AI use case risk classification that lights the path as the idea is typed, every branch tied to its clause
Every new AI idea classified in minutes, each conclusion tied to its clause.
See one case, screen by screen ↓Placing each new AI idea in a company under the rules that apply to it — its EU AI Act category, its GxP criticality, its model risk, personal data and vendor terms — so it gets the right review tier and the right reviewers. AI Use Case Risk Classification does this as the sponsor describes the idea, with six agents that cite the clause behind every branch and an AI review board that decides.
How to choose AI solutions for life sciences →
Updated
Every part of the business now brings AI ideas to the governance office: a QC lab wants help classing deviations, HR a candidate-screening assistant, commercial call analytics, patient services a chatbot. Each one has to be placed under the EU AI Act, judged for GxP criticality under draft EU GMP Annex 22 and GAMP AI, checked for model risk the way the FDA's draft guidance weighs model influence against decision consequence, and screened for personal data and vendor terms. Today that runs through a 40-question form, re-interviews and four separate reviews.
The risk sits in the gaps between those reviews. Each reviewer reads a different framework, and the reason for a tier is rarely written down, so the same idea can get a different answer six months later. Answers contradict the attached design — “no personal data”, while the data flow sends analyst names — and nobody notices until the DPIA. Generative tools slip into GMP decisions through a tenant the company already uses for meeting notes, and when Annex 22 is final, no one knows which earlier decisions cite the draft.
Before: the working solution's own estimate of about five weeks (35 days), as its dashboard splits it — classification was done inside the reviews. After: the dashboard's median days per step over the last 30 days, on its sample portfolio.
Six specialist agents read the idea as it is typed, light the classification path and route the reviews; the AI review board decides.
At Northwind Bio, Dr. Maya Chen, head of the QC laboratory at Plant 3 — Leiden, wants an assistant to class about 40 deviations a month. She submitted it on Oct 4 as AIU-2041, Deviation triage assistant. Here is how it is classified, redesigned and signed, screen by screen, in the working solution.
Dana chairs the AI review board. Her risk map places every idea at Northwind Bio: sales-call emotion scoring in Prohibited, candidate screening in High-risk, the patient chatbot under Transparency, and three ideas — deviation triage, vial inspection and a synthetic control arm — in minimal risk but critical GxP. The regulatory clock beside it counts what each date affects: the Annex 22 final text, expected in Q4 2026, puts 6 decisions up for re-check.
“AI review board · Thursday Oct 8 · 3 decisions on the agenda”
Each use case shows its sponsor, EU AI Act category, GxP impact, review tier, stage, days open and next step. The deviation triage assistant has been open 3 days: minimal risk under the AI Act, critical GxP, enhanced review — next step, choose a redesign. Batch record review by exception is still in intake, waiting for 2 answers from its sponsor.
Sofia types: “Reads each batch record and releases clean batches automatically, with no QA sign-off.” The path reads the process as Manufacturing or QC (GMP) and who acts as “Sets the outcome itself”, each tagged “read from the description”. She picks a generative model on a vendor with the no-training option. The GxP branch lights Critical GMP · high risk, the FDA branch high model risk, and the tier reads “High risk · not allowed as designed”, routed to Sam Patel, Omar Haddad and Dana.
“Releasing a batch with no QA sign-off is a critical GMP use.”
Each branch carries a one-sentence reason with numbered citations. Clicking one opens the clause itself: draft EU GMP Annex 22, Section 1 — Scope, with the passage the classifier relied on highlighted, and a link into the rule library.
Annex 22 §1: “Dynamic models … and models with a probabilistic output, such as generative AI and Large Language Models (LLM), should not be used in critical GMP applications.”
Classified from 5 answers and 4 documents. Maya's answer — “Ideally it sets the class in the QMS” — matches design §2.3, which says the assistant sets the deviation class in the QMS record, and under QA-114 the class decides CAPA and batch disposition. The model card shows a generative model. EU AI Act: minimal risk, AI literacy applies. GxP: critical GMP, high risk. FDA: high model risk. Personal data: design §3.1 sends analyst names, though the answer said none. Vendor: the no-training option is not signed.
“High risk · not allowed as designed — A generative model would decide a critical GMP outcome. Two redesigns make it approvable.”
