AI in quality

# AI in deviation investigations: faster, more consistent root cause analysis
By QLogix · Published 14 October 2026 · 7 min read
The short answer
AI is most useful in an investigation at the start, where time is lost: it drafts the problem statement, the containment check, the 5 Whys and a fishbone whose causes are testable hypotheses, each quoting the write-up or an attached document. The investigator then tests, decides and signs. Nothing the AI writes becomes the root cause until a qualified person says so.
Fishbone categories (the 6M) a complete analysis covers, each cause written as a testable hypothesis. 6
Phases in FDA's OOS investigation guidance: the laboratory phase, then the full-scale investigation. 2
Written record per investigation, with conclusions and follow-up, required by 21 CFR 211.192. 1

## Key takeaways
- 21 CFR 211.192 requires a thorough investigation of any unexplained discrepancy, extended to other batches that may be affected, with a written record of the conclusions and follow-up. EU GMP Chapter 1 asks for an appropriate level of root cause analysis and, where the true root cause cannot be determined, the most likely one.
- AI is at its best drafting the parts investigators find slowest to start: the problem statement, the containment check, the 5 Whys and a fishbone whose causes are phrased as hypotheses with the test that would confirm or refute each, every quote naming its source.
- An investigation that ruled out alternatives with objective evidence holds up at inspection; one that argued its way to a cause does not. The AI's job is to make the alternatives explicit and testable, not to pick one.
- The investigator decides. The AI never sets the root cause, the classification or the CAPA; it proposes, cites and flags what is missing, and every edit to its draft is audited with a reason.

## What do the regulations expect from a deviation investigation?
For drugs, 21 CFR 211.192 is the anchor: any unexplained discrepancy, or a batch that fails to meet its specifications, must be thoroughly investigated, whether or not the batch was distributed; the investigation extends to other batches of the same product and other products that may have been associated with the failure; and a written record must include the conclusions and the follow-up. EU GMP Chapter 1 adds that an appropriate level of root cause analysis is applied to deviations, suspected defects and other problems, and that where the true root cause cannot be determined, the most likely root cause is identified and addressed.
FDA's guidance on investigating out-of-specification results, revised in 2022, sets the shape most firms use for laboratory results: a phase one laboratory investigation that checks for an assignable laboratory error before any retesting, then a full-scale phase two investigation of manufacturing and sampling when the laboratory is not the cause. ICH Q9(R1), adopted in 2023, asks that the formality and effort of risk-based work be commensurate with the risk, which applies as much to the depth of an investigation as to any other quality decision.
In FDA's published inspection observation data, failures to thoroughly investigate discrepancies under 211.192, and inadequate CAPA procedures under the device regulation, have been among the most frequently cited observations year after year. The common thread in those citations is not a missing form; it is an investigation that did not go deep enough, did not extend far enough, or did not show its evidence.
What an inspector looks for in an investigation record
Expectation Where it comes from What the record must show
Thorough investigation of every unexplained discrepancy 21 CFR 211.192 A problem statement, the facts gathered and the conclusion
Scope extended to other batches and products that may be affected 21 CFR 211.192 Which batches were assessed and the result
Appropriate level of root cause analysis; most likely cause when the true one cannot be found EU GMP Chapter 1, 1.4(xiv) The causes considered, the evidence for and against each, the conclusion
Laboratory error ruled in or out before retesting FDA OOS guidance (2022 revision) Phase one checklist, analyst and supervisor review, retest justification
Effort commensurate with risk ICH Q9(R1) The classification and why the depth of investigation fits it
Written record with conclusions and follow-up 21 CFR 211.192 Signed conclusion, CAPA references, effectiveness follow-up

A reading of 21 CFR 211.192, EU GMP Chapter 1 and FDA's OOS guidance. The wording of each expectation is ours; the sources are listed at the end.

