Contents (5 sections)
Every AI output generated inside your GMP facility is now a Schedule M record. Most pharma IT teams do not yet realise this — and the five compliance gaps that follow are already visible to a trained CDSCO inspector.
Revised Schedule M was notified via G.S.R. 922(E) on 28 December 2023. Large manufacturers — turnover above Rs 250 crore — were required to comply by 5 July 2024. MSMEs had until December 2025. CDSCO is now conducting risk-based inspections against the revised standard. The revision brings Indian GMP into closer alignment with WHO Technical Report Series guidelines and EU GMP Annex 11 on computerised systems. Among the tightened clauses: the Pharmaceutical Quality System chapter elevating senior-management accountability, the Computerised Systems clause requiring validated, access-controlled, and auditable systems, and — cutting across both — the ALCOA+ data-integrity framework operationalised as the binding standard for all GMP records. An AI system that drafts deviation investigations, answers SOP questions, or reviews batch records produces GMP records. ALCOA+ therefore applies to every prompt-and-response pair that touches a regulated workflow.
ALCOA+ — the nine attributes, applied to AI
ALCOA is a mnemonic originating in FDA data-integrity guidance and adopted by the WHO and now Schedule M: Attributable, Legible, Contemporaneous, Original, Accurate. The four "plus" attributes — Complete, Consistent, Enduring, Available — were added to address gaps that became visible when records moved from paper to electronic systems.
| Attribute | Definition | AI implementation requirement | Cloud LLM gap |
|---|---|---|---|
| Attributable | Identify who performed the action and when. | Log: user identity, model name + version, fine-tune adapter SHA-256 hash, retrieval context sources. | Cloud providers rotate model versions silently. The system version cannot be attributed. |
| Legible | Readable throughout the retention period. | Deterministic, version-locked rendering. Raw source preserved alongside any rendered form. | Markdown rendering diverges across cloud UI versions. |
| Contemporaneous | Created at the time the event occurs. | Synchronous logging of prompt + context + version + response + server timestamp before the response is returned. | Streaming responses + deferred batch logging create a time gap. |
| Original | First capture or certified true copy. | The raw token sequence IS the original record. Capture exactly, no paraphrase. | Cloud APIs do not expose raw tokens; the caller never holds the original. |
| Accurate | Free of errors; truthful. | LLMs hallucinate. SOP-defined human review + QP signature attests to accuracy. | Cloud accuracy is non-deterministic and unverifiable against a pinned baseline. |
| Complete | No data omitted. | Retrieval context must be logged alongside the output. | Cloud APIs don't log what documents were fed; provider may add system context invisibly. |
| Consistent | Chronological order preserved. | Frozen production model. Each refresh is a change-control event with a new version ID. | Cloud model versions update at provider discretion. |
| Enduring | Persists for 5-10 years for batch records. | WORM storage or append-only log with hash-chain integrity. Default 7-year retention. | OpenAI default API retention is 30 days. |
| Available | Accessible to regulator on request. | On-premises storage. CDSCO/WHO/FDA can query the audit log directly. | Inspector cannot walk into a cloud datacenter. |
The five places cloud LLMs already fail
The table above maps the gaps attribute by attribute. In practice, they cluster into five failure modes that a prepared CDSCO inspector will probe in sequence.
- Silent model rotation fails Attributable. Every major cloud LLM provider rotates the model served under a given endpoint alias without issuing a change-control notification. The model responding to
gpt-4oin March is not the model that responded in January. You cannot attribute your January deviation draft to a specific, verifiable system version. - Streaming without server-side capture fails Contemporaneous. Streaming responses display partial output to the user as tokens arrive. If your logging layer captures the final response after the stream completes, the log timestamp reflects a moment after the event.
- Logging the response without logging the prompt and retrieval context fails Complete. An audit record that says "the AI said X" without recording "the AI was shown SOP-QC-042 §4.3 and asked Y" is structurally incomplete.
