· Pre-deployment assurance for AI agents
Before an AI agent reaches production, someone has to prove it can be governed: the rules it must meet, the controls it is missing, the evidence an auditor or customer will demand. Preclari runs that preflight from the design and ties each requirement to the regulatory source it comes from. Live today for regulated pharma.
· Preflight assertion / a fixed example
applicable_requirements · sources
Each source is listed below with its jurisdiction, document type and retrieval date.
The corpus is versioned. See the full corpus and how to request a jurisdiction on the Coverage page.
Capex and opex regulatory coverage · Basel
Basel pharma engineering and GMP-operations consultancy covering both sides of the regulated lifecycle: facility design, cleanroom and HVAC qualification, and commissioning on the capital side; ATMP and biologics GMP operations, tech transfer, and compliance auditing on the operational side. Partner of Preclari, with offices in Basel and Baltschieder.
Are you a specialist consultancy serving regulated industries? Email access@preclari.com to discuss a partnership.
A structured review of an AI workflow before you put it into a regulated process, modelled on the routine a pilot runs before takeoff.
The cost of finding something wrong in the air is far higher than finding it on the ground.
Find yourself first. The technical sections that follow are written for these four roles, with one targeted section each below.
Need a preflight before QA review, not after.
Hold the design while missing_controls lists a required control.
Need the applicable requirements and the missing controls in front of you before a workflow reaches review.
Sign-off stays in your own quality system.
See § 11 · Regulatory guardrailsThe preflight returns its findings as structured fields, so your own hand-off rules can act on them.
See § 08 · Built for agents, audited by humansPharma, medical-device, and financial-services firms in Switzerland, the EU, and adjacent markets.
Roughly CHF 100M to 1B revenue.
See § 12 · ImpactRegulatory intelligence platforms are document-first. They index rules, redlines, and guidance, and they help a regulatory affairs professional find the right paragraph.
Preclari is workflow-first by design. You describe the workflow (what the AI does, where it runs, what it touches), and Preclari lists the requirements that apply, the controls that are missing, and the questions a reviewer will ask. The result is a review of your workflow, not a search result.
Most regulatory tools are systems of record. They store content and answer what the rules say. Preclari sits upstream of them: it checks an AI workflow before the workflow enters the regulated process.
An agent (or a person) describes the workflow once. Preclari does the rest.
In a paragraph or a structured form, say what the AI does and where it runs. Preclari normalises prose or a typed WorkflowDescription.
WorkflowDescription { pif_version: "0.1", workflow_id: "wf_qd_triage_2026_001", intent: "Use an LLM to classify incoming quality deviations by severity", ai_role: "recommendation", output_destination: "draft_for_review", human_gate: "approve_each" }
Preclari lists the requirements that apply, the controls that are missing, and the questions a reviewer will ask. Each requirement is tied to the regulatory source and section it comes from.
PreflightAssertion { applicable_requirements: 3, missing_controls: 6, assumptions_made: 3, clarifying_questions: 3, verification_steps: 3, risk_classification: { level: "medium" } }
The result is shown on screen. When you upload a document, the result comes back signed. If anyone edits it afterwards, the signature no longer checks.
v0.1 ships the pharma GMP corpus. Medtech and the EU AI Act high-risk regime are on the roadmap; when they arrive, they will use the same architecture and reasoning pattern, with a different corpus.
Today's corpus. Covers AI workflows in GMP environments: deviation triage, batch record review, OOS handling, change control, computerised systems validation.
Example workflow: AI triage of quality deviations → preflight names Annex 11 validation requirements, missing change-control records, ALCOA+ audit-trail expectations.
EU GMP Annex 11, Annex 15 and Chapter 1 · ICH Q9(R1), Q10 and E6(R3) · FDA guidance on Part 11 scope and application, FDA data integrity and CGMP Q&A, and FDA 21 CFR Part 58 (GLP) · MHRA GxP data integrity guidance · PIC/S PE 009 Chapter 1 and PI 011-3 · WHO TRS 1033 Annex 4.
Smallest cognitive distance from pharma capability. AI-enabled medical devices fall under the EU AI Act's Annex I high-risk track. Full obligations there apply from August 2028, on a later clock than the standalone Annex III systems (December 2027), both as deferred by the Digital Omnibus in force since July 2026.
Example workflow, once the medtech corpus is in: AI-assisted Software-as-a-Medical-Device classification → the preflight would name MDR Article 10 manufacturer obligations, Annex XIV clinical evaluation gaps, and the PRRC sign-off path.
Listed with their state on the Coverage page.
