KENX AI in GxP East 2026

2026-09-16-1331-trust-by-design-gxp-ai-lecture

43 min read

Trust by Design lecture on the AI trust paradox in GxP

Recorded 2026-09-16 at 1331 via Plaud. 38:21.

Summary

Risk Cortex’s compliance and quality authority lead (46 years in life-sciences computer-system compliance; Plaud diarizes her as Carol Maturianno) frames the trust paradox: AI promises speed while GxP demands deterministic, evidenced outcomes, so trust has to be engineered in from the start rather than bolted on afterward. Their three pillars: a Playbook (risk-based planning with objective, tool-driven risk assessment replacing room debates that get watered down because nobody wants to own residual risk); a Coach (the trademarked Expert in the Loop, a trained human who challenges, approves, and stays accountable, with every accept-or-reject decision audit-trailed); and Telemetry (continuous monitoring for failed jobs, anomalies, model drift, and complaints, plus automated regression on every update). Underneath sits a Semantic Risk Graph that converts regulatory rules into deterministic, explainable logic, wrapped in security controls: read-only access, sandboxed execution, tenant isolation, input sanitization, and versioned snapshots. Four lines of defense layer up: built-in AI controls, the Expert in the Loop, regulatory validation, and external audit.

The case study is a global pharmaceutical LIMS with 50-plus decision points: 75 percent faster validation, 100 percent risk coverage, and zero audit findings at the latest inspection. She also covers vendor qualification for cloud and SaaS through tailored IT audit questionnaires and SOC 2 certificates, and distills the FDA’s standing requirements to four items: requirements met, intended use met, risk-based approach, validated state maintained for life.

Plaud AI notes

<App-generated notes from the Plaud cloud, verbatim.>

Date Time: 2026-09-16 13:31:40 Location: [Insert Location] Instructor: Carol Maturianno; Carolyn Troiano; [Insert Name]

Plaud summary

The lectures address the “trust paradox” of integrating AI into GxP-regulated environments, where deterministic, validated outcomes and absolute data security are mandatory, yet AI is probabilistic and prone to errors. Both speakers emphasize the need for “Trust by Design,” operationalized through Risk Cortex’s three pillars: the Playbook (risk-based plan and objective validation), the Coach (Expert in the Loop, EIL), and Telemetry (continuous monitoring and analytics). Risk Cortex converts regulatory rules into a deterministic, explainable Semantic Risk Graph to enforce logic, generate requirements and tests, and maintain complete traceability and auditability. The EIL—a trained professional with deep operational and regulatory expertise—reviews, challenges, and approves AI outputs, remaining accountable to inspectors. This framework enables continuous, inspection-ready compliance, faster validation, full risk coverage, and improved ROI by applying AI to advanced “thinking” tasks rather than simple document workflows. Additionally, modern vendor qualification for cloud/SaaS requires tailored IT audit questionnaires, thorough policy/procedure reviews, and SOC 2 certificates to streamline due diligence and formal approval.

Knowledge Points

1. AI in GxP: Promise vs. Demands, Cost, and ROI

  • AI offers speed and efficiency but conflicts with GxP’s need for deterministic, validated results and secure, integral data; AI hallucinations and confident errors are inherent risks.
  • Non-compliance costs the industry billions annually, likely to rise with poorly integrated AI.
  • Many organizations deploy AI without clear objectives, yielding marginal ROI; leveraging agentic AI for complex reasoning maximizes returns.

2. Expert in the Loop (EIL)

  • Human oversight restores critical thinking lost with past automation; AI cannot be accountable—humans must defend decisions to regulators.
  • EIL qualifications include deep operational knowledge, regulatory fluency, and critical thinking; they serve as human guardrails.
  • EIL actions are audit-trailed: agree, disagree with justification, escalate repeat findings, and defend evidence to inspectors.
  • Certification program (Risk Cortex + BioPharma Institute) includes a free intro module and six additional modules (live/CBT) with practical exercises using Risk Cortex.

3. Trust by Design: Playbook, Coach, Telemetry

  • Trust must be engineered upfront; no single control suffices—layered defenses are required.
  • Playbook: identify GxP risks, prioritize controls, test performance; objective risk outputs (high/medium/low) foster consensus.
  • Coach (EIL): center of evaluation, decision-making, accountability; validates checkpoints and maintains continuous monitoring.
  • Telemetry: real-time signals (failed jobs, anomalies, model drift, complaints), proactive controls (automated regression tests), continuous validation on updates or functional changes.

4. Semantic Risk Graph and Security Controls

  • Rules from a unified regulatory framework are converted into a structured, deterministic, explainable graph enforcing strict checks.
  • Security and integrity controls include read-only access, sandboxed execution, tenant isolation, strict context scoping, full audit logs with versioned snapshots, input sanitization, constrained prompts, and output validation.
  • Customer data is not used to train models for other customers.

5. System Functionality and Evidence

  • Risk Cortex automates validation end-to-end: requirements enhancement (with citations like 21 CFR Part 11), test script generation, RTM, and summary reports.
  • EIL can accept/reject AI-proposed enhancements; rejections require justification and are audit-trailed.
  • Objective risk assessments reduce bias and gaming common in manual processes.
  • Continuous inspection readiness replaces ineffective “panic defense”; inspectors now demand defensible evidence and accountable ownership.

