Ask around and you will hear about "the new Part 11 rules for AI". They do not exist. 21 CFR Part 11 has not been amended to address artificial intelligence, and FDA has not proposed that it should be. What has changed is the guidance around it, and the questions inspectors ask when a model is involved in a GMP record or decision.
Part 11 already applies to your model
If an AI model creates, modifies or relies on electronic records that the predicate rules require you to keep, Part 11 applies to the system it runs in. The familiar controls carry straight across: validation for accuracy, reliability and consistent intended performance; secure, computer-generated, time-stamped audit trails; authority checks; and electronic signatures that are linked to their records.
What AI adds is a harder question under "consistent intended performance". A model that drifts, retrains or behaves differently on unfamiliar inputs strains that phrase in a way a fixed calculation never did.
The credibility framework
In January 2025 FDA published draft guidance, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products. Its core is a seven-step, risk-based framework for establishing that a model is credible for a specific context of use. The guidance covers the drug lifecycle broadly, and it includes manufacturing in its examples.
Model risk combines two things: model influence, how much the AI output contributes to the decision relative to other evidence, and decision consequence, how bad an incorrect decision would be. A model that only prioritises samples for human review sits in a very different place from one whose output alone releases a batch.
Computer Software Assurance: the companion piece
FDA finalised Computer Software Assurance for Production and Quality System Software on 24 September 2025 and issued a revised version in February 2026 aligned with the device Quality Management System Regulation. CSA's message is that assurance effort should follow risk: concentrate rigorous, scripted testing where a failure would affect product quality or patient safety, and use lighter, unscripted methods and supplier evidence elsewhere. It is a device-centre guidance, but its thinking is being read widely across pharma.
| Question | EU: draft Annex 22 | US: FDA draft AI guidance |
|---|---|---|
| Starting point | Intended use | Question of interest and context of use |
| Risk basis | Critical versus non-critical GMP application | Model influence × decision consequence |
| Model types | Static, deterministic models for critical use | Not restricted by type; credibility must be shown |
| Test data | Independent of training data, representative | Part of the credibility assessment plan |
| In use | Change control, drift and input monitoring, human review | Life-cycle maintenance and change reporting |
Kestrel view
Build one evidence package that satisfies both: an intended use that doubles as a context of use, a risk rationale that speaks both languages, and a test set you can defend to either inspector.
Practical steps for a model that touches GMP records
- Confirm which predicate-rule records the model creates, changes or relies on.
- Make the model version, configuration and input data part of the audit trail.
- Rate model influence and decision consequence, and document the result.
- Scale the assurance effort to that rating, in the spirit of CSA.
- Define the trigger for revalidation: retraining, new inputs, or a drop in monitored performance.
Sources and further reading
- Considerations for the Use of AI to Support Regulatory Decision-Making for Drug and Biological Products, draft guidance (FDA, January 2025): summary by Faegre Drinker
- FDA final guidance on Computer Software Assurance (NSF)
- 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR)
Regulatory status is stated as at 9 October 2026. Draft texts can change before they are finalised; always work from the current published version.