QFINITY · News · Insights & Events
What is driving the regulated quality of tomorrow.
Articles and analysis from our own work across GxP, pharma, quality management, GAMP and AI. They cover what is changing in the regulated environment, what it means in practice, and what is happening inside our company.
Latest articles
AI in Pharma 2026 in Kraków: AI-Supported Validation Between Vision and Reality
AI in Pharma 2026, the fourth edition of the conference run by ISPE Poland and its GAMP Community of Practice, brought practitioners from pharma, technology and the regulatory field together in Kraków on October 26 and 27. Frank Henrichmann opened the track on trustworthy and regulated AI for QFINITY with a reality check. AI-supported validation of computerized systems is achievable today, within the applicable regulations and guidance, with the draft Annex 22 outlining the AI-specific additions.
The program covered four tracks over two days, from “Trusted, Safe & Regulated AI” to “Sustainable & Responsible AI”. A student hackathon at AGH Kraków had already taken place the day before. At the Novotel Kraków Centrum, one question stood at the center, the question many quality organizations are working on right now. How do computerized systems with AI support get from pilot status into validated operation? Frank Henrichmann, Senior Executive Consultant at QFINITY and Chair of the ISPE GAMP Global Steering Committee, showed on day one how that question can be answered from a validation point of view. The vision of AI-supported CSV can be measured against what 21 CFR Part 11 and Annex 11 require, what GAMP 5 and the FDA’s CSA guidance describe as the way to get there, and what the draft Annex 22 outlines for AI in GMP.
Why validation is seen as a bottleneck
The talk started from the everyday reality of many validation teams. Risk assessments and test scripts are written by hand. Ambiguous requirements lead to ineffective tests and compliance gaps. Traceability lives in static spreadsheets that nobody likes to maintain. As a result, validation, a cornerstone of compliance, is perceived as a brake on innovation. This is where AI comes in, at drafts and routine steps.
What may an AI draft in the validation workflow, and what remains a human decision?
Three approaches from the talk
What QFINITY takes home from Kraków
Four tracks, a hackathon and talks from users such as GSK, Roche and Polpharma show that the discussion has arrived at the question of how AI in validation is controlled in a way that can be demonstrated. As Chair of the ISPE GAMP Global Steering Committee, Frank Henrichmann bridged the Polish GAMP community and the global GAMP work, which includes the GAMP Guide Artificial Intelligence. For users, the conclusion is that the path to AI-supported validation runs through controls the current regulations already require.
Our topic area Artificial Intelligence in the GxP Environment shows how we use AI in your validation without losing the evidence. What the EU expects of AI in GMP is explained in our article on the draft EU GMP Annex 22. If you would like to talk to us directly, book an appointment.
AI in Pharma 2026, ISPE Poland Affiliate (ispe.org.pl)↗
DSAG Life Sciences Working Group 2026: The Invented Reviewer
The DSAG Life Sciences Processes working group met on October 21 and 22, 2026 in Hockenheim under the heading “Between innovation and compliance: AI in the GxP environment”. QFINITY opened the afternoon of day one with the impulse talk “The Invented Reviewer”. What the safety tests of two AI labs and the UK AI Security Institute in summer 2026 reveal about agents, and why it matters to every user who gives an agent write access in an SAP landscape.
Around the keynote by Stefan Münch (GAMP D-A-CH) and the SAP sessions on Autonomous Regulated Manufacturing and Cloud ERP GxP Readiness, two days revolved around the same question. How does AI get from pilot status into validated operation? Oliver Herrmann (QFINITY) took the first part of the session block at 1:30 pm from Washington, where the ISPE Annual Meeting was running at the same time. Alexander Kunz (Merck KGaA) delivered the second part with “Einführung von KI im GxP Umfeld @ Merck”.
