Deviations and CAPA are where quality teams lose the most time, so they're an obvious place to point AI. They're also where a bad AI deployment does the most damage, because a weak investigation that reads well is harder to spot than one that reads badly.
Here's an honest split: what AI does well in this process, what has to stay a human decision, and the failure mode nobody talks about.
Where AI genuinely helps
- Triage and routing. Reading the initial description and proposing a category, an owner and a likely criticality. A person confirms it, but the blank-form step disappears.
- Finding similar past cases. This is the strongest use. "We have seen this on this line four times in eighteen months" is exactly what a human investigator struggles to know and a search over your own history answers immediately.
- Drafting the write-up. Turning the investigator's findings into the report structure your SOP requires, with the evidence referenced. The thinking stays human; the typing doesn't.
- Trend detection across records. Spotting that twelve "unrelated" minor deviations share an equipment ID or a shift pattern.
- Checking completeness. Flagging that a CAPA has no effectiveness check defined, or that an investigation closed without addressing an impact question.
What has to stay human
Root cause is a judgement about what actually happened, made by someone who knows the process. AI can propose candidates from similar cases; it cannot decide.
Product impact and criticality are GMP-critical decisions. Under the draft Annex 22, that is not a call a generative model should be making, and it is the one an inspector will trace hardest.
Effectiveness checks need someone to decide what evidence would prove the problem stopped. And closure is a signature — a person accepting the investigation as adequate. See roles and responsibilities.
The failure mode nobody mentions
AI that suggests root causes learns from your past investigations. If those investigations historically said "operator error, retrain", the system will keep proposing operator error and retraining — fluently, consistently, and with the appearance of pattern recognition.
You have then automated your worst habit and made it faster. Inspectors already treat repeated "operator error" conclusions as evidence that the investigation process itself is weak, and a tool that industrialises it turns a cultural problem into a systemic one.
Two defences. First, look at your own history before you deploy anything: if a large share of your deviations close on human error, fix the investigation process first. Second, monitor what the AI proposes versus what investigators conclude. If they almost never disagree, your reviewers have stopped reviewing — the automation-bias problem covered in SOPs and training for AI.
Validating it
Nothing exotic, but do it properly. Write the intended use narrowly — "proposes a category and retrieves similar historical cases; does not determine root cause or product impact" is a good example. Set acceptance criteria tied to the cost of a miss: failing to surface a relevant similar case matters far more than an extra irrelevant one.
Build the test set from real past deviations, including the messy ones and the ones that turned out to be serious, with agreed answers prepared in advance. The full method is in GxP AI validation, and effort should follow a documented risk assessment.
One practical note: this only works if your deviation history is in reasonable shape. If categories are inconsistent and half the records are free text with no structure, that is the project — the AI is the step after. See CAPA programme design and GxP AI.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.