THE SCENARIO

mpathic has just closed a contract with a Fortune 50 pharmaceutical company to deploy its Observing Agent API — an AI safety monitoring platform that evaluates the quality and safety of AI-assisted clinical trial interactions in real time.

The deployment spans five clinical trial sites across three countries:

• Two sites in the United States (HIPAA, SOC 2 Type II compliance required)
• One site in the United Kingdom (UK GDPR, NHS data governance standards)
• Two sites in Germany (EU GDPR, Data Protection Impact Assessment required)

The AI system at each site monitors live conversations between clinical coordinators and trial participants — including sensitive discussions about medical eligibility, side effects, and adverse events. Monitoring accuracy directly affects whether safety signals are detected in time. There is no acceptable gap in clinical oversight during the transition from pilot to production.

The program must complete full deployment across all five sites within 90 days of contract execution. You are the Senior TPM. The CTO (Brian) has final technical authority. The CEO (Dr. Grin Lord) is the executive sponsor and is directly engaged with the client's VP of Clinical Operations.

Constraint: mpathic's engineering team is four people. The clinical science team owns annotation protocols and quality thresholds but does not report to engineering. The client's clinical operations team controls site access scheduling and has its own program manager — who has never worked with an AI safety vendor before.

Three days before go-live at the first US site, your engineering lead flags a potential data integration issue: the client's EDC (Electronic Data Capture) system is returning inconsistent participant identifiers across API calls. It may be a configuration issue. It may be a data pipeline bug. The root cause is not yet known.

You own the decision on whether to delay go-live.

CONSTRAINTS

Honor all of the following — strong candidates adapt to them; generic AI output will ignore them.

• Engineering team is four people. Your plan cannot assume unlimited engineering bandwidth for parallel site configuration.
• The clinical science team controls annotation quality thresholds and expert protocols. They are not in your reporting line. Your coordination plan must reflect this.
• The client's clinical operations PM has no prior AI safety vendor experience. Your communication framework must account for this — do not assume they understand mpathic's technical architecture.
• mpathic is HIPAA, SOC 2 Type II, and EU GDPR compliant. Your compliance gates must reflect actual regulatory requirements per jurisdiction — not a generic compliance checklist.
• The go-live decision is yours. The CTO has authority but expects you to bring a recommendation, not a question.