Training IEC 62304 SDLC training now available — structured learning, timed assessment & certificate

AI Validation for Quality & Regulatory Workflows

Oversure™

A Framework for Validating AI Used in Regulated Processes

Oversure is an original framework for deciding how much validation an AI use needs, carrying it out, and keeping that use under control for as long as it runs. Written for medtech, medical device, IVD, pharma and biotech organisations, it answers one question: how do you show that a specific use of AI in a regulated process is fit for purpose, that the people overseeing it can catch it when it is wrong, and that it stays that way?

Framework at a Glance
5 Steps
Define, identify obligations, classify, assure, maintain — the same method at every tier
7 Principles
Every requirement in the framework traces back to at least one
3 Tiers + Redesign
Assurance proportionate to consequence and reliance, not a fixed checklist
7 Deployment Types
From personal chat tools to agentic AI acting in other systems
AI Validation Services

Validating AI Used in Your Quality & Regulatory Workflows

If your teams use AI to draft documents, review records, classify complaints or analyse data, auditors and regulators will expect evidence that it is fit for its intended use. We carry out that validation with you, using the Oversure framework, so the evidence is proportionate, recorded and ready for audit.

ISO 13485

Quality Management Workflows

Document drafting and review, CAPA and nonconformity handling, complaint triage, internal audit preparation and training records.

MDR · IVDR

Regulatory Workflows

Technical documentation drafting, regulatory intelligence, literature screening for clinical evaluation and submission support.

Post-Market

Surveillance & Vigilance

AI that analyses complaints, trends and post-market data, or helps classify incidents for reporting.

Operations

Manufacturing, Lab & Supplier

AI used in process control, laboratory operations, supplier management or knowledge work that feeds a regulated record.

What We Deliver

Scope & Classify

An inventory of your AI uses, and a classification of each by consequence, oversight and reliance, so effort goes where the risk is.

Plan, Test & Document

Validation plans, intended-use definitions, acceptance criteria, test protocols and reports that fit your quality system.

Oversight & Control

Human-oversight design, procedures, staff training, performance monitoring and change control for as long as the AI is used.

Why Oversure

One Question, Answered Systematically

Validating AI in a regulated process is not only software testing. It is a proportionate, recorded demonstration that a specific use of AI is fit for purpose, that the people overseeing it can catch it when it is wrong, and that it stays that way for as long as it is used.

Oversure applies to AI used inside regulated processes — quality management, manufacturing and process control, laboratory operations, regulatory affairs, post-market surveillance and vigilance, clinical operations support, and supplier, training or knowledge management work that feeds a regulated record. It applies equally to general business AI tools, such as chat assistants, when they are used for any of those tasks.

It does not apply to AI that forms part of, or is itself, a medical device or IVD. Every AI use passes an exit gate in Step 1: if the AI is part of a device, or its output informs the diagnosis, treatment or monitoring of an individual patient, the use leaves this framework and is referred to the product regulatory route.

Foundations

Seven Principles

Every requirement in Oversure traces back to at least one of these principles.

The seven Oversure principles: assess the use not the tool; effort follows consequence and reliance; oversight counts only when it works; evidence should be sufficient, not maximal; assurance lasts as long as the use; AI outputs that enter regulated records are records; people remain accountable.
Figure 1 — Oversure Seven Principles for AI Assurance
Assess the Use

The same AI system can be low risk for one task and high risk for another. Classification and assurance apply to each AI use, not to the tool as a whole.

Consequence & Reliance

The more serious the effect of a wrong output, and the more it is relied on without an effective check, the more evidence is needed.

Effective Oversight

A human review step reduces reliance only if it is designed to catch errors and there is evidence that it does.

Sufficient Evidence

The aim is enough evidence to defend the decision to use the AI for its intended use. More documentation does not mean more assurance.

Lifecycle Assurance

AI performance can change when data, suppliers, models or processes change. Control continues until the use is retired.

Traceable Records

Evidence generated in support of an AI use must be attributable and traceable, like any other regulated data.

Human Accountability

Every AI use has a named owner, and every decision informed by AI is made by a person who is accountable for it.

The Method

Five Steps, Every Time

Every AI use goes through the same five steps. Only the depth of work changes with the tier — for a Tier 1 use, Steps 1 to 3 can be completed as a single short assessment.

The Oversure method: Step 1 Define (determine intended use, apply the exit gate, define limits of use), Step 2 Identify Obligations, Step 3 Classify (by consequence, oversight and reliance, to set the assurance tier — Tier 1, Tier 2, Tier 3, or Redesign/Do Not Use), Step 4 Assure (plan and perform assurance activities, release for use), Step 5 Maintain (monitor, manage change, periodic review, retire when no longer needed) — the same method at every tier, only the depth of work and evidence changes.
Figure 3 — Oversure Method: five-step assurance pathway
Step 1
Define the use
Write the AI Use Statement — process and step, task, system, inputs, output and destination, users, effect of a wrong output, oversight, and limits of use — and apply the exit gate that removes product AI from scope.
Step 2
Identify obligations
Record which regulatory, quality and contractual obligations the use touches — record and data integrity, GxP, AI Act, data protection — so the assurance addresses what actually applies.
Step 3
Classify
Rate consequence, oversight and reliance to set the assurance tier, and apply any modifiers — generative, agentic, supplier-controlled, sensitive data, uncontrolled tool.
Step 4
Assure
Carry out the evidence-gathering the tier requires — testing against a known-answer set, oversight verification, supplier assessment — and release the use formally.
Step 5
Maintain
Keep the use under control through monitoring, a defined change envelope, change triggers and periodic review, for as long as the use runs — until it is retired.
Classification

Consequence, Oversight & Reliance Set the Tier

Classification is not a checklist — it is an equation. Consequence is rated first, oversight second, and the strength of that oversight determines how much reliance on the output can be justified. Consequence and reliance together set the assurance tier.

