Validation

AI in document management and validation workflows for life sciences

By QLogix · Published 14 October 2026 · 7 min read

The short answer

Document control under EU GMP Chapter 4, 21 CFR Part 11 and Annex 11 is about controlled versions, approvals, effective dates, distribution and periodic review. AI changes who writes the first draft and who finds the gaps, not what must be controlled. The same holds for validation: plans, protocols and reports drafted from templates and requirements, with assurance effort set by risk under GAMP 5 and FDA's CSA guidance, and a person approving every version with an electronic signature.

EU GMP Chapter 4 (documentation) and Annex 11 (computerised systems) revised; both still in force.: 2011
GAMP 5 Second Edition: critical thinking and risk-based assurance over scripting everything.: 2022
FDA's computer software assurance guidance final: assurance effort set by process risk.: Sept 2025

Key takeaways

Document control under EU GMP Chapter 4, 21 CFR Part 11 and Annex 11 means controlled versions, approvals by authorised people, effective dates, controlled distribution, training and periodic review. AI changes who writes the first draft and who finds the gaps, not what must be controlled.
The useful AI jobs in a document system are drafting from a template and the approved sources, reviewing a draft against procedures and regulations with findings by severity, and flagging what is due for periodic review or affected by a change.
Validation benefits the same way: validation plans with activities and owners, protocols and reports generated from Part 11-ready templates, test cases drafted from requirements with traceability, and assurance effort set by risk under GAMP 5 Second Edition and FDA's CSA guidance.
Everything an AI writes stays a draft until a qualified person approves it with an electronic signature. The audit trail records the tool and its version; a change of model goes through change control; exported copies are stamped and locked.

What must a document management system control?

EU GMP Chapter 4 sets the expectations most sites work to: documents are designed, prepared, reviewed and distributed with care; approved, signed and dated by appropriate and authorised people; have unambiguous contents and a unique identifier; are regularly reviewed and kept current; and superseded versions are prevented from unintended use. Annex 11 adds the controls for the computerised systems that hold them: validation, audit trails, access control, electronic signatures with the same impact as handwritten ones, and data integrity through the record's life.

In the United States, 21 CFR Part 11 sets the conditions under which electronic records and signatures are trustworthy and equivalent to paper: validated systems, accurate and complete copies, record protection and retrieval, limited access, audit trails that are computer-generated and time-stamped, and signatures linked to their records. FDA's 2003 scope guidance narrowed enforcement to the records that predicate rules require, which is where the quality system's documents sit. For devices, the QMSR incorporates ISO 13485:2016, whose document control clause asks for the same things in its own words.

Document control requirements and where AI can help

Requirement	Source	Where AI helps	Who decides
Unique identifier, controlled versions	Chapter 4; ISO 13485	Numbering by document type; a version is created, never overwritten	The system enforces; the author requests
Review and approval by authorised people	Chapter 4; Part 11	Draft from template and sources; review findings by severity before routing	Reviewers and approvers, with electronic signatures
Regular review, kept current	Chapter 4	Periodic review due dates; the documents a change control or regulation update affects	Document owner
Controlled distribution; superseded versions withdrawn	Chapter 4	Stamped controlled copies; superseded versions marked for reference only	Document control
Training before use	Chapter 2 and 4; ISO 13485	Who must attest; reminders; the attestation signed per version	Each trained person; the supervisor
Audit trail, access control, signatures	Annex 11; Part 11	Nothing: these are system controls the AI runs inside	Quality unit and IT

Our reading of Chapter 4, Annex 11 and Part 11. The requirement column is the regulation's; the AI column is what a drafting and review tool can do without taking the decision.

Where does AI fit in the document lifecycle?

At the start, when a document is drafted from a template and the approved sources that constrain it: the parent procedure, the regulation, the equipment manual, the previous version. At review, where the AI reads the draft against those sources and the firm's conventions and returns findings with a severity and a location, so the author fixes them before the reviewers see the draft. At change, where a change control names the documents it affects and the AI proposes the edits for the owner to accept. And at periodic review, where the AI summarises what has changed in the regulations and in the connected records since the document was last approved.

What it does not do is approve, make effective, distribute or train. Those steps carry electronic signatures and the audit trail, and they stay with the people the procedure names.

The document lifecycle with AI in the loop

1. DraftFrom a template and the approved sources, by the author with the AI's draft.
2. AI reviewFindings by severity against procedures, regulations and conventions; the author resolves them.
3. Review and approvalReviewers and approvers sign electronically; the version is locked.
4. Effective dateThe version becomes the one in use; the previous one is superseded.
5. TrainingEach person who must follow it attests, per version, with a signature.
6. Periodic reviewOn the schedule, or when a change or regulation touches it; the AI summarises what changed.
The active step advances to show the sequence; every step is listed in the text.

The AI contributes at drafting, review and periodic review; the signed steps are people's. Every version is kept, and the effective version is the only one in use.

What does an AI document review look like?

Findings, each with a location in the document, a category and a severity: major, minor or observation.
Clarity: steps that can be read two ways, undefined terms, instructions without an actor.
Completeness: a section the template expects that is missing, a form referenced but not attached, a record the step produces that is not named.
Consistency: a limit that differs from the specification, a reference to a superseded version, a responsibility that contradicts the parent procedure.
Compliance: a requirement from the regulation or the standard the document should implement that it does not address, cited by clause.
Data integrity: a step that records a result without saying where, how and by whom, or that allows a value to be overwritten.
Safety: a step with a hazard and no control.

