// subscribe
The AI Validation Boundary: Extended Edition
The articles stay open. The full worked examples come here: complete validation walkthroughs for probabilistic AI systems in regulated drug development, too long for a post. Free. No fixed schedule; you’ll hear from me when one is ready.
Validation assurance for probabilistic systems in regulated science.
Where reproducibility is bounded, the validated state is a moving target, and conventional CSV practices were not designed for the sources of risk these systems introduce.
Britt Biocomputing builds the validation evidence that holds anyway — the plans, risk assessments, supplier qualifications, and audit trails your QMS needs before an inspector asks for them. Grounded in published frameworks that operationalize the FDA seven-step credibility framework, ICH Q9(R1), and the GAMP® 5 / GAMP® AI Guide lineage.
If any of these sound familiar, this is the work.
We put an LLM in front of deviation triage — and QA is asking what the validation package looks like.
There's a defensible answer. It starts with context of use, not with the model.
Our AI vendor passed SOC 2. Our auditor still wants supplier qualification evidence.
SOC 2 doesn't cover silent model changes or inherited validation. VALID Trust does.
The model is frozen. So why does the system keep behaving differently?
The failure modes live in the harness — prompts, retrieval, tools, guardrails. Those drift, and they're validatable.
Named artifacts, not advisory decks.
- →Validation plans & protocolsScoped to context of use, model, harness, and human-in-the-loop.
- →Risk assessmentsBuilt on a published failure-mode taxonomy, mapped to ICH Q9(R1).
- →Supplier qualification packagesAI vendor qualification under the VALID Trust methodology.
- →Traceability & capture-layer designSo every AI decision is inspectable after the fact.
- →Validation summary reportsThe document your inspector actually reads.
Three ways to engage: fixed-fee exposure screens and prioritized risk assessments, scoped engagements that produce inspection-ready evidence, and a fractional AI quality lead for teams that need the role before they can hire for it.
Work is sized to the consequence of error and to the maturity of your current posture.
See the full services overview →An integrated body of work, applied to your system.
Every engagement runs on frameworks that are public and citable. Your auditor can read the methodology before they read your evidence.
House of AI Trust
Five-layer governance architectureThe umbrella framework for AI in regulated drug development: five layers, each resting on the one beneath it, with Security and Supplier Qualification running through all of them. It shows where each control belongs, and what has to be in place before validation can hold. The three frameworks below operate within or alongside the House.
L3 is where Britt Biocomputing operates: the Control Layer, where governance becomes evidence — context of use, risk tiering, evaluation design, acceptance criteria, human oversight, continuous monitoring, and change control.
Read the flagship guide →Probabilistic Validation Lifecycle
Seven-step execution modelAdapts the V-model to systems where reproducibility is bounded rather than absolute. Maps cleanly onto GAMP 5 lifecycle stages while extending them for probabilistic behavior, drift, and continuous verification.
Read →VALID Trust
Four-pillar supplier qualificationA framework for qualifying AI suppliers and inheriting validation evidence in regulated environments. Extends GAMP 5 supplier qualification into non-deterministic upstream components.
Read →Probabilistic Failure Mode Taxonomy
6 × 6 classification matrixA public framework for classifying probabilistic AI failures in GxP regulated drug development by both error type and origin, mapped against GAMP 5, ICH Q9(R1), and the FDA seven-step credibility framework.
Read →Latest writing
Coherence ≠ Compliance: The Capability Paradox, 10 Months Later
As models grow more fluent, their errors get harder to see. A ledger of what's shipped since December, why agentic structure compounds error at every step, and why reading an SOP doesn't qualify the person reviewing the output.
The Inheritance Boundary Inside the House
How does a manufacturer show that layered AI controls produce reliable output? By knowing which evidence it can inherit from the supplier and which it must own, floor by floor of the House, walked through with a deviation intake triage assistant.
The Validation Boundary Inside the House
If a probabilistic system is CoU × model × harness × HITL, the inventory unit is the system, risk is determined per system, and acceptance criteria are domain judgments, not just statistical ones. Revisiting AI governance (Layer 2) and domain expertise (Layer 4) through that boundary.
The Version Bump Nobody Change-Controlled
Your supplier moves the foundation model from 5.1 to 5.2 and nothing in your agreement, supplier file, or change control fires. Prospective, architectural, and organizational controls, plus the three questions to put to your supplier before it happens.
When the Check Runs Somewhere Else
A guardrail that fired, one that crashed, and one that was never configured can reach you as the same signal. What that means for GxP vendor qualification when accountability sits on one side of the boundary and the evidence sits on the other.
When a Check Doesn't Run
Capture must distinguish three states — passed, failed, and did not run — because a check that never fires leaves nothing behind, and a missing record reads as nothing wrong. Recording the expected check-set per decision, and tiering the response to capture failure by action class, closes the blind spot.
Thirty minutes to find out whether this is your problem.
A scoping call is free and specific: what you've deployed, what your QA function is asking for, and what the evidence gap actually is.
Book a scoping call Or see the full services overview →Part of the VALID Trust methodology. Not an endorsement or certification. Signing up adds you to the AI Validation Boundary: Extended Edition list; unsubscribe anytime.