6. Risk Management and Defense-in-Depth

  • Three-question model (Hold, Assess, Shot): identify hazards, assess exposure, implement controls.
  • Four lines of defense: LoD1 AI controls (Semantic Risk Graph), LoD2 EIL, LoD3 regulatory validation, LoD4 external audit/certification.

7. Practical Results and FDA Compliance

  • Case study: global pharmaceutical LIMS with zero tolerance for uncertainty achieved 75% faster validation, 100% risk coverage, zero audit findings.
  • FDA expects: requirements met, intended use met, risk-based approach, validated state maintained for life; it specifies “what,” not “how.”
  • Common failures include repeat findings and lack of systemic controls; poor 483 responses can escalate to warning letters or consent decrees lasting decades.

8. Vendor Qualification for Cloud/SaaS

  • Thoroughly review vendor policies, procedures, practices, and certifications; document and retain records.
  • Use a tailored IT audit questionnaire; obtain and review the vendor’s SOC 2 certificate to address most security/compliance questions.
  • Produce a summary statement to formally document vendor qualification, adapting methods to modern technologies.

Questions

  • [Insert Question/Confusion]

Assignments

  • Visit riskcortex.ie and try the TriSpecLoom tool to explore requirements enhancement.
  • Download the free introductory module for the EIL certification from the BioPharma Institute and review the full program.
  • Evaluate current organizational AI use to move beyond simple workflows toward agentic “thinking tools” for ROI.
  • Implement continuous inspection readiness with layered controls and telemetry rather than last-minute preparation.
  • Use tailored IT audit questionnaires and obtain SOC 2 certificates to streamline vendor qualification for cloud/SaaS.

Highlights (button-flagged moments)

Introduction to the Dual Challenge of AI and Data Security in GxP Applications

The presentation slide visually establishes the core topic, “Dual challenge of AI & Data Security in GxP Applications,” which the speaker, Carolyn Troiano, immediately references as the subject of her talk. • Visual Context: The screen displays the title slide of the presentation, which reads “Dual challenge of AI & Data Security in GxP Applications.” • Discussion Insight: Speaker 1 introduces herself as Carol Maturianno/Troiano and frames her presentation around the central problem of ensuring trust and security when deploying AI in regulated GxP environments. • Key Takeaway: The speaker outlines the “trust paradox”: AI offers speed, but GxP compliance demands deterministic certainty, a conflict that requires new solutions like the ‘expert in the loop’ and ‘trust by design’ principles.

Addressing the AI Trust Paradox in GxP Compliance

The speaker presents a slide that frames the core challenge of using AI in regulated GxP environments and introduces the ‘Trust by Design’ system, which she explains is built on the three pillars of a Playbook, Coach, and Telemetry. • Visual Context: The slide outlines a problem statement: AI promises efficiency, but GxP compliance requires certainty. It then presents a solution system called ‘Trust by Design’ with three pillars: Playbook, Coach, and Telemetry. • Discussion Insight: The speaker clarifies that her company, Risk Cortex, addresses this ‘trust paradox’ by building ‘Trust by Design’ into its AI tool, defining the playbook as the plan, the coach as the ‘expert in the loop’, and telemetry as analytics. • Key Takeaway: The central thesis, echoed on the slide and in the discussion, is that a structured system, like the three-pillar model, is essential to reconcile AI’s probabilistic nature with the deterministic demands of GxP compliance, analogizing that ‘systems win championships’.

Evolution of GxP: From Manual Processes to AI-Driven Challenges

The speaker uses a presentation slide to contrast slow, traditional paper-based GxP processes with modern cloud-based AI applications, highlighting the dual challenge of ensuring GxP certainty and data security in this new paradigm. • Visual Context: The slide visually contrasts ‘Traditional GxP’—characterized by manual paper documentation—with the introduction of AI, which brings cloud-based GxP, increased regulatory scrutiny, and AI-led automation. • Discussion Insight: Speaker 1 elaborates that while traditional paper processes are time-consuming and prone to human error, the shift to cloud-based AI systems introduces complex compliance challenges, particularly in protecting GxP data and ensuring explainable, inspection-ready outputs. • Key Takeaway: The core issue presented is the ‘Dual Challenge of AI’: balancing the GxP compliance demand for deterministic, certain outcomes against the probabilistic nature and data security risks inherent in AI technologies.

While AI promises efficiency, GXP compliance requires certainty and a human expert to be accountable for and defend the output.

• Speaker 1 highlights the fundamental conflict: AI offers speed but is probabilistic, whereas GXP compliance demands deterministic outcomes and absolute certainty for data security and integrity. • To resolve this, the proposed solution requires an ‘Expert in the Loop,’ a human with critical thinking skills who is trained to challenge AI outputs, make final decisions, and be formally accountable for them during regulatory inspections. • An FDA warning letter was cited as an example where an employee incorrectly blamed an AI for a process failure, demonstrating the necessity for a human expert to be ultimately responsible for defending all system outputs.

