[{"data":1,"prerenderedAt":192},["ShallowReactive",2],{"\u002Fblog\u002Fai-governance-framework-ecs-botanics-case-study":3},{"id":4,"title":5,"author":6,"body":7,"category":174,"date":175,"description":176,"draft":177,"excerpt":178,"extension":179,"heroImage":178,"heroImageAlt":178,"meta":180,"navigation":181,"path":182,"seo":183,"slug":178,"stem":184,"tags":185,"__hash__":191},"blog\u002Fblog\u002Fai-governance-framework-ecs-botanics-case-study.md","AI Governance in a PIC\u002FS GMP Manufacturer: The ECS Botanics Approach","QikSolve",{"type":8,"value":9,"toc":164},"minimark",[10,14,17,22,25,41,44,48,51,72,76,79,118,122,125,129,136,139,143],[11,12,13],"p",{},"ECS Botanics operates as a regulated, pharmaceutical-grade medicinal cannabis manufacturer, subject\nto PIC\u002FS GMP standards and Organic Drugs Commission (ODC) oversight. Like many regulated\nmanufacturers, the organisation faced a familiar problem: teams were already using consumer\ngenerative AI tools such as ChatGPT and Google Gemini for document drafting, data analysis, and\nprocess design, alongside an enterprise Microsoft 365 Copilot deployment that had no governing\nframework around it.",[11,15,16],{},"That gap between available capability and controlled use is what an AI governance framework needs\nto close.",[18,19,21],"h2",{"id":20},"the-shadow-ai-risk","The shadow AI risk",[11,23,24],{},"Uncontrolled consumer AI use creates specific, identifiable risks in a GMP environment:",[26,27,28,32,35,38],"ul",{},[29,30,31],"li",{},"no enterprise data governance, audit trail, or change control on the tools being used;",[29,33,34],{},"outputs that are not version-tracked or linked to the decisions they informed;",[29,36,37],{},"no record of which tool, model version, or controlled instruction produced an output;",[29,39,40],{},"potential exposure of confidential product formulations, cultivation data, or manufacturing\nparameters to consumer services with no contractual data protection.",[11,42,43],{},"The mitigation is not to ban AI use — it is to make Microsoft 365 Copilot, already licensed and\nalready enterprise-governed, the sole approved tool for company data, with guardrails that\neliminate the risks shadow AI use creates.",[18,45,47],{"id":46},"a-risk-based-use-category-model","A risk-based use-category model",[11,49,50],{},"The framework ECS Botanics adopted classifies AI use into three categories, each with different\ncontrols and approval authority:",[26,52,53,60,66],{},[29,54,55,59],{},[56,57,58],"strong",{},"Category A — Corporate\u002Fnon-GMP:"," Copilot only, human review before external use, no\nconfidential or manufacturing data. Approval: team lead sign-off.",[29,61,62,65],{},[56,63,64],{},"Category B — GMP-adjunct:"," Copilot only, human and qualified-person review before use in a\nGMP workflow, audit trail of tool\u002Fversion\u002Foutput\u002Fapprover, no direct output in batch records.\nApproval: qualified person or quality team.",[29,67,68,71],{},[56,69,70],{},"Category C — GMP-critical:"," full ALCOA+ compliance, version-controlled Copilot instances,\nmandatory QP approval, immutable audit trail, electronic signature capability, formal change\ncontrol on any model or instruction change. Approval: QA Director and Regulatory Affairs.",[18,73,75],{"id":74},"six-governance-principles","Six governance principles",[11,77,78],{},"The framework rests on principles that will be familiar to any mature quality system:",[80,81,82,88,94,100,106,112],"ol",{},[29,83,84,87],{},[56,85,86],{},"Regulated use first"," — AI use in regulated decisions must support audit readiness,\ntraceability, and data integrity; convenience use is not permitted in GMP workflows.",[29,89,90,93],{},[56,91,92],{},"Human