Cosine Metrics
Get the checklist Scope a workflow
AI Workflow Control · Life Sciences · Diagnostics · Healthcare Operations

Use AI in your regulated workflows — and stay inspection- and audit-ready.

Your quality, lab, and operations teams are already using AI. We train your team, shape the strategy, and build the validated workflow itself — inspection- and audit-ready, fixed fee.

Scope a workflow See a sample binder
1workflow per engagement
Fixedfee, never hourly
0regulated data in intake
What you get · a validated AI workflowInspection / audit-ready
  • 01Retrieval over your controlled documents (vector search)
  • 02Intent classification & triage
  • 03Structured human-review & approval stages
  • 04Validation & acceptance testing (CSA / GAMP)
  • 05Data-integrity & PHI controls, audit logging
  • 06Monitoring, drift detection & SOPs
  • 07The Control Binder — evidence to defend it

See the full engagement →

Built to FDA AI Guidance (Jan 2025) EU GMP Annex 22 GAMP 5 21 CFR Part 11 HIPAA Security Rule
The problem

The risk isn't AI. It's uncontrolled AI in a regulated workflow.

An inspector or auditor won't ask whether your tool is clever. They'll ask who's accountable, where the data went, and where the evidence is. Three places it breaks down:

No documented human review

"Human in the loop" isn't a control unless the loop is written down — a named reviewer, logged corrections.

Data-integrity / PHI exposure

Regulated records or PHI flowing into unvalidated tools, with no audit trail and no ALCOA+ or privacy assurance.

No validation evidence

It works in a demo, but there's no context of use, risk class, or acceptance testing an inspector will accept.

Why there are two of us

We sit between your compliance/quality and IT/security teams.

It takes quality-and-validation discipline and a real grasp of how AI behaves. Most teams have one, not the other. We work in both — and ship one set of controls everyone signs off on.

Regulated quality & validation

What an inspector expects

Risk-based validation, data integrity (ALCOA+), deviation/CAPA, and inspection readiness — from someone who runs regulated manufacturing compliance today.

AI & security

How AI actually behaves

Context of use, hallucination and drift, model-change control, and vendor data review — from someone who has built AI compliance products, not just read the guidance.

A "HIPAA-compliant" or "SOC 2" vendor badge doesn't make your workflow defensible. You still own the controls, the human review, and the evidence.
What we do

From training your team to a built, validated workflow.

Four ways we help you put AI to work in regulated work — safely. Start anywhere; most teams begin with a Risk Review.

Train

Train your team

Get quality, operations, and IT fluent and safe with AI in regulated work — before they improvise.

Strategize

Shape the strategy

Which workflows, which tools to buy, what to build — and the controls each needs.

Build

Build the workflow

Retrieval, classification, and human-review stages — the working system, built right.

Validate

Validate & defend it

Acceptance testing, monitoring, and the Control Binder — inspection- and audit-ready.

Scope a workflow See services & pricing

Fixed fee — from a $7,500 Risk Review to a full build. No hourly billing.

Not ready to talk?

Get the AI Workflow Readiness Checklist.

Mapped to FDA AI guidance, EU Annex 22, GAMP 5, Part 11, and HIPAA. Find the gaps before an auditor does — one email, no call.

Get the resource pack

The checklist, a sample Control Binder, and the vendor checklist — one email.

Work email only — no PHI or confidential records. Unsubscribe anytime.

Have one workflow where AI is already in play?

Scope it in a two-minute intake. We'll tell you whether it's a fit — and the fastest path to a defensible workflow.

Scope a workflow See a sample binder
Flagship · we build it

The AI Workflow Engagement

We design, build, and validate one AI workflow end to end — the working system your team actually uses, plus the evidence to defend it to Quality, Operations, IT/Security, and an auditor.

Scope a workflow See a sample binder

$45,000–$90,000 fixed fee · 6–12 weeks · 50% to start, 50% on delivery · one workflow, one team  ·  scoped per SOW

What we build

A working AI workflow — on your controlled data.

The system your team actually uses, built to a standard an inspector or auditor accepts. Typical components:

Retrieval over your documents

A vector database / semantic search over approved SOPs, regulatory text, batch records, or policies — answers grounded in your controlled sources, not the open internet.

Intent classification & triage

Classify and route the work — deviations, quality events, prior-auth cases, document types — with confidence thresholds and fallbacks.

Structured human-review stages

The workflow stops at defined gates. Nothing auto-commits to a regulated record; reviewer roles, approvals, and corrections are built in and logged.

Acceptance-test harness

CSA/GAMP-aligned test cases, an error taxonomy, and before/after metrics — run against the system we built.

