Part 11, Electronic Records, and AI Traceability

AI introduces new questions about what constitutes the record, which metadata reconstructs a decision, how electronic signatures bind to AI-assisted content, and whether audit trails capture meaningful change. Part 11 analysis must start with predicate rules and actual intended use.

Published: September 4, 2026 | Version 1.0

Editorial owner: CSV to CSA Knowledge Hub | Review status: Open for practitioner peer review

Scope: U.S. FDA Part 11 considerations plus broader data-integrity practice. Applicability requires qualified, context-specific assessment.

THE PART 11 STARTING POINT

Identify:

• The predicate-rule or quality-system record
• Whether the record is required and maintained electronically
• Whether an electronic signature is used to satisfy a signature requirement
• Which system creates, modifies, maintains, archives, retrieves, or transmits the record
• The role of the AI output in the final decision

FDA’s Part 11 scope guidance recommends a justified and documented risk assessment that considers product quality, safety, record integrity, and the applicable predicate rules. Do not state that an AI chat is automatically a Part 11 record or automatically outside Part 11.

THE AI RECORD MODEL

Depending on intended use, the complete record may need some combination of:

• Original source or source reference
• Input data snapshot or identifier
• User prompt
• System and developer prompt version
• Retrieved document IDs, revisions, and passages
• Model provider, model/version identifier, and relevant parameters
• Tool calls, external queries, and results
• Generated output
• Confidence, uncertainty, or rule flags
• Human edits, acceptance, rejection, and reason
• Final controlled decision or content
• Date/time and user/service identity
• Exceptions, retries, and failed actions

Retain what is necessary to reconstruct and evaluate the regulated event. Capturing every hidden technical token may be neither possible nor meaningful; omitting the evidence actually used is equally weak.

AUTHORITATIVE, TRANSITORY, AND SUPPORTING RECORDS

Authoritative record

The controlled record used to demonstrate the regulated activity or decision.

Supporting evidence

Information needed to understand how the decision was made, such as cited sources, model output, or review trace.

Transitory working content

Draft material not relied upon and discarded under an approved process.

Do not classify content as transitory after an unfavorable result. Define record rules before use and configure retention accordingly.

AUDIT-TRAIL DESIGN

An AI-enabled audit trail should help answer:

• Who or what initiated the event?
• Which model, prompt, data, source, and tool versions were used?
• What was proposed?
• What did the person review, change, accept, reject, or override?
• Which record or action resulted?
• Were any prohibited, failed, or retried actions attempted?
• Can administrators alter the history?

Audit-trail review should focus on meaningful risk events, not create an unreadable log dump.

ELECTRONIC SIGNATURES

When an AI drafts or modifies content before signature, verify:

• The signer sees the final content and relevant context
• Identity and signature meaning are clear
• The signature binds to the correct record version
• AI output cannot change after signature without controlled revision
• The signature cannot be executed by an AI agent
• Delegation and impersonation are prevented
• Export preserves signature linkage and meaning

AI may prepare a record; accountable humans or approved systems perform authorized signatures according to applicable requirements.

WORKED EXAMPLE: AI-DRAFTED CAPA SUMMARY

The investigator asks an assistant to summarize evidence. The user edits the draft and signs the CAPA.

Record decision:

The final signed CAPA is authoritative. Because the AI draft materially supports the investigation and could introduce an unsupported conclusion, the organization retains the prompt, source document references, model/prompt version, original output, user edits, and acceptance event as supporting evidence for the defined retention period.

Controls:

• Output clearly marked as draft
• Source citations displayed
• Critical fields cannot be auto-populated without review
• Final signature applies only after user review
• Post-signature change creates a new controlled version
• Audit trail records AI generation and human change

Tests:

• Generate, edit, reject, regenerate, and sign
• Confirm identity and timestamps
• Confirm correct model/prompt metadata
• Attempt post-signature output replacement
• Export human-readable record and supporting trace
• Attempt administrator alteration or deletion
• Verify retention and retrieval

DATA INTEGRITY RISKS

• Chat history deleted while final record remains unexplained
• Model version not identifiable
• Retrieved source later superseded without preserving historical reference
• AI edit overwrites original human entry
• Tool call changes a record under a service account without attribution
• Logs contain confidential data outside approved retention
• Export omits prompt, citation, or signature metadata
• Time zones create misleading sequence

RECORD-RETENTION DESIGN

Define retention for inputs, outputs, citations, prompts, logs, audit trails, monitoring, and evidence. Ensure readability, access, migration, and legal hold. Test retrieval after supplier export and system retirement.

PART 11 ASSESSMENT WORKSHEET

Predicate-rule record:

Electronic record or signature use:

AI contribution:

Authoritative record:

Supporting evidence:

Required metadata:

Audit-trail events:

Signature linkage:

Retention and retrieval:

Access and administration:

Export and migration:

Risk rationale and controls:

PROFESSIONAL INTERPRETATION

AI traceability should reconstruct the decision, not imitate source code. Capture the information a qualified reviewer needs to determine what the system proposed, on what evidence, under which version, and how the accountable person or process responded.

PRIMARY SOURCES

FDA, Part 11—Electronic Records; Electronic Signatures—Scope and Application:

www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application

FDA CSA final guidance, digital objective evidence and electronic records:

www.fda.gov/media/188844/download

MHRA GxP Data Integrity Guidance:

www.gov.uk/government/publications/guidance-on-gxp-data-integrity