Sooner or later an inspector will point at AI-generated content and ask who is accountable for it and how you know it is correct. The defensible answer is not an adjective. It is one architectural rule: AI output is always a draft, and only a person can promote it into the record.
Key takeaways
- GxP does not forbid assistance in creating records; it requires accountability for them to rest with a person.
- Draw the line between draft and record: AI works up to it, people own everything past it.
- The interesting engineering is in making the promotion step impossible to bypass.
- Ask vendors for mechanisms, not principles.
AI features are arriving in regulated software faster than governance frameworks can classify them. Most vendors answer the accountability question with words like responsible and trustworthy. The answer an inspector can accept fits in one sentence: AI output is always a draft; only a person can promote content into the record.
Why this is the right line
GxP regulation is about records: who created them, when, why, and whether they can be trusted. Part 11 and ALCOA+ do not prohibit help in creating records — regulatory professionals have always used templates, precedents and medical writers. They require that accountability is attributable to a person and that the record’s history is transparent.
The machinery
Drafts are structurally drafts. AI-generated content — a cover letter draft, a suggested response to a health authority question, a proposed classification — is created in a state the workflow treats as non-authoritative. That is a state the system enforces, not a label on a screen.
Generation is grounded. The draft boundary does not excuse careless generation; a reviewer facing a stream of plausible fabrications will eventually miss one. Drafts should come from retrieved, cited sources, and where a fact is not available the draft should say so with a placeholder rather than invent a value.
Consequential promotion is signed. Approving a controlled document, closing a quality issue, signing off a review: the human step is a Part 11 signature with re-authentication, a recorded meaning and a binding to the exact content signed. If the draft changes afterwards, the signature visibly no longer covers it.
Automated ingestion lands in quarantine. Inbound agency correspondence can be filed and attributed automatically — which application, which agency, which kind of interaction. Nothing filed that way should become authoritative on arrival; it lands as proposed, and a person confirms it.
Automation proposes. People promote.
Does this throttle the value?
Two answers. Reviewing a well-grounded draft is far faster than writing from a blank page, so the human hour moves from assembling boilerplate to exercising judgment. And the boundary is what makes broad deployment safe: because no AI output can become a record unnoticed, the blast radius of a model error is bounded by review. Without it, organisations end up either trusting unreviewed output or banning AI after the first scare.
Four questions for any vendor: Can any AI output reach an approved or released state without an identified person’s action? Where do I see, per document, that it originated from AI and who approved it? What happens when the AI does not know a fact? What state does automatically ingested data land in?
How DnXT approaches it
In DnXT, AI-written review comments are labelled as AI and a person answers each one before a review can complete; signatures record the signer, time and meaning and are bound to the content they sign; and automatically filed correspondence lands as proposed until a person confirms it.
AI up to the line, people past it
See where DnXT draws the draft-versus-record line in planning, documents and review.
