CIOMS WG XIV — The Seven Governance Principles

CIOMS Working Group XIV published its Final Report in December 2025, and it’s worth being precise about its status: this is not a draft position or an advocacy document — it’s the final, published position of an international expert working group convened by CIOMS and WHO, and it’s the specific document ICH, EMA, FDA, and CDSCO are expected to reference as they develop their own AI-specific guidance through 2026 and 2028. Every organisation using AI anywhere in its PV system should have specifically reviewed this report, not a general corporate AI ethics policy.

The seven principles run through the whole lifecycle of an AI tool in a regulated PV workflow. Transparency requires AI model logic to be explainable in human terms — black-box models where the decision pathway can’t be understood aren’t acceptable in safety-critical workflows, and every model needs documented architecture and decision-pathway explanations sufficient for audit. Validation requires every model to be tested against representative PV datasets before deployment, with documented precision, recall, and F1-score metrics covering every population subgroup the model will actually encounter — Lesson 13.9 covers exactly what this validation dossier contains.

Human Oversight is the principle this entire module has been building toward from every angle: mandatory human-in-the-loop review for every AI output before regulatory action, with genuine override capability, and — explicitly — this cannot be waived for efficiency. A workflow design that makes AI override practically impossible undermines the principle even if it technically exists on paper. Bias Testing requires models to be tested for demographic, geographic, and clinical bias, with underrepresentation in training data documented and disparate subgroup performance addressed through retraining or documented constraints — a model that performs well overall but poorly for elderly or paediatric patients is not acceptable simply because its aggregate numbers look good.

Audit Trails require every AI model action to generate a reproducible log — input, model version, and output, showing both what the AI proposed and what the human decided, and explicitly where they differed — extending the audit trail discipline Module 11 built for the PSMF to cover AI outputs specifically. Accountability is the principle that connects most directly to Module 11: the QPPV retains final legal and ethical responsibility for every safety decision, including AI-informed ones, and that responsibility cannot be transferred to a technology vendor through contract or clever technical design — a vendor contract can define what the vendor is responsible for (platform performance, model accuracy), but it can never make the QPPV’s accountability disappear. And Ongoing Monitoring requires continuous post-deployment performance tracking, because model drift — accuracy degrading as real-world data distributions shift away from training conditions — requires detection and a defined response protocol, with revalidation triggered whenever performance falls below a documented threshold.