Agentic AI in Regulated Manufacturing: Where Autonomy Stops

Forget the marketing taxonomy of assistants, copilots and agents. The only classification that matters on a regulated site is whether an action is reversible and unsigned, or whether it constitutes a regulated decision. Assembling a draft, gathering evidence, opening a record in draft state, populating a form, scheduling a reminder, running a query — reversible, unsigned, safe to automate. Approving a document, releasing a batch, closing a CAPA, dispositioning material, changing a specification, overriding a tolerance, signing anything — regulated decisions with a legally accountable human behind them. An agent may prepare all of the second category. It may complete none of it.

There is real value on the safe side of the line. An agent can watch for a deviation with no investigation started after 24 hours and open the draft with the evidence attached. It can assemble the annual product review from live batch, deviation, OOS, complaint and stability data and present it for the QP to challenge. It can monitor regulatory publications, identify the changes touching your products, and raise a proposed change control. It can score supplier performance continuously and flag certificates approaching expiry. It can rank a sales worklist, draft the customer email, and prepare the inspection binder. Each of those ends with a human opening something that is already 80% done — which is where the hours actually are.

Batch release and material disposition are out: 21 CFR 211.22 and EU GMP place them with the quality unit and, in the EU, a named Qualified Person. Electronic signature is out: under 21 CFR Part 11 a signature is bound to an individual with re-authentication and a stated meaning, and a model has no identity to bind. CAPA closure and effectiveness verification are out, because both are judgements about whether a risk has actually been removed. Specification and tolerance change is out: that is change control, with impact assessment and approval. Audit trail modification is not merely forbidden but architecturally impossible on any system worth buying. The list is short. Its shortness is the point — everything else is available for automation, so there is no reason to argue about these five.

Three specific risks separate a well-built agent from a liability. Confident error: an agent asserting something false with the same tone it uses for truth — mitigated by grounding every output in a cited record and showing the source. Version blindness: acting on a superseded procedure or an expired specification — mitigated by making effectivity a first-class constraint, not a field the model happens to read. Silent scope creep: an agent given a broad goal taking a path nobody anticipated — mitigated by defining permitted actions as an explicit allow-list rather than by instructing a model not to do things. Prompt text is not a control. Permissions are a control.

You need four things on file, and they are the same four regardless of framework. One: an intended-use statement per agent capability, narrow enough to be tested. Two: a risk assessment under GAMP 5 Second Edition classifying the capability as supporting and non-decision-making, with the consequence of a wrong output documented. Three: evidence of human review in the audit trail — every agent output recorded as accepted, edited or rejected, with the person and timestamp. Four: the permitted-action allow-list itself, held under change control, so you can show an inspector what the system is technically incapable of doing rather than arguing about intent. Under the EU AI Act, that package is broadly what documented purpose, human oversight and traceability require.

Six questions, and the answers should be immediate. What is the technical list of actions your agent can take — not the policy, the list? Can the agent sign, release or dispose, under any configuration? How is effectivity enforced when the agent reads a procedure? Does the audit trail distinguish a human-authored entry from an accepted AI draft? Where does inference run, and is our data used for training? What intended-use and risk documentation do you supply for validation? A vendor who answers the first question with 'it's very capable' is selling you an unbounded system, and an unbounded system in a GxP environment is a finding waiting for an inspection date.