Artificial intelligence and machine learning are becoming increasingly embedded across the life sciences industry. Organizations are using AI/ML tools to support clinical development, manufacturing, laboratory operations, quality management, pharmacovigilance, regulatory submissions, and supply chain activities.
While these technologies can improve efficiency and decision-making, they introduce a significant compliance challenge: AI/ML systems can change in ways that traditional validated systems do not.
A conventional computerized system generally performs according to predefined rules. An AI/ML model may behave differently after retraining, the introduction of new data, configuration changes, software updates, or adjustments to its operating environment. Even when the intended use remains the same, these changes can affect model outputs, performance, bias, reliability, and ultimately product quality or patient safety.
Under Good Practice, or GxP, expectations, organizations must maintain control over these changes throughout the system lifecycle. AI innovation does not eliminate the need for change control. It makes a structured, risk-based change control process even more important.
Why AI/ML Change Control Is Different
Traditional change control processes typically evaluate changes to software code, system configurations, infrastructure, workflows, or user requirements. AI/ML systems introduce additional change types that may be less visible but equally significant.
An AI/ML system may change because:
- The model was retrained using new or updated data.
- The training dataset was expanded or filtered.
- Data preprocessing or feature-engineering methods changed.
- A model parameter, threshold, or decision rule was adjusted.
- A third-party provider updated the underlying model.
- The system began operating within a new user population or process environment.
- Input data drift caused performance to deteriorate.
- The relationship between the input data and the predicted outcome changed.
- A connected platform, interface, or data source was modified.
Some of these changes may occur without altering the system’s visible user interface. However, they can still change how the model performs or how its outputs should be interpreted.
This means an effective AI/ML change control program must look beyond source code. It must consider the complete model, its data, its context of use, its supporting infrastructure, and the human processes surrounding it.
The Current Regulatory Direction
There is not one universal GxP regulation dedicated exclusively to AI/ML change control. Instead, regulators are applying existing expectations for computerized systems, validation, data integrity, quality risk management, and lifecycle oversight to AI-enabled technologies.
The FDA’s January 2025 draft guidance on using AI to support regulatory decision-making for drugs and biological products introduced a risk-based credibility assessment framework. The framework emphasizes defining the model’s context of use, assessing model risk, developing a credibility plan, and generating evidence appropriate to that risk. These principles reinforce the importance of reassessing an AI model when changes could affect its credibility for the intended use. The guidance remains a draft and contains nonbinding recommendations. FDA: Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making
In January 2026, FDA and EMA jointly published guiding principles for good AI practice in drug development. These principles promote a human-centric, risk-based approach across the technology lifecycle, including clear context of use, multidisciplinary expertise, data governance, performance assessment, and lifecycle management. FDA and EMA: Guiding Principles of Good AI Practice in Drug Development
For AI-enabled medical devices, change management expectations are more developed. FDA, Health Canada, and the UK Medicines and Healthcare products Regulatory Agency have established guiding principles for Predetermined Change Control Plans, or PCCPs. A PCCP can describe planned model modifications, the methods used to develop and validate those modifications, and the process for evaluating their impact.
The regulators identify five central principles for these plans: changes should be focused and bounded, risk-based, evidence-based, transparent, and managed from a total product lifecycle perspective. FDA: Predetermined Change Control Plans for Machine Learning-Enabled Medical Devices
A PCCP is not automatically required or appropriate for every GxP AI application. However, its core concepts provide a useful model for managing anticipated AI/ML changes in a controlled and documented manner.
What Regulators and Auditors Will Expect
Although expectations will depend on the system’s intended use and associated risk, organizations should be prepared to demonstrate several fundamental controls.
A Clearly Defined Context of Use
Before evaluating a change, the organization must understand what the AI/ML model is intended to do.
The context of use should identify:
- The specific task performed by the model
- The GxP process supported by the model
- The intended users and operating environment
- The data used as inputs
- The outputs generated
- How those outputs influence decisions
- The degree of human review or intervention
- The potential impact of an incorrect or unreliable result
A change cannot be assessed properly without this baseline. The same technical modification may be low risk in an administrative application but high risk when it influences batch disposition, clinical eligibility, product quality, or patient safety.
Complete Change Identification
Organizations need a process for determining what qualifies as a controlled change. This should include changes to more than the model itself.
The change control process should address modifications to:
- Algorithms and model architecture
- Training, validation, and test datasets
- Data-cleaning and preprocessing methods
- Model features and parameters
- Decision thresholds
- Prompts, system instructions, or retrieval sources used by generative AI
- Interfaces and upstream data sources
- Infrastructure and hosting environments
- User access and human-review workflows
- Monitoring criteria and performance limits
- Third-party services and vendor-controlled components
For externally hosted AI services, the organization must also determine how vendor updates are identified, assessed, documented, and tested before continued GxP use.
Risk-Based Impact Assessment
Every proposed change should undergo a documented impact assessment. The depth of that assessment should reflect the model’s intended use, the significance of the change, and the potential consequences of failure.
Questions to consider include:
- Could the change affect product quality, patient safety, or data integrity?
- Could it alter the model’s validated context of use?
- Does it introduce new data sources or populations?
- Could it increase bias or reduce generalizability?
- Does it affect explainability or the ability to review results?
- Could it change a regulated decision or GxP record?
- Does it require regulatory notification, submission, or approval?
- Will existing procedural controls remain effective?
