Evidence,
not assurances.
We assess AI systems for pharmaceutical and life-sciences companies against ISO/IEC 42001, the EU AI Act, FDA 21 CFR Part 11, and India's DPDP Act 2023 — and we independently test the models themselves, not just the documentation.
Four services, one coordinated assessment.
Every engagement is scoped independently — you pay for what applies to your systems, not a fixed package.
Governance readiness assessments
Clause-by-clause gap assessment against ISO/IEC 42001 Annex A, plus any regulatory overlays your export markets or data flows trigger.
Technical verification
Independent testing of your models and data — explainability, bias and fairness metrics, pipeline integrity, and audit-trail completeness.
Training workshops
Half- or full-day sessions that build real capability in compliance, QA, and data teams — not a slide deck they'll forget by Friday.
Ongoing retainers
Quarterly monitoring so your compliance posture keeps pace as regulations — and your own AI systems — continue to change.
Four standards. One shared evidence base.
A single control can satisfy several frameworks at once — we test overlapping concerns together instead of repeating the same evidence request four times.
ISO/IEC 42001
The AI Management System standard — Clauses 4–10 plus the Annex A controls.
Foundation layerEU AI Act
High-risk obligations reach AI that is a safety component of an MDR/IVDR device, or that falls in one of Annex III's narrow categories — from 2 December 2027 and 2 August 2028 respectively. Most pharma AI is not high-risk; scoping establishes which.
Export marketsFDA 21 CFR Part 11
Electronic records and signature controls for US-facing regulatory submissions.
US filingsDPDP Act 2023
Consent, data-principal rights, and fiduciary obligations under India's data protection law. The Rules are notified; the substantive obligations commence 13 May 2027.
India dataEngineering credibility, not just compliance paperwork.
Most compliance consultants read documentation. We read the model, the data pipeline, and the logs too — then tell you what the documentation didn't.
Six phases, logged like everything else we do.
Discovery call
A free, no-obligation conversation about your AI systems, markets, and current governance maturity.
Regulatory scoping
We formally determine which frameworks actually apply — you're never quoted for one you don't need.
Technical verification
Independent testing of your models, data, and logs against what your documentation claims.
Findings & reporting
A Gap Analysis Report with an executive summary, plus a scored, prioritized remediation roadmap.
Training
A workshop that hands your team the skills to close the gaps we found — and catch the next ones themselves.
Sign-off & ongoing monitoring
A formal, signed assessor declaration recording our independence, the scope, and the basis of every finding — and, if you want it, a quarterly retainer to keep pace with what changes next.
Start with a scoping call.
No cost, no obligation. We'll tell you honestly which frameworks apply to your systems before you commit to anything.