oversight"," — qualified personnel review and approve AI-generated outputs before use.",[29,95,96,99],{},[56,97,98],{},"Auditability"," — every AI-supported regulatory decision creates an immutable audit trail\nlinking user, timestamp, model version, inputs, outputs, and approval.",[29,101,102,105],{},[56,103,104],{},"Qualified tools"," — AI tools must be enterprise-managed, with data governance, change\nmanagement, and model governance controls.",[29,107,108,111],{},[56,109,110],{},"Segregated use"," — corporate and non-GMP workflows carry lighter controls than GMP-critical\noperations.",[29,113,114,117],{},[56,115,116],{},"Data classification discipline"," — public and internal data can go to Copilot freely;\nconfidential and GMP-critical data are restricted to Category B\u002FC workflows with explicit\napproval, and specific inputs (batch record numbers, patient names, cultivation parameters,\nformulation details) are never entered into an AI system directly.",[18,119,121],{"id":120},"making-the-audit-trail-concrete","Making the audit trail concrete",[11,123,124],{},"A Category B or C interaction produces a structured record: timestamp, user, category, tool and\nmodel version, the controlled instruction version applied, an input summary, the output generated,\nthe approving qualified person, and a retention period aligned to the organisation's record-keeping\nrequirements. Records are never deleted or edited retroactively — a correction creates a\nsuperseding record with a documented reason.",[18,126,128],{"id":127},"what-this-buys-an-inspector","What this buys an inspector",[11,130,131,132],{},"When an ODC or GMP auditor asks how the organisation ensures data integrity in its AI processes,\nthe answer is a documented, risk-based framework with an audit trail, not an informal assurance.\nThe response an ECS Botanics QA lead can give reads simply: ",[133,134,135],"em",{},"\"We follow a risk-based approach. AI\nin administrative workflows is lighter-touch. AI in GMP workflows requires full ALCOA+ controls,\nqualified-person review, and an immutable audit trail. We do not use consumer AI tools for company\ndata.\"",[11,137,138],{},"That is the practical shape of AI governance in a GMP environment: not a parallel compliance\nregime, but the same risk-based, evidence-led discipline already applied to every other quality\nprocess, extended to a new category of tool.",[18,140,142],{"id":141},"related-reading","Related reading",[26,144,145,152,158],{},[29,146,147],{},[148,149,151],"a",{"href":150},"\u002Fblog\u002Fpharma-does-not-need-a-new-ai-governance-religion","Pharma Does Not Need a New AI Governance Religion",[29,153,154],{},[148,155,157],{"href":156},"\u002Fblog\u002Fqxaios-compliance-centric-operating-model-for-ai-systems","QxAIOS: A Compliance-Centric Operating Model for AI Systems",[29,159,160],{},[148,161,163],{"href":162},"\u002Fproduct\u002Fagentic-ai-governance","Governed AI pathway",{"title":165,"searchDepth":166,"depth":166,"links":167},"",2,[168,169,170,171,172,173],{"id":20,"depth":166,"text":21},{"id":46,"depth":166,"text":47},{"id":74,"depth":166,"text":75},{"id":120,"depth":166,"text":121},{"id":127,"depth":166,"text":128},{"id":141,"depth":166,"text":142},"AI Governance","2026-09-10","How a PIC\u002FS GMP-regulated cannabis manufacturer moved from uncontrolled consumer AI tools to a governed, auditable model built on Microsoft 365 Copilot.",false,null,"md",{},true,"\u002Fblog\u002Fai-governance-framework-ecs-botanics-case-study",{"title":5,"description":176},"blog\u002Fai-governance-framework-ecs-botanics-case-study",[186,187,188,189,190],"ai-governance","gmp","m365-copilot","data-integrity","case-study","uud9eCqYFTBviHpMoNKm2zFEOhQMtW2FB97iaT3BE_k",1789037363197]