AI document review and drafting for GMP quality teams.
Andrei writes to your SOP's own structure and then checks the draft against it, criterion by criterion. Deviations, OOS investigations, qualification and validation, risk assessments, and the annual review that has to reconcile a year of all of them.
Nobody gets cited for the deviation. They get cited for the investigation.
The event was handled. The batch was fine. What the inspector reads, months later, is a report that names the operator instead of the procedural gap, asserts an impact conclusion no evidence in the file supports, and never says which SOP section the acceptance criteria came from. By then, the people who knew have moved on.
Sources: GMP Journal, The FDA warning letter report for fiscal year 2025; Pharmaceutical Online, What 2025 FDA warning letters tell us about GMP compliance (85 letters reviewed, 1 January – 9 December 2025).
Bring the document type and the procedure behind it.
There is no fixed catalogue. Andrei learns a document type from your procedure and your approved examples, so a new one takes a conversation, not a release. These are where pharmaceutical teams usually start.
Deviations, OOS and CAPA
The documents an inspector reads first, and the ones 21 CFR 211.192 is about.
- Deviation investigation reports5-Why or 6M reasoning built from facts already in the report, with immediate actions, investigation steps, and conclusions kept distinguishable.
- OOS and OOT investigationsPhase I laboratory investigation and Phase II full-scale investigation written as the separable things the FDA guidance expects to read.
- CAPA plans and effectiveness reviewsActions tied to the causes they close, effectiveness criteria set before approval, and prior CAPAs reassessed when a deviation repeats.
- Product and past-batch impactSystem, document, equipment, patient safety, and distributed batches, each traced back to evidence in the investigation.
- Market complaints and returnsConsistent intake, evaluation, and a reportability decision with the rationale written down rather than assumed.
Qualification and validation
Protocols and reports that have to agree with each other months apart.
- URS, DQ, IQ, OQ and PQEquipment, utilities, and facilities, with each report checked against the acceptance criteria of the protocol it closes.
- Process validationProcess design rationale, PPQ protocols and reports, and continued process verification against the limits you set in Stage 1.
- Cleaning validationWorst-case rationale, MACO derivation, sampling and recovery, and clean and dirty hold-time justification.
- Analytical method validationValidation, verification, and transfer protocols and reports covering the characteristics the method actually needs.
- Computerised systemsCSV documentation and Annex 11 / Part 11 assessments, including audit-trail review procedures.
Risk, change and transfer
Where a weak assessment is invisible until the change has already shipped.
- Quality risk assessmentsFMEA in your own form and scoring scale, with mitigation, residual risk, and a conclusion the scores actually support.
- Contamination control strategyThe links between facility, personnel, utilities, monitoring, and the trends and investigations that feed it.
- Change control assessmentsImpact on product, process, validation status, and registered details, with the reportability call justified.
- Technology transferTransfer protocols and reports, with the receiving site's data compared against the sending site's claim.
- Suppliers and CMOsQualification packages, technical agreements, and the evidence behind an approved-supplier decision.
Product review and inspection readiness
A year of small documents that has to reconcile into one argument.
- Annual product quality reviewBatches, deviations, OOS results, changes, returns, and stability pulled into a review whose conclusions follow from its own data.
- Batch record reviewException summaries that say what happened and what it meant, instead of listing what was noticed.
- StabilityProtocols, reports, and trend summaries, with out-of-trend results handled as investigations rather than footnotes.
- Responses to 483s and warning lettersResponse drafts that answer the observation, commit to something checkable, and match what the underlying records say.
- CMC and Module 3 sectionsSource sections drafted from the manufacturing and control records that have to support them.
What the week actually looks like.
A real GMP deviation, from the moment someone notices to the moment QA signs. Andrei never approves anything — the decisions stay where they have to stay.
Intake
Someone writes what happened in their own words, or dictates it. Andrei asks for the facts the SOP needs and does not have yet: detection time as distinct from occurrence time, the area code rather than the department, the instrument ID, the governing section.
Andrei asksEvidence
The audit trail export, alarm report, service record, and batch record go in as attachments. Andrei reads them and cites the page a claim came from, so the narrative and the evidence stay attached to each other.
Andrei draftsRoot cause
Andrei builds a 5-Why chain out of facts already in the report. It refuses chains that repeat the same wording, and it refuses to land on human error with no procedural gap behind it. The investigator fixes what is wrong with the chain.