Dana chooses the first of two redesigns; the other, a static, validated model, would mean full validation over 4–6 months. The GxP branch re-lights as non-critical, person decides — a qualified person decides every output, with the operator's duties written down — and the FDA branch drops to medium model risk. The assessment planner creates 6 assessments with owners and due dates and puts the use case on Thursday's agenda.
“Enhanced review — Approvable: a QA reviewer decides every deviation. 5 conditions, then the board signs.”
Suggestion only — the assistant never sets the class. A qualified QA reviewer confirms or changes every suggestion, and the choice is recorded. Analyst names and initials are removed before any text leaves the company. The enterprise no-training option is signed and data stays in the EU region. Agreement and override rates are reviewed quarterly, with a re-check on every model version change.
Meaning of the signature: “I approve this use case with the conditions above.”
Once Dana signs, the assessment planner writes inventory entry REG-0413 and sends the assessments to their owners: the validation plan and monitoring plan to Sam Patel, the security review to Omar Haddad, the no-training option to Hannah Brooks, the privacy note to Lena Ortiz and AI literacy training for 12 QA reviewers to Maya.
“REG-0413 · In the AI inventory — Approved with 5 conditions · signed by Dana Okafor”
The use case keeps the intake conversation, the attachments, a classification sheet of seven dimensions with a confidence for each — 93 for the AI Act category, 90 for GxP criticality, 97 for model type — the assessments, the approval route and the activity. The inventory entry names Maya as owner, the next review on Jan 7, 2027, then quarterly, and monitoring of agreement and override rates and model version changes.
Evidence, design v0.3 §2.3: “The assistant sets the deviation class (minor, major or critical) in the QMS record.”
The rule library holds the EU AI Act, draft Annex 22, a GAMP AI summary, the FDA draft guidance, GDPR and Northwind Bio's AI policy, clause by clause, with the use cases that cite each one. Four open use cases and two inventory entries cite draft Annex 22; one click previews what changes if the final text keeps human-in-the-loop for non-critical generative use and adds an operator training record.
Change rule: “A change re-checks every citing decision.”
The same AI idea, seen by the people who carry it — the governance lead, the sponsor and the reviewers — before and after.
Six specialist agents read the idea as it is typed, light the classification path and route the reviews; the AI review board decides.
Talks to the sponsor in plain words, asks only the questions that change the classification, and requests the design and vendor documents. When an answer contradicts a document, it asks once and records both.
Reads architecture, data-flow and vendor model documents and pulls model type, hosting, data fields, training terms and who acts on the output — each with its page — and compares them with the intake answers.
Checks Article 5 practices, Annex I and Annex III, Article 50 transparency and deployer duties under the EU AI Act.
Decides GxP criticality against draft Annex 22, GAMP AI and the company's AI policy 6.5, and model risk with the FDA influence × consequence grid; drafts the validation approach.
Finds personal and special-category data, automated decisions, confidential data leaving the company and vendor training terms, with the contract system read only.
Turns the classification into the required assessments with owners and due dates, routes the reviews, builds the board agenda and writes the inventory entry after the decision.
Decides, with conditions on the record. The agents propose; a named person decides.
Ask in plain words about a classification and the clause behind it, list use cases by risk or stage, or describe a routing rule — every answer points to its source.
Why can't the deviation assistant go ahead as designed?
As designed it would set the deviation class in the QMS — and the class decides investigation depth, CAPA and batch disposition. That is a critical GMP use, and draft Annex 22 keeps generative models out of critical GMP applications. Our own policy says generative AI must not make a GxP decision. Yes if: it only suggests and a qualified QA reviewer decides every deviation — then it is non-critical with a person in the loop.
Which use cases are high-risk or prohibited?
Two open ideas. Sales-call emotion scoring infers employees' emotions at work — banned since Feb 2025 under Article 5(1)(f). Candidate screening is Annex III point 4(a); deployer duties start Dec 2, 2027 and the DPIA is under way.
Add a rule: agents that email people outside the company need a security review
Added to the routing rules and switched on: “An agent that sends email or messages outside the company → security review by Omar Haddad.” Today it would route 1 open idea — the patient-support chatbot (AIU-2035), which emails co-pay forms. The change is versioned and in the audit trail.
What changes when Annex 22 is final?
