Most writing about AI in regulated work argues about capability. Can a model map a dataset, write a derivation, draft a define file. We find the capability question less interesting than the constraint question, because the constraints are what decide whether any of it is usable in a filing. So here are the rules we actually build Norva under. They are not aspirations. They are the lines we do not cross, and every feature we ship has to live inside them.
Rule one: the AI never sees raw data
A model does not need a patient record to help build a derivation. It needs the structure of the data, the variable names, the types, the codelists, the specification. So that is all it gets. The assistive layer works against metadata and specifications, not against the clinical values themselves. The values are processed by validated, deterministic code that runs in an isolated environment with the data mounted read only.
This is partly a privacy position and partly an engineering one. If the model never touches a subject value, then a whole category of risk simply does not exist: there is no raw data in a prompt, no raw data in a log, no raw data in a place it was not meant to be. We wrote separately about why telling an agent not to open the folder is not a control. The short version is that isolation has to be enforced by the platform, not requested in an instruction.
The model works on the shape of the data. The deterministic code works on the data.
Rule two: every derivation ships with its validation and a risk score
A derivation that arrives without evidence is not finished, no matter who or what produced it. In our model, the unit of work is not a line of code. It is the derivation plus the test that exercises it, plus a record of what it was checked against, plus a risk score that says how much scrutiny it still needs. The three travel together. You cannot promote the code and leave the evidence behind.
The risk score is the part people ask about most, so to be plain about it: it is an indicator, not a verdict. It combines things we can measure, such as whether the derivation is a standard pattern or bespoke study logic, whether it touches a variable that feeds a primary endpoint, and whether its inputs changed since the last run. A high score does not block anything. It directs attention. It tells a reviewer which twenty derivations in a study of hundreds are the ones to read first. We covered the broader idea in FMEA risk scoring for a submission package; the rule here is simply that the score is attached at the point of creation, not bolted on at the end.
Evidence that is generated with the work is cheap. Evidence reconstructed after the fact is expensive, and it is the first thing an auditor distrusts.
Rule three: a qualified human is the last gate
Nothing becomes a controlled artifact because a model produced it. It becomes a controlled artifact because a qualified person reviewed it and attested to it, and that attestation is recorded. We call the moment this happens the freeze point. Upstream of it, the assistive layer can draft, suggest, and iterate freely. Downstream of it, the record is fixed and change is controlled.
The attestation is not a checkbox. It is a scoped electronic signature under 21 CFR Part 11, tied to the specific artifact and the specific version, with the reviewer identified through single sign on and separation of duties enforced so that the person who built a thing is not the only person who approves it. The signature, the identity, and the state change all land in a tamper evident, hash chained audit trail, so the sequence of who did what, and in what order, cannot be quietly rewritten later.
What these rules cost, and why we keep them
They cost speed, in the narrow sense. A system that let a model touch raw data, skip the attached evidence, and self approve its output would demo faster and feel more magical. It would also be unusable in a filing, because none of the questions a reviewer asks would have answers. Where did this value come from. Who checked it. How do we know the thing that ran is the thing that was validated. The rules exist so that those questions always have an answer that was captured at the time, not assembled under pressure during an inspection.
We think this is the honest shape of AI in regulated analytics. The model is assistive and human in the loop. It makes a skilled person faster at producing work that still has to meet the same standard it always did. The rules are what keep the speed from becoming a liability.
If you are drawing your own version of these lines for a validated environment, we are happy to compare notes. You can reach us here.
Top comments (0)