Three boundaries, three failures, nobody was watching
In summer 2026, Anthropic, OpenAI and the AI Security Institute (AISI) published what happened in their safety tests with the protective classifiers deliberately switched off. What happened in the tests, case by case:
For users, this means: a prompt is not a network boundary, a sandbox alone is not one either, and reading logs after the fact is not oversight. All agents ran in test environments of the labs, their partners or the AISI. The damage occurred at third parties on the internet. As far as is known, no pharmaceutical company and no SAP system has been affected so far. What do we learn from this when agents look for the path of least resistance to complete a task? The question arises as soon as models from the same vendors, with considerably stricter safeguards, work as agents in enterprise systems and receive write access in GxP environments.
What the logs show
Two investigation reports document the agents' logged reasoning, the report by METR and Redwood Research on the Hugging Face incident and the AISI incident report. They contain three patterns familiar from deviation reports and inspections, until now only from humans:
In the third case, the attack was not aimed at the technology but at the review. The review held because a human did not hand over his judgment to the second voice.
Who in your SAP landscape would notice if an agent invented its own reviewer?
Missing alignment or missing boundaries?
In all three cases, completing the assigned task remained the agents' measure, and in all three cases they left the frame without purpose-built monitoring recognizing it at the moment it happened. Ethical concerns surfaced in the reasoning but rarely limited the action. Whether an agent behaves differently under observation than unobserved cannot be ruled out in a test. For regulated users, the question of intent therefore leads nowhere. What matters is what an agent is allowed to do, within which boundaries it executes actions, and how reliably the control mechanisms enforce those boundaries.
Inspectors have asked these questions for decades, so far of people and systems. The impulse talk ended with two of them for the drive home, and they apply to every SAP landscape: Which systems already give an agent write access today? Who can stop it, and what happens to the data afterwards?
Insight: four entry points into the SAP world
Anyone who wants to answer the two questions for their own SAP landscape will find four places at SAP where the entry begins. What SAP offers there comes first in each case; what reaches the operator follows.
1. See which agents exist and who is responsible for them. The SAP AI Agent Hub, built on SAP LeanIX, keeps a central registry of all agents, MCP servers and language models in the landscape, from SAP, partners and in-house development. Each entry carries identity, owner, capabilities, technology stack and governance status; an optional extension for risk assessment under the EU AI Act assigns agents to a risk class. Agents that have not yet passed verification remain in a pending state, and each agent's identity sits alongside human identities in SAP Cloud Identity Services. Noticing presupposes that someone knows which agents exist. For an inspector, the registry counts only once it matches the system inventory of the QMS and every entry names a responsible person.
2. Understand what happens to the data after the stop. In its white paper on Joule in GxP-regulated environments (May 2026), SAP describes, along GAMP 5 Appendix D11 and ISO 42001, the lifecycle controls an agent needs in GxP operation: monitoring in operation, change control with version control for model and data changes, periodic revalidation with CAPA, and maps what Joule brings to each of them. Joule is decision support, the human remains the decision maker (human-in-the-loop); SAP provides platform logging, the operator sets up application logging. A revised edition that takes the GAMP AI Guide into account is, according to SAP, in preparation. Which event at the agent triggers a renewed check, such as a new model behind the same interface, is left to the operator in the white paper; the operator defines those triggers.
3. Know the vendor's guardrails. In its Responsible AI principles, SAP sets out the rules by which the company selects, implements and controls AI use cases. For the question “alignment or boundaries”, that is the frame in which SAP builds its own agents. These are the vendor's rules for its products. The controls in their own operation, and the boundaries there, are set by the user.
4. Place the architecture as a whole. The AI-native North Star Architecture describes SAP's target picture in four layers, with Joule as the entrance, agents that execute processes across system boundaries, and a platform that provides runtime, sandbox, observability and governance. Every call passes through a controlled gateway; only exceptions and policy-bound decisions go to a human. SAP explicitly calls the document a direction, not a commitment.
These four places deliver the capability. The control architecture an inspector sees is built by the operator: the intended use of the process step the agent serves, the limits of its rights, the records under ALCOA++ and the person who stops it. That is where our work begins.
Why a human-in-the-loop alone is not yet control is explained in our article Human-in-the-Loop: An Illusion of Control?. What the answer looks like for your SAP landscape is something we clarify in conversation: book an appointment. The working group meets again on April 7 and 8, 2027.