The investigator decidesImpact and CAPA
Product, past batches, equipment, documents, patient safety. Each answer has to trace back to evidence already in the report. CAPA effectiveness criteria are written now, not at closure.
The investigator decidesCheck
Every criterion in the SOP gets a traffic light and a stated reason. Amber and red criteria come with a suggested edit you can apply, reword, or dismiss.
Andrei checksQA review and close
The reviewer comments, returns it with feedback, or approves it. Approval is an electronic signature in a tamper-evident hash chain, and the report exports into your own Word template.
QA decidesAndrei checks your SOPs. These are what your SOPs implement.
A document is compliant because it satisfies the procedure your site approved, not because it matches a regulation in the abstract. Andrei works from the procedure. Knowing what sits behind it is how it asks the right follow-up question.
21 CFR 210 & 211
Finished pharmaceuticals. 211.22, 211.100, 211.160 and 211.192 are the sections warning letters keep returning to.
21 CFR Part 11
Electronic records and signatures: attribution, audit trail, signature manifestation, record integrity.
EudraLex Vol. 4, Parts I & II
Chapter 1 product quality review, Chapter 4 documentation, Chapter 8 complaints, quality defects and recalls.
Annex 1
The contamination control strategy, and the trending and investigation that has to keep it current.
Annex 11 & Annex 15
Computerised systems, and qualification and validation across the equipment and process lifecycle.
ICH Q9(R1)
Quality risk management: formality, subjectivity in decision-making, and risk-based justification rather than habit.
ICH Q10 & Q12
The pharmaceutical quality system, and lifecycle management of post-approval change.
ICH Q7
Active pharmaceutical ingredients, including how deviations and OOS results are handled upstream.
WHO, PIC/S & national GMP
WHO GMP, PIC/S PI 041 on data integrity, and the national rules your own SOPs implement.
Andrei is not a regulatory database and does not give regulatory advice. It reads the procedure you give it and checks whether the document in front of it satisfies that procedure. Your QA and regulatory experts decide everything that matters.
An AI-assisted record still has to survive an audit trail review.
Which means the assistance has to leave a trail of its own. Who wrote a sentence, when, on what evidence, and who approved it.
ALCOA+ in the record itself
Every edit is attributed and timestamped. Nothing is silently overwritten, and the history of a section is still there when someone asks how a number changed.
Signatures that detect tampering
Approvals are recorded as electronic signatures in a hash chain, so an altered record after approval is a detectable record, not a quiet one.
Evidence stays attached to the claim
Attachments are indexed and searchable, and a drafted claim cites the page it came from, so a reviewer can check it without going back to the original folder.
Questions GMP teams ask first.
Does Andrei replace our QMS or document management system?
No. Andrei is not a QMS and does not try to be the system of record. Your deviations, changes, and CAPAs keep living where they live today. Andrei is where the document gets written and checked before it goes back into that system, and it exports into the same Word template you already approve.
How does Andrei know what our SOP requires?
You give it the procedure and a few approved examples. Andrei turns the procedure into the criteria it checks against, section by section, so a deviation written to SOP/QA/008 is judged against SOP/QA/008 and not against a generic idea of what a deviation should look like. When your SOP is revised, the criteria are revised with it.
Can investigators write in their own words?
Yes, by typing or by dictation. Dictation supports English, Hindi, and Marathi for sites in India; the transcript stays in the spoken script and the report stays in English. Shop-floor detail usually arrives faster spoken than typed, and the facts the SOP needs are prompted for either way.
What about data integrity and 21 CFR Part 11?
Every edit is attributed and timestamped, nothing is silently overwritten, and approvals are recorded as electronic signatures in a tamper-evident hash chain. Attachments are indexed and cited, so a claim in the narrative points at the page of the audit trail or service report it came from.
Does this work for CDMOs and contract sites?
Yes. A contract site usually runs to several clients' procedures at once, which is exactly the case where reviewing from memory breaks down. Andrei holds a separate set of criteria and templates per procedure, so the same investigator can write to two different clients' formats without switching how they work.
Will AI-written documentation be a problem in an inspection?
The record has to show who decided what, and it does: Andrei drafts and flags, a named person edits, reviews, and signs. Nothing is approved by the model. The FDA has deployed its own generative-AI assistant internally, so the realistic expectation is that documentation will increasingly be read by tools that notice an unsupported claim quickly.
Try it on a deviation you have already closed.
Send us one closed investigation and the SOP it was written against. We will show you what Andrei would have flagged, and you can judge whether it is right. We reply within one business day.