ISPE AI Summit 2026: Practical AI in GxP

The first ISPE AI in Life Sciences Summit – Powered by GAMP put one question at its centre, a question QFINITY has worked on for years: how do you move AI in GxP environments from experiment to validated, responsible use? QFINITY was on site and helped shape the content – among other things with a workshop on working with AI suppliers.

Boston skyline on the Charles River — **Setting**Boston on the Charles River – host city of the first Summit.

The Summit turned on a core question for regulated life sciences: what changes when AI enters the picture – and what does not? Collaboration between the regulated user and the supplier was always demanding: different vocabularies, quality brought in too late, short-notice changes in SaaS services. AI sharpens these familiar challenges and adds new ones – dynamic models, model drift, a higher relevance of data, ongoing performance monitoring.

The answer, however, is not a new discipline: it is the proven GAMP 5 key principles, critical thinking and a risk-based approach – the right mix of flexibility and rigor.

Four blind spots in AI supplier relationships

How concrete this gets became clear in the workshop, drawing on real gaps that recur in AI supplier relationships:

The AI supplier updates the model without notice. In a GxP environment this is an unauthorized change to the validated state – the regulated user loses their evidence without knowing it.

The LLM provider was never qualified as a sub-supplier. The audit scope extends to the sub-supplier; a SOC 2 attestation does not cover the GxP-specific obligations.

The contract contains no audit rights. For GxP-critical AI, certificates are necessary but not sufficient – without a contractual right, the supplier can decline any audit.

The provider trains on your data. Sensitive deviation descriptions flow to a third party – without an explicit contractual arrangement, no GxP company can accept this.

The decisive question behind every gap: what would you put in front of an inspector to justify your validation strategy?

Frieze at MIT with the names Pasteur, Linnaeus, Jenner — **The depth**Between sessions: the MIT campus, where the names of scientific history are carved in stone – Pasteur, Linnaeus, Jenner.

The regulatory framework for this is taking shape right now: the draft EU GMP Annex 22 requires the regulated user to review the documentation – regardless of whether the model is trained in-house or by a supplier. Methodological orientation comes from the ISPE GAMP Guide: Artificial Intelligence (2025), and the EU AI Act draws a further line with its distinction between provider and deployer. Specific guidance on AI supplier management is still rare – and this is where QFINITY works at the leading edge.

That QFINITY helps shape this development is no coincidence: as chair of the GAMP Global Steering Committee, Frank Henrichmann, Senior Executive Consultant at QFINITY, is close to where these guidelines take form. The real value, however, is created where QFINITY translates this still-young framework into robust practice – from AI experiment to validated, audit-ready use.

ImpressionsFrom the Summit and around Boston1 / 4