Proprietary software

AAP. The control layer between AI and the decisions that matter.

The AiVACO Assurance Platform is our highly customised, proprietary software. It sits above your existing systems and any AI model, and ensures that nothing generated by AI reaches a person, a record or a process without being grounded, validated, risk tiered and recorded.

See an example now →Book a platform briefing
AiVACO workspaceSovereign · in-environment
QuestionWhat is the dissolution acceptance criterion in SOP-114?
01

Ground

02

Validate

03

Tier

04

Record

05

Release

SOP-114 v4.0 sets Q = 80% dissolved at 30 minutes, stage 1, six units, per the linked USP method.Cited: SOP-114 v4.0 §6.2 (effective) · REC-1042 · committed before release
A1
Definition

What AAP is, and what it is not.

AAP isAAP is not
A deterministic assurance layer that verifies every AI outputAnother chatbot
Model agnostic, working with the models you chooseA model you are asked to trust
Deployed in your environment, on premises or in your tenancyA shared, multi tenant AI service
Configured to your SOPs, policies, rules and approversA generic, one size fits all product
An evidence engine that records before releaseA black box
A complement to your eQMS, EDMS and learning systemsA replacement for them
How AAP works

The five stage pipeline.

Every AI output passes through the same five stages before it can reach a person or a system. Identical inputs give identical results. Select a stage.

STAGE 1

Ground

The output is bound to the approved, current version of the source material it claims to rest on. If an output cannot be substantiated against a controlled source, it does not proceed.

Aligned withData integrity and ALCOA+ expectations; controlled documentation
STAGE 2

Validate

Deterministic rule checks, encoded from the applicable regulatory and organisational requirements. Rules are authored and version controlled by qualified regulatory specialists, and every rule produces a clear pass or fail.

Aligned withAcceptance criteria and test execution in draft Annex 22; computerised system validation
STAGE 3

Risk tier

The output is assigned a tier from A1 to D4 according to the consequence of it being wrong and the context of use. The tier decides the route it takes next.

Aligned withICH Q9(R1); intended use in draft Annex 22; the FDA risk based credibility approach
STAGE 4

Record

The output, its grounding, its validation result, its tier and any refusal are written to the audit trail before anything is released. Refusals are recorded as fully as releases.

Aligned withAudit trail, attributable and contemporaneous record expectations in EU GMP Annex 11
STAGE 5

Release

Low tier outputs that pass are released. Higher tier outputs are routed to a qualified person for explicit acceptance by electronic signature. Outputs that fail are refused or escalated.

Aligned withHuman oversight for generative AI; electronic signature requirements; retained human accountability
APPEND ONLY · HASH CHAINED AUDIT TRAILruns beneath all five stages · every output, refusal and decision recorded and reconstructable
Built on proprietary, deterministic IP

The intelligence is in the control. And the control contains no AI.

Proprietary

Deterministic Assurance Engine

Applies grounding and encoded rules to every output. Deterministic software that can be validated under existing computerised system expectations and explained to an inspector without reference to model internals.

Proprietary

A1 to D4 Tiering Service

Converts the consequence of an error and the required level of rigour into a single, auditable risk tier for every output, using a method built on ICH Q9(R1).

Proprietary

Append Only Audit Trail

A hash chained record of every output, refusal, escalation and signature, written before release. Tampering is evident, and every decision can be reconstructed.

Commodity by design

Model Agnostic Gateway

Any approved model, open weight or frontier, connects through one gateway. Swap models by configuration. Your assurance evidence does not change when the model does.

The A1 to D4 risk tier, explained

One code that encodes both principles of ICH Q9(R1).

Every output receives a two part tier. Hover or tap a cell to see the route an output takes.

1 · Low
2 · Moderate
3 · High
4 · Critical
D
D1
D2
D3
D4
C
C1
C2
C3
C4
B
B1
B2
B3
B4
A
A1
A2
A3
A4
↑ letter = formality, effort, documentationnumber = consequence →

The number (1 to 4) expresses science based risk to the patient, the learner, the citizen or the process, banded from the risk priority number in the underlying risk assessment.

The letter (A to D) expresses the level of formality, effort and documentation the output demands, derived from uncertainty, importance and complexity.

A commensurability control is enforced in software: the level of formality can never fall below the minimum the risk requires. Resource pressure never lowers rigour.

