{ "pif_version": "0.1", "assertion_id": "pa_2026_001_a", "workflow_ref": "wf_qd_triage_2026_001", "produced_by": { "tool": "preclari", "version": "0.1.0", "methodology": "preclari-method-v1.0", "tier": "practice", "workspace_id": "ws_pramod_consulting", "model_assignments": { "workflow_parsing": "claude-haiku-4.5", "risk_classification": "claude-sonnet-4.6", "requirement_projection": "claude-sonnet-4.6", "missing_controls": "claude-haiku-4.5", "brief_generation": "claude-haiku-4.5" }, "entitlements": { "jurisdictions": ["EU", "US", "CH", "UK"], "gxp_domains": ["GMP", "GDP", "GCP", "GLP", "GVP", "CSV", "data_integrity", "quality_systems"], "premium_features": [] } }, "produced_at": "2026-05-17T14:30:00Z", "corpus_snapshot": { "snapshot_id": "corpus_2026_w19", "snapshot_hash": "sha256:7f3e8a2b5c4d9e1f6a8b3c5d7e9f1a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f", "snapshot_date": "2026-05-12T00:00:00Z", "source_count": 10 }, "risk_classification": { "level": "medium", "rationale": "Workflow influences GxP decisions (deviation classification feeds into investigation) but human approval gate is required before any action. Lifecycle stage is pilot, narrowing the operational scope. Reversibility is reversible, lowering the consequence of error. The medium classification reflects the GxP touchpoint combined with the controlled pilot scope.", "drivers": [ "data_classes includes gxp_record", "output_destination=draft_for_review (human gate exists)", "human_gate=approve_each (every output reviewed)", "lifecycle_stage=pilot (limited blast radius)", "reversibility=reversible" ] }, "gxp_domains_identified": ["GMP", "quality_systems", "data_integrity", "CSV"], "applicable_requirements": [ { "requirement_id": "req_001", "requirement_text": "Computerized systems that influence GxP decisions are subject to validation expectations proportionate to their risk and intended use, including documented user requirements, risk assessment, and qualification activities.", "source": { "url": "https://example-regulator.eu/annex-11", "canonical_document_id": "EU-GMP-Annex-11", "title": "EU GMP Annex 11: Computerised Systems", "issuing_authority": "European Commission", "jurisdiction": "EU", "document_type": "annex", "section_anchor": "Section 4 - Validation", "effective_date": "2011-06-30", "retrieved_at": "2026-05-12T08:30:00Z", "content_hash": "sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2" }, "applicability_basis": "The workflow uses an AI system to produce structured recommendations that feed into GxP decisions (deviation classification and investigation planning). Annex 11 validation expectations apply because the system is computerised, used in GxP context, and influences regulated decisions, even when a human approval gate exists.", "confidence": "high", "jurisdictional_scope": ["EU"] }, { "requirement_id": "req_002", "requirement_text": "Records influenced by computerised systems used in GxP activities must meet data integrity expectations including attribution, legibility, contemporaneity, originality, accuracy, completeness, consistency, enduringness, and availability (ALCOA+).", "source": { "url": "https://example-mhra.gov.uk/data-integrity-guidance", "canonical_document_id": "MHRA-DI-2018", "title": "MHRA GxP Data Integrity Guidance", "issuing_authority": "MHRA", "jurisdiction": "UK", "document_type": "guidance", "section_anchor": "Section 6.6", "effective_date": "2018-03-09", "retrieved_at": "2026-05-12T08:31:00Z", "content_hash": "sha256:b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3" }, "applicability_basis": "The AI suggestions become part of the deviation record and influence the investigation that follows. Even though the human engineer makes the final call, the system's output is captured in the GxP record and must therefore meet ALCOA+ expectations including attribution of the AI suggestion as distinct from human input.", "confidence": "high", "jurisdictional_scope": ["UK", "EU", "CH"], "interpretation_notes": "MHRA guidance is widely referenced across EU and Swiss inspections even when not formally adopted in those jurisdictions. Recommend treating it as effectively applicable." }, { "requirement_id": "req_003", "requirement_text": "Swissmedic expects pharmaceutical manufacturers to apply risk-based controls to computerised systems consistent with PIC/S GMP Annex 11 and to demonstrate suitability for intended use.", "source": { "url": "https://example-swissmedic.ch/gmp-cs-expectations", "canonical_document_id": "Swissmedic-CS-Note-2023", "title": "Swissmedic guidance on computerised systems in GMP", "issuing_authority": "Swissmedic", "jurisdiction": "CH", "document_type": "guidance", "effective_date": "2023-01-15", "retrieved_at": "2026-05-12T08:32:00Z", "content_hash": "sha256:c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4" }, "applicability_basis": "Workflow operates at a Swiss manufacturing facility (Basel, per context_notes). Swissmedic alignment with PIC/S Annex 11 means EU Annex 11 expectations effectively apply in Switzerland as well.", "confidence": "high", "jurisdictional_scope": ["CH"] } ], "missing_controls": [ { "control": "documented_user_requirements_specification", "rationale": "Annex 11 expects URS for computerised systems influencing GxP decisions. The WorkflowDescription does not indicate whether a URS has been authored for this LLM-based workflow.", "criticality": "required", "related_requirements": ["req_001"] }, { "control": "risk_based_qualification_plan", "rationale": "A