## Where do investigations go wrong?
- They start late. The first days after a deviation are when evidence is freshest, and they are often spent on the form rather than the facts.
- The problem statement is vague. Without what, where, when and how much, every later step argues about the wrong thing.
- They jump to human error. Retraining the operator closes the record and leaves the condition that let the error happen.
- Causes are asserted, not tested. A fishbone with twenty causes and no tests is a brainstorm, not an analysis.
- Scope stops at the batch in front of the investigator, when 211.192 expects other batches and products to be assessed.
- The CAPA does not follow from the cause, so the effectiveness check, if there is one, cannot show anything.
What happens to 100 deviations without hypothesis testing
- Deviations openedevery record100
- Problem statement with what, where, when, extentspecific enough to test64
- Causes written as testable hypotheseswith a named test31
- Alternatives ruled out with objective evidencelab data, inspection, statistics22
- Root cause confirmed, not arguedholds up at inspection18
- Same cause recurs within a yearwhere it was not confirmed27

An illustrative model of a typical site, not a measurement: the figures show the shape of the funnel, where investigations lose their evidence and where recurrence comes from. Each stage is a count of deviations.

## What can AI draft, and from what?
The AI reads the write-up and the documents attached to the record: the batch record, the SOP, the equipment log, the lab data, the previous investigation. From those it drafts the pieces of a structured investigation, and every statement it makes quotes the source it came from, by document and page, so a reviewer can check it in seconds. Where the documents do not support a statement, the draft says so and lists what is missing instead of filling the gap.
The parts it drafts are the problem statement with its is and is-not boundaries, the containment and impact assessment, the 5 Whys chain, the Ishikawa fishbone across the six categories, a provisional root cause with a stated confidence, and a CAPA plan whose actions address the cause rather than the symptom. The investigator can change any line; each change is a separate audit entry with a reason, and a redraft replaces the earlier draft only with a reason too.
The division of labour in an AI-assisted investigation
- DataThe write-up and the attached documentsBatch record, SOP, equipment or maintenance log, lab record, training record, previous investigation, specification.

- AIDraft investigation with sourced quotesProblem statement, containment and impact, 5 Whys, fishbone causes as hypotheses with tests, provisional root cause, CAPA plan, and the list of information still missing.

- People decideTest, disposition, conclude, signInvestigators run the tests, record results, rule causes in or out, set the root cause and its confidence, approve the CAPA, and sign under 21 CFR Part 11.

Data goes in, the AI drafts and cites, people test, decide and sign. The AI never changes a record on its own.

## How does hypothesis testing make the root cause robust?
A potential cause becomes a hypothesis when it is written as a prediction: if this cause is responsible, the test will show this; if it is not, the test will show that. The AI drafts each fishbone cause that way, with a test method that prefers objective evidence (a laboratory analysis, an equipment inspection, an experiment, a statistical comparison of data) over interviews. The investigator records the result, and the record shows whether it supports, refutes or cannot decide the cause.
When data exists, the comparison can be a statistical test: a t-test between two batches, a chi-square across shifts, a control chart that shows whether a shift happened when the suspected cause appeared. At the end, an AI review of the conclusion rates it as robust, adequate, weak or not established, says what an inspector would challenge, and lists the next steps to close the gap. The rating is advice; the conclusion and its confidence remain the investigator's.
From potential cause to confirmed root cause
- 1 Hypothesis
If this cause is responsible, then this observable consequence follows.

- 2 Test
The method, preferring objective evidence: analysis, inspection, experiment, data comparison.

- 3 Prediction
What the test shows if the cause is responsible, and what it shows if it is not.

- 4 Result
The recorded outcome, with the data or the document it rests on.

- 5 Disposition
Supports, refutes or inconclusive; the root cause is the cause that survived and explains the facts.

Every cause on the fishbone goes through the same five steps. A cause that cannot be tested is recorded as such, with the reason.