Full obligations on Annex III high-risk AI systems (standalone, including financial-services creditworthiness assessment) apply from 2 December 2027, deferred by the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026); Annex I product-embedded systems follow from August 2028. Article 50 transparency duties have applied since August 2026. Financial services is the planned entry point (Annex III §5(b) creditworthiness assessment).
Example workflow, once the EU AI Act corpus is in: AI-assisted credit decisioning under AI Act Annex III §5(b) → the preflight would name the Article 6 classification basis, the Article 9 risk management posture, the Article 10 data governance steps, and the Article 14 human oversight design.
Listed with their state on the Coverage page.
The corpus state, source by source, is on the Coverage page: what is covered today, and what is on the roadmap.
Preclari is a tool the team that builds the workflow runs against itself, not a tool QA runs after the fact.
Make a preflight a step in your AI-workflow design template, and hold the design while missing_controls lists a required control.
Run the preflight on the design before it goes to review, so the questions a reviewer will ask are answered in the design document, not in the meeting.
// hand-off rules the agent enforces against its own draft if risk_classification.level in ("high", "critical") and human_gate == "none": refuse_to_finalise() if any(c.criticality == "required" for c in missing_controls): recommend_pause_pilot() if clarifying_questions: escalate_to_human("answer_first")
Two ways in to the same preflight engine.
Preclari has an MCP server, with typed tools, so an AI agent can use the same preflight. Access is by invitation today.
A person runs the same check in the web app and reads the result on screen. When you upload a document, the result comes back signed. If anyone edits it afterwards, the signature no longer checks. Sign-off stays in your own quality system.
One engine, two readers: the agent that builds the workflow, and the person who signs it off.
PIF (Preflight Interchange Format) is an open JSON specification published under Apache 2.0. Version 0.1 defines three schemas: WorkflowDescription, PreflightAssertion, and PreflightSession.
A document run returns its result as a dossier in the draft of the next version, PIF v0.2, which the published v0.1 specification does not yet describe. That output is structured JSON that validates against a schema we publish, so it can move between tools instead of living in a screenshot.
Read the spec{
"pif_version": "0.1",
"assertion_id": "pa_2026_001_a",
"workflow_ref": "wf_qd_triage_2026_001",
"produced_by": {
"tool": "example-preflight-tool",
"version": "0.1.0",
"methodology": "example-method-v1.0"
},
"corpus_snapshot": {
"snapshot_id": "corpus_2026_w19",
"snapshot_hash": "sha256:7f3e8a…0a1b",
"source_count": 10
},
"risk_classification": { "level": "medium" },
"applicable_requirements": [
{ "requirement_id": "req_001", "source": { "canonical_document_id": "EU-GMP-Annex-11" }, "confidence": "high" },
{ "requirement_id": "req_002", "source": { "canonical_document_id": "MHRA-DI-2018" }, "confidence": "high" },
{ "requirement_id": "req_003", "source": { "canonical_document_id": "PIC/S PI 011-3" }, "confidence": "high" }
],
"missing_controls": [ /* 6 entries: 4 required, 2 recommended. see example.json */ ],
"assumptions_made": [ /* 3 entries with impact_if_wrong */ ],
"clarifying_questions": [ /* 3 entries with would_change */ ],
"verification_steps": [ /* 3 entries with applies_to */ ],
"status": "draft",
"notice": "This assertion is informational and does not constitute regulatory advice."
} Not disclaimers. Fields.
assumptions_made (required): what was inferred where the description was incomplete.verification_steps (required): how a person can check the conclusions against their sources.applicability_basis (required on each applicable requirement): why that requirement applies to your workflow.clarifying_questions (optional): what would change the result if you answered it.out_of_scope (optional): what was deliberately not considered, and why.An assertion without the required fields does not validate against the published v0.1 schema. The web app does not show every field; the full set is in the returned data.
What Preclari lists, what it leaves alone, and who keeps the judgment.
These are real adjacent products. Preclari stays narrow on purpose.
The v0.1 corpus is pharma GMP. Medtech (EU MDR + FDA) and the EU AI Act high-risk regime are on the roadmap. The Coverage page is the authoritative list and updates as the corpus grows. The regulatory judgment stays with your QA.
For the budget owner deciding whether Preclari earns its line item.
Typical budget owner: Head of Digital/AI, Head of Quality, or CIO. Procurement runs through whichever owns the AI workflow's deployment risk.
Free access is curated, not self-serve. Approved users get a workspace, a monthly quota, and the full set of preflight tools. Builder, Consultancy, and Team tiers are for committed users; Private deployment is for regulated enterprise. Pricing is on request. Approval typically takes two business days.