You can use either the "Validation" or the "Question validation equation" fields. The "Question validation equation" allows for far greater flexibility in the validation criteria but requires the use of Expression Manager syntax.
Something like this (which also restricts any characters after the first two to be numeric):
Something like this (which also restricts any characters after the first two to be numeric):
regexMatch("/^[A-Z][0-9][0-9]*$/", this)