Annex 11 expects computerised systems used in GMP to keep records of who did what and when, with audit trails that can be reviewed, electronic signatures bound to their records, and changes that remain visible. General-purpose AI used beside those systems sits outside them: the tool keeps no GxP audit trail, the output is pasted into a validated system as if typed, and the trail carries no trace that AI was involved or that anyone checked it. Closing that gap means recording the human review at the point it happens, in a form that binds to the document and survives review.
The requirement itself is summarised at EU GMP Annex 11, computerised systems integrity.
Where the trail actually breaks
A validated system records the entry, the user and the time. What it cannot record is what happened before the paste: that a general-purpose model drafted the text, what it was asked, and what the scientist verified before accepting it. From inside the system, an AI-drafted deviation summary and a hand-written one are the same keystrokes.
That is not a system defect. The event happened outside the system boundary, so the system has nothing to record. The record has to be made where the decision was made.
What data integrity asks of the record
| Attribute | What it means for AI-assisted work |
|---|---|
| Attributable | A named person, bound to the entry by their own signature, not a shared account or a tool log. |
| Contemporaneous | Made at the time of the review, not assembled for an inspection. A record that asserts its own time should say so plainly. |
| Original | Bound to the exact document produced, by fingerprint, so the declaration cannot be moved onto a different version. |
| Accurate | What the reviewer actually checked, in their words. Reported, never scored, because a score invites the reader to trust an inference instead of a statement. |
| Enduring and available | Verifiable years later by whoever holds the record, without an account, a vendor or a live service. |
A record that outlives the vendor
Retention periods in GMP outrun software contracts. A trail that can only be read inside a subscription is a trail with an expiry date attached to someone else's business.
A Regulayer Receipt is a file. It is sealed on the signer's machine, it carries the fingerprints rather than the document, and it verifies with an open verifier that contacts no server. If the subscription lapses, existing records still verify. The open verifier is at open verifier and the format at the Regulayer Receipt.
Deployments that never leave the site
Manufacturing and QC environments frequently cannot send records to a service. The desktop application signs locally, and the record never leaves the machine unless someone sends it. Nothing about the work, the batch or the product is transmitted to us at any point.
Where a site needs the control applied across systems rather than by individuals, the enterprise section sets out how the same authority record is produced at that scale.
The limits
Tamper-evident, not tamper-proof. Nothing is unalterable. The guarantee is narrower and stronger: any change after sealing breaks the signature, and the break shows on verification.
It records evidence. It does not certify compliance. Annex 11 compliance is established by your validation, your quality system and your inspectors. A receipt is a record you can put in front of them. It does not validate a system, and it does not certify that a process is compliant.
Attested, not proved. A signature makes a declaration permanent and attributable. It does not make it true. The record says a named person declared this, at this time, and nothing has changed since. That is what it shows, and it is all it shows.
Questions people ask
Is a receipt a qualified electronic signature?
It is a cryptographic signature over a declaration, bound to a named signer and to the document by fingerprint. Whether a given signature satisfies a particular legal or regulatory form is a question for your quality and legal functions, and it depends on the jurisdiction and the use.
Does it need validating before we can use it?
Treat it as you would any software touching GxP records: your quality system decides the level of qualification. The verification path is open and can be exercised independently, which makes the checking part straightforward to evidence.
Does anything about the batch leave the site?
No. The desktop application signs on the machine and transmits nothing. The record carries fingerprints of the file rather than the file, so even sending it discloses no content.
What happens to old records if we stop paying?
They keep verifying. Verification needs the record and a verifier, not an account or a live service, and the verifier is free and open.
Close the trail where the person actually reviews the work.
The live demos sign a real record in your browser and let you alter it: change one character and verification flips to tampered. Seven days free, then $349 a month. Cancel at any time; records already signed stay independently verifiable.
Written 16 August 2026. A summary for orientation, not regulatory advice. A receipt attests what the signer declared; it does not certify compliance with Annex 11, and qualification decisions rest with your quality system.