21 CFR Part 11

The 21 CFR Part 11 AI consultant who evaluates before building.

Most AI sold to regulated teams skips the question an auditor will ask first. We answer it before we build: can this workflow meet Part 11, and how do we prove it.

A 21 CFR Part 11 AI consultant evaluates whether an AI workflow can meet Part 11 before any build, then builds it with the controls the rule requires: an audit trail of every action, versioned records you can reproduce, and a named person accountable for the output. The work runs inside your own Claude Enterprise tenancy. Part 11 applies whenever AI touches an electronic record or signature the FDA could ask to see.

That is the short version. Here is why it matters. Most AI pitched at pharma, CRO, and CDMO teams sells the model and treats compliance as a box checked after the fact. In a regulated setting the model was never the hard part. The hard part comes the day an auditor asks who approved this output and how you would reproduce it. We build for that day first.

What a Part 11 AI consultant does

  • Reads the workflow against the rule. We map where AI output becomes an electronic record and where Part 11 and ALCOA+ obligations attach.
  • Decides build or no build. If a workflow cannot be made defensible, we say so before you spend.
  • Builds with the controls in. Audit trail, versioning, and human sign-off are part of the design, not a retrofit.

The pre-build evaluation

We start with a 21 CFR Part 11 evaluation of the specific workflow, run alongside our reading of GAMP 5 for AI agents. It tells you which workflows are worth building and which need rework first, and it gives each output an audit story you could defend. The evaluation decides what gets built. See 21 CFR Part 11 for AI for how the rule reads against an agent, and our trust and security page for the controls in full.

The build discipline

  • An audit trail. Every action the agent takes is logged and time-stamped.
  • Versioned records. Each output is captured so you can reproduce exactly what the agent saw and produced.
  • A human accountable. A named reviewer signs for the result. The agent removes the blank page. It does not remove the person who owns the output.

This is what we mean by audit-ready AI agents. It is the same discipline behind our regulatory affairs work, where first-draft submissions still pass through a writer who owns the final text.

Common questions

Who needs 21 CFR Part 11 for an AI workflow?

Any FDA-regulated team whose AI touches an electronic record or electronic signature that the agency could ask to see. That covers regulatory affairs, clinical operations, quality, and pharmacovigilance in pharma, CRO, and CDMO settings. If the output could end up in a submission or an audit, Part 11 applies.

Do you evaluate Part 11 fit before building?

Yes. We run a pre-build evaluation of the specific workflow against Part 11 and ALCOA+ first. If a workflow cannot be made defensible, we say so before you spend on a build. The evaluation decides what gets built, not the demo.

How does an AI agent meet Part 11 in practice?

Three things have to hold. Every action is logged in an audit trail. Each output is a versioned record you can reproduce. A named person reviews and signs for the result. The agent removes the blank page. It does not remove the human who is accountable.

Book an AI Audit

15 min. 5-day written diagnosis. No deck.