EU GMP names two people for every live computerised system, and both are roles that get refilled when the person leaves. The project to build that system has a champion instead, and I’ve watched projects dissolve with the champion while the business still needed the system.
Some pharma companies validate their systems with millions of pages, others with thousands, and the FDA passes both. The page count measures what the company believes compliance is. The inspector is grading something else.
A model vendor’s deprecation notice names the replacement and tells you to test against it before the retirement date, so every criterion written inside that window was written knowing the answer. Device regulators already settled what counts instead: criteria dated before the change.
A model vendor’s deprecation page puts a retirement date on every model it serves, with about sixty days between the notice and the day requests start failing. An approval bound to a hash of the spec voids itself when the spec changes and never hears about the executor changing.
A shared platform ends up at the strictest requirement any of its consumers carries, and onboarding is when that gets decided. Vendors fence off the strict part. An internal platform team usually can’t, and the mark only ever moves up.
Last month’s GxP post ended on an open question about agent-written changes swamping per-change assurance. Manufacturing hit that wall a hundred years ago and wrote down its answer, and the answer has an entry fee agent pipelines can’t pay yet.
The agent pitch prices a change by what it costs to produce. A validated GxP system never priced changes that way, and the regulated world already renegotiated the real price once, before agents showed up.
Your audit trail proves the raw record wasn’t tampered with. It says nothing about which definition turned that record into the number you put in a deck, and definitions move.
The whole agent-reliability project is trying to engineer the one thing a tool can’t have: accountability. Data governance already named this. The agent is a custodian, and we keep trying to promote it to owner.
I built audit logs and self-voiding approval gates to make an autonomous agent safe to run unattended, then realized I’d rebuilt a regulation the FDA shipped in 1997. The regulated world solved agent trust before agents existed.