Most GxP environments are now hybrid whether anyone planned it or not. Legacy on-premise systems sit alongside SaaS platforms that update on the vendor’s schedule, not yours, and the validation package written at implementation assumed a system that would hold still. It hasn’t. Meanwhile suppliers are shipping AI features into validated systems as routine releases, and most quality organizations have no mechanism to catch it, assess it, or document a decision about it. This session covers how to validate systems you do not control: what to demand from supplier assessment and how far you can lean on vendor testing under CSA, how to build change control that survives a quarterly release cadence, and what to do when a feature you did not ask for lands inside a validated application.