Presenter Outlines the Three Pillars of Trust in AI Systems for GxP Compliance

During the presentation, the speaker explains that trust in the Risk Cortex AI system is built on the three pillars displayed on the slide: the ‘Playbook’ for risk-based compliance, the ‘Coach’ representing the expert-in-the-loop, and ‘Telemetry’ for continuous monitoring. • Visual Context: The slide presents a framework where trust is built upon three pillars, visually represented by football analogies: 1. PLAYBOOK (risk-based GxP compliance), 2. COACH (expert-in-the-loop), and 3. TELEMETRY (continuous trust). • Discussion Insight: The speaker explicitly references the slide, explaining that just like a winning football team, the Risk Cortex system uses the ‘Playbook’ (plan), ‘Coach’ (human expert), and ‘Telemetry’ (analytics) to ensure GxP compliance and trustworthy AI outputs. • Key Takeaway: The core methodology for building trustworthy AI in regulated GxP environments, as presented by Risk Cortex, is a three-part system combining risk management plans, human oversight, and continuous real-time monitoring.

Speaker Analogizes Risk Assessment to Squash Strategy

The speaker uses the on-screen squash analogy to explain the critical thinking process for risk assessment, correlating the player’s ‘Hold, Assess, Shot’ actions with identifying a hazard, understanding risk exposure, and implementing a control. • Visual Context: The presentation slide outlines a three-step risk assessment principle: ‘What can go wrong? (Hold)’, ‘What is at risk? (Assess)’, and ‘What action prevents it? (Shot)’, linking them to Hazard, Risk Exposure, and Control. • Discussion Insight: The speaker explicitly references the squash analogy on the slide, explaining that just as a player must pause and hold before a shot, risk management requires holding to identify what can go wrong before assessing the risk and deciding on a control. • Key Takeaway: The ‘Hold, Assess, Shot’ framework is presented as a practical model for applying critical thinking to risk management, emphasizing a deliberate sequence of questioning before taking action.

Speaker Outlines Four-Layered Defense Strategy for Building Trust in AI Systems

Using a football analogy, the speaker elaborates on the presentation slide’s four lines of defense for AI trust, identifying the Semantic Risk Graph and the ‘Expert-in-Loop’ as the first two critical layers. • Visual Context: The presentation slide lists four ‘Lines of Defense’ (LoD) for evaluating AI guardrails: Semantic Risk Graph, Expert-in-Loop, Regulatory Validation, and External audit. • Discussion Insight: The speaker confirms that building trust is like building ‘defensive lines,’ with the AI’s internal controls (Semantic Risk Graph) as the first line and the human ‘Expert-in-Loop’ as the second line responsible for decision-making and accountability. • Key Takeaway: The strategy emphasizes a multi-layered approach where no single control is sufficient, culminating in the principle that AI provides advice while the human expert remains in control and is ultimately accountable for the outcomes.

built in controls, risk graph??? what is this?

• Context: The discussion covers how to build trustworthy AI systems for GXP-compliant environments. The Risk Cortex tool is presented as a solution that engineers ‘trust by design’ through multiple layers of defense. • Key Insight: The ‘semantic risk graph’ is the core control mechanism, turning pre-set rules into a structured graph that all AI outputs must pass through for validation. • Key Insight: Trust is engineered into the system from the beginning, rather than being an afterthought, which is crucial for making AI recommendations inspection-ready. • Key Insight: The validation process includes logic enforcement, various automated checks, and verification by a human challenger agent known as the ‘Expert in the Loop’.

Speaker Details the ‘Trust by Design’ Workflow Centered on a Semantic Risk Graph

While presenting a slide on ‘Trust by Design’, the speaker explains how the system configures rules into a ‘Semantic Risk Graph’ where logic is enforced before an ‘Expert in the Loop’ verifies the output during the execution phase. • Visual Context: The presentation slide outlines a process flow from ‘CONFIGURE’ to a ‘SEMANTIC RISK GRAPH’ for logic enforcement, and finally to ‘EXECUTE’ with an ‘Expert in the Loop’. • Discussion Insight: The speaker confirms this workflow, stating that rules are set up to create the semantic risk graph, and every output undergoes logic checks before being verified by a human expert. • Key Takeaway: This ‘Trust by Design’ model ensures accountability by having a human expert—the ‘Expert in the Loop’—make the final decision and verification, as the AI itself cannot be held accountable.

RiskCortex’s Built-In AI Security Features Explained

The speaker details how RiskCortex’s ‘trust by design’ approach is implemented through the on-screen ‘Semantic Risk Graph,’ which provides built-in protections against data security threats like unauthorized changes, data leakage, and prompt injection. • Visual Context: The slide illustrates how the RiskCortex Semantic Risk Graph addresses four key data security/integrity risks: unauthorized data changes, cross-tenant data leakage, loss of audit history, and prompt injection. • Discussion Insight: The speaker emphasizes that trust and security are ‘built in, not bolted on,’ explaining that the Semantic Risk Graph enforces strict logic and checks to mitigate these risks from the start. • Key Takeaway: The tool ensures data integrity through features like read-only access, tenant-isolated stores, and a full audit log, which are designed so that even if the primary expert leaves, a successor can understand and defend the system’s history during an inspection.

