Separate transient generation from the approved outcome. Determine which inputs, versions, outputs, review decisions, and technical details are needed for traceability, investigation, retention, and applicable obligations. Do not assume every token must be retained or that nothing matters because the output began as a draft.
Worked example
Worked example — fictional
A reviewer accepts three AI-suggested findings, rejects two, and adds one independently identified issue. The approved review record needs to distinguish the final findings and their disposition. Depending on the assessed process, supporting generation and source information may also be needed to reconstruct significant decisions or investigate a failure.
Practical questions
Which system is authoritative? Can approved content be changed without the required control? Is generated text clearly labeled before approval? Can a user recover the relevant source version? Are personal or confidential details unnecessarily copied into logs? What happens when the AI service retention period is shorter than the organization’s record needs?
Completed record boundary: “The eQMS retains the approved review outcome. Supporting evaluation artifacts are stored under the approved evidence-retention approach. The external AI chat history is not treated as the sole authoritative record.”
Exercise
An assistant-generated review is exported to PDF and digitally signed. Does that prove the underlying content is correct?
Show suggested answer
No. Approval and signature controls address aspects of the record and decision; content correctness still depends on the review and supporting evidence.
Expected records
A record assessment identifying the authoritative outcome, supporting records, access, revision/signature needs, retrieval and retention. Adapt record names and detail to the applicable procedures; these are practitioner examples, not a universal mandatory document list.
Relevant regulations and guidance
Regulations set requirements within their scope; guidance offers recommendations or explains applicable expectations; standards depend on adoption or incorporation. Voluntary frameworks do not establish compliance. The lesson's controls, test designs and example records are practitioner suggestions unless explicitly identified otherwise.
Regulation · U.S. Food and Drug Administration · Current eCFR text
Scope: United States · Electronic records and signatures within FDA Part 11 scope, tied to the underlying required records.
Relevance to this lesson: Establish applicable electronic-record/signature requirements before selecting controls.
Publication status: Final / published. Source checked 21 September 2026.
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Source details and applicabilityGMP guideline · European Commission · January 2011 revision
Scope: European Union · Computerised systems supporting activities in the applicable EU pharmaceutical GMP context.
Relevance to this lesson: Consider applicable GMP computerised-system expectations for the actual record process.
Publication status: Final / published. Source checked 21 September 2026.
The Commission index confirms the January 2011 operative revision. The linked PDF could not be retrieved in this check; retained detailed section mappings need review against an authorized copy.
Source details and applicabilityGuidance · European Medicines Agency · EMA/INS/GCP/112288/2023
Scope: European Union · Sponsors, investigators and service providers using computerised systems and electronic data in clinical trials.
Relevance to this lesson: For clinical-trial records, assess the trial context and relevant actors separately.
Publication status: Final / published. Source checked 21 September 2026.
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Source details and applicability