AI in quality

AI-assisted CAPA: from root cause to a verified effectiveness check

By QLogix · Published 14 October 2026 · 7 min read

The short answer

A CAPA fails for structural reasons: actions that restate the symptom, no owner or date, an effectiveness check invented at closure, and no view across records to see the same cause coming back. AI helps most before the plan is approved: proposing actions that address the confirmed cause, drafting the effectiveness criterion up front, and matching the CAPA against earlier records. People approve, implement, verify and close.

Elements of the ICH Q10 pharmaceutical quality system; the CAPA system is one of them.: 4
QMSR in effect: ISO 13485's corrective and preventive action clauses now apply under 21 CFR Part 820.: 2 Feb 2026
Things to keep apart in every CAPA: the correction, the corrective action and the preventive action.: 3

Key takeaways

ICH Q10 names the CAPA system as one of four elements of the pharmaceutical quality system, fed by complaints, rejections, non-conformances, recalls, deviations, audits, inspections and trends, with effort commensurate with risk.
For devices, the QMSR, effective 2 February 2026, incorporates ISO 13485:2016, whose clauses on corrective and preventive action require actions to be taken without undue delay, their effectiveness verified, and the results recorded.
The commonest CAPA failures are structural: actions that treat the symptom, missing owners and dates, an effectiveness check written at closure to fit what happened, and no way to see the same cause across records.
AI's contribution comes before approval: actions that follow from the confirmed cause, an effectiveness criterion defined up front with its data and window, and a match against earlier records that share the lot, equipment or cause. Approval, implementation, verification and closure stay with people.

What do ICH Q10, 21 CFR 211 and the QMSR require of CAPA?

ICH Q10 describes the CAPA system as one of four elements of the pharmaceutical quality system, alongside process performance and product quality monitoring, change management and management review. It should be fed by complaints, product rejections, non-conformances, recalls, deviations, audits, regulatory inspections and findings, and trends, and it should use a structured approach to the investigation with the objective of determining the root cause, with the level of effort commensurate with the risk, as ICH Q9 describes.

For drugs, 21 CFR 211.192 ties the CAPA to the investigation: the written record must include the follow-up. EU GMP Chapter 1 asks that appropriate corrective and preventive actions are identified and taken in response to investigations, and that their effectiveness is monitored and assessed. For devices, the Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference, whose corrective and preventive action clauses require the firm to review non-conformities, determine causes, evaluate the need for action, plan and record the action, verify that it does not adversely affect the device, and review its effectiveness.

CAPA requirements by framework

Framework	What it asks of a CAPA	What the record shows
ICH Q10 (drugs, PQS)	A structured investigation to root cause; actions commensurate with risk; CAPA as an input to management review	Source of the CAPA, root cause, actions, outcome, trend
21 CFR 211.192 (drugs)	Investigation record with conclusions and follow-up	Follow-up actions linked to the investigation
EU GMP Chapter 1, 1.4(xiv) (drugs)	Appropriate CAPA identified and taken; effectiveness monitored and assessed	Actions, their completion, the effectiveness assessment
QMSR with ISO 13485:2016 8.5.2 and 8.5.3 (devices)	Review non-conformities, determine causes, plan, record and verify actions, review effectiveness	Cause, action plan, verification, effectiveness review, records

Our summary of the published texts; each document is in the sources. The QMSR's requirements are those of ISO 13485:2016 as incorporated.

Why do CAPAs fail?

The action restates the symptom: retrain, re-clean, re-inspect. The condition that produced the event is untouched.
No owner or date, so the plan is approved but nothing is due to anyone.
The effectiveness check is written at closure, after the fact, and shows whatever happened to happen.
Correction, corrective action and preventive action are mixed together, so the record cannot show that the cause was addressed.
The CAPA is not connected to the deviations, complaints and signals that share its cause, so the same CAPA is opened again under a new number.
Closure is driven by the due date rather than by evidence that the action was implemented and worked.

What happens to 100 CAPAs

CAPAs openedevery record100
Actions address a confirmed causenot the symptom58
Owner and due date on every actionsomeone is accountable74
Effectiveness criterion defined at approvaldata, window, threshold36
Implemented with evidence on filerecords, not statements61
Verified effective at the checkcriterion met29
Reopened or recurs under a new numberthe cost of the gaps21

An illustrative model of a typical site, not a measurement. The point is where the losses occur: at the plan, where the effectiveness criterion should be set, and at verification, where evidence is missing. Each stage is a count of CAPAs.

Correction, corrective action, preventive action: why the distinction matters

A correction deals with the non-conformity itself: the batch on hold, the rework, the replaced part. A corrective action removes the cause so it does not happen again. A preventive action removes the cause of a potential non-conformity that has not yet occurred, often found through trends or risk assessment. ISO 13485 keeps the three in separate clauses for a reason: a record that only shows the correction has fixed the instance and left the cause, and an inspector reads it that way.

AI drafts help keep them apart by labelling what it proposes. A draft CAPA plan from an investigation carries the correction already taken, the corrective actions that address the confirmed cause, and, where the investigation found a condition that could affect other lines or products, preventive actions with their scope. The person approving the plan sees the three kinds side by side and can refuse a plan that is all correction.

Three kinds of action, one record

1
Correction
Contains the instance: hold, rework, reject, replace. Done at once, recorded in the deviation.
2
Corrective action
Removes the confirmed cause: a procedure, a control, a design, a supplier. Owner, due date, evidence of implementation.
3
Preventive action
Removes a cause found by trend or risk assessment before it produces a non-conformity. Scoped to the lines and products it applies to.
4
Effectiveness check
Defined at approval: the data that will be looked at, the window, and the threshold that means the action worked.

The order in which they usually happen. Only the corrective action is tested by the effectiveness check; the correction is verified by the batch disposition.

