 | In Life Sciences, an AI system isn’t finished when it works, but when the data behind, the process around it and the output it produces can be validated, documented and defended to an auditor. Mats Govaerts, Data & AI Lead at Sopra Steria, explains why the real starting point is not the model, but the foundation underneath it. |
Many Life Sciences organisations have a pilot sitting somewhere that nobody can approve. The model works. The demo went well. But it never left the sandbox. For Mats, that is usually a sign that the work started too late in the chain. “They can build a pilot,” says Mats Govaerts. “But they cannot get it into GxP production. The blocker is almost never the model, it is data lineage, governance and validation.”
Data first, governance built around it from day one
Mats frames the whole discipline as a value chain rather than a list of technologies. “Everything starts with the foundation, the data platforms and the data integrity controls underneath them,” he says. On top of that comes intelligence: analytics, machine learning and AI applied to a specific outcome. Around both sits governance: the risk model, ownership, validation approach and audit evidence that decide whether the system can be used in a regulated environment.
Whatever you build sits on top of your data, and it’s only as good as that data is,” he adds. “If you can’t say where a number came from or who changed it, you can’t defend the output, no matter how good the model is.
In Life Sciences, ‘it works’ is only the start
In most sectors, a data or AI capability is done when it’s built, tested and live. Job finished. Nobody looks back unless something breaks. In Life Sciences, it’s different. An AI system has to be shown, with documented evidence, to be fit for its intended use. The effort scales with risk: the higher the impact on patients, product or data, the deeper the testing. And the reasoning has to hold up in front of an auditor who is entitled to ask how you know it is reliable, and why you tested what you tested.
That changes the role of AI. The question is not whether a model can produce a plausible answer in a demo. The question is whether the organisation can show that the data, the controls, the human oversight and the operating process around the system are reliable enough for regulated use.
The blocker for AI projects in Life Sciences is almost never the model,
it’s data lineage, governance and validation.
The pressure to get this right is mounting fast, as the number of computerised systems is growing. “A single audit trail review can exceed 10,000 entries for one system in one review period,” says Mats, “and it has to happen yearly or sometimes even monthly, while the pool of qualified reviewers isn’t growing to match.” Much of that work, he says, is high-volume pattern matching with a thin layer of expert judgement on top. That is exactly the profile generative AI handles well under human oversight.
And for the first time, the regulatory target is becoming visible: the EU AI Act, ISO/IEC 42001, the draft revised Annex 11 and the draft Annex 22 show what European GxP inspectors will expect from computerised systems and AI. “The rules aren't final yet, but you no longer have to guess where they're heading,” he says. "You can start designing against them now."
The point most pilots never get past
Typically, Life Sciences organisations don’t have a shortage of good ideas. The real obstacles are present at multiple layers.
At the foundation layer, data is often not AI-ready. “There are gaps in provenance, integrity and lineage that only become visible when someone asks where a number came from,” says Mats. Everything functions fine, until someone asks, and nobody can reconstruct the answer.
At the intelligence layer, AI introduces behaviour that traditional validation methods were not designed for. Generative AI systems are non-deterministic: ask the same question twice, and you will not necessarily get the same answer twice. Traditional software is not like that. Feed it the same input and it returns the same output, every time, which is exactly what makes it straightforward to validate.
"The point is not to validate the model in isolation," says Mats. "You validate the system and the process around it." That means fixed, representative test sets with pre-defined acceptance criteria, human oversight treated as a tested control, and performance monitoring once the system is in operation.
At the governance layer, ownership is often unclear. “Ownership of AI risk is unassigned,” he says. “It sits somewhere between IT, QA and the business. No one clearly owns it, so a pilot can easily stall, with nobody in a position to push it forward.” This is where governance frameworks such as ISO/IEC 42001 become relevant: not as paperwork, but as a way to define ownership, risk responsibilities and decision rights around AI.
Compliance and delivery, under one roof
Understanding compliance is one thing. Being able to build a compliant AI system is another. “People who understand both the model and the regulation are rare,” says Mats. “The two conversations typically happen in separate rooms.” Sopra Steria’s approach closes that gap by keeping compliance expertise and delivery capability inside the same team. There is no handover from a consultant who understands the regulation to a builder who does not.
You need people who can speak both languages: the language of data and models, and the language of quality, validation and audit.
Sopra Steria doesn’t just build AI systems for clients; it validates its own AI products under the same regime it applies at clients. Themis, Sopra Steria’s GenAI product, carries an intended use statement, a defined position against draft Annex 22, a full validation lifecycle and a risk assessment. It is not only a product example, but also an example of the full chain Mats describes: the data foundation underneath it, the intelligence layer that generates output and the governance layer that makes that output usable in a regulated context.
That also connects back to the 10,000-line audit trail problem. A tool such as Themis is valuable only if it can walk the whole path: understand the underlying data, support expert review, document the reasoning and leave behind evidence that can be inspected later. “When we tell a client how to validate a GenAI system,” he says, “we are describing work we have done on our own product, not a methodology deck.”
The next step for AI in GxP
Today, the realistic scope for AI in regulated Life Sciences is assisting: drafting, flagging, summarising, with a human reviewing every output. The trend Mats is watching most closely is that AI is moving from assisting the reviewer to executing regulated work: requirements mapping, test scripts, traceability, deviation documentation.
Mats: “What stands in the way of that is a shared, inspectable method for validating a non-deterministic system.” Once that exists, a large share of regulated documentation work will become automatable. There are already signs of where this is heading. “EMA has publicly confirmed that the Annex 22 drafting group is examining whether dynamic, adaptive and probabilistic models could be accommodated in critical GMP applications under risk-based controls. If that happens, AI will be permitted to do considerably more within EU GMP than the 2025 draft allows.”
Mats’ advice to organisations starting this journey is to resist the instinct to start with the model. “Start with your data, and build governance around it from day one,” he says. “Governance is what decides whether something you build ever makes it into a regulated environment. Plenty of companies have a working pilot sitting there that nobody can approve, because it can’t be validated, and usually because of data problems.”