AI in quality

Connecting LIMS to investigations and CAPA: how AI speeds up OOS investigations and strengthens compliance

By QLogix · Published 14 October 2026 · 12 min read

The short answer

Most OOS investigations lose their first days to gathering: the result, the raw data, the instrument's calibration, the standard's expiry, the analyst's history, the trend. When the LIMS, the investigation and the CAPA are one connected record graph, that evidence arrives with the result, AI reads it and drafts the hypotheses, and the effectiveness check is proven by the results that follow. The analyst, the investigator and QA still decide and sign.

Phases in FDA's OOS investigation guidance: the laboratory phase first, then the full-scale investigation of manufacturing and sampling.: 2
ALCOA+ attributes a laboratory record must keep, from attributable to available, across every system the result passes through.: 9
Original result. An OOS result stands until an investigation finds an assignable cause; a passing repeat never replaces it.: 1

Key takeaways

The laboratory is where most investigations start, and the regulations are specific: 21 CFR 211.160 and 211.165 require scientifically sound specifications and complete laboratory records, 211.192 a thorough investigation of any failure, and 211.194 the data derived from every test. FDA's OOS guidance sets the two-phase shape that inspectors expect.
A LIMS connected to the investigation and CAPA records is a different thing from a LIMS with an export button. The OOS result opens its investigation with the determinations, raw data fingerprints, instrument calibration state, standards and analyst attached and linked both ways; the investigation's findings govern what the laboratory may do next; the CAPA's effectiveness check reads the results that come after it.
AI accelerates the parts that are slow and repetitive: reading the trend, listing the testable hypotheses from the data around the result, drafting the phase one checklist and the write-up with every quote sourced. It proposes; the investigator tests and decides.
Compliance improves because the record is complete by construction: every result keeps its history, every link is audited, no result is tested into compliance, and the AI's drafts are reviewed and signed by people. The inspector sees one trail from the chromatogram to the closed CAPA.

What do the regulations ask of laboratory results and their investigation?

The laboratory controls in 21 CFR 211 are among the most specific in the regulation. Section 211.160 requires that specifications, standards, sampling plans and test procedures be scientifically sound and that laboratory controls include the calibration of instruments at suitable intervals. Section 211.165 requires testing of each batch against its specifications before release, with the accuracy and reliability of the test methods established. Section 211.194 lists what laboratory records must contain: the sample, the method, the weights and measures, the data derived from every test including all graphs and charts, the calculations, the results and how they compare with the acceptance criteria, and the initials of the person who performed each test and of the person who reviewed it.

When a result fails, 211.192 takes over: a thorough investigation, extended to other batches that may have been associated with the failure, with a written record of the conclusions and follow-up. FDA's guidance on investigating out-of-specification results gives that investigation its shape for laboratory results: a phase one laboratory investigation that looks for an assignable laboratory error before any retesting, and a phase two full-scale investigation of manufacturing and sampling when the laboratory is not the cause, with retesting and resampling under a protocol and the original result never discarded without an assignable cause. EU GMP Chapter 6 asks the same of quality control, including that out-of-specification and out-of-trend results are investigated and that trend analysis is performed on results.

FDA's data integrity guidance adds what a system must do with all of this: the data must be attributable, legible, contemporaneous, original and accurate, with audit trails reviewed, and nothing deleted or overwritten. MHRA's GxP data integrity guidance sets the same expectations across the lifecycle of the data. The thread through all of it is that the result, its raw data, the investigation it triggered and the action that followed must be one connected, reviewable story.

What a laboratory result must carry with it

Expectation	Where it comes from	What the connected record shows
The specification the result is judged against, scientifically sound and approved	21 CFR 211.160; EU GMP Chapter 6	The approved specification version linked to the sample, with the method and limits
Instruments calibrated at suitable intervals; standards and reagents in date	21 CFR 211.160(b)(4), 211.194(d)	Calibration state and standard expiry checked at the time of analysis and kept with the result
Complete laboratory records: data, calculations, comparison with criteria, who tested and who reviewed	21 CFR 211.194(a)	Determinations as typed, raw data fingerprinted, calculated by the system, second-person review signed
A thorough investigation of any failure, extended to other batches	21 CFR 211.192	The investigation opened from the result, pre-filled, linked both ways, with the batches assessed
Phase one laboratory investigation before retesting; original result kept	FDA OOS guidance (2022)	No repeat without the investigation linked; invalidation only with an assignable cause and a reason
Out-of-trend results investigated; trends reviewed	EU GMP Chapter 6	Control chart with run rules on every test; out-of-trend flagged on the sample
Attributable, contemporaneous, original, audit trails reviewed	FDA and MHRA data integrity guidance	Every entry under the analyst's own account, time-stamped, in a hash-chained audit trail

A reading of 21 CFR 211.160, 211.165, 211.192 and 211.194, FDA's OOS guidance and EU GMP Chapter 6. The wording of each expectation is ours; the sources are listed at the end.

