Governance Risk and Human Factors MOC
The enforcement-and-controls cluster: what actually draws warning letters (humans, not AI), the regulatory wave arriving between 2025 and 2027, the framework talks, and the security lectures arguing quality and security are one discipline wearing two badges.
Transcripts
Day one:
- Bharanitharan Rajendran (Validfor) - human error as the citation engine; the 2025-2026 regulatory convergence; five properties of defensible AI; the three-step Monday plan
Day two:
- Gaurav Walia (PQE Group) - the EU AI Act, Annex 22’s slide to 2027, FDA draft guidances, and the regulators’ own AI tools
- Expert panel: AI misuse and regulatory actions - biased screening, claim-denial laws, FCA actions, deepfake legislation; absent human oversight as the recurring root cause; CSA as the path forward
- Robert (Bob) Wherry (QACV Consulting) - the ten-step adoption framework; the Purolea warning letter and the MHRA blog; AI SOPs separate from the SDLC
- Aarti (Amy) Arora (RxT), part 1 - a cyber event can be a quality event; the AI-expanded control surface; co-design over handoffs
- Aarti (Amy) Arora (RxT), part 2 - four trust checks; responsibility splits by strength; the S.H.A.R.E. tabletop framework
Evergreen notes
- Human error, not AI failure, drives GxP warning letters
- AI development needs its own SOPs, separate from the software development lifecycle
- Human verification of AI output must be explicit because document creation no longer carries implicit verification
- Companies own the accuracy of AI-drafted submissions regardless of the drafting tool
- Regulators audit against principles, so size quality rigor to risk
- Assuming humans will follow SOPs is hope, not control
- In the GxP control loop, AI acts, humans decide, and the system remembers
- Regulators are becoming AI users themselves
- Tool-driven risk assessment beats debate because owners dilute their own ratings
- A security failure that changes a validated outcome is a quality failure
- GxP documentation builds institutional trust on behalf of patients
- Human-in-the-loop must be a named hard gate, not rubber-stamp oversight