risk assessment determining qualification scope is expected before pilot. The workflow declares pilot stage but no qualification approach is described.", "criticality": "required", "related_requirements": ["req_001", "req_003"] }, { "control": "ai_output_attribution_in_record", "rationale": "When the AI suggestion becomes part of the deviation record, ALCOA+ attribution requires distinguishing AI-generated content from human-authored content. The WorkflowDescription does not specify how this distinction is preserved.", "criticality": "required", "related_requirements": ["req_002"] }, { "control": "audit_trail_of_ai_invocations", "rationale": "Prompts, inputs, and outputs should be logged in a way that supports audit and trend review. Not specified in the WorkflowDescription.", "criticality": "required", "related_requirements": ["req_002"] }, { "control": "change_control_for_model_updates", "rationale": "When the underlying LLM is updated by the provider, this constitutes a change to a GxP-impacting system and should be evaluated through change control.", "criticality": "recommended", "related_requirements": ["req_001"] }, { "control": "periodic_performance_review", "rationale": "AI suggestion quality should be reviewed periodically against human engineer decisions to detect drift.", "criticality": "recommended", "related_requirements": ["req_001"] } ], "assumptions_made": [ { "assumption": "The Basel facility holds a Swiss GMP manufacturing authorization from Swissmedic.", "impact_if_wrong": "Swiss-specific requirements would not apply; the assessment would narrow to EU-only.", "basis": "Inferred from context_notes mention of Basel manufacturing without explicit confirmation of regulatory status." }, { "assumption": "Products manufactured on this line are intended for EU and Swiss markets.", "impact_if_wrong": "Additional jurisdictions (e.g., US, UK) might apply requirements not considered here.", "basis": "WorkflowDescription jurisdictions field lists only EU and CH." }, { "assumption": "The LLM provider's service is treated as an external service, not as a system component developed in-house.", "impact_if_wrong": "If developed in-house, additional software lifecycle expectations would apply.", "basis": "Common pattern for SMB pharma AI deployments; not explicitly stated in WorkflowDescription." } ], "clarifying_questions": [ { "question": "Is there an existing User Requirements Specification (URS) for this workflow?", "would_change": "If yes, the 'documented_user_requirements_specification' missing control would be removed." }, { "question": "How is the AI suggestion captured in the QMS deviation record — as a distinct field, embedded in narrative text, or attached as a separate document?", "would_change": "Determines specificity of the ai_output_attribution_in_record control and possibly its criticality." }, { "question": "Is the LLM accessed via a vendor API, deployed on-premise, or hosted by a third-party integrator?", "would_change": "Affects which supplier qualification and change control expectations apply." } ], "out_of_scope": [ { "topic": "FDA 21 CFR Part 11 expectations", "reason": "Workflow jurisdictions do not include US." }, { "topic": "Pharmacovigilance signal detection requirements", "reason": "Workflow scope is quality deviations from manufacturing, not adverse events." }, { "topic": "GDPR data subject rights", "reason": "Workflow data_classes do not include PII or PHI. If patient identifiers are inadvertently present in deviations, this should be reassessed." } ], "superseded_or_excluded": [ { "source": { "url": "https://example-old-guidance.eu/annex-11-pre-2011", "title": "Pre-2011 Annex 11 draft", "issuing_authority": "European Commission", "jurisdiction": "EU", "document_type": "guidance" }, "reason": "Superseded by the 2011 revision; included only to confirm currency of the cited version." } ], "cross_jurisdiction_conflicts": [], "verification_steps": [ { "step": "Confirm the EU GMP Annex 11 citation at https://example-regulator.eu/annex-11 matches the requirement text in req_001 and that the document version retrieved on 2026-05-12 remains the current version on the regulator's site.", "type": "source_check", "applies_to": "applicable_requirements[0]" }, { "step": "Have a qualified GMP expert review the risk_classification and confirm the medium-level designation is appropriate for the workflow as described.", "type": "expert_review", "applies_to": "risk_classification" }, { "step": "Review the missing_controls list against the organization's existing CSV procedures to identify any controls already in place that were not visible in the WorkflowDescription.", "type": "internal_policy_check", "applies_to": "missing_controls" } ], "recommendation": "Treat as a controlled pilot with the missing_controls (especially URS and AI output attribution) addressed before first live use. Document the qualification approach proportionate to medium risk classification. Plan a periodic performance review to detect drift. Do not promote to production until pilot data demonstrates suggestion quality and human override rate are within acceptable bounds defined upfront.", "status": "draft", "notice": "This assertion is informational and does not constitute regulatory advice. Validate all citations against current official sources before relying on this output for regulated decisions." }