Monitoring & drift detection

Sampling, KPIs, model-change control, and revalidation triggers — so the validated state doesn't silently expire.

Data-integrity & PHI controls

ALCOA+ / Part 11 and HIPAA boundaries enforced in the build — access controls, audit logging, retention, BAA triggers.

Validation evidence

The Control Binder — the evidence to defend it.

Every build ships with the 11-part Control Binder: the package Quality, IT/security, and an auditor sign off on.

Use-case charter & context of use · current-state map · data-integrity / PHI & Part 11 flow map · risk & impact assessment · human-review & accountability model · validation / acceptance-test plan · AI tool & vendor assessment · SOP pack · monitoring & sampling plan · training & sign-off · executive go/no-go memo.

Workflows we cover: SOP authoring · deviation/CAPA · batch-record review · lab quality events · clinical documentation · prior-auth & denials · regulatory/literature search.

See a full sample binder →
The process

Design, build, validate, hand off.

Wk 0

Scope & contract

SOW, NDA, document & data access

Wk 1–2

Design

Use case, context of use, architecture & controls

Wk 3–7

Build

Retrieval, classification, review stages, integrations

Wk 7–9

Validate

Acceptance tests, data-integrity / PHI controls, SOPs

Wk 9–11

Pilot & monitor

Pilot, monitoring, drift detection, training

Wk 12

Handoff

Final binder, readout, go/no-go, roadmap

Built for your team

One binder your whole team can use.

We sit between your compliance/quality and IT/security teams and produce one set of controls both sign off on. Each function gets the section it needs:

Quality & Regulatory

Will this hold up in an inspection?

Context of use, risk classification, CSA-aligned validation evidence, data-integrity and Part 11 mapping, and a documented human-review control.

Clinical & Operations

Will it hold up operationally and with payers?

Workflow map, payer- or rule-verification step, human-review thresholds, error sampling, and an adoption plan staff will follow.

IT & Security / Privacy

What happens to our data and PHI?

Vendor assessment: data handling, retention and training settings, access controls, audit logs, model-change handling, and BAA triggers.

Executive Sponsor

Do we proceed?

A one-page go/no-go memo: readiness rating, material gaps, residual risk, and a 30/60/90-day path.

FAQ

Common questions

Do you build the system, or just advise?
We build it — retrieval, classification, review stages, integrations — the working workflow, plus the validation evidence around it. That's the point: builders who can validate to a regulated standard, and validators who can build. Final regulatory determinations stay with your team and counsel.
What is your pricing model?
Fixed fee, fixed scope — never hourly. Each engagement is a defined set of deliverables and dates, priced against the cost of an audit finding or a failed validation, not against time spent. A build engagement runs $45–90k; strategy and training are lower; entry reviews start at $7,500.
Do you replace our quality, compliance, or operations team?
No. We work alongside your QA/RA, validation, IT, compliance, and operations stakeholders and produce artifacts they own. Final regulatory determinations stay with your team and counsel.
Do you do FDA device submissions?
No. We're not a 510(k)/De Novo submission shop, and we don't represent you to FDA. We govern and validate AI inside your regulated quality, manufacturing, lab, and operations workflows. For a diagnostic lab, that includes helping you classify whether an AI feature stays under CLIA — verified in your own lab under 42 CFR §493.1253 — or crosses into FDA device territory, and validating it to the right standard. Final device/LDT determinations stay with your team and counsel. If you need submission authoring, we'll tell you plainly and point you elsewhere.
What's out of scope?
Legal advice, FDA representation, certification, 510(k)/De Novo authoring, full QMS builds, penetration testing, and any guaranteed regulatory or inspection outcome. We design and validate the controls; final regulatory determinations stay with your team and counsel. Every statement of work says so explicitly.
Which frameworks do you align to?
FDA's 2025 AI draft guidance (context-of-use credibility), EU GMP Annex 22, GAMP 5 (2nd Edition), FDA Computer Software Assurance, 21 CFR Part 11, ALCOA+ data integrity, CLIA (42 CFR Part 493) for diagnostic labs, the HIPAA Security Rule, and NIST AI Risk Management Framework. Several of these are draft or contested (Annex 22, the FDA AI guidance; the FDA laboratory-developed-test rule was vacated in 2025) — we work from what's currently in force and re-verify per engagement.
Scope a workflow
Services

Engagements & pricing

Everything is fixed-fee and fixed-scope, so you always know what you're getting and what it costs.

Train your team, shape the strategy, build the validated workflow, then run it as it scales. Start anywhere — most teams begin with a Risk Review.