## How does the investigation stay compliant with AI in the loop?
- Every quote names its source: the write-up, or an attached document by its ID and page. A reviewer can verify any statement without re-reading the whole file.
- The AI's draft is a version of the record like any other. Replacing it needs a reason; every edit to it is an audit entry with who, when, what and why.
- The audit trail records the AI tool and its version with each draft, so the record shows what produced the text that a person then reviewed.
- Decisions stay with people: the dispositions, the root cause and its confidence, the classification, the CAPA and the signature. The AI cannot change a record by itself.
- The tool is assured for its intended use: under GAMP 5 Second Edition and FDA's CSA guidance, a feature that drafts text for review sits at a lower process risk than one that changes a record, and a change of model goes through change control.
Who does what, step by step
Step
AI drafts Person reviews Person decides
Problem statement From the write-up Corrects boundaries Accepts the statement
Containment and impact From records Checks scope Confirms actions
Fishbone hypotheses and tests Six categories, with tests Adds or removes causes Chooses which to test first
Running the tests Suggests the method Records results Performs and interprets
Root cause and confidence Provisional, with evidence Reviews the verdict Sets the root cause
CAPA plan Actions that address the cause Assigns owners and dates Approves the plan
Classification and signature None None Classifies and signs
Role

Where the AI's contribution is high the person reviews; where the decision matters the person decides. The AI's share never reaches the signature.

## What changes in cycle time and in the quality of the conclusion?
The first draft is where the time goes: gathering what the documents say, writing a problem statement that survives a second reading, and laying out the causes. With that draft on the screen within minutes of attaching the documents, the investigator's day starts at testing, not at a blank page. The same structure every time also makes investigations comparable, which is what a trend review and an inspector both need.
The second gain is across records. A quality system that connects deviations, complaints, batch reviews, signals and CAPAs by shared lot numbers, equipment, products and cause wording shows the investigator the earlier records that share something with this one before the fishbone is drawn, so a recurrence is treated as one, and the new investigation starts from what the last one found.
An investigation with AI support, day by day
- Day 0Opened
Deviation raised, documents attached
Write-up, batch record, SOP and equipment log on the record.

- Day 0AI draft
Draft investigation
Problem statement, containment, 5 Whys, fishbone with hypotheses and tests, sourced quotes, missing information listed.

- Day 1In progress
Hypotheses prioritised, tests assigned
Investigator corrects the draft and assigns the laboratory and engineering tests.

- Day 5In progress
Results recorded, causes dispositioned
Each cause marked supports, refutes or inconclusive, with its evidence.

- Day 6Review
Conclusion reviewed
AI review rates the conclusion and lists what an inspector would challenge; investigator closes the gaps.

- Day 8Signed
CAPA approved, investigation signed
Plan approval and electronic signatures; the effectiveness check is defined before closure.

An illustrative sequence for a deviation with attached documents and laboratory follow-up. Days are working days from the deviation being raised.

## How QLogix supports investigations
QLogix's Investigations and CAPAs product drafts the analysis from the write-up and attached documents with every quote sourced, keeps each fishbone cause as a hypothesis with its test and result, reviews the conclusion for robustness, connects the record to earlier ones that share a lot, equipment or cause, and keeps every change in a hash-chained audit trail with Part 11 signatures. The services pages below describe how we put it in place within an existing quality system.

## Common questions

### Can AI decide the root cause of a deviation?

No, and it should not. The AI drafts the analysis and proposes a provisional root cause with its evidence; the investigator tests the hypotheses, records the results, sets the root cause and its confidence, and signs. Regulations place the investigation and its conclusion with the firm's qualified people, and an inspector will ask who concluded what and on what evidence.

### Does using AI in investigations need validation?

The tool needs assurance for its intended use, as any software in the quality system does. Under GAMP 5 Second Edition and FDA's computer software assurance guidance the effort follows process risk: a feature that drafts text for a person to review is lower risk than one that changes a record. The assurance record names the model version, and a change of model goes through change control.

### What is the difference between a deviation, a non-conformance and an OOS result?

A deviation is a departure from an approved instruction or standard during manufacturing or testing. A non-conformance is material, product or a process that does not meet its requirements. An out-of-specification result is a test result outside the acceptance criteria and is investigated first in the laboratory, under FDA's OOS guidance, before a full-scale investigation.

