ISPE AI Summit 2026: Practical AI in GxP

The first ISPE AI in Life Sciences Summit – Powered by GAMP put one question at its center, a question QFINITY has worked on for years: how do you move AI in GxP environments from experiment to validated, responsible use? QFINITY was there and helped shape the program, including a workshop on working with AI suppliers.

Boston skyline on the Charles River — **Setting**Boston on the Charles River – host city of the first Summit.

The Summit turned on a core question for regulated life sciences: what changes when AI enters the picture – and what does not? Collaboration between the regulated user and the supplier has always been demanding: different vocabularies, quality brought in too late, short-notice changes in SaaS services. AI intensifies these familiar challenges and adds new ones: dynamic models, model drift, data that carries more weight and ongoing performance monitoring.

The answer, however, is not a new discipline. It lies in the established GAMP 5 key principles, critical thinking and a risk-based approach, which together strike the right balance between flexibility and rigor.

Four blind spots in AI supplier relationships

The workshop made this concrete with real gaps that keep appearing when companies source AI from suppliers:

The AI supplier updates the model without notice. In a GxP environment this is an unauthorized change to the validated state, and the regulated user loses their evidence without knowing it.

The LLM provider was never qualified as a sub-supplier. The audit scope extends to the sub-supplier; a SOC 2 attestation does not cover the GxP-specific obligations.

The contract has no right-to-audit clause. For GxP-critical AI, certificates are necessary but not sufficient. Without a contractual right to audit, the supplier can refuse any audit.

The provider trains on your data. Sensitive deviation descriptions flow to a third party. Without explicit contractual terms, no GxP company can accept this.

The decisive question behind every gap: what would you put in front of an inspector to justify your validation strategy?

Frieze at MIT with the names Pasteur, Linnaeus, Jenner — **The depth**Between sessions: the MIT campus, where the names of scientific history are carved in stone – Pasteur, Linnaeus, Jenner.

The regulatory framework for this is taking shape right now: the draft EU GMP Annex 22 provides for the regulated user to review the documentation, regardless of whether the model was trained in-house or by a supplier. The ISPE GAMP Guide: Artificial Intelligence (2025) provides methodological direction, and the EU AI Act draws a further line with its distinction between provider and deployer. Specific provisions on managing AI suppliers are still rare. QFINITY works at the forefront of this field.

That QFINITY helps shape this development is no coincidence: as chair of the GAMP Global Steering Committee, Frank Henrichmann, Senior Executive Consultant at QFINITY, is close to where these guides take shape. QFINITY creates the real value, however, by translating this still-young framework into reliable practice, from AI experiment to validated, audit-ready use.

ImpressionsFrom the Summit and around Boston1 / 4