The takeaway Eric brought home from the 2026-09 GxP conference and debriefed in the 2026-09-24 one-on-one: the FDA does not audit against a fixed checklist. It audits against a set of principles, and it is up to each company to prove it meets them. The hundred-item validation checklist that makes everyone miserable was written internally, not imposed. That means the right move is not “do seventy of the hundred prescribed items” but “write a seventy-item checklist for the simple domain and a hundred-fifty-item checklist for the hard one.” Rigor should track risk, and the anchor is the promise to patients that medicines are made exactly the way they are documented, with evidence to show it. That promise is GxP documentation builds institutional trust on behalf of patients, and the evidence is Validation is data, not an event rather than a longer checklist.

The same logic extends to how SOPs live. An SOP consumed as an acknowledge-click PDF proves nobody read it; an SOP that matters enough to regulate behavior matters enough to sit down and discuss, thirty minutes at a time. For AI work those procedures cannot be a software lifecycle in disguise, which is why AI development needs its own SOPs, separate from the software development lifecycle. And it bounds how far technical people can go embedding themselves in the business: leadership’s shadow-IT objection (building without processes, skipping GxP, skipping SOPs) is answered by SOP fluency plus the character to say “now is not the time to build” when the process says so. Freedom to right-size and the discipline to follow through are one package. Right-sizing the AI case is how Validating an AI system in a regulated industry means validating a measurement system picks a threshold, and how Assurance must scale with autonomy picks a rung.