Using AI under 21 CFR Part 11: what the rule actually asks
If you run a GMP or GLP lab and someone suggests using AI to draft reports or check data, QA's first question is usually: does Part 11 allow it?
Part 11 doesn't say. It was published in March 1997 and took effect that August, long before anyone wrote reports with a language model. It has no section on AI or machine learning, and no list of approved tools. It sets controls for electronic records and signatures, and those controls apply to a record whether a person or a model wrote it.
So the better question is: which of our records does the AI touch, and do they still meet Part 11 once it has?
When Part 11 applies
Part 11 covers records that another FDA rule makes you keep, when you keep them electronically. Those other rules are the predicate rules: Part 211 for finished pharmaceuticals, Part 58 for nonclinical lab studies, and so on. FDA's 2003 guidance, "Part 11, Electronic Records; Electronic Signatures: Scope and Application", narrowed the rule to exactly that, and left it to the predicate rules to say what has to be kept.
That matters for AI, because much of what a model does never becomes a required record. A model suggesting wording for an email to a sponsor is outside Part 11. A model drafting the results section of a study report, or calculating a value for a batch record, is inside it.
So first list where the AI output ends up.
The controls that matter
Section 11.10 lists the controls for closed systems, (a) to (k). Four matter most when a model is involved. For two of them, validation and audit trails, the 2003 guidance says FDA won't enforce Part 11's own wording. The predicate rules still apply, though: validation where they call for it, and records that date each change and don't hide what was there before. So both still need an answer.
Validation, 11.10(a). The system has to be shown to work, and to tell a wrong or altered record from a good one. The rule's words are "to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records." A language model can give two answers to the same prompt, so most of the worry sits here. But you are not proving the model is always right. You are proving that the review and record keeping around it catch it when it is wrong.
Audit trails, 11.10(e). The system itself has to log every change to a record, with the time, without hiding what was there before. The rule asks for "secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records", and says changes "shall not obscure previously recorded information." A model writing or changing part of a record is an entry like any other. A trail that only shows the person who clicked "accept" hides that a model wrote the text.
Authority checks, 11.10(g). Only authorised people may sign, change a record or use the system. A model is not an authorised person, so it can draft but not finalise.
Accountability, 11.10(j). You need written policies that hold people accountable for what is done under their signature. So whoever signs a record owns the AI output in it.
Who signs
A signature belongs to one person, says what it means, and stays tied to the record it was put on. Section 11.100(a) says each signature "shall be unique to one individual and shall not be reused by, or reassigned to, anyone else." Section 11.50 says a signed record shows the signer's printed name, the date and time, and what the signature means, such as review, approval or authorship. Section 11.70 says the signature has to be linked to its record so it cannot be cut out, copied or moved to falsify another one.
So a model can never sign. If it drafted the record, the signature that counts is a review or approval by someone who read it, on the final content. If the text can change after signing without anyone being able to tell, the system fails 11.10(a), whoever wrote the text.
The AI-specific guidance
Two newer texts address AI directly.
FDA's January 2025 draft guidance, "Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products", asks you to state a model's context of use: what question it answers and what decision rests on it. Then you show it is credible for that use, with effort scaled to the risk. It is a draft and not binding, but it shows FDA weighs the risk by what the output is used for.
In Europe, the draft Annex 22 to EU GMP, published for consultation in 2025, is blunter. It says generative AI and large language models should not be used in critical GMP applications, meaning those with a direct impact on patient safety, product quality or data integrity. In non-critical uses, qualified people should be responsible for the output. It is a draft and not in force, but if you sell into the EU it shows where the rules are heading.
Neither changes Part 11. Both point the same way: a person stays responsible, and the controls scale with what the output decides.
What an inspector will ask
If a model touches your required records, have answers ready for these.
- Which records does the model write to or change, and under which predicate rule are they kept?
- How do you know which parts of a record a model wrote? Show me in the audit trail.
- Who reviewed the model's output before the record was signed, and what did their signature mean?
- Can the record change after it is signed? Show me how you would know if it had.
- Pick a number in this signed report. Show me the raw data it came from, and show me that the raw data has not changed since signing.
- How did you validate the process? What happens when the model is wrong?
- Which model and version produced this, and how do you control changes to it?
The fifth question catches most labs out, AI or no AI. ALCOA, the principle behind FDA's 2018 guidance on data integrity and CGMP, asks that data be attributable, legible, contemporaneous, original and accurate. A value a model copied into a report is not the original. The original is the instrument export or worksheet it came from, and that has to be kept and traceable.
How to set it up
None of this waits on new regulation. It takes six choices.
- Keep the model as a drafter. It proposes text and values, and a named person accepts or rejects each one.
- Record the model's changes in the audit trail as the model's, apart from the person who accepted them.
- Sign the final content, and make the signature fail if the content changes afterwards.
- Keep the raw data behind every value, and link each value to it.
- Validate the review process for your intended use, including what happens when the model is wrong.
- Decide in your risk assessment whether any of this use is critical. Under draft Annex 22, that decision changes what is allowed.
How we do it at Ordo
We build Ordo for labs under these rules, so we made the same choices. Ordo uses a large language model. It drafts, and a named person reviews, accepts and signs every regulated output. When a report is finalised, the content hash of every source file that went into it is frozen into the signature record, and those files cannot be deleted. An inspector who points at a number can be shown the raw source and proof it has not changed since signing.
Whether your use of AI is critical, and whether the system is validated for your intended use, is still your decision. Part 11 puts it there, and so does every draft that has followed it.
For how Ordo checks a report's data against the study plan, see how Ordo finds the deviations nobody wrote up.