What does a connected LIMS, investigation and CAPA architecture look like?

A LIMS that stands alone produces results, and the quality system receives them by export, email or re-typing. Every hand-off loses context: the investigator gets the number but not the determinations, the instrument but not its calibration history, the analyst's name but not the other results they recorded that day. The connected architecture treats the laboratory record, the investigation and the CAPA as nodes in one record graph. A link is a first-class, audited object with a direction and a meaning: this investigation runs under this OOS result; this CAPA addresses this investigation's root cause; this change control implements this CAPA's action on the method.

In QLogix the graph has a few more nodes. Specifications are controlled documents, so a result is judged against an approved version and a specification change goes through change control. Instruments and reference standards are records with their own calibration and expiry history, so a failed calibration lists the results recorded on that instrument since the last good one and opens a deviation investigation pre-filled with every sample to assess. Interfaces are controlled too: an instrument data system or an ERP connects through a registered interface that starts in validation, is bound to an API key with a laboratory scope, and is only heard once its validation reference is recorded. A result received through an interface is checked exactly like a typed one.

The figure shows the flows. Data moves from instruments into the LIMS and from the LIMS into the investigation; findings move back as invalidations and repeat approvals; actions move into the CAPA and change control; every result and every link lands in the audit trail; and the AI reads across all of it, in the same permission model as the person asking. Nothing in the diagram is a file transfer. Each arrow is a link on a record that an inspector can follow in either direction.

One record graph: laboratory data, investigation, CAPA and the AI that reads across them

data systems
AI
people decide and sign
connected systems

The dots travel in the direction of the data. Instruments and the ERP connect through validated interfaces; the LIMS, investigation, CAPA and change control are records linked both ways; the AI reads the graph under the user's permissions and writes only drafts; people decide and sign; every arrow is an audited link.

From an OOS result to an open investigation in one step

The moment that matters is the one just after the result fails. In a disconnected laboratory the analyst tells a supervisor, someone opens a deviation form, and the investigator begins by asking for things: the chromatogram, the sequence, the standard's certificate, the instrument's last calibration, the analyst's training record, the results of the other samples in the run. Days pass before the first hypothesis is tested, and the phase one laboratory investigation that the guidance wants done promptly is done late and from memory.

In the connected architecture the result's failure is a system event. The sample shows the result in red and offers to open the OOS investigation. The investigation opens pre-filled: the specification and limit, the determinations as typed, the fingerprints of the raw data files, the instrument with its calibration state at the time of analysis, the standards with their expiry, the analyst, and the other results in the same run. It is linked to the sample both ways. From here the rules are enforced by the system rather than by vigilance: a repeat can be recorded only under the linked investigation with the step it follows; the original result cannot be corrected into compliance; a passing repeat never replaces the failing one; and the sample goes to review only once the investigation that invalidated a result has itself been approved.

The same pattern applies beyond the single result. A failed calibration lists every result recorded on that instrument since its last good calibration and opens a deviation investigation with all of those samples attached. A trend crossing a run rule on the control chart flags the sample as out of trend, which EU GMP Chapter 6 also expects to be investigated. Each path lands in the same investigation record with the same links.

The OOS path, with the system enforcing the rules

1
Result fails
Judged by the system against the approved specification; the sample shows it in red and cannot be cancelled while the result stands.
2
Investigation opens, pre-filled
Result, determinations, raw data fingerprints, instrument calibration, standards, analyst and the rest of the run, linked both ways.
3
Phase 1: laboratory
Assignable laboratory error sought first. AI drafts the checklist from the data; the analyst and supervisor answer and sign.
4
Phase 2: full scale
Manufacturing and sampling when the laboratory is not the cause. Retests and resamples under a protocol, each repeat linked to its step.
5
Disposition
Invalidation only with an assignable cause and a reason; the original result stays on the record with its history.
6
CAPA and effectiveness
Actions address the confirmed cause; the effectiveness criterion is a result window and threshold the LIMS reports against.

Each step is a record state, not a form. The investigation carries the laboratory data from the moment it opens; the laboratory cannot act on the result without the investigation; the CAPA's effectiveness is read from the results that follow.