Continuous Monitoring and Proactive Controls Ensure Constant Inspection Readiness

The speaker introduces the concept of ‘telemetry,’ the third pillar of their system, which is visually represented on the slide as a continuous process of monitoring signals and applying proactive controls to remain perpetually ‘inspection ready’ and avoid ‘last-minute scrambles.’ • Visual Context: The presentation slide advocates for ‘NO LAST-MINUTE SCRAMBLES!’ by highlighting a process of ‘Continuous monitoring of signals’ and ‘proactive controls,’ which builds inherent trust. • Discussion Insight: Speaker 1 explains this as ‘telemetry,’ where continuous real-time monitoring for anomalies like model drift allows for proactive controls, such as automated regression tests. • Key Takeaway: The goal is to maintain a constant state of validation and ‘Inspection Ready’ trust, so that preparing for an audit is an ongoing process, not a frantic last-minute effort.

Transcript

[00:00] Speaker 1: I’m Carol Maturianno. Nice to see everyone here and coming. And in your pamphlet, the title is “Established Continuum Scalability Through Real-Time Mining.” And to demonstrate that, the subtitle “Dual Challenge of AI and Data Security in GXP Applications.” Can everybody hear me? Okay. Okay. So basically, I’m here to present the dual challenge, AI and data security in GXP applications. And I have 46 years of experience in life sciences, focused on regulatory compliance for computer systems and data. And it’s kind of interesting. Everybody in here, I’m sure, has used some form of AI, and you know about hallucinations and drift and all kinds of things that can happen. It can sound very confident when it’s not. And just a quick story. I was. As part of my role, I’m the Compliance and Quality Authority Lead at Risk Cortex, and as part of my role, that’s an agentic AI platform, next generation, and it’s for verification of data assets or validation of computers or processes, and it looks at risk management as well. So, as part of that, I convene a bi-monthly roundtable, and I look for global regulatory experts to bring in to Just kind of have a very casual conversation about about a topic, a couple of questions, and then let them converse. What was interesting was I went to ChatGPT. I had been using it for a while, and I said, “Can you give me a list of the top global experts in computer system and data regulations compliance?” And I guess because I had been using it for a while, it wanted to please me. So when I got the list back, I was number one on the list. So for a day, I was like, “Oh, I’m number one in the world. There I am.” But then, you know, I looked at Copilot and Gemini with the same prompt, and I wasn’t even in the top 20. So I mean, but it just goes to show you how much it starts to know you and want to please you and do things, which really doesn’t do you very much service. In fact, another time I was researching something. And I said I’m looking for information several topics, and it gave me a whole list of references. They were all me as a source. I thought, well, I already know that. Give me some sources for other people doing some information, you know, providing information the same thing. But you have to be very careful with AI. So, basically, I also run the Expert in the Loop certification training program for Riskortex. And that’s a program we founded this year. We started it up in conjunction with BioPharma Institute. And if you go to the BioPharma Institute website, you can actually get a free introductory session download for the Expert in the Loop program. So it’s like an introductory model module, but then there are six other modules, and both live and CBT. And the certification program also includes practicals. Where you get to see the Risk Cortex tool, you get to log in, use it, demonstrate your capability, and that’s part of the certification. So, we realized very early on that with Risk Cortex being an agentic AI solution, you’ve got to have the expert in the loop, and we kind of trademarked that name because that’s the person who has to go through some rigorous training to know not just their operational area; they need the depth and breadth of that. But they also need to know regulations that apply, and they need to be able to challenge the AI output. So they’ve got to look at the AI output. They’ve got to do a judgment of it. They’ve got to make decisions based on it, and be accountable because AI can’t be accountable. And we saw that with Purilator, I think that’s the name of the company, cosmetics company, early this year, got cited for, I think it was misuse of AI was the term they used. But basically, somebody was being interviewed by the FDA, and they got a warning letter from it. And the person said, “How did you come to that decision? You you missed a step in some process.” And the guy said, “Oh well, the AI didn’t tell me I needed that step.” So, completely leaning on AI, not challenging any of it, taking it at face value. And I always say, like in the 80s. We started validating systems. ‘83 was the first guidance. I was there. And once you had computers and automation and validation, people started basically taking the output at face value, implicitly accepting it. And we lost the art of critical thinking, and that’s the art that we need to bring back because of AI. So a big component of the expert in the loop training is the Critical thinking. How to do that? How to become that person? And not everybody is good at it. Not everybody belongs in that role. But you know, you want the AI to do the rote behavior. You want some people to do the rote if they’re not good at critical thinking. But you want those critical thinkers to be there to guard, guardrail, human guardrail, the tool. So when we look at AI, when we look at the industry, the life science industry. Right now, the cost to the life science industry annually is 10 billion dollars just for remediation based on citations, and I would imagine, based on people starting to bring AI in, that’s going to escalate. And what I’ve seen is most people in industry are using large language models, ChatGPT, Copilot, Gemini, Claude. They’re not using agentic AI or things that are more thinking tools. And that’s where the EIL, the expert in the loop, comes in. You’ve got to have somebody in control of that. So