use mandate.
Regulatory guidance · European Union medicines regulation
European Medicines Agency
Describes regulatory considerations across the medicinal-product lifecycle. It does not replace binding legislation or GxP requirements.
Binding law · European Union
European Union
Specific duties depend on system classification, actor role, territorial scope and the applicable date. No duty should be extended beyond those conditions.
GMP requirement · European Union GMP
European Commission
Applies to computerised systems used as part of GMP-regulated activities. Applicability follows the regulated process and intended use.
Draft regulatory guidance · European Union GMP
European Commission
Used only as a prospective signal. It must not be presented as a current binding GMP requirement unless and until adopted and applicable.
Binding law · United States
U.S. Food and Drug Administration / eCFR
Part 11 does not make every electronic output a regulated record. Predicate rules and record use determine applicability.
Binding law · European Economic Area
European Union
The relevant duties depend on personal-data processing, role, lawful basis, location and data-subject context.
Binding law · United States
U.S. Department of Health and Human Services / eCFR
HIPAA is not a general confidentiality law for every life-sciences dataset. Entity status and PHI determine scope.
Voluntary framework · Non-sector-specific; international use
U.S. National Institute of Standards and Technology
Provides risk-management outcomes and practices. It does not create a legal mandate unless adopted through contract, policy or another authority.
Consensus standard · International consensus standard
International Organization for Standardization
Specifies requirements for an AI management system. Use of the standard does not itself establish regulatory compliance.
Consensus standard · International consensus standard
International Organization for Standardization
Supports integration of AI-specific risks into organisational risk management; it is not a sector-specific legal rule.
Consensus standard · International consensus standard
International Organization for Standardization
Provides an information-security management system. Specific privacy, GxP and AI duties still require separate applicability analysis.
Harmonised guideline · ICH regions; implemented through regional frameworks
International Council for Harmonisation
Supplies quality-risk principles. It does not independently classify an AI system or prescribe one universal control set.
Harmonised guideline · ICH regions; implemented through regional frameworks
International Council for Harmonisation
Provides the pharmaceutical quality-system model used to place AI controls within governance, CAPA, change and management review.
Harmonised guideline · ICH regions; implemented through regional frameworks
International Council for Harmonisation
Applies to clinical trials within its scope. It should not be transferred to manufacturing or other domains without an independent basis.
Regulatory guidance · United Kingdom GxP
UK Medicines and Healthcare products Regulatory Agency
Used for data-governance and inspection expectations. Its scope and MHRA's stated GLP qualification must be preserved.
Regulatory guidance · PIC/S participating authorities
Pharmaceutical Inspection Co-operation Scheme
Inspection-oriented guidance. It supports, but does not replace, the binding requirements of the applicable jurisdiction.
Industry guidance · International industry practice
International Society for Pharmaceutical Engineering
Widely used industry guidance. It must not be described as legislation or a regulator-issued mandate.
Scheduled review: the source register and curriculum are reviewed at least quarterly.
Event-driven review: a new law, final guidance, material amendment, safety issue or broken primary link triggers targeted review.
Corrections: confirmed material errors are dated, corrected and described under the public corrections policy.