Situation
A retrieval-augmented AI assistant proposes related deviations, common themes, and missing investigation questions for a qualified investigator.
Intended Use
Support investigation preparation using approved records. The AI cannot classify severity, determine root cause, approve a conclusion, initiate CAPA, or close a record.
Decision Summary
| Decision element | Case record |
|---|---|
| GxP assessment | Missed critical similarity, false linkage, obsolete source, privacy exposure, or automation bias can affect investigation quality and timeliness. |
| Potential impact | The investigation can overlook recurring failure or pursue an unsupported conclusion. |
| Known issue | The fictional evaluation misses two related deviations stored only in scanned attachments after a parser change. |
| Validation conclusion | Scanned attachments are excluded and the update is not released until critical-miss criteria and reviewer controls pass. |
GxP Assessment
Missed critical similarity, false linkage, obsolete source, privacy exposure, or automation bias can affect investigation quality and timeliness.
Affected GxP Functions
- Record retrieval and similarity
- Source version and access
- Proposed theme and question generation
- Reviewer disposition
- Monitoring and change assessment
Failure Scenarios
- Critical prior deviation is missed
- Unrelated record is presented as similar
- Restricted record is retrieved
- Unsupported root-cause wording is accepted
- Model update changes performance without detection
Potential Impact
The investigation can overlook recurring failure or pursue an unsupported conclusion.
Existing Controls
- Read-only approved corpus
- Source citation
- Role-filtered retrieval
- Qualified reviewer disposition
- No autonomous Quality action
Existing Evidence
- Independently labeled reference set
- Security assessment
- Human-workflow study
- Audit and version records
Evidence Gaps
- Rare critical events
- Poor-quality attachments
- New model version
- Reviewer workload effect
Testing Approach
- Evaluate correct links, false links, missed critical links, and source correctness by record type and criticality
- Challenge prompt injection and restricted access
- Test reviewer detection and override under representative workload
- Verify monitoring, stop, rollback, and revalidation criteria
Deviations or Known Issues
The fictional evaluation misses two related deviations stored only in scanned attachments after a parser change.
Validation Conclusion
Scanned attachments are excluded and the update is not released until critical-miss criteria and reviewer controls pass.
Reassessment Criteria
- Model, prompt, parser, retrieval, source, access, or workflow change
- Critical miss or privacy incident
- Acceptance-criteria or supported-population change
Limitations and unresolved questions
Scanned material remains outside the permitted reliance until the critical misses are addressed. A parser change requires targeted evaluation and human-review evidence.
Relevant regulations and guidance
These sources apply within their stated scope. The suggested worksheet fields, test designs and fictional decisions are practitioner recommendations, unless a source requirement is expressly identified. Completing a template does not establish compliance.
Computer Software Assurance for Production and Quality Management System Software ↗
Regulatory guidance / GMP guideline · United States · February 2026
Scope: Medical-device manufacturers assuring software used in production or their quality management system.
Relevance: For medical-device production or QMS software, supports selecting assurance activities from intended use, risk and available evidence. It is nonbinding guidance and does not determine other sectors’ obligations.
Status: Final / published · Checked 2026-09-21
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Read source details and applicability →EudraLex Volume 4, Annex 11 — Computerised Systems ↗
Regulatory guidance / GMP guideline · European Union · January 2011 revision
Scope: Computerised systems supporting activities in the applicable EU pharmaceutical GMP context.
Relevance: For computerised systems used in EU GMP activities, informs lifecycle, supplier and record controls. Confirm applicability to the actual activity; the example does not establish it.
Status: Final / published · Checked 2026-09-21
The Commission index confirms the January 2011 operative revision. The linked PDF could not be retrieved in this check; retained detailed section mappings need review against an authorized copy.
Read source details and applicability →Artificial Intelligence Risk Management Framework (AI RMF 1.0) and NIST AI 600-1 ↗
Industry guidance / framework · United States · AI RMF 1.0 (2023); GenAI Profile (2024)
Scope: Cross-sector AI governance and risk management, including generative AI.
Relevance: A voluntary framework for describing AI risks, evaluation and ongoing management. Its suggested practices are not regulatory requirements.
Status: Final / published · Checked 2026-09-21
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Read source details and applicability →Was this useful? Leave feedback
Was this resource useful?
Tell us what helped and what could be clearer. Usefulness feedback does not establish technical validity or regulatory compliance.
Loading contribution options…
Questions and moderated discussion
Questions and discussion
What additional information would you need before making this decision?
Loading contribution options…
Suggest a correction
Sent privately to the editorial moderation queue. Your account email and correction are not published as a comment. Do not include confidential or personal information.
Resource: AI-Assisted Deviation Review
Loading sign-in status…