How do we know the process is in place to stand over AI assisted decisions? Why are pilots so hard to move into production, and harder still to measure and track? How do we keep pace with what is changing? What is the standard, and where is the process?
These were the questions I was being asked. A credible benchmark matters, and that is what began the journey towards the AIGP certification
AIGP stands for Artificial Intelligence Governance Professional. It is issued by the IAPP, the professional body that has certified privacy practitioners for two decades and now does the same for AI governance. The credential launched in April 2024. Its scope is deliberately broad, and the body of knowledge is revised on a regular cycle to keep pace with regulation.
The syllabus covers six areas:
It is a comprehensive programme. Read through the lens of domain knowledge already held in a regulated business, it reads as a lifecycle process, closer to project management than to compliance training: definitions, risk, controls, validation, deployment, oversight, stakeholder engagement.
Compliance and governance are the backbone of operations in life sciences. What changes now is mapping AI to them specifically.
The guidance is arriving in pieces. The EMA has published a reflection paper on the use of AI across the medicinal product lifecycle. The FDA has set out considerations for AI used to support regulatory decision making on drug and biological products. A draft Annex 22 addresses AI in a GMP context; if AI is used in a regulated process, you will be expected to explain how it was selected, tested, controlled and overseen.
The wider regulatory picture matters just as much. Ireland has taken a distributed approach to enforcing the EU AI Act, with the HPRA designated as the authority for AI in health products and medical devices, coordinated by the AI Office of Ireland. The regulator is one you already know. Separately, Article 4 of the EU AI Act, in force since February 2025, requires organisations to ensure staff have a sufficient level of AI literacy, whatever the risk classification of the system.
Governing it is not a QA task, an IT task or a data science task. It is an AI system lifecycle question that brings all three around the same table. So the question a QA lead now faces is not whether AI is in the building. It is whether anyone can describe where it is used and who signed off on its use.
Certification does not make governance happen. People do. What the AIGP provides is a common vocabulary and a defensible reference point, which matters when a validation lead, a data scientist and a compliance officer are trying to agree what "human oversight" means in a specific workflow.
It also brings jurisdictional breadth. Life sciences organisations rarely operate in one regulatory environment. A team that understands only the EU AI Act will be surprised by what applies to the same system in the United States, the United Kingdom or Japan.
At The Institute of Applied AI, the AIGP body of knowledge sits underneath our AI governance and responsible use work, including the playbook we build with client organisations. It is not the whole method. It is the floor the method stands on.
Where is AI currently used in processes that supply a regulated output?
Who is named as accountable for those uses, by role rather than by committee?
If an inspector asked how your people were trained to use AI, what document would you reach for?
Siobhán O'Leary is an Applied AI Advisor, co-founder of The Institute of Applied AI, and holds the IAPP AIGP credential.