right now we have a dual challenge of AI of trust, where you have to secure the data, you have to deploy trustworthy applications in GXP. But how do you do that with AI? And that’s the the challenge right now, or the challenge is trying to make the slide move. There we go. Okay, so managing managing the AI trust paradox in GXP. The problem statement: trust in AI means you have to have excellence across multiple disciplines. You can’t afford to have a single weak point. Everybody has to be on it’s non-negotiable in a regulated environment. So the problem statement we’re sharing is that the trust paradox for AI. AI promises speed and efficiency. It’s got great benefits, but GXP compliance demands that you do things that are deterministic. You can’t have any question as far as outcomes in terms of data security and data integrity. So we address this at Risk Cortex by focusing on trust by design that’s built into the agentic AI tool, and it’s built on three pillars: the playbook, which is the plan. The coach, which is the expert in the loop that I described, and telemetry, the analytics and probabilistic estimates, and our approach is to use the system’s system to win championships. So this system of playbook, coach, telemetry is to win championships, and we use a lot of sports analogies here. So here, when we look at traditional. GXP traditional validation, paper documents. You’ve got drafting, refining, consensus sign off. That takes significant time, a lot of resources, and we still make human error, so it’s not even foolproof. So now with cloud-based AI-enabled systems, now we’ve got further complications and a more complex compliance picture. Increased regulatory scrutiny. The compliance is very complex. So there really are two big challenges: protecting your data, GXP data, and especially now with cloud and AI-enabled apps, you have increased regulatory scrutiny. You’ve got to protect the GXP data. You also have to have outputs that are explainable and inspection-ready. So someone, the expert in the loop, has to be able to be accountable and defend what, why they agreed an output was good, and what decisions were made based on that. And inspectors used to ask for documentation, and I’ve seen so many where they did an SOP review or some other documents were reviewed. But now they’re looking for evidence, and not just the evidence documents or whatever that that is form that takes. But they’re also looking at someone to defend it, to explain it. And if you’re not accountable, you can’t explain the output, can’t defend it. AI can’t help you. At that point, you’ve got to be the expert in the loop who can be Accountable and responsible for doing that. So AI promises. Where are we? AI promises efficiency, but GXP compliance means you need to have certainty. So AI and data security integrity—it’s probabilistic. AI is probabilistic. So really, it’s based on or relating to the likelihood. Of something happening rather than providing total certainty doesn’t provide certainty. Now it may hallucinate, and it can sound very confident even when it’s wrong, and it happens all the time. I’ve had people tell me they were researching something and got these journal citations, and the journals didn’t exist or the article didn’t exist. So you have to check and verify everything. And what I find is. I think it’s 65 percent or so of companies have deployed AI, but only about 16 percent consider them themselves users that are high AI users. So people are not taking advantage of those big wins that you can get from AI. People poured money into this thing a couple of years back, two five years ago. They poured money into it, but without a purpose. They just thought we’ve got to have AI. We have to say we are using it. We have to tell the board that we’re using it. And they put the money in, but they didn’t get the reward from it. They weren’t able to lay off so many people, or reduce costs, or come back with any kind of return on investment. And the problem is that you’re only going to get a marginal return if all you’re using it for is documents and workflow, simple tools, AI tools, large language models. But if you want to do thinking tools like Risk Cortex, agentic AI tool. You’ll get the reward. You’ll get the return on investment maximized by doing that. So don’t leave a, sorry, don’t leave ROI on the table, which is what you will do if you don’t start making use of it. And you can’t make use of it without having a qualified expert in the loop who can look at it and see what, what’s going on. So in addition, you have to worry about security. So, no room for uncertainty. You need deterministic behaviors, and you need complete audit trail. You need evidence-based decisions. This is what GX compliance, GXP compliance demands. Evidence-based decisions, and you can’t bolt on the trust once you’ve already deployed the model. You’ve got to engineer from the start. That’s where we do trust by design, engineered. Where the tool is guardrails already with technical guardrails, and then the expert in the loop is another layer of that guardrail and human guardrail. And of course, you have the review and approval of things. So you’ve got multiple layers with validation and other activities, audit. But you have to be able to do that from the start. Now we see how panic defense doesn’t help you when you have an inspection. Coming up, if you know it’s coming up, you get under stress. You go into panic defense, and you, your inspection is expecting you. The inspector is expecting you to have robust evidence and consistent controls throughout, and you have to be building this over time, not just before an inspector comes in. You don’t want to go out and start finding your evidence when you know the inspector is coming next week. You want to be prepared. Inspection ready all the time, and just like with a team, you don’t build a winning system in a week. People have to be trained; they have to go through training season before they get out on the field. So, build trustworthy GXP systems one step at a time. You’ll get clean audits, and that will give you the trust of the auditors, the customers, and the regulators. And I’ll walk you through how we do this. So trust in our system is built on three pillars, and these compound over time. In terms of sustainability, in terms of return, these are