Does Using AI Trigger Part 11? The Question Is Misframed

Quality functions usually ask this about the tool. 21 CFR Part 11 attaches instead to electronic records that a predicate rule requires you to keep, and to electronic signatures applied to them. The question to ask of an AI tool in a regulated workflow is: does this system create, modify or maintain a record I am required to keep?

Identifying the system of record

Suppose a model drafts a section of Module 3. A regulatory writer edits it. The final document is checked into your document management system, reviewed and approved there, and submitted from there.

The Part 11 obligations sit on the document management system. That is where the required record lives, where the approval signature is applied, and where the audit trail has to exist. The drafting tool produced an input that a person reviewed and superseded.

If instead the tool itself is where the approved document is stored, versioned and signed, it is a system of record, and Part 11 applies to it directly: audit trails, access controls, signature manifestations, retention.

The model's sophistication does not decide this. Where the record ends up does, and that is an architecture decision you control.

Validation under CSA

Computer Software Assurance asks what the software is used for and what could go wrong. Applied here:

• What decision does the output feed? A search that helps someone find a document is not the same risk as an assessment that determines a reporting category.
• Is there qualified human review before the output has consequence? Where a person is accountable for accepting or rejecting each output, the failure mode is a reviewable error rather than an unnoticed one.
• Can you show why the output says what it says? See source traceability, below.

Source traceability

For a document-generating system, the useful safeguard is that every assertion points at the source document it came from, so a reviewer can check it in seconds rather than re-deriving it. A confidence score gives the reviewer nothing to check.

Review that fast gets done under deadline, which keeps a person in the loop in practice. The evidence for each claim is then a document you already control rather than the model's recollection of one.

A system that cannot show its sources moves the burden onto the reviewer to verify everything from scratch, and reviewers under time pressure do not do that.

Accountability

The sponsor is responsible for the content of its submissions and the integrity of its records. Using a tool does not transfer that, and neither does a vendor claim about a model.

FDA has issued draft guidance on the use of artificial intelligence to support regulatory decision-making for drugs and biologics, built around a risk-based credibility assessment: establish the question, establish the context of use, then justify credibility proportionate to the risk of the decision the output influences. It is a better starting point than asking whether AI is permitted.