AI and data integrity in labs: where the line is

The short answer

A lab can use AI without breaking data integrity rules, as long as everyone knows where the GxP record starts. AI is fine for work that sits outside the record, such as drafting an email, summarising a published paper or tidying meeting notes. It needs real care when it helps someone prepare a record. The line is crossed when AI creates, changes, interprets or stands in for a GxP record or decision without a validated system, a working audit trail and a named person who reviews and signs off.

The rules that apply are the data integrity rules the lab already follows. AI adds a new way for a record to be created or changed, and those rules follow the record wherever it goes.

Why data integrity is the question for labs

Regulators judge a lab on whether its records can be trusted. In the US, 21 CFR Part 11 sets the expectations for electronic records and signatures, including secure, computer-generated, time-stamped audit trails. The FDA's 2018 question-and-answer guidance on data integrity and compliance with drug CGMP explains what that means in practice. The MHRA's GXP data integrity guidance (2018) and the PIC/S guidance PI 041-1 (2021) say much the same for teams that work with UK and European partners.

All of them come back to ALCOA: data should be attributable, legible, contemporaneous, original and accurate. Many quality teams extend this to ALCOA+, adding complete, consistent, enduring and available.

A general AI chatbot struggles with most of those words. Output can change each time the same question is asked. A personal chat history sits outside the lab's systems, with no audit trail the lab controls. And a tidy summary can drop or invent a detail without anyone noticing.

ALCOA+ applied to AI use

• Attributable. Who prompted the tool, who accepted the output and who signed the record? If the answer is "the AI", the record has a problem.
• Legible and original. The original data stays the original. An AI summary of a chromatogram or a notebook entry is a secondary document at best.
• Contemporaneous. Records are made at the time of the work. Asking AI to reconstruct a record after the fact is exactly the kind of practice inspectors look for.
• Accurate. AI output can be confidently wrong. Every figure, unit and reference it produces needs checking against the source.
• Complete, consistent, enduring and available. If AI played a part in a record, the prompt, the output and the review should be kept where the lab can retrieve them for the record's full retention period.

Three zones: where the line sits

Zone 1: outside the GxP record

• Drafting internal emails, agendas and training outlines
• Summarising published papers, public guidance and conference notes
• First drafts of general SOP wording that then goes through normal document control
• Admin tasks with no sample, batch or study data

This is reasonable on a firm-approved business account, under the lab's AI use policy. Confidential data still stays out unless the tool is approved for it.

Zone 2: helping someone prepare a record

• Suggesting structure for a deviation report or investigation write-up
• Checking a draft protocol for missing sections
• Turning rough notes into a cleaner draft that a person then verifies line by line

This is where most of the risk sits. Use only approved tools, keep the original data as the record, and make sure a qualified person reviews and owns the final document. If the AI output influenced a decision, record that it was used.

Zone 3: inside the record or the decision

• Generating, calculating or transforming GxP data
• Interpreting results, deciding pass or fail, or releasing a batch
• Writing entries into a notebook, LIMS or quality system on someone's behalf
• Anything that replaces a step a validated system or a qualified person is meant to do

General chatbots do not belong here. AI in this zone has to be treated as part of a computerised system: a defined intended use, validation proportionate to risk, change control, an audit trail and human oversight. For most small labs, the honest answer today is to stay out of Zone 3 until the quality team has a plan for it.

What regulators are saying about AI right now

The guidance is still moving, so it helps to know what is final and what is draft.

• EU GMP Annex 11 on computerised systems remains the text in force. A revision of Annex 11 and a new Annex 22 on artificial intelligence were published for consultation in July 2025. As we checked on 13 November 2026, Annex 22 has not been adopted. The consultation draft would have kept generative AI and large language models out of critical GMP uses, and regulators have since discussed whether to widen that scope with strong controls. Treat it as a sign of where expectations are heading.
• The FDA's draft guidance on using AI to support regulatory decision-making for drugs and biological products (January 2025) sets out a risk-based credibility framework built around the model's context of use. It is still a draft.
• The FDA and EMA's ten guiding principles of good AI practice in drug development (January 2026) include data governance and documentation that is traceable and verifiable in line with GxP. Our post on generative AI in a GxP environment covers the wider picture.

The common thread across all of them: define what the AI is used for, match the controls to the risk, keep a human accountable and keep the evidence.

Where it usually goes wrong

Most data integrity problems with AI start with convenience. A scientist pastes results into a personal chatbot to draft a summary. A team member asks AI to "clean up" notebook entries after the fact. Someone copies an AI-generated figure into a report without checking it against the raw data. A new tool with AI features is switched on inside an existing system without change control.

None of these needs bad intent, which is why a clear rule and an approved tool matter more than a ban. The shadow AI guide explains how to find out what is already in use, and the post on personal versus business AI accounts covers why the account type matters.

Five steps you can take this week

1. Write the three zones on one page and share it with everyone who touches lab data.
2. Name the AI tools the lab has approved, the account type for each and which zones each may be used in.
3. Ask staff, without blame, where AI has touched lab records or reports in the last few months.
4. Ask your quality lead to check whether any AI features have arrived inside existing validated systems through vendor updates.
5. Add a line to relevant SOPs saying that AI output used in preparing a record must be verified against the original data, and by whom.

How we help

An AI Safety Check finds where AI is already touching lab data and records, and shows which uses sit in which zone. A Safe AI Setup moves staff onto approved business accounts and writes the zones into your AI use policy, alongside your quality team's procedures. Managed Safe AI keeps those controls in place month by month as vendors add features and the guidance changes.

We work alongside your quality and validation people. Decisions on GxP validation and regulatory strategy stay with them.

FAQs

Can we use ChatGPT or similar tools in a GxP lab?

For work outside the GxP record, yes, on a firm-approved business account and under a written AI use policy. For anything that creates, changes or interprets a GxP record, a general chatbot is the wrong tool unless your quality team has assessed and controlled that use.

Does AI output count as a GxP record?

It can. If AI output is used to make a decision or forms part of a record, regulators may expect it to be retained, attributable and reviewable like any other record. Keep the original data as the primary record and document where AI helped.

Is EU GMP Annex 22 in force?

No. As we checked on 13 November 2026, Annex 22 is still a draft and EU GMP Annex 11 remains the applicable guidance for computerised systems. It is worth reading the draft to understand where expectations are heading.

How does ALCOA+ apply to AI?

The same way it applies to any data. Someone has to be accountable for each record, the original data has to be kept, records have to be made at the time of the work, and output has to be accurate and retrievable. AI that cannot meet those tests should stay outside the record.

Who should own AI decisions in a small lab?

The quality lead or head of QA should own the rules for GxP use, with IT or a managed provider handling accounts, settings and monitoring. One named person should be the go-to for questions and for reporting a mistake.

---

*This post is general information, not legal, regulatory or compliance advice. Guidance on AI in regulated labs is changing, so check current requirements (we checked 21 CFR Part 11, the FDA's 2018 data integrity Q&A guidance, the MHRA GXP data integrity guidance, PIC/S PI 041-1, EU GMP Annex 11 and draft Annex 22, the FDA's January 2025 draft AI guidance and the FDA and EMA's January 2026 good AI practice principles on 13 November 2026) and talk to your own quality, regulatory or legal adviser about your lab's situation.*