TierExampleRoute
A1Factual lookup from a current, approved SOPReleased automatically, fully recorded
B2Summary of related records prepared for an investigatorReleased to a qualified reviewer, recorded
C3Draft content that will inform a regulated decisionHeld for named approver e-signature
D4Attempt to alter or bypass a controlled recordRefused, logged as an incident, escalated
Quality risk management, built in

A regulated quality process, expressed as software behaviour.

Residual risk acceptance is always human. Acceptance is an explicit, electronically signed decision by a named person, never automatic.
Highly customised to your organisation

Configured to how you work, not the other way round.

Content packs

The approved, version controlled sources AAP grounds against: SOPs, specifications, policies, curricula, published guidance.

Rule sets

Your regulatory, organisational and sector rules, encoded and version controlled by specialists.

Tier mapping

How consequence and context translate into A1 to D4 for each use case.

Workflows and approvers

Who reviews, who signs, who is notified and when.

Escalation thresholds

Aligned to your QMS, safeguarding or governance framework.

Deployment and interfaces

On premises or in tenancy, single sign on with your identity provider, and user interfaces in your brand.

AAPCONTROL LAYER
eQMS
EDMS
ERP / MES
LIMS
LMS
IdentitySSO · e-signature
Case & recordsgovernment
AI platformsany model
Works with the systems you already own

AAP sits above your existing estate rather than replacing it.

Life scienceseQMS, EDMS, ERP, MES, LIMS, LMS and third party AI platforms already in use
EducationLearning platforms, management information systems and document repositories
GovernmentCase management, records management and published guidance repositories
EverywhereYour identity provider for single sign on and electronic signature
What organisations use AAP for

Six patterns, one pipeline.

Knowledge retrieval with provenance

Answers drawn only from approved, current sources, with the source shown and recorded.

Investigation and casework preparation

AI gathers related records and prepares a structured summary. The qualified person decides.

Controlled first drafts

Documents, reports and correspondence drafted by AI, grounded and checked, then approved through your existing process.

Regulatory and policy intelligence

Comparison, change impact analysis and horizon scanning for expert review.

Training content

Learning material generated from approved sources and checked against encoded rules.

Assured AI assistants and avatars

Interactive assistants for congresses, events and public facing services, where every response is grounded in an approved content pack. High exposure topics are excluded at platform level.

Explore AI Avatars →
Interactive demonstrator

Don't take our word for it. Click through it.

Our interactive demonstrator shows AAP's assurance logic end to end. In under ten minutes you can:

  • → Run eight scored scenarios, from an A1 factual lookup to a D4 blocked data integrity attempt
  • → Watch each output move through ground, validate, risk tier, record and release
  • → See how ICH Q9(R1) principles map to the A1 to D4 matrix
  • → Apply risk reduction measures and watch residual risk re score live
  • → See Quality and executive escalation reports generated automatically when thresholds are breached
See an example now →

Illustrative concept using fictional data. Not a validated system. Makes no live AI calls.

Walkthrough07:00
Delivered with validation in mind

A platform that arrives with its evidence.

Every AAP deployment is supported by a validation approach aligned with GAMP 5 Second Edition. Your validation team starts from a structured pack rather than a blank page.

Change control package

For your QMS

IQ, OQ and PQ protocols

Installation, operational and performance qualification

Work instructions

For reviewers and administrators

Platform risk assessment

FMEA per ICH Q9(R1)

Frequently asked questions

Straight answers for Quality, IT and procurement.

Does AAP use AI?
AAP works with AI models, but its control layer contains none. The assurance engine, the tiering service and the audit trail are deterministic software, so the same input always produces the same result.
Which AI models does AAP support?
Any model you approve, connected through our model agnostic gateway. That includes open weight models running on your premises and frontier models inside your own cloud tenancy.
Can AAP run without an internet connection?
Yes. The Tier 1 sovereign deployment is designed to run with zero egress and is air gap capable.
Does AAP replace our validation activities?
No. It makes them proportionate and repeatable. You validate the control layer once, then govern each new use case through configuration and documented testing.
Is AAP certified or approved by a regulator?
No regulator approves software platforms in this way. AAP is designed in alignment with the frameworks named on this site, and we describe that alignment transparently. Our security certification roadmap is available on request.
How long does deployment take?
A first use case can be live in shadow mode within a 90 day pilot. See How We Engage.
We already use an AI vendor. Do we have to change?
No. AAP is model agnostic and sits above the AI you already use, adding the assurance and evidence layer that most AI products do not provide.
Does AiVACO train models on our data?
No. Your data stays in your environment and is not used to train or fine tune models.

See the control layer in action.

See an example now →Book a platform briefing