Sandbox profile
Deviation and notebook drafts
Medium intensityScientists draft deviation summaries and notebook answers on a server in the lab building.
- Vertical
- Life sciences and biotech
- Scale
- Small company
- Organization
- Fieldglass Bio
- Shape
- Series B biotech, one clinical candidate, a small quality team.
The business problem
Deviations and notebook entries are written late, in inconsistent language, and the quality person is also the person running samples. The team looked at a hosted assistant and stopped when counsel asked where the sequence data and the batch ids would go. They want a draft that quotes the notebook, reviewed by the study lead, cheap enough for a company that does not have an ML group.
What Grae SI recommends
Family
Qwen 2.5 Instruct or Gemma 2
Size
2B–3B on a single workstation GPU.
Why this size
The corpus is internal SOPs plus notebook text. The risk is unsupported statements, not lack of world knowledge. A small model that the quality lead can retrain when an SOP changes is a better fit than a cluster.
License
Gemma’s license is acceptable for many companies and still must be read. It is not an approval to put the model in a batch record.
Data controls
What is sensitive
Notebooks may include donor ids, sequences, and unreleased chemistry. Treat donor and patient-derived material as personal or coded health data until counsel says otherwise.
De-identification
Donor and subject codes are tokenized in the training extract. Batch ids can remain if they are not tied to a person.
Access
Study team and quality. A vendor with a support login is not given a path to the host.
Residency
The workstation or a small server in the lab office. No sync to a personal cloud drive.
Retention
Drafts that enter a deviation record follow the quality retention schedule. Exploratory chats that are not part of a record are disabled, so there is no shadow log.
Risk classification
Intensity is a planning tier for evidence. It is not a certification and not a regulatory classification.
- If the draft can become part of a GLP or GMP record, a person in quality has to accept it.
- The model does not disposition a batch and does not determine a subject’s eligibility.
- Donor-derived material keeps the tier from falling to low even when the text looks operational.
Compliance requirements to prepare for
GxP
GLP or GMP applies when the record is in that system. The model is then in the quality scope, and QA owns the change control.
21 CFR Part 11
When the deviation is an electronic record. Signatures stay in the quality system.
ICH E6(R3)
Only if the notebook is part of a clinical trial record. Preclinical lab work may be outside GCP and still inside the company’s quality system.
ISO/IEC 42001
A light AI management record: intended use, data classes, and who can promote a model version.
Grae SI helps assemble the evidence. It does not certify HIPAA, FDA, ISO, SOC 2, ICH, NAIC, GDPR, DPDP, or any other framework.
Validation KPIs
These are targets to lock before go-live. They are not measured outcomes from a customer deployment.
SOP citation
Every cited SOP section exists in the approved SOP set
Invented procedure numbers are a release blocker.
Draft usefulness
70% of deviations need only wording edits on a 60-record set
A small team will abandon the tool if they rewrite every fact.
Donor codes
No raw donor identifiers in the training extract
Tokenize before the job, then check.
Scope drift
The model refuses batch-release questions in a 30-prompt probe
The intended use is a draft, not a disposition.
Deployment architecture
One machine in the office network. ELN export is a scheduled file drop. The runtime has no default route to the internet.
01
ELN and QMS
Exports land on an internal share. People keep working in those systems.
02
Masking
Donor codes tokenized before training. Grae SI previews the sample.
03
Runtime
llama.cpp or Ollama on the lab server.
04
Quality review
The draft is pasted or posted back into the deviation. The QMS signature is the record.
Each box is a component in the customer’s network. Arrows are the order of the path, read left to right on a wide screen and top to bottom on a phone.
Where this sits in the stack
The same ten layers appear on every profile. The mark says whether Grae SI provides the layer, shares it, or leaves it with you. Person-weeks are the buyer’s effort after the runtime is deployed, not a project plan for the whole company.
- Grae SI providesGrae SI provides the layer
- SharedShared. Grae SI supports part of it.
- You ownYou own the layer after install
- You own
Layer 1
Infrastructure and compute
A single workstation-class GPU in the lab office. No VPC project.
Buyer effort after the runtime is up: 0.5–1 person-weeks
- Shared
Layer 2
Data ingestion and prep
Grae SI shows what the safety or labeling corpus needs. Your RIM or safety database produces the extract.
Buyer effort after the runtime is up: 2–5 person-weeks
- Shared
Layer 3
Data controls and governance
Subject and reporter identifiers are masked before training. Part 11 retention of the signed record is yours.
Buyer effort after the runtime is up: 1–3 person-weeks
- Grae SI provides
Layer 4
Model selection and training
2B–3B instruct model. Retrain when the SOP set changes, using the same job spec.
Buyer effort after the runtime is up: 0.5–1.5 person-weeks
- Shared
Layer 5
Evaluation and validation
A tier-matched suite, thresholds, and an exportable report. The labeled set, the acceptance call, and any statistics your quality system requires on top.
Buyer effort after the runtime is up: 1–3 person-weeks
- Shared
Layer 6
Agents and orchestration
Compliance agents that classify the use case and name the frameworks to prepare for. Any production agent that calls tools inside your applications.
Buyer effort after the runtime is up: 1–2 person-weeks
- Grae SI provides
Layer 7
Deployment and serving
Safetensors, GGUF, a model card, and an offline bundle for Ollama, vLLM, or llama.cpp. Moving that bundle into the zone and keeping the host patched.
Buyer effort after the runtime is up: 0.5–1.5 person-weeks
- Shared
Layer 8
Monitoring and drift
Registry lineage: version, dataset, eval result, and the package that was released. Live traffic checks, drift alarms, and the decision to pull a version.
Buyer effort after the runtime is up: 1–3 person-weeks
- You own
Layer 9
Application and integration
File drop in, draft out. Do not integrate the ELN until the quality lead wants the workflow twice a week.
Buyer effort after the runtime is up: 1–3 person-weeks
- You own
Layer 10
Organizational validation and sign-off
QA decides whether this version may be used on GMP deviations or only on internal drafts.
Buyer effort after the runtime is up: 1–3 person-weeks
Buyer effort for this profile
3–6 person-weeks
This is a small-company path on purpose. The enterprise version of the same industry is the manufacturing twin, not a bigger chatbot.
- Quality lead
- One scientist reviewer
- Whoever already manages the lab server
Quantitative benefits
Illustrative estimate for this sandbox. It is not a measured customer result. Assumptions for this profile are listed under the figures.
Time to a reviewable package
2–4 weeks
One server, one SOP corpus. A services engagement to “add AI” is often a six-figure project before a draft exists.
Cost versus a cloud API
About $0.5k–$1.5k a month avoided, and a policy problem avoided
Illustrative at 1,500 drafts a month. The stronger point is that sequence-adjacent text was never going to a shared API.
Compute
Under $50 a month in power
One desktop or workstation GPU left on during work hours.
Validation writing
About 1 person-week saved
Enough for a small QA team to review a packet instead of authoring one from a blank page.
Accuracy target
70% wording-only edits, no invented SOP ids
Gold-set targets.
Assumptions
- Illustrative estimate for this sandbox. It is not a measured customer result.
- The ELN can export text. If it cannot, the pilot is copy-paste and the integration weeks stay at the low end until it can.
- Batch disposition and subject eligibility are out of scope.
- A later manufacturing twin is a different model, described in the digital-twin profile.