### How long should a deviation investigation take?

Neither 21 CFR 211.192 nor EU GMP sets a number of days; they require a thorough, timely investigation whose depth fits the risk. Many firms set 30 calendar days as an internal target and document a justified extension when laboratory or engineering work takes longer. What inspectors challenge is an unexplained delay, not a documented one.

## Sources
- [21 CFR 211.192, Production record review (eCFR, current)](https://www.ecfr.gov/current/title-21/section-211.192)
- [FDA: Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production, guidance for industry (revised 2022)](https://www.fda.gov/media/71001/download)
- [EudraLex Volume 4, Chapter 1: Pharmaceutical Quality System (2013)](https://health.ec.europa.eu/system/files/2016-11/vol4-chap1_2013-01_en_0.pdf)
- [FDA: Q9(R1) Quality Risk Management, guidance for industry](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/q9r1-quality-risk-management)
- [FDA: Q10 Pharmaceutical Quality System, guidance for industry](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/q10-pharmaceutical-quality-system)
- [FDA: Inspection Observations (annual observation data)](https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspection-references/inspection-observations)
- [FDA: Quality Systems Approach to Pharmaceutical CGMP Regulations, guidance for industry (2006)](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/quality-systems-approach-pharmaceutical-current-good-manufacturing-practice-regulations)
This article is general information for quality and regulatory professionals. It is not regulatory or legal advice. Check the source documents for their current status before acting on them.

## Topics
- Investigations
- Root cause analysis
- 21 CFR 211.192
- ICH Q9

## How QLogix helps
- [QMS digitization](https://qlogix.ai/services/qms-digitization)
- [AI-assisted investigations](https://qlogix.ai/services/ai-assisted-investigations)

[All articles](https://qlogix.ai/blog)

## More from the blog
- [AI in quality · 14 October 2026Connecting LIMS to investigations and CAPA: how AI speeds up OOS investigations and strengthens complianceMost OOS investigations lose their first days to gathering: the result, the raw data, the instrument's calibration, the standard's expiry, the analyst's history, the trend. When the LIMS, the investigation and the CAPA are one connected record graph, that evidence arrives with the result, AI reads it and drafts the hypotheses, and the effectiveness check is proven by the results that follow. The analyst, the investigator and QA still decide and sign.](https://qlogix.ai/blog/lims-investigation-capa-integration-ai)
- [AI in quality · 14 October 2026AI-assisted CAPA: from root cause to a verified effectiveness checkA CAPA fails for structural reasons: actions that restate the symptom, no owner or date, an effectiveness check invented at closure, and no view across records to see the same cause coming back. AI helps most before the plan is approved: proposing actions that address the confirmed cause, drafting the effectiveness criterion up front, and matching the CAPA against earlier records. People approve, implement, verify and close.](https://qlogix.ai/blog/ai-capa-management-effectiveness)
- [Validation · 14 October 2026AI in document management and validation workflows for life sciencesDocument control under EU GMP Chapter 4, 21 CFR Part 11 and Annex 11 is about controlled versions, approvals, effective dates, distribution and periodic review. AI changes who writes the first draft and who finds the gaps, not what must be controlled. The same holds for validation: plans, protocols and reports drafted from templates and requirements, with assurance effort set by risk under GAMP 5 and FDA's CSA guidance, and a person approving every version with an electronic signature.](https://qlogix.ai/blog/ai-document-management-validation-workflow)

## Talk it through with someone who has run a plant
Bring your backlog, your systems map or one investigation that keeps coming back. We will tell you plainly what we would do and what we would leave alone.
[Request a meeting](https://qlogix.ai/contact)[Email us](mailto:contact@qlogix.ai)

In the first meeting we cover
- Your current QMS and how it connects to MES, LIMS and ERP
- Where deviations, CAPAs and change controls slow down
- Whether a readiness assessment makes sense, and what it would cover

---
Source: https://qlogix.ai/blog/ai-deviation-investigation-root-cause-analysis
QLogix · contact@qlogix.ai · +17146639012