Annex 22 is still a draft; the final text is expected in Q4 2026. Six of our decisions cite it — mostly §1 on where generative models may be used. If the final keeps human-in-the-loop for non-critical use, none changes tier; two gain an operator-training condition (clinical data query drafting and the patient chatbot). When the final text is loaded, the re-check runs these and asks you to confirm.
13 screens from the working solution, on its sample data. Pick one to see it large.
Who reviews what, the routing rules the agents follow and the service levels are settings — changing a reviewer moves the open assessments with it.
| Setting | Default | Choose from |
|---|---|---|
| GxP criticality and validation reviewer | Sam Patel | Any person on the team — Dana Okafor · Sam Patel · Lena Ortiz · Omar Haddad · Hannah Brooks · Dr. Maya Chen |
| Personal data and DPIA reviewer | Lena Ortiz | Any person on the team |
| Security, hosting and connectors · vendor AI terms | Omar Haddad · Hannah Brooks | Any person on the team |
| Board decision and signature | Dana Okafor | Any person on the team |
| Self-service approves automatically | On | On · Off — approved tool, internal data, no decision about a person, a product or a submission |
| Target: intake to decision | 7 working days | Step up or down, one day at a time |
| AI review board | Thursday 15:00 CET | Thursday 15:00 CET · Wednesday 15:00 CET |
| Low-confidence classifications | 80% | 75% · 80% · 85% |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample portfolio · “target” = the design goal, measured in the live solution · “estimated” = an estimate, including the before figures and the split of days, which are the working solution's own estimates. Frameworks named: Regulation (EU) 2024/1689 (EU AI Act); EudraLex Vol. 4 draft Annex 22 “Artificial Intelligence” (EMA/PIC/S consultation, July 2025); FDA draft guidance “Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products” (Jan 2025); ISPE GAMP Guide: Artificial Intelligence (July 2025); Regulation (EU) 2016/679 (GDPR). People, companies, vendors and models named on this page are fictional — characters and sample data in the working solution.
Placing each new AI idea in a company under the rules that apply to it — its EU AI Act category, its GxP criticality, its model risk, personal data and vendor terms — so it gets the right review tier and the right reviewers. AI Use Case Risk Classification does this as the sponsor describes the idea, with six agents that cite the clause behind every branch and an AI review board that decides.
The AI Act classifier checks Article 5 prohibited practices, Article 6 with Annex I and Annex III for high-risk uses, Article 50 transparency and deployer duties, and cites a clause for every conclusion. Ideas that are none of these are minimal risk, where AI literacy for users still applies under Article 4.
The GxP & credibility classifier asks whether the idea supports a GxP process, whether it decides the outcome and whether the model is static and deterministic, against draft Annex 22, GAMP AI and your AI policy. It flags generative or adaptive models in any critical GMP use and proposes redesigns — such as a qualified person deciding every output — that re-light the path.
Yes. The document reader pulls model type, hosting, data fields, training terms and who acts on the output from each attachment, with its page, and compares them with the sponsor's answers. In the working solution it found analyst names in design §3.1 where the answer said no personal data.
The rule library is versioned clause by clause, with the use cases and inventory entries that cite each clause. When a clause changes — Annex 22 going final, for example — every decision that cites it is re-checked, and the owner is asked to confirm any that move.
Yes. The agents classify, infer and route; they never approve. Reviewers confirm their own branch, the AI review board approves, approves with conditions, sends back or rejects with an e-signature that records its meaning, and nothing enters the AI inventory without a signed decision.
Yes. Reviewers by dimension, routing rules, self-service auto-approval, the intake-to-decision target, the board day and the confidence floor are settings. Changing a reviewer moves open assessments with it, and new routing rules can be described in plain words.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your AI policy, your review tiers and reviewers, and a sample of past AI intakes — and it goes live once every quality gate has passed. We will walk you through it on your own AI ideas first.
Testing sized to each function's risk, every line linked to its source.
1-min demoAudit Trail ReviewEvery audit-trail period reviewed on schedule and signed, rows cited
1-min demoVendor Security AssessmentA cited vendor risk rating with gaps and controls, ready to sign
1-min demoWe'll run AI Use Case Risk Classification on a sample of your own AI intakes and your AI policy.