things that are very important. And if we look at football again, we see a football match has a winning system, and they have it based on three pillars. They do the playbook, they do the coach, and they do telemetry. They do it a little differently, but similarly, with Risk Cortex, we design the trust into the system with three pillars. First is the risk-based GXP compliance, identifying risks, prioritizing controls, testing performance. Then we get into the coach, which is the expert in the loop, human oversight of the continuous monitoring validation at key checkpoints. So Risk Cortex takes you through the entire validation process from planning through. Reporting, it goes off and autonomously does an enhancement of your requirements. So you can feed any kind of contextual documents in. You feed in all the global regulatory governance that you need if you have to comply with things in the U.S. or in Europe or anywhere in the world, and then it’ll come back and it’ll say, “Here’s a set of requirements that are enhanced,” and tells you exactly where that enhancement comes from. It’s from this citation. It’s from 21 State Bar Part 11, or something else, and then you can either accept it or reject it as the expert in the loop working with the Risk Cortex tool. And if you accept it, that’s fine. If you reject it, you have to provide a reason, and that gets put in an audit trail. So everything is built into the tool, complete audit trail, complete workflow, and you have it all there when an inspector comes in. And after you get your requirements enhanced, it goes back and autonomously does an objective risk assessment, and that’s important because if you’ve ever sat through a risk assessment manually, I’ve sat through ones that had 20 people in a room for six weeks straight, arguing because they were looking at a scale of one to ten, arguing is it a three or four, is it a seven or an eight, and most of the time they would they would water down the results because. They would learn throughout this process that someone has to own residual risk. You don’t mitigate it to zero, and people don’t want that hot potato. So, a lot of these risk assessments, the output are really not meaningful because people have been doing that kind of gaming the system and watering it down. So, this is an objective risk assessment, and it actually comes back again and says, for every requirement, here’s the risk, and here’s why. And it’ll tell you exactly what citations make it high, medium, or low. And we do high, medium, low because it’s easier for people to come to consensus. And you can take that to a group of people, stakeholders, and say, “This is the objective output. What do you think?” And get that agreement fairly quickly. So here, we’re looking at the playbook. We’re looking at the coach, the expert in the loop, and the telemetry. Because once you do your validation, also the risk assessment comes back. Same thing with the expert in the loop. You get to look at it, say I want it, I don’t want it, I disagree with a reason, audit trailed, and then you finalize it, and it goes off and does the test scripts. And in the end, you get the requirements traceability matrix, the summary report. Everything is built into this one tool. So you you ensure that trust by design. Carries through. It’s bolted as a core element, trust and risk, at the core of the tool. So now we’ll switch to squash. Let’s look at a squash model. Here, we’ve got, for example, coach drills and novice. They drill them to pause and hold before they take a shot. Similarly, this is. It’s a split second assessment of opponent, opponents, patterns how they play, but it’s the same thing that you can hold, understand risk scenario and choose the correct control. Same pattern of of things done in the tool, the RiskVortex tool. So you ask three questions: What can go wrong? That’s where you hold and ask that question, and that’s critical thinking, asking why, why things are happening. Then what is at risk? Assessment. And then, what action prevents it? That’s your shot. It’s your control. So it’s the hazard, the risk, exposure, and the control, all taken into account. And through those three questions, you’ll get to know exactly where you should be going. So critical thinking again: determining what control for what risk, asking questions, questioning assumptions, removing bias in your thinking, looking at things from different perspectives. That’s necessary, and that’s what the expert. The loop does. So now, let’s look at go back to football. So here we look at the lines of defense, and you’re building trust like defensive lines on a pitch. The first line of defense is with AI in the Risk Cortex tool with built-in controls, and we have the semantic risk graph, which is the control. Line of defense two, the expert loop, who is the centerpiece of evaluation, decision making, and accountability, and then you have the third line, regulatory validation, the fourth line of defense, external audit and certification. So no single control can carry the whole match. You have to win with the depth of all these controls taken together. And AI is advisory, but the expert is in control and accountable. And that’s got to be the case. No single control. You need depth to win. AI will advise and recommend, but the expert has to make the decision and be accountable. So this shows a little bit about the trust by design configuration, semantic risk graph, and execution. So here we create trust by design. We set rules up. This is what the risk graph does. It is going to set rules. That are turned into a structured graph, semantic risk graph, and then every output has gone through logic and strict checks. So you have logic enforcement, you have checks, you have the challenger agent who is the expert in the loop, who does verification and execution of this tool, and then the expert approves and is accountable. Somebody has to be holding the bag because AI can’t speak. Which is a good thing. So now we see trust by design, data security, and data integrity built in again, not bolted onto the tool. So here, it’s built into the semantic risk graph to handle data security and integrity. You look at things like unauthorized changes, cross-tenant data leaks, audit history loss, prompt injection attacks. Everything is isolated. Everything is logged