GCP, Veeva, validation, and inspection readiness — with people still in charge.

Where teams get stuck

• TMF completeness reported as a percentage with no clause-level evidence map
• Monitoring reports filed, but follow-up actions not closed or not traceable
• Consent versions not reconciled to amendment dates at site level
• CAPAs closed on status, not on new evidence
• Training matrices that do not match the people who actually touched the trial

Standards we score against

• ICH-GCP E6(R2) and E6(R3) principles and sponsor/investigator duties
• Protocol, IB, and amendments in force by visit date
• Your GCP, monitoring, TMF, deviation, and training SOPs
• 21 CFR 312 / 812 and applicable local requirements when in scope
• ALCOA+ for records that support data integrity findings

AI layers (then a person)

1. Corpus control We only index the trial(s), SOP set, and systems you name. The model is instructed to judge against those sources, not against generic internet GCP text. Out-of-scope studies are excluded so findings cannot be invented from another program.
2. Clause-to-artifact mapping Each selected ICH-GCP clause and SOP requirement is paired with the TMF artifact type (or CTMS/EDC record) that would satisfy it. AI lists present, weak, missing, or wrong-version evidence and points to the expected zone/section in your TMF plan.
3. Temporal consistency Consent, amendment, monitoring visit, and deviation dates are checked against each other. A common finding is a visit conducted under the previous protocol without a documented waiver — AI flags the date collision; a person decides if it is a true deviation.
4. Repeat-theme clustering The same gap at many sites (late monitoring report, unsigned DoA, missing temperature log) is grouped so you fix the process, not only the file. Specialists set severity and whether it is systemic.
5. CAPA language, not CAPA decisions AI drafts finding text, likely root-cause prompts, and suggested evidence to attach on close. QA assigns owner, due date, and classification. Nothing enters the official CAPA system until a person pastes and signs.

Where teams get stuck

• No intended-use paragraph; validation scope is “the whole system”
• GAMP category argued in email, not in the VP
• Same scripted depth for a report color and for an e-signature
• Vendor validation package unread; everything re-tested
• Periodic review is a calendar reminder with no release diff

Standards we score against

• FDA Computer Software Assurance for Production and Quality System Software (2022 guidance)
• GAMP 5 2nd edition — categories, risk, supplier assessment
• 21 CFR Part 11, EU Annex 11, and your Part 11 SOP
• ALCOA+ / data-integrity policy
• Your CSV/CSA SOP and periodic-review procedure

AI layers (then a person)

1. Intended-use draft From SOPs and architecture notes, AI proposes who uses the system, on which GxP records, and what a wrong result would do. You edit this until it is boring and true — that paragraph drives everything else.
2. Boundary and GAMP hint Interfaces, SOUP, cloud vs. on-prem, configurability. AI suggests a GAMP category and supplier-assessment questions. The team confirms the system boundary (what is in the VP vs. a connected system’s VP).
3. Risk scenarios Failure modes against safety, product quality, and data integrity (including audit trail, access, backup). Each function gets a suggested risk and a suggested assurance type: vendor evidence, automated test, unscripted, or scripted protocol.
4. CSA rationale table The split is written as a table an inspector can read: function, risk, assurance method, pointer to evidence. If you cannot fill a cell, that function is not assured yet.
5. Protocol and evidence index Scripted steps and expected results are drafted only for high-risk / no-vendor-evidence functions. Screenshots and logs are indexed so the report cites files, not “passed.”
6. Delta / periodic review New vendor release notes or config exports are diffed against the last validated state. AI proposes a delta plan; you decide what must be re-assured.

Where teams get stuck

• Orphan forms — a form with no parent SOP
• Two SOPs that assign the same approval to different roles
• Validation plan that does not match the SOP’s system name
• Periodic review overdue; no one knows what changed
• Training quiz that tests the old procedure

Standards we score against

• Your document-control SOP (numbering, review, training, periodic review)
• Linked process SOPs (deviation, change control, training, data integrity)
• GCP / CSV / CSA / TMF procedures this document must not contradict
• Your validation templates (VP, RA, IQ/OQ/PQ, RTM, VSR)
• ALCOA+ language where records are created

AI layers (then a person)

1. Inventory and orphans List SOP/WI/form/validation docs, owners, and next review date. Flag forms without a parent and titles that collide.
2. Process map from the room Interview + screenshots → trigger, roles, systems, records, exceptions. This map is what the SOP must say. If the room cannot agree, we do not paper over it.
3. Template-faithful draft Purpose, scope, responsibilities, procedure, records, references — in your header. Cross-references are placeholders until the owner confirms numbers.
4. Conflict pass Compare the draft to sibling SOPs and to the validation workbook. “QA approves in SOP-12; SOP-19 says the system owner approves.” Listed, not silently picked.
5. Validation set alignment VP, RA, protocol, and report drafts share one function list. AI checks the names match. Your validation lead still owns the science of the tests.
6. Effective packet Change-history paragraph, training outline, quiz items if you use them. Document control runs the workflow.

Where teams get stuck

• No single narrative — each function has a different story
• Document retrieval over 10 minutes or “we will email it”
• SMEs who have never been interrupted mid-answer
• Audit trail demo that only one IT person can perform
• Open CAPAs from the last inspection with no evidence of effectiveness

Standards we score against

• Applicable inspectorate practice (FDA BIMO / PAI, EMA, MHRA, or sponsor QA)
• ICH-GCP and your SOPs for the scoped process
• Prior commitments, 483s, CAPAs, and audit findings still open
• eTMF / QMS / validation evidence paths
• Your inspection SOP (front room, back room, scribe, hold)

AI layers (then a person)

1. Narrative harvest Protocol deviations, safety summaries you provide, CAPA log, previous findings → draft “what they will want explained first.” Specialists edit tone and cut speculation.
2. Question-to-path map Likely questions paired with TMF ID, SOP number, VP/report, or system screen. Missing path = readiness gap.
3. Commitment tracker Prior 483 / audit items vs. current evidence. Still open is a finding before the inspector arrives.
4. Interview notes Optional transcription and theme tags after the mock. Scoring of answers is human.
5. Closeout plan Day-by-day list for 30 days: who files what. AI can keep the list; owners are named by you.