- Could several individually minor changes create a significant cumulative impact?
The organization should use predefined criteria to categorize changes and determine the required level of review, testing, approval, and documentation.
Verification and Validation
An AI/ML model should not be moved into production simply because it performs better against one metric after a change.
Testing must demonstrate that the revised system remains fit for its intended use. Depending on risk, this may include:
- Functional and regression testing
- Comparison with the previously approved model
- Testing against independent or locked datasets
- Evaluation of accuracy, sensitivity, specificity, precision, or other relevant metrics
- Assessment across representative demographic or operational subgroups
- Bias and fairness testing
- Evaluation of false-positive and false-negative rates
- Stress testing and edge-case analysis
- Human factors or usability testing
- Confirmation that audit trails, security controls, and data-integrity protections remain effective
Acceptance criteria should be defined and approved before testing begins. Organizations should also document the scientific or operational rationale for selecting each metric.
Data Governance and Lineage
Because AI/ML performance depends heavily on data, changes to data require the same level of attention as changes to software.
The organization should be able to trace:
- Where training and evaluation data originated
- Which dataset versions were used
- How data were cleaned, labeled, transformed, and approved
- Whether the data remain representative of the intended population
- Who authorized additions or exclusions
- How missing, anomalous, or low-quality data were handled
- Whether privacy, security, consent, and use restrictions were respected
Data lineage should make it possible to reproduce, investigate, and explain a model version and its associated performance results.
Model and Configuration Versioning
Each approved model should have a unique, controlled identity. The organization should be able to connect a deployed model to its code, parameters, datasets, configurations, validation evidence, approvals, and release date.
Version control must also support rollback. If monitoring reveals unacceptable performance after release, the organization should be able to stop the model, revert to a previously approved version, or activate an established contingency process.
Approval Before Implementation
Changes affecting a GxP AI/ML system should be reviewed by appropriate representatives from Quality, system ownership, data science, information technology, validation, cybersecurity, privacy, and relevant business or clinical functions.
The change record should clearly document:
- The reason for the change
- The components affected
- The risk and impact assessment
- Testing and acceptance criteria
- Validation results
- Deviations encountered
- Required procedure or training updates
- Regulatory impact
- Implementation and rollback plans
- Final approval
High-risk changes may also require formal review by medical, statistical, regulatory, or patient-safety experts.
Continuous Learning Requires Defined Boundaries
One of the most difficult questions is whether an AI/ML model may continue learning after deployment.
Allowing a GxP model to update itself continuously without review can undermine the validated state. If the model changes with each new dataset, its behavior may no longer match the version that was originally tested and approved.
Organizations should therefore distinguish between locked and adaptive models.
A locked model does not automatically change after deployment. New data may be collected and used to develop a future version, but that version must pass through change control, testing, approval, and controlled release.
An adaptive model may update after deployment within specifically defined boundaries. This approach requires stronger controls, including approved update rules, performance limits, automated monitoring, human oversight, implementation criteria, rollback mechanisms, and documentation of every deployed model state.
For many high-risk GxP applications, a locked or periodically retrained model may currently be easier to validate and control than a continuously learning system.
Post-Implementation Monitoring Is Part of Change Control
Approval and deployment do not mark the end of AI/ML change control. Model performance may decline even when no deliberate technical change has occurred.
Organizations should monitor for:
- Data drift
- Concept drift
- Unexpected output patterns
- Changes in error rates
- Performance differences between user or patient populations
- Increased human overrides
- Complaints, deviations, or adverse events
- Changes in upstream systems or data sources
- Cybersecurity vulnerabilities
- Vendor updates
Monitoring thresholds should be established in advance. The procedure should define when a signal requires investigation, model suspension, corrective action, retraining, or a new change control.
Periodic review should also evaluate whether the model remains suitable for its approved context of use.
Building an Inspection-Ready AI/ML Change Control Program
A strong program begins with governance. Organizations should establish clear ownership for each AI/ML system and define who is accountable for approving changes, evaluating performance, maintaining documentation, and responding to emerging risks.
AI/ML systems should be included within the organization’s computerized system inventory and assigned a GxP impact and risk classification. The supporting procedures should address data governance, model development, validation, release, monitoring, incident management, vendor oversight, and retirement.
Most importantly, the documentation must tell a coherent story. An inspector should be able to understand:
- What the model does
- Why the model is appropriate for its intended use
- Which version is currently deployed
- What has changed since the previous version
- How the change was assessed and tested
- Who approved the change
- How ongoing performance is monitored
- What happens if the model no longer meets requirements
If these questions cannot be answered quickly and consistently, the organization may not have adequate control over the system.
Preparing for the Next Generation of GxP Systems
AI/ML technologies will continue to evolve faster than traditional validation practices. The answer is not to prevent change, but to establish a lifecycle framework that makes change controlled, traceable, evidence-based, and proportionate to risk.
Organizations implementing AI/ML in regulated environments should update their change control procedures now. Waiting until an inspection, system failure, or unexpected vendor update can expose serious gaps in validation, data integrity, and governance.
EMMA International helps life sciences organizations develop risk-based AI governance, computerized system validation, data integrity, and change control programs that support innovation while maintaining GxP compliance.
Contact EMMA International to learn how our experts can help your organization assess AI/ML risks, strengthen lifecycle controls, and prepare AI-enabled systems for regulatory scrutiny.