The Oversure Assurance Equation: inherent risk of the AI use, minus risk controls and effective oversight, minus assurance derived from evidence, equals residual risk for the AI use, which must be less than or equal to the acceptable risk threshold for that use.
Figure 4 — The Oversure Assurance Equation
Consequence

What happens if it's wrong?

C1 — no direct effect on quality, safety or record integrity.
C2 — feeds a regulated record subject to later independent review.
C3 — feeds a release, safety, risk or submission decision.

Oversight

Is the review real?

O0/O1 — no review, or a nominal check that receives no credit.
O2 — informed review: competent, resourced, recorded.
O3 — verification by design, built into the workflow itself.

Reliance

How much is it trusted?

R1 — fully, independently checked before use.
R2 — reviewed, but the reviewer depends on it substantially.
R3 — used as it comes, or not realistically checkable.

Consequence R1 R2 R3
C1 — Low Tier 1 Tier 1 Tier 2
C2 — Medium–Significant Tier 1 Tier 2 Tier 3
C3 — Critical Tier 2 Tier 3 Redesign

A use rated C3 and R3 does not proceed. The answer to high consequence and high reliance is to redesign the workflow so reliance falls — usually by building verification by design — not to test the AI harder.

Why Deployment Matters

The Same Task, Deployed Four Ways

How an AI is deployed changes who controls the model and the workflow — and that changes what's needed. Take one task: drafting a first-draft deviation description from investigator notes, for QA review. Consequence is C2 in every case.

Deployment Outcome
D1 — Personal public tool Not permitted. Confidential data on an uncontrolled tool.
D2 — Enterprise assistant Permitted with QA review against the notes. Tier 2
D3 — Feature in the eQMS Permitted once classified; vendor evidence leveraged. Tier 2
D4 — In-house tool Each sentence traced to its source, QA confirms by design. Tier 1

Good workflow design can lower the tier more than additional testing ever can. Oversure defines seven deployment types in total — from personal public tools (D1) through to agentic AI taking actions in other systems (D7) — each with its own typical modifiers and framework position.

Alignment

Built to Sit Alongside What You Already Do

Oversure is an original framework — it does not depend on any single external source — but it is deliberately designed to align with the regulations, standards and guidance already in use across medtech, pharma and biotech.

EU MDR & IVDR EU AI Act ISO 13485 ISO 14971 ISO/IEC 42001 GAMP 5 FDA Computer Software Assurance 21 CFR Part 820 & Part 11 EU GMP Annex 11 & draft Annex 22 ICH Q9(R1) & Q10 ISO 7870-2 (SPC) NIST AI RMF GDPR & ISO/IEC 27001

Annex B of the framework sets out its relationship to FDA's Computer Software Assurance guidance in detail. Auditors already familiar with CSA will recognise the reasoning: Oversure follows the same risk-based, evidence-proportionate logic, then extends it to deal with how AI actually fails — non-determinism, fabrication, drift, and model changes a supplier makes without notice.

In Practice

A Worked Example

Adverse event retrieval for a risk file — a tool retrieves candidate reports from the FDA MAUDE database so a risk management team can consider real-world failure data.

The output feeds risk acceptability decisions, so consequence is C3. In the first design, users were simply asked to "check the results" — nominal oversight (O1) — giving reliance R3 and the redesign outcome. The workflow was redesigned: the tool now presents the exact search used alongside a sample of results, so the user can reproduce the search at source and confirm it before results can be added to the risk file. That's verification by design (O3). Reliance falls to R1, and the use becomes Tier 2 — with repeatability testing added because retrieval is non-deterministic.

This is one of two full worked examples in the framework document, each carried through all five steps with the reasoning shown at every decision point.

Bringing It Together

Seven Principles, One Framework

Applying the seven principles with the methods for assurance assessment gives a single, defensible wheel of AI assurance for regulated life science processes.

The Oversure Assurance Wheel: the seven principles — assess the use, consequence and reliance, effective oversight, sufficient evidence, lifecycle assurance, traceable records, human accountability — arranged around a central shield reading 'Oversure: AI assurance that can be defended'.
Figure 6 — Oversure's Assurance Wheel
Version 1.0 · Released 22 September 2026

Get the Full Framework

The complete Oversure document includes the full method, all seven deployment types, statistical monitoring guidance, role definitions, two fully worked examples, alignment tables against MDR, IVDR, GMP and the AI Act, a detailed comparison to FDA's Computer Software Assurance approach, and a full set of supporting templates. It's free to download — training is delivered in partnership with Leap Compliance, and I'm available to help organisations put it into practice.

Oversure is a trademark of St John Lynch & Co Ltd (registration pending). © St John Lynch & Co Ltd. All rights reserved.