- Cloud retention defaults fail Enduring. OpenAI's default API retention is 30 days. Schedule M requires batch records to be retained for the shelf life of the product plus one year, with a practical minimum of five years. A 30-day retention window creates a 4-year-10-month gap.
- Provider access to data fails Available. Cloud terms of service permit the provider to access data for model improvement, trust-and-safety review, and operational purposes. "Available to your auditor and only your auditor" is not the arrangement you have with a cloud provider.
The audit-trail components every AI output must carry
An ALCOA+-compliant AI audit record for a GMP workflow is not a conversation log. It is a structured artefact with the following mandatory components, all captured synchronously at the moment of inference:
- User identity — authenticated username and role from the IdP (Keycloak / SAML).
- Model version — base model name, version tag, and SHA-256 hash of the production adapter file.
- Retrieval context — complete set of chunks retrieved from the vector store, with source document ID, version, section reference.
- Raw prompt — exact text submitted to the model after system-prompt construction.
- Raw response — exact decoded token sequence returned, before post-processing.
- Server timestamp — NTP-disciplined server-side timestamp at request entry.
- Hash chain entry — hash of the current record chained to the previous record.
The Accurate problem: why human-in-loop is not optional
Schedule M does not permit "the AI said so, therefore the record is correct." The Accurate attribute requires that the record truthfully represents the event. LLMs produce plausible-sounding text that is sometimes factually wrong. This is not a flaw that will be engineered away; it is a property of how autoregressive language models work.
The only approach that satisfies ALCOA+ Accurate within the current state of the technology is a documented human review step. In the OwnAI standard SOW, every pharma customer is required to define an SOP that specifies: "AI-generated deviation drafts, CAPA summaries, and regulatory-filing sections are reviewed by the responsible Qualified Person before submission. The QP signature, applied via the electronic signature workflow, attests to the accuracy and completeness of the record."
This is not a limitation we hide. It is the architecturally honest answer to an audit question that every pharma AI vendor will eventually face. The QP signature is the point where the system transitions from a drafting tool to a regulated record.
How OwnAI captures all nine attributes
Every OwnAI customer deployment runs the following stack on the customer's own hardware, in the customer's own server room, with no outbound connections in production:
- Langfuse (on-premises instance) as the audit log. Every prompt, retrieval context, model version, adapter hash, raw response, server timestamp, and user identity is written synchronously, before the response is returned. No deferred logging.
- WORM-equivalent retention via a hash-chain integrity layer. Each log entry carries the SHA-256 hash of the previous entry. Any deletion, modification, or insertion is detectable.
- 7-year default retention, configurable. Restic encrypted backups to a customer-designated target. Encryption keys are customer-held.
- Frozen production models with version-pinned adapters. The runtime refuses to load any model or adapter not registered in the version registry.
- NTP-disciplined server clock. NTP sync report is a named audit artefact produced quarterly.
- Keycloak RBAC + SAML / OIDC SSO federated to the customer's identity provider. MFA mandatory for admin roles.
- Customer-controlled encryption keys throughout. Reyatech cannot read production data.
Bottom line.
Schedule M revised 2024 does not mention artificial intelligence. It does not need to. The Computerised Systems clause, the ALCOA+ data-integrity framework, and the Computer System Validation requirements apply to any software system that creates, modifies, or maintains GMP records. An LLM that drafts a deviation investigation creates a GMP record. A chatbot that answers a question about a batch specification based on retrieved SOP content creates a GMP record.
The five failure modes described above are not theoretical. They are the predictable outcome of deploying a cloud LLM — even one with enterprise data controls — into a GMP-regulated workflow without building the capture layer that ALCOA+ requires. That capture layer is not difficult to build. OwnAI ships it as the default. The harder work is the organisational layer: the QP review SOP, the eval rubric, the change-control process for model refreshes.
If your quality team is evaluating AI tools and the vendor cannot answer the 60-second audit question above, the answer is not ready. Bring your top three deviation reports and book a discovery call. We will walk through each one.