Does AI Break 21 CFR Part 11?

Strip the folklore away and Part 11 is a short list. §11.10(a): validation of systems to ensure accuracy, reliability and consistent intended performance, including the ability to discern invalid or altered records. §11.10(d): limiting system access to authorised individuals. §11.10(e): a secure, computer-generated, time-stamped audit trail recording operator entries and actions that create, modify or delete records, without obscuring previous entries. §11.10(g): authority checks so that only authorised individuals can use the system, sign records or perform the operation at hand. §11.50: signature manifestations — printed name, date and time, and the meaning of the signature. §11.70: signature-to-record linking so signatures cannot be excised and transplanted. Nothing in that list addresses how the text inside a record was composed.

Draft generation is fine. A model writing the first version of a deviation narrative, an investigation summary, an annual product review or an SOP revision is doing what a word processor, a template or a junior colleague would do — producing text an accountable person then reviews and adopts. Evidence assembly is fine: pulling the relevant batch, equipment, lot and prior-occurrence data into one place changes nothing about record integrity. Ranking and triage are fine: ordering a reviewer's queue is not a record. Search and question-answering over effective documents is fine, provided answers cite the revision they came from. In each case the record that ends up signed is signed by a human who is accountable for its content.

§11.100(b) and §11.200 require that an electronic signature is unique to one individual, verified as belonging to that individual, and executed with components the individual alone controls. A model has no identity to verify and no credentials it alone controls, so a model-applied signature fails on its face. §11.10(g)'s authority check has the same consequence: the system must confirm the individual performing the operation is authorised to perform it. That is why batch release, CAPA closure, document approval and material disposition cannot be delegated to AI — not because AI is untrusted, but because there is no person to attribute the act to. Any vendor offering autonomous signature is offering a Part 11 finding.

§11.10(e) requires the audit trail to record who created or modified a record and when. Where a suggestion was generated by a model and adopted by a person, the honest and defensible approach is to record both facts: that a draft was AI-generated, and that a named individual reviewed and accepted, edited or rejected it. This is not explicitly mandated by the 1997 text, which predates the question, but it directly serves §11.10(a)'s requirement to discern invalid or altered records, and it is the first thing an investigator asks once they learn AI is in use. Systems that silently present model output as human-authored make the review impossible to evidence — which is the actual risk.

Validation under §11.10(a) is about intended performance, so the work is to define intended use narrowly enough to test. For each assist: what input does it read, what output does it produce, who reviews it, what happens if the output is wrong, and how would that wrongness be detected? Because assistive outputs are drafts under mandatory human review, the consequence of a bad output is a human correcting a draft — a materially different risk profile from a model inside a decision path, and one GAMP 5 Second Edition handles well through critical thinking and risk-based effort. Test that the assist is grounded in the correct record and the effective document revision; test that it cannot write, sign or override; test the audit-trail behaviour. Non-determinism is not a blocker when the acceptance criterion is 'produces a reviewable draft grounded in the correct source', rather than 'produces identical text every run'.

Part 11 is not the only lens. EU GMP Annex 11 expects risk management across the lifecycle, defined responsibilities, data integrity controls and periodic evaluation — all of which apply to an AI capability as to any other function. GAMP 5 Second Edition explicitly addresses the use of AI/ML in GxP, directing effort to critical thinking about intended use and to the controls around the output rather than to exhaustive testing of the model itself. The EU AI Act adds documented purpose, human oversight, logging and traceability for assistive systems. The encouraging part is how much these overlap: a good Part 11 package with intended-use documentation, human-review evidence and a permitted-action list satisfies most of the other three with modest additional effort.

Can your AI apply an electronic signature, under any configuration? Does the audit trail distinguish AI-drafted content from human-authored content, and record the review decision? Is the assistant constrained to the effective document revision, and does it cite what it used? What intended-use and risk documentation do you supply for validation? Where does inference run, and are our records used to train models? Clear answers to those five, in writing, is what an inspector's question about AI use will ultimately be answered with — so get them before you buy, not after.