What an Audit Trail Must Record When AI Helps Make a GxP Record

What to record for each AI-assisted step

These are our recommendations rather than a regulatory list, but each one answers a question an inspector can reasonably ask:

• The inputs: which records and documents the AI was given, by reference and version.
• The model and its configuration: model version, prompt version and relevant settings.
• The output as generated: kept unchanged, before any human edit.
• The human action: who reviewed it, what they changed, and whether they accepted, edited or rejected it.
• The time of each step, from a trusted system clock.

Keep the AI output separate from the approved record

If the approved document simply overwrites the draft, you lose the ability to show what the reviewer changed. Keeping both lets you show that review actually happened, and it gives you the data to measure how often reviewers correct the AI, which is your early warning that its quality is slipping.

The signature still belongs to a person

An AI cannot sign. The electronic signature on an AI-assisted record is the reviewer's, with the meaning of the signature recorded as Part 11 requires. If the system lets a record be approved without a named person signing it, the audit trail is the least of the problems.

For how reviewers can sign with genuine confidence, see automation bias and how to stop rubber-stamping AI output. The draft EU GMP Annex 22 also expects records of changes to AI models and their configuration; see prompt change control.