and audit-trailled. So that’s where the tool comes in handy when you have an inspection, and someone who’s been working with it as the expert to be able to defend what was going on. And even if that person leaves, and an inspector comes in six months later, somebody who is now the expert should be able to pick up exactly what the tool is doing and be able to defend it as well. That’s the beauty of it: is that it’s not like relying on someone’s tribal knowledge. So. Okay, so here telemetry. This the third part, third pillar, for monitoring of signals and proactive controls. It’s trust built in, not a last-minute addition or a scramble. So here telemetry, you can’t get fit on match day. A player’s fitness is tracked through the whole season. Trust building is trust built in, continuous real-time monitoring, and this for looking for. Failed jobs, anomalies, model drift, complaints on your desk. So proactive control is what’s used: automated regression tests, and then inspection ready trust. You are inspection ready all the time, so that every time you have an update to the software, you run it through this process. Anytime you want to change something, same thing: functional change or just an update. You can always be in a continuous state of validation. You can run it any time, even if you don’t have changes, just to check, make sure you’re still okay. Now, I’m going to look at a real example of a complex system showing the AI trust paradox. So, this is a global pharmaceutical quality testing system. It’s a lab information management system, a lens. It has 50 plus decision points. It’s deployed across multiple sites. It’s running on both legacy and modern platforms. And it’s high risk, and scrutiny is is heavy, because it’s being used to release product. For example, whether test results agree that it meets specification should be released. So there’s no room for uncertainty. You have to apply risk-based validation. You have to have the expert to review the gates and continuous monitoring, and the results speak for themselves. Risk Cortex has shown through different pilots and implementations. 75% faster validation time, 100% risk coverage, and zero audit findings in the latest inspection for this particular case. So, what we mean by systems win championships, trust by design from the start brings in you have speed and certainty, inspection-ready outcomes. So here, the message is clear: you want to have. The most return on investment that you can get, and you’re not going to get that just from large language models (LLMs). So, don’t miss out on using AI that’s intelligent AI, thinking AI, like Risk Cortex. If you do, you’re leaving ROI behind on the table. And a lot of the people who are in those positions where they they allowed the funding of all these things for the last couple of years are now being called on the carpet by the board to say. You you spent all this money. What did you get for it? And they’re really at a loss. They can’t figure out what happened. And most of them are worried that they’re going to be replaced. And the other part about the expert in the loop is that it upskills people so that they are more marketable. So if you’re mid season of your career or even starting out, you can learn this discipline, and you can become the expert in the loop. Eventually, that will be a role in industry. It’s not a role today. We’re actually going to post a job description in the near future to say this is what companies need, and drive that. You know, it doesn’t matter what tool you’re using; you need expert in the loop people who can defend and be accountable. So, the huge promise of ROI from AI will be achieved using tools that are going to enable. The expert will look to judge outputs, make decisions, take actions, and defend them to the inspector. So, AI changed the picture, and you can overcome that trust paradox that we talked about to have trust as the ultimate competitive edge. So that’s what this tool does. It gives you trust as a competitive edge. So, overcoming that is a very big difficulty in most cases. And people are at a loss for how to do that and what kind of governance to put in, and of course it’s going to kill us in ten years anyway, so maybe we should worry about it. But you don’t want to scramble at the end; you want to build things in from the start, and that’s where building in trust from the start is the root of risk cortex. You’ll always be inspection ready. That system of three pillars: the the playbook, the coach, and the telemetry. That’s how you win championships, and how you compound the returns through every clean audit that you get. So that concludes the presentation. Are there any questions? And I also have handouts up here and business cards. If anyone’s interested, please pick them up. One thing I will note is if you go to riskcortex.ie, the website. Here you’re going to get, and I apologize for not having it on the slide, but Ritz Cortex One Word. ie It’s a UK and Irish company. If you go to the website, the first screen you get in the top center, it’s called. It says TriSpecLoom, S P E C L O O M, and if you click on that, you can actually go in as a user and try the requirements enhancement piece of. The Risk Cortex tool, so you can see a piece of it. But if you want a demo, certainly my cards are here. Please feel free to contact us, and we’ll give you a demo of the product. So the Biopharma Institute is the other element where they have the Expert in the Loop certification program out on their platform. So if you go to Biopharma Institute, their website, just search for the Expert in the Loop certification program, and it’ll come up with a list. Of different different courses and modules you could take, but it also has that free introductory course, and that’s a good way to get acclimated to the idea that this person has to play a special role. And if you want to upskill yourself, that’s the way to go. But certainly, if we can do a demo for anyone, you know, we we’ve done a lot of these, and they’ve been very successful. Implementations have been successful. And we love to have feedback from people, especially people looking at a demo and telling us if anything’s missing or what they’re looking for, their expectations. It’s a great way to continue to improve the tool over time. So, any questions? I have one.

