Can AI write deviation reports and help with root cause analysis and CAPA?

1What an investigation must contain.

21 CFR 211.100(b) requires any deviation from written production and process control procedures to be “recorded and justified”.¹ Under 211.192, an unexplained discrepancy or a failure to meet specifications “shall be thoroughly investigated, whether or not the batch has already been distributed”. The investigation extends to other batches and products that may be associated, and “a written record of the investigation shall be made and shall include the conclusions and followup.”²

EU GMP Chapter 1 asks for “an appropriate level of root cause analysis” in investigating deviations, suspected product defects and other problems, which can be set using quality risk management. Where the true root cause cannot be determined, consideration should be given to identifying and addressing the most likely causes. Where human error is suspected, “this should be justified having taken care to ensure that process, procedural or system-based errors or problems have not been overlooked”. CAPAs should follow from the investigation, and their effectiveness should be monitored and assessed.³ ICH Q10 asks for “a structured approach to the investigation process” with the objective of determining the root cause, and effort, formality and documentation “commensurate with the level of risk”.⁴

2What regulators have said about AI and deviations.

At the QP Forum in Dublin on 12 May 2026, an HPRA GMP inspector was asked how AI can be used for GMP activities, “e.g. writing deviations, customer complaints, audit and inspection responses”. The answer: “testing / confirming the outputs is key, e.g. through verification of a ‘Human in the loop’ or using alternative guardrails.” The company and the personnel responsible for the activity “are responsible for the decisions made based on the outputs of those models”. The inspector named three things that keep outputs accurate: in-depth knowledge of the process, review and verification of AI outputs, and training and validation of the systems. Inspectors may ask at the opening meeting whether AI is used in any GMP system or process.⁵

The draft Annex 22, still under revision, says generative AI and large language models should not be used in critical GMP applications, those with direct impact on patient safety, product quality or data integrity. In non-critical applications, qualified and trained people are responsible for the output.⁶ The draft does not list which tasks are critical. FDA’s April 2026 warning letter told Purolea Cosmetics Lab that if it resumed production, AI output used for CGMP activities must be “reviewed and cleared by an authorized human representative of your firm’s QU”.⁷

3Where AI helps, and where it can mislead.

The part of an investigation AI can take on is the assembly: putting timestamps, alarms, batch records and procedures into one chronology, and finding earlier events and CAPAs like this one. ICH Q9(R1) warns that subjectivity, including bias, can enter every stage of risk management, and that it is controlled partly by “maximizing the use of relevant data and sources of knowledge”.⁸ Searching every past deviation and CAPA is one way to do that.

The risk runs the other way too. NIST’s Generative AI Profile describes confabulation, confidently stated but false content, including invented logic or citations that make a wrong answer look justified. It also describes automation bias, “excessive deference to automated systems”.⁹ A drafted root cause that reads well is not evidence for it. If a draft blames human error, Chapter 1 still expects that conclusion to be justified against process, procedural and system causes.³

4Who does what at each stage.

5How CAPA effectiveness is judged.

ICH Q10 expects a CAPA system for actions arising from complaints, product rejections, non-conformances, recalls, deviations, audits, inspections and trends. In commercial manufacturing “the effectiveness of the actions should be evaluated”, and CAPA methodology “should result in product and process improvements and enhanced product and process understanding.”⁴ Chapter 1 asks for effectiveness to be monitored and assessed in line with quality risk management.³ When a QP considers certifying a batch after an unexpected deviation, Annex 16 expects the deviation to be “thoroughly investigated and the root cause corrected”, with its impact on the batch assessed through quality risk management.¹⁰ A comparison of event rates before and after a change is evidence for that evaluation, not a substitute for it.

6How it runs in Seal.

Neil can draft a deviation investigation. It reads the deviation description and affected records, execution timestamps and equipment events, and the relevant procedures, then drafts an investigation with a timeline, sources and open questions. The investigator determines root cause, and QA approves the investigation and any CAPA. Missing evidence stays visible as an open question.

For CAPA, Neil can compare a CAPA’s event rates, setting recurrence after the action against a defined population, exposure measure and effectiveness criteria instead of relying on closure status. The CAPA owner assesses effectiveness and QA approves the conclusion. Neil drafts and proposes; it signs, approves and releases nothing.