{"id":17132,"date":"2026-09-05T12:07:02","date_gmt":"2026-09-05T10:07:02","guid":{"rendered":"https:\/\/q-finity.de\/?p=17132"},"modified":"2026-09-05T12:09:17","modified_gmt":"2026-09-05T10:09:17","slug":"agentic-ai-gxp-sap-expert-workshop","status":"publish","type":"post","link":"https:\/\/q-finity.de\/en\/agentic-ai-gxp-sap-expert-workshop\/","title":{"rendered":"How does agentic AI become possible in GxP? QFINITY brings the governance perspective to an SAP expert workshop"},"content":{"rendered":"

Recap of the SAP expert workshop on AI in regulated pharma processes, Walldorf, August 18, 2026.<\/em><\/p>\n

On August 18, 2026, QFINITY, represented by Oliver Herrmann, brought the governance perspective to an SAP expert workshop on AI in regulated pharma processes. The workshop followed an ecosystem format: selected organizations each represented their role, SAP as the vendor, Merck for the regulated industry, alongside specialists in governance, validation and guardrails. They work on the same questions because none of them can solve them alone, and these questions concern everyone in a regulated environment. Who is accountable when agentic AI is deployed in GxP processes? And how do you know that the answer holds up?<\/p>\n

What the vendor delivers and what stays with the customer<\/h2>\n

QFINITY’s contribution followed one principle: the software vendor delivers the technical capability, embedded in a GxP-shaped governance that fits the governance systems of its users. What no vendor can deliver is the regulatory accountability of each individual customer. It arises on the customer’s side: in their own governance, in the validation of the systems in their own process, in their own controls.<\/p>\n

The structural challenge behind this is an asymmetry. One product governance meets many governance systems of regulated users, and each of those users carries its GxP accountability itself, including for outsourced activities, as Annex 11 provides in its section on suppliers and service providers. That asymmetry is built into the structure, and harmonization alone does not resolve it. It takes defined interfaces where evidence crosses the boundary: model changes, provenance of training data, monitoring signals, audit rights reaching into the supply chain of the model providers.<\/p>\n

The capability is delivered. The accountability is not.<\/p>\n

The human stays accountable<\/h2>\n

Human oversight<\/a> does not mean that a human is involved. The test question is: can that person still intervene and stop? This holds at every level, up to the roles that personally answer for what is released. We therefore put three questions to every agentic system, whatever the vendor:<\/p>\n