[29:03] Speaker 2: Yeah. How long have you had this product? You know. In the market.

[29:10] Speaker 1: This version launched in March. We have four customers we’re working with now to implement.

[29:20] Speaker 2: And the example of the limb system that you mentioned. Yeah. You said that you were also able to look at, you know, clean audits as part of that system. So how much? Like, what’s the length of time for which you have data to look at it? And is it based on an inspection or just internal audits?

[29:42] Speaker 1: This was. I believe based on an inspection from an auditor, but also keep in mind. So the validation gets condensed. If something takes, a lens might take six months or a year to validate, and we break it down to weeks, where you can get the whole full validation package, the documentation pack. So after that, it’s continuous monitoring, and so any inspections that happen, you’re able to get that feedback right away. This is one particular case that was done. I believe was done at the end of last year, and they went through an audit from the outside, and everything looked good. So, that’s that example. Thank you. Okay.

[30:25] Speaker 3: Any other? As part of the overall telemetry process, the signals that are generated may or may not warrant corrective controls or other activities to go downstream. Traceability into the signals that are generated, and then either some kind of documented acceptance or dismissal of those signals as warranting an activity associated.

[30:54] Speaker 1: Yeah. So as you’re doing it, you will get information back from the from the system saying, ” Okay, you validated it at this point. Now we’re doing continuous monitoring, and you’re looking to validate it now with a change to your function.” But these are the flags, the red flags that are coming up, and then you can determine: are they something that I I want to continue looking at, or is it irrelevant in this case? I mean, there are many reasons why even a requirement you may not want it, even though you are regulated and required to have it. You may not be able to do it. You may have to put a procedure in place to work around it. So, and I find that lots of legacy systems that don’t have audit trails and they’re on individual. Computers and instruments and labs and manufacturing equipment, and without an audit trail, you you’re really stuck without being able to do that. FDA expects you to have some kind of balance book or control forms that you’re using to record who did what, when they logged in, when they logged out, what they did, and signing it. So if you do that, that’s fine. But most companies they don’t do that.

[32:03] Speaker 3: Yeah, I was just thinking of where’s where. Even with without a tool, where you know SMEs are generating potential risk signals that are being escalated to various you know quality departments, and then they’re being dismissed kind of offhand, or maybe they are accepted further. But then it’s if it comes up again, then it’s up to the SME to recognize that oh, I I brought that up last time and it got dismissed, and we didn’t implement corrective control. And it would be nice to record that.

[32:31] Speaker 1: Yeah, yeah, and so that would be recorded, and these. The person using the system would have the ability to respond to that and document that within the tool, so that it is escalated, and they would be that first point of stopping. You know, there’s a problem here, and reporting it. And if it comes out repeat, that’s a real issue. So if they can fix it right then, yeah, we want to look at repeat findings and those kinds of things. And a lot of companies are getting cited for not putting in systemic control. So something happens, they put a band-aid on it. They don’t look at other parts of the code that could be affected, and or similar to see if if they’re compromised. They just fix the one with a band-aid and they move on. So FDA is is getting people for that citations. And the other thing is that many companies have repeat findings. So going from one year to the next or next, same things are coming up over and over again, and they are not giving very good remediation plans to FDA. They’re not responding in some cases. If you don’t respond in time or effectively, you’re going to end up escalating. If it’s a 483, it’ll go to a warning letter. It’s a warning letter. It could go to a consent decree, and I’ve seen consent decrees can run 20 to 25 years in duration because. The work to get that done is so it’s so expensive. First of all, you have to have shadow people looking over the shoulders of people who are operating and touching product using that system. So you end up layers of extra hands that are very expensive, and the time lost, and then the idea of the reputational harm. So you don’t want to escalate. If you with FDA, you want to respond in a timely manner and do that. But amazingly, a lot of companies don’t do that. They’re not very good at it. So, any other questions? Anybody want to demo? You can try the try SpecLoom at the website. Just try SpecLoom at riskortex.ie, and that’ll give you a feel for the tool and the capability. And it does go way beyond that with the risk assessment that’s objective, and then tying everything together with a validation package. So, having done this for well since the nineteen eighty three guidance has been out, I started developing ways of methodologies for doing validation. There was nothing out there at the time, and it’s evolved over years. and Technology has evolved, but I can tell you one thing: FDA tells you what is required. They will never tell you how to meet the requirement, and so there are four things that they require for any technology. You just have to figure out how to apply it. So you have to show that the requirements are met. You have to show that the intended use is met. You have to take a risk-based approach in validation, and you have to maintain the system in a validated state for life. So if you look at those four things and try to figure out how to meet the requirements. You have to be creative too. I know I’ve had so many people who do endless screenshots during testing. You know, big buckets of paper. And what I suggested about seven eight years ago, I said, why don’t you do an AV recording, audio video recording? You start it, you sit down to test, and you keep going through, and you end up with a file that you can you know your voiceover, your showing on evidence on the screen as well as your voice. And then you lock it down; no one’s able to edit it. But you have to label your files because I did have one client who didn’t label anything, and when the auditors came in, they had a nightmare trying to figure out if they could show a certain piece of that that evidence. And then the other thing is websites where you can’t go on site and audit a vendor. Say they’re a cloud provider; their software as a service. You can’t get on site to do an audit. You go to their website. And you look at all the policies, procedures, practices, certifications, everything that they have to show that they do meet the requirements. They are qualified to provision and support your system. And you want to have that at least on file. I use an I T audit questionnaire. It’s a generic questionnaire that I tailor for each particular vendor, and then go to the website. And if you can get a SOC 2 certificate, the SOC 2 certificate. Is what you need in a cloud environment or a SaaS environment, and if you get that document, it answers most of the questions in your questionnaire, and you can write up a summary statement saying whether or not you have qualified them as a vendor you’re going to use. So things like that, you have to think differently. You have to try to apply different ways of doing things when you can’t do it the old-fashioned way. But there are so many new technologies coming out, and I’m sure there are going to be many, many more that we’re going to have to figure these things out as we go. So, any other questions? Oh, okay. Well, thank you very much.

Graph View

Backlinks