Start here

AI Workflow Risk Review

$7,500
1–2 weeks

One workflow: what to build, which tools to buy, where the data and PHI risk is, and the controls it needs.

  • Use-case charter + data/PHI risk
  • Recommended architecture & controls
  • Go/no-go and a path forward
Scope a workflow
Train

AI in Regulated Workflows — Team Training

$7.5–15k
briefing + workshop

Get quality, operations, and IT fluent and safe with AI in regulated work.

  • Executive briefing + practitioner workshop
  • Role-based safe / unsafe examples
  • The human-review discipline, applied to your workflows
Ask about training
Strategize

AI Workflow Strategy & Roadmap

$15–25k
2–4 weeks

Where AI fits across your workflows, which tools to buy, what to build, and the controls each needs.

  • Prioritized workflow map
  • Target architecture: retrieval, classification, review stages
  • Which tools to buy, what to build, in what order
Scope a workflow
Flagship · Build

The AI Workflow Engagement

$45–90k · 6–12 weeks

We design, build, and validate one AI workflow end to end — the working system and the evidence to defend it: retrieval over your controlled documents (vector search), intent classification and triage, structured human-review stages, an acceptance-test harness, monitoring and drift detection, and the full Control Binder. Tailored to pharma & biologics, diagnostic labs, medical affairs, or regulated healthcare operations.

See full detailsScope a workflow
Run

Governance & Monitoring

$4–8k /mo
ongoing · after a build
  • Monitoring, sampling & drift review
  • Model-change control & revalidation
  • Controls for each new workflow you add
Discuss a retainer

Not sure where to start?

A Risk Review tells you what to build, the controls it needs, and what it will cost — for one workflow, fixed fee.

Scope a workflow
About Cosine Metrics

Who we are

Two practitioners — one from regulated quality and validation, one from enterprise AI and security. Governing AI in a regulated workflow takes both.

Nicole Brooks
Regulatory, Quality & Validation

Nicole Brooks

15+ years in life-sciences & healthcare quality and compliance
  • Senior Specialist, Manufacturing Compliance at a biologics manufacturer
  • ~8 years leading quality in cytogenetics & molecular-genetics labs
  • Translates GMP, GLP, CAP/CLIA, and data-integrity mandates into validation evidence that passes inspection
  • Lives in deviation/CAPA, audit readiness, and document control
  • M.S. Biotechnology Regulation · ASCP-MLS
Eric Brooks
Enterprise AI & Cybersecurity

Eric Brooks

10 years in enterprise AI product management
  • Built an AI compliance platform from concept to launch in 60 days; built AI evaluation and audit-preparation tooling
  • Subject-matter expert across 100+ compliance frameworks
  • Owns secure architecture, data handling, threat modeling, and vendor-security review
  • Translates how AI behaves — context of use, drift, model-change control — into operating controls
  • CompTIA Security+ certified
Boundaries: We build and validate AI workflows for regulated teams. We are not a law firm, a certification body, or a 510(k)/De Novo submission shop — final regulatory and legal determinations stay with you and your counsel.
Scope a workflow
Resources

Tools to find your gaps before an auditor does

Free, practical, and mapped to current FDA, EU, and HIPAA expectations. Sent to your inbox — no sales call required.

Checklist

AI Workflow Readiness Checklist

See where your AI use stands against FDA AI guidance, EU Annex 22, GAMP 5, Part 11, and the HIPAA Security Rule — across data integrity, human review, validation, vendor risk, and monitoring.

Sample deliverable

Sample AI Workflow Control Binder

See exactly what the Engagement produces. A redacted, illustrative binder for a fictional "AI-assisted deviation summary" workflow — charter, data-integrity map, risk register, validation plan, and SOPs.

Checklist

AI Vendor / Tool Review Checklist

Evaluating an AI vendor or an eQMS/EHR AI feature? Run it through this first — data handling, retention/training settings, audit logs, model-change handling, and validation gaps.

For referral partners

Validation/CSV firms, eQMS implementers, regulatory counsel, CDMOs, and HIPAA/RCM/EHR consultants: when a client asks about AI in their workflows and it's outside your scope, we handle the build and the controls around your work. Formal, reciprocal referrals — referred clients get a fast-tracked call.

Refer a client
Qualification first

Scope a workflow

This intake tells us — and you — whether one AI-assisted workflow is a fit for a Risk Review or the Engagement. Answer at the business level. It takes about two minutes.

No confidential records. Describe the workflow and risk in business terms only. Do not paste batch records, quality records, validation files, patient data/PHI, or proprietary documents.
Checklist Scope a workflow