Use AI in a way that supports good quality and earns trust

The control domains that make trust credible

• Boundary definition

  Define the intended use, process impact, approved data and tools, and where AI output can influence a GMP record, decision, approval, release, or evidence set.

• Traceability

  Keep the relevant input context, output, reviewer action, decision, and version information understandable and retrievable.

• Validation and evaluation

  Define evaluation criteria and acceptance thresholds before release, then review effectiveness as the use case operates and changes. Where the applicable computerised-system context calls for it, consider the relevant Annex 11 expectations alongside GMP requirements.

• Observability and escalation

  Make quality signals, uncertainty, exceptions, missed reviews, and escalation ownership visible to the people who can act.

• Change control

  Assess changes to models, prompts, retrieval, rules, tools, and workflows for their potential effect on the controlled state.

A planning model for AI output boundaries

The level of governance should follow the effect of the output on the process. This planning model helps teams ask the right questions; it is not a universal regulatory or validation classification.

• Informational support

  Internal drafting, ideation, or non-controlled assistance with no direct decision authority.

• Process guidance

  Suggested steps or non-final summaries used to prepare work, with traceability and a named reviewer.

• Decision-influencing output

  Risk proposals, deviation support, or compliance-gap recommendations requiring accountable human decision ownership and stronger evidence.

• Record-integrated output

  Output incorporated into a controlled record, approval, release, or evidence set, requiring a complete attributable evidence chain and change-control linkage.

Use a practical language for AI roles

Predictive AI predicts data, generative AI produces content, and agentic AI coordinates actions. This is a planning language rather than a universal regulatory classification; the control response still depends on intended use and process impact.

• Predictive AI

  Assess performance against suitable data and acceptance criteria when the system produces a classification, measurement, probability, or prediction.

• Generative AI

  Evaluate the quality, grounding, completeness, and suitability of content, with an accountable reviewer defining acceptance and disposition.

• Agentic AI

  Test the workflow as well as generated content: approved sources, permissions, sequencing, escalation, human approval, and traceability.

Oversight is a workflow, not a signature

People should be able to understand how an AI-assisted quality decision was reviewed. The right pattern depends on process impact, reviewer role, acceptance criteria, disposition, escalation, and closure evidence.

• Structured review gate

  Use defined criteria and explicit accept, reject, rework, or escalate outcomes for process guidance and other reviewable outputs.

• Dual-role review

  Use technical and quality or compliance perspectives when an output may affect quality judgement or compliance direction.

• Escalation by threshold

  Define signals, owners, and response expectations before exceptions or uncertainty occur.

• Controlled exception review

  When the normal path cannot be followed, record the reason, apply compensating controls, and complete a time-bound retrospective review.