Where review findings fall in a first AI review

Clarityambiguous steps, undefined terms34%
Consistencylimits, references, responsibilities24%
Completenessmissing sections or records19%
Complianceclause not addressed11%
Data integritywhere, how, by whom8%
Safetyhazard without a control4%

An illustrative distribution for a procedure drafted from a template, from our experience of such reviews, not a published statistic. Clarity and consistency findings dominate; compliance findings are fewer but carry the most weight.

How do controlled copies and training stay controlled with AI in the loop?

A controlled copy is a copy that says what it is. The approved version carries its stamp with the final approval and effective dates and the approvers; a draft says draft and is not for use; a version routed for approval says so; a superseded version is for reference only. Printed copies are uncontrolled by definition, and the stamp says that too. The copy is locked so it cannot be edited after it leaves the system, and the audit trail records who exported which version when.

Training follows the version, not the document: when a new version becomes effective, the people who must follow it attest that they have read and understood that version, with an electronic signature, and the record shows who has and who has not. The AI's part is small and useful: proposing who is affected from the roles the document names, and summarising what changed between versions so the attestation is informed.

How does AI change validation workflow?

Validation work is document-heavy by design: a plan, requirements, risk assessments, protocols, executed tests, deviations, reports. Each has a template, a set of inputs and an approval, which is the shape AI drafting suits. From a description of the system and the attached documents, the AI drafts the validation plan with its activities, owners and due dates; from a template and the requirements, it drafts a protocol with test cases traced to requirements; from the executed results and deviations, it drafts the summary report. Each is a draft for the validation lead to correct and the approvers to sign, and a protocol is approved before it is executed and a report after.

GAMP 5 Second Edition and FDA's computer software assurance guidance set the effort: critical thinking about what the system does and what happens if it fails, scripted testing where the risk calls for repeatability and traceability, unscripted testing where it does not, and supplier evidence where an assessment supports relying on it. A drafting tool does not change that calculus; it makes the documents that record it faster to produce and more consistent.

A computerised system validation, requirement by requirement

User requirementsURS, traced120
Assessed high process riskGxP impact, data integrity, safety34
Scripted tests (high risk)steps, expected, actual34
Unscripted tests (the rest)exploratory, with a record86
Executed with results recordedpass, fail, deviation120
Deviations raised and closedbefore the report7
Requirements verified in the summary reporttraceability complete120

An illustrative model of one system's validation under a risk-based approach, not a measurement. Requirements flow to tests whose rigor follows risk; the counts show that most requirements do not need scripted testing. Each stage is a count of requirements.

Which assurance effort does the AI tool itself need?

The same question applies to the AI feature as to any software in the quality system: what does it do, and what happens if it is wrong? A feature that drafts a document or a protocol for a person to review sits at a lower process risk than one that changes a record or releases a batch, and the assurance activities follow. Two things are specific to AI. Its behaviour can change when the model or the prompt changes, so the assurance record names the model version and a change goes through change control with regression tests. And the draft must never be mistaken for the record: it is a version, audited like any other, until a person approves it.

In the European Union, a draft Annex 22 on artificial intelligence in GMP was put to consultation in 2025 and had not been finalised when this article was last updated. Its direction is consistent with the above: intended use defined, performance evidenced, a human in the loop where the output affects quality decisions, and the model under change control.

Assuring an AI drafting feature

1
Intended use
What the feature drafts, from which inputs, for whom to review. What it must not do.
2
Process risk
What happens if the draft is wrong and the review misses it; the controls that catch it.
3
Assurance activities
Exploratory testing of drafts against known inputs; scripted tests of the controls (audit trail, signature, version).
4
Model and prompt under control
Versions named in the record; changes through change control with regression tests.
5
Periodic review
Performance and incidents reviewed on a schedule, with the documents the feature drafts.

The sequence we follow under GAMP 5 Second Edition and the CSA guidance. The record is proportionate to the process risk of the feature, not to the novelty of the technology.

What stays with people

Approval of every version, with electronic signatures, and the decision to make it effective.
The review findings' dispositions: accepted, rejected with a reason, deferred to a change.
Training attestations and the decision of who must train.
Protocol approval before execution, execution itself, and the report's approval after.
The risk assessment of the AI tool, the change control over its model, and the periodic review of its performance.

Common questions

Can an AI-drafted SOP be approved as it is?

Only by the people the procedure names, after review, with electronic signatures, exactly as a human-drafted SOP. The AI's draft is a version of the document with its author recorded; the reviewers' findings and the approvers' signatures make it an approved document. Nothing about the drafting changes the approval.

Does 21 CFR Part 11 apply to AI-generated documents?

Part 11 applies to the electronic records and signatures that predicate rules require, however the text was produced. The system that holds an AI-drafted procedure must be validated, keep an audit trail, control access, and link signatures to their records. The AI's contribution is recorded in that audit trail with the tool and its version.

Do AI document and validation tools need to be validated?

They need assurance for their intended use, proportionate to process risk, under GAMP 5 Second Edition and FDA's CSA guidance. A drafting feature whose output a person reviews is lower risk than a feature that changes a record. The assurance record names the model version, and a change of model goes through change control with regression testing.

What is the difference between CSA and GAMP 5?

FDA's computer software assurance guidance, final since September 2025, is the agency's statement of a risk-based approach for software used in medical device production and quality systems. GAMP 5 Second Edition, published by ISPE in 2022, is the industry's good practice guide for compliant GxP computerised systems across drugs and devices. They point the same way: critical thinking, assurance effort by risk, and records that show the reasoning rather than screenshots of every step.

Sources

This article is general information for quality and regulatory professionals. It is not regulatory or legal advice. Check the source documents for their current status before acting on them.