Regulated industries · GxP
Safety is engineered and proven. Never assumed.
Regulated manufacturing and life sciences run on one principle: the control is designed into the operation, and it produces evidence that it worked. Regulayer™ brings that principle to AI that acts.
Runs inside your environment. Your data does not leave it.
The film · AI in a GMP plant
The AI wrote the batch record. Who cleared it?
In April 2026 the FDA issued its first warning letter on AI: a firm used AI agents to write drug specifications, procedures and master production records, and the FDA asked who in the quality unit, by name, cleared each one. Watch the same work run through the Regulayer™ airlock, and watch each rule light up as the record answers it.
An AI agent drafts the master production record for Batch 105.
Press Play. Every step is a sample; the rules on the right are real.
The AI
Production agentThe airlock
Regulayer™ · Mathematical. Outside the AI.- Named person in the quality unit
- Authority current, this moment
- Signed on these exact words
- Record sealed first
The real world
Maya Chen, QA LeadWhat each rule asks, and the record that answers it
Attributable, contemporaneous, original: a named person, made at the time, bound to the exact document.
The signature is sealed on the signer’s machine, bound to the record by fingerprint, verifiable years later without us.
The named person whose authority covered the action, checked at the moment it took effect, sealed with the action.
What produced the output, and continuous human oversight: every output signed as it is written, under a person who can stop it.
One person pulls the authority and every action after that stops. Every decision, allowed or refused, logged on your own infrastructure.
GxP · Annex 11
Where the audit trail breaks.
Your validated systems produce audit trails by design. The AI a scientist used to summarize a deviation report does not. From inside the system, an AI-drafted deviation summary and a hand-written one are the same keystrokes. The record has to be made where the decision was made.
The regulators, in their own words
One asks who cleared it. The other asks what produced it.
“Any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative.”
The firm used AI agents to write drug specifications, procedures and master production records. The FDA did not ban the practice. It asked who, by name, cleared each output, under 21 CFR 211.22(c).
The record in the Consequence LibraryDynamic models, generative AI and large language models should not be used in critical GMP applications.
Non-critical use stays under continuous human oversight, and a qualified person stays responsible. Where a model informs a decision, that may mean review or test of every output. Still a draft; no effective date announced.
Drafted by EMA’s inspectors with PIC/S, alongside a revised Annex 11A firm can satisfy the first and still sit outside the second. Both land on the same record: who the person was, what they looked at, and whether it can still be shown a year later.
What each rule asks, and the record that answers it
From the rule to the record.
| Rule | What it asks | What Regulayer™ records |
|---|---|---|
| FDA, 21 CFR 211.22(c) | An authorized person in the quality unit reviews and clears AI output before use. | The named person whose authority covered the action, checked at the moment it took effect, sealed with the action. |
| FDA, 21 CFR 211.68(b) | Changes to master production and control records, or other records, are made only by authorized personnel. | Every change the AI attempts is checked against the named person’s current authority. A change outside it does not run, and the attempt is sealed. |
| FDA, 21 CFR 211.188(b)(11) | The batch record identifies the persons performing, supervising or checking each significant step, and the person checking any step done by automated equipment. | Each step the AI takes carries the named person whose authority covered it, sealed with the action. |
| FDA, 21 CFR 11.10(g) | Authority checks, so that only authorized individuals can use the system, sign or alter a record, or perform the operation at hand. | A named person’s current authority, checked at the moment the AI acts. Withdraw it, and the same request stops. |
| FDA, 21 CFR 11.10(e) | Secure, computer-generated, time-stamped audit trails of the entries and actions that create, modify or delete records. | Every decision, allowed or stopped, sealed and time-stamped as it happens. Change one character, and the check fails. |
| EU GMP Annex 22, draft | What produced the output, continuous human oversight, and possibly review of every output. | Heartbeat. Prove the AI. At every output. |
| FDA and EMA, Good AI Practice, principle 6, January 2026 | Data provenance, processing steps and analytical decisions documented in a traceable and verifiable manner, in line with GxP. | A sealed record of each decision, traceable to the person whose authority covered it, and verifiable without us. |
| ISPE GAMP Guide: Artificial Intelligence, July 2025 | Industry good practice for AI in GxP computerised systems. | Evidence of human authority at each consequential AI action, sealed and ready for the validation file. |
| 21 CFR Part 11 and EU GMP Annex 11 | Attributable, contemporaneous records, with signatures bound to the record. | The Regulayer™ Receipt: sealed on the signer’s machine, bound to the exact document by fingerprint, verifiable years later without us. |
| EU AI Act, Article 14 | Effective human oversight, and the ability to intervene or stop the system. | One person pulls the authority, and every action after that stops. Off the authority, an action is sent back to correct. |
| EU AI Act, Articles 12 and 26 | Automatic logs over the system’s life, kept under the deployer’s control. | Every decision, allowed or refused, recorded locally on your own infrastructure. Nothing about the batch or the product is sent to us. |
Sources: 21 CFR Part 211 and 21 CFR Part 11; FDA and EMA, Guiding Principles of Good AI Practice in Drug Development, January 2026; ISPE, GAMP Guide: Artificial Intelligence.
Regulayer™ supplies the evidence. The quality unit reads the record and decides.
When automation in the lab went wrong
The records that were missing.
When AI starts to act
Two companies’ AI agents both say release the batch.
A contract manufacturer and a sponsor each run an AI agent. Both agree the batch can go. The Regulayer™ airlock in each company checks that a named person with the authority to release it is still in control. When that authority is withdrawn, the release cannot commit, and both sides hold the same record of why.
The model may agree. The action still requires current human authority.
Where it is put to work
Anywhere an AI action carries consequences.
Any change to a sealed record fails verification. Regulayer™ supplies the evidence; the quality unit makes the determination.