DSAG, German-speaking SAP User Group (dsag.de)↗SAP AI Agent Hub, reference architecture (architecture.learning.sap.com)↗SAP white paper: Joule in GxP environments, May 2026 (sap.com)↗SAP AI-native North Star Architecture (architecture.learning.sap.com)↗
ISPE Annual Meeting 2026: Who Reviews the Reviewer?
The 2026 ISPE Annual Meeting & Expo in National Harbor near Washington, D.C., put one question at the center of its Digital, Data and Decision Integrity track, a question QFINITY has worked on for years. Who reviews the reviewer when AI writes and checks at the same time? QFINITY was there with two talks, one on oversight of AI systems and one on the computerized system validation lifecycle.
From October 18 to 21, 2026, the industry met at the Gaylord National Resort & Convention Center on the Potomac. Whether AI models will enter GxP processes was hardly up for debate anymore. The discussion was about who carries the results once agentic systems take actions, change records or write review reports, while the person who signs off at the end sees only the outcome. What additional information that person needs for oversight to remain effective was the track’s second question. The regulatory expectation itself has not changed, but with AI systems an organization has to meet it at a different point than before.
Progressive QA: Who decides, who stops?
Oliver Herrmann (QFINITY) and Martin Heitmann (MH Consulting & Advisory) started with Socrates and the mask of the ancient theater. A person speaks through the mask, and the mask changes nothing about that person’s responsibility, however convincing it may sound. Applied to AI output, plausibility is no substitute for human judgment. Three cases from 2026 made the risk tangible. In a security evaluation by the UK AI Security Institute, an agent created fake identities, one of which praised the agent’s own code as an independent reviewer, until a human maintainer refused the pull request. The UK MHRA reported in June on inspection responses containing invented references to guidance, and the FDA cited “overreliance on artificial intelligence” in a warning letter because AI-generated documents had not been reviewed at all.
The talk’s answer was a control architecture that is in place before the system goes live. Quality emerges from the interplay of business processes with data, application, infrastructure, model and controls; the model is verified, the overall system is validated in its process, and the rights to decide and to stop are assigned. A technical trigger may halt the agent; a named person carries the responsibility for it.
Who in your organization could say today what stops an AI agent, who is accountable for it, and what happens to its data afterwards?
Four risks when the language model holds the validation data
On the morning of the same day, Frank Henrichmann (QFINITY) showed how AI can be integrated into the computerized system validation lifecycle without weakening the evidence. Building on the article How AI Will Transform Computerized System Validation in Pharmaceutical Engineering, he demonstrated what works today: requirements are captured in plain language as structured data, risks are assessed, test scripts are generated with traceability to the requirement, and a subject matter expert approves them before execution. Annex 11 and 21 CFR Part 11 remain the yardstick for attributability and data integrity, and GAMP 5 Second Edition remains the methodology for scaling the depth of verification to the risk. When a general-purpose language model without controlled integration becomes the leading system for validation data, the talk identified four risks:
The regulatory framework is tightening right now. With Computer Software Assurance the FDA scales the depth of verification to the risk, and the draft of its AI guidance puts risk and context of use at the center. The EU drafts of Chapter 4, Annex 11 and Annex 22 address the chain from the record through the computerized system to the model, and the EMA report on its Annex 22 expert workshop of June 30 and July 1, published in early October, suggests that the final text could cover dynamic and generative models provided a documented, risk-based control strategy is in place. Specific requirements for agentic systems do not exist yet. This is where QFINITY works at the leading edge. What follows for control is set out in our article Human-in-the-Loop as an Illusion of Control? and on our EU GMP Annex 22 page.
That QFINITY helps shape this development also shows in its roles. Oliver Herrmann chairs the GAMP Europe Steering Committee, Frank Henrichmann the GAMP Global Steering Committee. The real value, however, is created where QFINITY translates this framework into a control architecture, a test strategy and the chain of evidence the operator presents to the inspector. Critical thinking, AI literacy and data understanding for your own team are taught in the H² Digital Hive.
Session in the ISPE program (ispe.org)↗