Strategy & Concept

Are there already AI use cases in your company?

No Yes, but not GxP-relevant Yes, but unclear whether GxP-relevant Yes, clearly GxP-relevant

Has the AI use case been assessed with regard to patient safety, product quality, and data integrity?

No Initial informal assessment Structured risk assessment performed Risk assessment is a documented basis for decision-making

Is there a structured process for evaluating and piloting AI ideas

No Ad hoc trials without a formal framework PoC process is defined PoC process is established with defined evaluation criteria and transition into the project phase

Governance & Organization

Are there clearly defined responsibilities for development, operation, and monitoring of the AI system?

No Implicitly distributed Roles are defined Roles are formally embedded in the governance/QMS framework

Is the use of AI organizationally and procedurally embedded into existing IT, quality, and validation structures?

AI is considered in isolation Initial points of connection exist Partially integrated Fully integrated

Is it defined what level of autonomy the AI system has and where human review is mandatory?

No Informally known Autonomy levels are defined for the use case Autonomy levels are documented and human-in-the-loop requirements are implemented operationally

Data & Model Quality

Are the origin, purpose, and quality of the data used for AI traceable?

No Partially known Largely documented Fully documented and traceable

Are data- or model-related risks (e.g., bias, drift) addressed deliberately?

Not considered Awareness exists Risks have been assessed Monitoring and measures are defined

Are AI results and decisions critically challenged and validated by subject matter experts (critical thinking)?

No, AI results are adopted as-is Occasionally, depending on individuals Systematic review is intended Critical review is integrated into processes and training

Suppliers & Transparency

Is the responsibility between suppliers and the operator clearly defined and taken into account in operations?

No Partially Contractually defined Contractually defined and operationally practiced

Is there sufficient transparency regarding changes to models, data, or AI functions made by suppliers?

No Limited Documented information is available Auditable transparency is ensured

Lifecycle & Operations

Is the AI system considered across its entire lifecycle (not only up to go-live)?

No Partially Documented Implemented operationally

Are performance indicators and monitoring criteria defined for ongoing operations?

No Roughly defined Clearly defined Defined including thresholds and responses

Are there clear rules for when adjustments, re-training, or re-validation are required?

No Discussed Defined Embedded in SOPs / processes

Is the IT infrastructure suitable for AI operations (e.g., data storage, model versioning, deployment)?

Not assessed Basic infrastructure available AI-specific requirements have been identified and partially implemented End-to-end MLOps/AI infrastructure established

Regulatory & Competence

Are transparency, traceability, and fairness of AI systematically considered?

No Generally considered Assessed Integrated into governance and decision-making processes

Has the relevance of regulatory requirements (e.g., EU AI Act, GDPR, GxP) for the use of AI been assessed?

No Uncertain Assessed Measures have been derived

Is the development of AI competence (AI literacy) established in the company as an ongoing development process?

No Individual initiatives Regular training Established, continuous competence model