What does AI draft in a CAPA?

From the investigation's confirmed root cause and the attached documents, the AI proposes actions that address that cause, each with the role that should own it and a suggested due date, and it drafts the effectiveness check: which data to look at, over what window, and what result means success. It also reviews a CAPA plan a person wrote and says, with its reasons, whether the actions are adequate for the cause and what is missing. The plan is approved by people, under the review and approval cycle, before any action starts.

During implementation the AI does not act; people complete actions and attach evidence. At verification it helps again, by reading the evidence against the criterion and drafting the effectiveness assessment for the verifier to confirm or correct. Every draft names its sources, every edit is audited with its reason, and the tool and its version are recorded on the record.

Where the AI works in a CAPA, and where it does not

DataThe investigation and its evidenceConfirmed root cause, the tested hypotheses, attached SOPs and records, earlier CAPAs that share the cause.
AIDraft plan, adequacy review, effectiveness criterionActions that address the cause, with owner roles and dates; a review of a human-written plan; the data, window and threshold for the effectiveness check; a draft effectiveness assessment at verification.
People decideApprove, implement, verify, closePlan approval with signatures, implementation with evidence, verification against the criterion, closure with the effectiveness result signed.

The AI drafts before approval and at verification; between the two, people implement. It never completes an action or closes a CAPA.

How do you define an effectiveness check before closing?

An effectiveness check is a measurement, decided before the action starts: the data that will show whether the cause is gone, the period over which it will be watched, and the threshold that counts as success. A check that says the SOP was updated and training was done measures the action, not its effect. A check that says no recurrence of the defect in the next twenty batches, or a defect rate below a stated level over three months, measures the effect.

Writing the criterion at approval has a second benefit: it tells the team what data to keep. A control chart that was started when the CAPA was approved is the effectiveness evidence; one that was reconstructed at closure is an argument.

Effectiveness checks that can be verified

Root cause	Corrective action	Effectiveness criterion (set at approval)
Worn stopper feeder rail shedding fragments	Six-monthly PM made mandatory in the CMMS; rail inspection added to line clearance	No particle rejects attributable to the feeder in the next 20 lots; PM completed on time for 12 months
Assay method transfer missed a column lot sensitivity	Method revalidated with the column lot as a parameter; specification of column lots added	No OOS or OOT assay result from column lot variation in 6 months of release testing
Label mix-up: two products share a storage bay	Physical segregation; scanner check at line set-up	Zero label mix-ups and zero scanner overrides without QA approval in 3 months
Deviations closed late because of a vague escalation rule	Escalation rule rewritten with named roles and days	Median closure under 30 days and no unexplained extension for two quarters

Examples of the form a criterion should take. The values are illustrative; each check is set against the site's own history and risk.

How does AI detect recurrence across records?

Recurrence hides in numbering. The same cause appears as a deviation one month, a complaint the next and a batch review exception after that, each with its own record and investigator. A quality system that connects records by the identifiers they share, the lot and batch numbers, the equipment, the product, the document numbers and the wording of the root cause, shows the CAPA owner the earlier records with the same cause when the plan is written, and shows the deviation investigator the open CAPA when a new event lands.

Two other tools close the loop. Signal detection trends batch and laboratory results with control chart rules, so a sustained shift is flagged before it becomes a deviation and the effectiveness check has data from the day the CAPA was approved. Backlog triage ranks the open deviations, CAPAs and change controls by risk, so the CAPA that is late and matters is at the top of the list rather than the one that is late and does not.

The CAPA loop

1. InvestigationHypotheses tested, root cause confirmed with evidence.
2. Plan approvalActions, owners, due dates and the effectiveness criterion, approved and signed.
3. ImplementationActions completed with evidence attached.
4. VerificationEach action checked as implemented and not harmful.
5. Effectiveness checkThe criterion measured over its window.
6. Closure and monitoringClosed with the result signed; trending continues and feeds management review.
The active step advances to show the sequence; every step is listed in the text.

Each step hands to the next, and monitoring feeds back into new investigations when the data says the cause is back. The loop is the quality system's learning mechanism; a CAPA closed without the check breaks it.

What stays with people

Approval of the plan, with electronic signatures, and the decision that the actions fit the cause.
Implementation and the evidence of it.
Verification that each action was done and did no harm, and the effectiveness assessment against the criterion.
Closure, and the escalation when the check fails: a reopened investigation, not a quietly extended date.
The assurance of the AI tool for its intended use, and change control over the model that drafts.

Common questions

What is the difference between a correction and a corrective action?

A correction fixes the non-conformity in front of you: the batch on hold, the rework, the replaced part. A corrective action removes the cause so the non-conformity does not happen again. A preventive action removes the cause of a potential non-conformity that has not yet occurred. ISO 13485, as incorporated by the QMSR, treats corrective and preventive action in separate clauses, and the record should keep the three apart.

Who approves a CAPA plan?

The plan is approved by qualified people under the firm's procedure, usually the quality unit with the owning department, before any action starts. In QLogix this is a review and approval cycle with electronic signatures; the AI's draft plan is an input to that approval, not a substitute for it.

Can AI close a CAPA?

No. Closure needs evidence that the actions were implemented, verified and effective against the criterion set at approval, and a signature from the person responsible. AI can draft the effectiveness assessment from the evidence for the verifier to confirm, which saves time without moving the decision.

How long should a CAPA stay open before the effectiveness check?

As long as the criterion needs: twenty batches, three months of complaint data, two PM cycles. The window is set when the plan is approved, from how often the cause had the chance to recur. A CAPA closed before its window has elapsed has not been checked, whatever the record says.

Sources

This article is general information for quality and regulatory professionals. It is not regulatory or legal advice. Check the source documents for their current status before acting on them.