Where does AI accelerate the investigation?

AI is not needed to judge a result against a limit; the system does that deterministically, and it must. AI earns its place in the parts of an investigation that are slow because they are reading and reasoning over scattered data. Given the pre-filled investigation and read access to the laboratory records, it drafts the phase one checklist specific to this result: the dilution and weighing checks, the sequence and integration review, the system suitability, the standard preparation. It lists hypotheses as testable statements, each with the data that would confirm or refute it and a quote from the record it came from: the standard was prepared two days before expiry; the instrument's last calibration was borderline on linearity; three other samples in the run drifted upward.

It also reads the trend. The control chart on every test, with limits from the moving range and Nelson run rules, is a mechanical calculation; interpreting it is not. The AI's draft notes that the OOS point was preceded by six rising results that already triggered a run rule, that the shift coincides with a new lot of the reference standard, and that the other tests on the same instrument show no such shift, so the standard is a stronger hypothesis than the instrument. That is the kind of synthesis an experienced investigator does in an afternoon and a new one takes a week to reach.

The limits are explicit. The AI proposes and cites; it does not set the root cause, invalidate a result, approve a repeat or close an investigation. Every draft is a draft on the record, with the model version named, until an investigator edits it, records the test results and signs. The AI's own final review before the record is routed for approval checks the investigation against what 211.192 and the OOS guidance expect, and lists what is still unsupported.

Reading the trend around an OOS result

An illustrative assay series for one test of one specification, drawn as the LIMS control chart draws it. The run of rising results before the failing point is the signal the AI points at: it was visible six samples earlier, and it coincides with the change of reference standard lot. The specification limits are the record's; the run rules and the hypothesis are the draft's.

Data analysis at the speed of the laboratory

The deeper gain is in what happens to the population of OOS results over a year, not to any single one. A laboratory that investigates each result from scratch finds assignable laboratory causes in some, confirms manufacturing causes in others, and leaves a residue of investigations that end in no assignable cause because the data to decide was never gathered or had been overwritten. A connected laboratory changes the shape of that funnel. Phase one is faster and more often conclusive because the checklist is specific and the data is present. Phase two extends to other batches because the system knows which batches were tested on that instrument, with that standard, by that analyst, in that period. The CAPA is tied to a cause rather than to a symptom because the investigation showed its evidence.

The figure is an illustrative model, not a measurement, and the point is the shape rather than the numbers: losses in a disconnected laboratory are concentrated at the gathering and the no-cause stages, and those are exactly the stages a connected record graph and an AI reader remove. What remains is the scientific work: testing the hypothesis, deciding, signing.

The same data serves continued process verification. Right-first-time rates, turnaround from receipt to approval, out-of-trend and invalidation counts by test, analyst and instrument are laboratory indicators the LIMS reports from the records themselves, and the AI can be asked, in plain language, what changed in the assay trend for a product over the last quarter and whether any open CAPA already addresses it.

What happens to 100 OOS results

OOS resultseach opens its investigation100
Phase 1 complete within targetdata present from the start88
Laboratory cause confirmedresult invalidated with a reason34
Phase 2 with batches extendedthe system lists them54
Assignable cause foundevidence on the record78
CAPA addressing the causeeffectiveness read from results46
No assignable causemost probable cause stated22

An illustrative model of a mid-sized QC laboratory, not a measurement. Each stage is a count of results. In a disconnected laboratory the losses sit at gathering (investigations that stall) and at the no-assignable-cause outcome; the connected graph and the AI reader act on exactly those stages.

Closing the loop: CAPA effectiveness proven by laboratory data

A CAPA fails most often at its effectiveness check, which is written at closure and shows whatever happened to happen. The connected graph makes the check concrete at the time the plan is approved: the criterion is a test, a product, a window of results and a threshold. No OOS or OOT result for the assay on the next twenty batches; the capability index for the dissolution test above the target for three months; no invalidation attributed to standard preparation in the next quarter. Those are LIMS queries, and the CAPA record reads them.

When the action changes the method, the standard preparation or the specification, it goes through change control, and the change control links back to the CAPA and forward to the new specification version, which the LIMS then judges results against. The same is true when the action is a system change: the interface to an instrument data system is suspended with a reason during the upgrade, revalidated, and made active again with the validation as the reason. Nothing in the loop depends on someone remembering to update a spreadsheet.

