What does FDA NDA/ANDA require for AI agents handling submission data?
FDA drug approval submissions are governed by 21 CFR Part 314 and cross-referenced with 21 CFR Part 11, which requires that electronic records used to support an application are attributable, legible, contemporaneous, original, and accurate — the ALCOA+ standard. Any AI agent that reads, transforms, or routes clinical or submission data must produce a traceable audit record showing who (or what) accessed which record, when, and under what authority. An unregistered or unmonitored agent writing to or reading from GxP data sources creates a data integrity gap that FDA reviewers can cite during inspection.
When does 21 CFR Part 11 apply to AI agent workflows in pharmaceutical companies?
21 CFR Part 11 applies whenever an AI agent creates, modifies, maintains, archives, retrieves, or transmits electronic records that are required under FDA regulations or submitted to FDA. This includes clinical trial data, pharmacovigilance records, CMC documentation, and batch records referenced in an NDA or ANDA. If the agent accesses those records through an automated workflow — querying a data lake, calling a document store, or retrieving regulatory submissions — Part 11's audit trail and access-control requirements apply to the system enabling that access, not just the human operator who initiated the workflow.
What are the data integrity requirements under ALCOA+ for AI in GxP environments?
ALCOA+ requires that GxP records be Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available. In an AI agent context, the hardest requirement to meet is attributability: every record action must be traceable to a specific actor. When an agent autonomously queries a GxP source, a standard application log typically cannot prove that the correct policy governed the access or that the record was not modified in transit. FDA investigators have issued 483 observations for data integrity failures in automated systems, and AI agents that lack a per-decision audit record face the same scrutiny.
How does AutoPIL help pharmaceutical companies meet 21 CFR Part 11 audit trail requirements for AI agents?
AutoPIL intercepts every AI agent request before the agent reaches a GxP data source. At that interception point it records the agent identity (from the agent registry), the source being requested (from the source registry), the policy that governed the decision, the sensitivity level of the data, and a cryptographic hash linking each record to the one before it — creating a tamper-evident chain. This chain directly satisfies the Part 11 audit trail requirement for AI-driven access to submission-supporting data. The source registry also enforces a boundary between GxP and non-GxP sources, so agents scoped to commercial data cannot reach clinical records without a policy change.
What are the enforcement risks if AI agents access NDA submission data without proper audit controls?
FDA can issue a Form 483 observation or a Warning Letter when a GxP audit trail is incomplete or not attributable to a specific system or user. For NDA/ANDA submissions, a data integrity finding can delay approval, require re-submission, or in repeat-violation situations trigger consent decree proceedings. AI agents that access clinical or regulatory data through informal pathways — without a registered identity, policy binding, or per-access record — create exactly the kind of uncontrolled system activity that FDA expects companies to prevent. The risk is not theoretical: FDA's data integrity guidance explicitly covers computerized systems and automated processes, which includes modern AI agent frameworks.