AI governance and model-risk framework for a pharma company

The client is a Swiss pharmaceutical company deploying AI into regulated processes across R&D and operations. In pharma, GxP obligations and the incoming EU AI Act make governance a board-level concern, not a technical footnote.

Adoption had outrun oversight: teams were shipping useful AI faster than the quality function could put controls around it, leaving the board exposed to a risk nobody clearly owned.

The company was shipping AI into regulated processes faster than its quality function could govern it, creating exposure that nobody formally owned. Useful tools were going live without a consistent control wrapper around them.

There was no single standard the board could stand behind, so each team improvised its own controls, a patchwork that was impossible to assure or defend to a regulator. Inconsistency itself was the risk.

With GxP obligations and the EU AI Act both in scope, the gap between practice and governance was becoming a genuine regulatory risk. The board needed to close it quickly, but without a heavyweight framework that would grind delivery to a halt.

We wrote a proportionate model-risk framework mapped to GxP and the EU AI Act, sized so it governs real risk without smothering delivery. Proportionality was the design principle: heavy controls on high-risk models, light-touch on low-risk ones.

It defines a tiering model, sign-off gates, and a monitoring standard, plus a model inventory that gives the board a single view of what is running where. That inventory alone turned an invisible sprawl into something governable.

Rather than hand over a document that would sit on a shelf, we piloted the framework on live models to prove it worked in practice, then trained the quality and data-science teams so ownership stayed inside the company. The goal was a capability they run themselves, not a dependency on us.