Where time is saved, it is saved in the places the figure shows. The model is illustrative; the stages are the ones investigators describe when asked where the days go. The connected graph and the AI reader remove most of the gathering and the waiting and shorten the writing; they do not shorten the testing, which is the part that should take the time it takes.

Where the days go in an OOS investigation

Gathering: disconnectedrequests to the lab, IT and QA6 days
Gathering: connectedattached when the investigation opens0.5 days
Phase 1 draft: disconnectedfrom memory and the SOP4 days
Phase 1 draft: connectedAI drafts from the data; investigator edits1 days
Testing hypotheses: boththe work that should take the time5 days
Write-up: disconnectedassembled from emails4 days
Write-up: connecteddrafted, cited, final-reviewed1.5 days

An illustrative model of a typical investigation, not a measurement. Calendar days by activity, disconnected laboratory first, connected graph with AI second. Testing the hypotheses is deliberately unchanged: that is the scientific work.

Compliance by design: what the inspector sees

The compliance gain is not that AI writes better paragraphs. It is that the record is complete by construction. Every result is under the analyst's own account, time-stamped, calculated by the system, with the raw data fingerprinted and the calibration and expiry checks made at the time of analysis. Every change keeps the old value, the new value, the reason and the person in a hash-chained audit trail whose integrity is verified when the record is opened. Every link between the sample, the investigation, the CAPA and the change control is itself an audited entry with a direction and a reason. An inspector asking for the story of a failed batch gets one trail, from the chromatogram to the closed CAPA, in either direction.

The AI sits inside that model, not beside it. It reads under the permissions of the person asking, in their organization only; it writes drafts that are labelled as drafts with the model version named; it never signs; and its use is itself audited. The assurance effort for the AI feature follows GAMP 5 Second Edition and FDA's computer software assurance guidance: a feature that drafts text for a person to review is lower risk than one that changes a record, and the effort is set accordingly, with a change of model going through change control. Part 11 and Annex 11 apply to the records and signatures the same way they did before the AI arrived.

The layers below show how the responsibilities divide. The data layer is deterministic and validated: it judges, calculates, links and audits. The AI layer reads and drafts. The people layer decides and signs. Keeping those three apart is what lets a laboratory move faster without weakening a single control.

Who does what in the connected laboratory

People decidePeople decide and signThe analyst records and corrects their own results; the second person reviews; the investigator tests hypotheses, sets the root cause and the CAPA; QA approves and signs. Every signature means something named.
AIAI reads and draftsPhase one checklist from the data; hypotheses with the evidence for each; the trend read; the write-up and the CAPA plan drafted with sources quoted; a final review against the regulations before routing. Drafts only, model version named, use audited.
DataData judges, links and auditsResults judged against the approved specification; calibration and expiry checked at analysis; raw data fingerprinted; OOS rules enforced; links between sample, investigation, CAPA and change control audited; hash chain verified on opening; interfaces validated and scoped.

The data layer is deterministic and validated; the AI layer proposes and cites; the people layer decides and signs. The boundaries are enforced by the system, not by policy alone.

Common questions

Does connecting the LIMS to the investigation system change how OOS results must be handled?

No. The connection enforces the handling FDA's OOS guidance already expects: a phase one laboratory investigation before any retesting, the original result kept, invalidation only with an assignable cause, retests and resamples under a protocol, and the investigation extended to other batches. What changes is that the system carries the data to the investigation and refuses the shortcuts, so compliance does not depend on vigilance.

Can AI decide that a laboratory error caused an OOS result?

No. The AI drafts the phase one checklist and lists hypotheses with the evidence for each; the analyst, the supervisor and the investigator test them, record the results and decide. An invalidation is recorded by a person with a reason, under the linked investigation, and the original result stays on the record. The AI's proposals are drafts with the model version named, and every edit to them is audited.

What does an instrument or ERP interface need before the LIMS will accept its data?

A registered interface that names the system, its version, its owner and what it exchanges; an API key scoped to the laboratory and bound to that interface; for an instrument data system, the instruments it may report for; and a recorded validation reference before the interface is made active. Every message is logged as accepted, rejected with a reason, or a duplicate, and a result received through an interface is checked exactly like a typed one.

How is a CAPA's effectiveness proven from laboratory data?

The effectiveness criterion is defined when the plan is approved as a test, a product, a window of results and a threshold: for example no OOS or OOT result for the assay across the next twenty batches. The CAPA record reads those results from the LIMS at the check, so the evidence is the laboratory's own data rather than a statement written at closure.

Sources

This article is general information for quality and regulatory professionals. It is not regulatory or legal advice. Check the source documents for their current status before acting on them.