Introduction

Artificial intelligence (AI) is becoming increasingly important in pharmaceutical manufacturing, laboratory operations, quality management, and other regulated life sciences activities. AI systems can help organizations analyse large datasets, identify patterns, support quality decisions, and improve operational efficiency. However, their use also creates new challenges related to data integrity, transparency, accountability, and regulatory compliance.

In GxP environments, reliable data is essential for maintaining product quality, patient safety, and regulatory confidence. This is where ALCOA+ principles become particularly important. These principles help organizations maintain complete, accurate, consistent, and reliable records throughout the data lifecycle.

When AI is used in a GxP-regulated process, auditors must assess more than the final output. They should also examine data sources, model development, access permissions, audit trails, change control, and ongoing system monitoring.

This guide explains what GxP auditors should check when reviewing AI governance, ALCOA+ compliance, and data integrity. It also explains how GxP Cellators supports organizations through specialized AI governance and data integrity auditing services.

What Is ALCOA+ and Why Does It Matter for AI?

ALCOA+ is a set of data integrity principles used to help ensure that records remain reliable, complete, and trustworthy. These principles are particularly relevant in pharmaceutical and other regulated environments where decisions may affect product quality and patient safety.

For AI applications, these principles should be considered across the entire data lifecycle, including data collection, preparation, model development, validation, deployment, and ongoing operation.

The Nine ALCOA+ Principles

• Attributable: Data should clearly identify the person or system responsible for generating, modifying, or recording it.
• Legible: Records should remain readable and understandable throughout their lifecycle.
• Contemporaneous: Data should be recorded when the activity takes place, with appropriate timestamps.
• Original: Records should be original or verified copies that preserve the required information.
• Accurate: Data should correctly represent the activity, measurement, or observation.
• Complete: All required data, relevant records, and associated metadata should be retained.
• Consistent: Records should follow a logical sequence and remain consistent across systems.
• Enduring: Data should be securely preserved for the required retention period.
• Available: Records should be accessible for review, investigation, and regulatory inspection when needed.

AI systems can process large amounts of information, but processing data efficiently does not automatically make that data reliable. Therefore, organizations should establish controls to demonstrate how data is created, transformed, stored, accessed, and used by AI applications.

What Should GxP Auditors Check for AI Governance?

AI governance establishes how an organization manages, approves, monitors, and controls AI systems. A documented governance framework helps ensure that AI applications are used responsibly and remain appropriate for their intended purpose.

1. Documented AI Governance Framework

Auditors should verify whether the organization has an approved AI governance framework covering system selection, risk assessment, validation, deployment, monitoring, and retirement.

The framework should explain how AI-related risks are identified and managed. It should also define the approval process for introducing AI into regulated activities.

2. Roles and Responsibilities

Clear accountability is essential when AI supports GxP processes. Auditors should review whether responsibilities are assigned to quality assurance, IT, data science, system owners, and relevant business teams.

They should also check whether personnel understand their responsibilities for reviewing AI outputs and escalating unexpected results.

3. AI Risk Assessment

Not every AI application creates the same level of risk. An AI tool used for administrative support may have a different risk profile from a system that influences product release, laboratory decisions, or manufacturing controls.

Auditors should check whether risk assessments consider intended use, data sensitivity, system complexity, human oversight, and the potential consequences of incorrect outputs.

4. Change Control and Model Updates

AI models, datasets, configurations, and software components may change over time. These changes can affect system performance and the reliability of outputs.

Auditors should verify that significant changes are documented, assessed, approved, tested, and released through an appropriate change control process. Where necessary, the organization should also reassess model performance and validation status.

Training Data Integrity: Essential Audit Checks

Training data plays a major role in AI performance. Poor-quality, incomplete, inaccurate, or unsuitable data can affect the reliability of model outputs. Consequently, auditors should examine how training datasets are selected, prepared, reviewed, and maintained.

1. Data Sources and Traceability

Auditors should confirm that training data comes from identified and appropriate sources. Documentation should explain where the data originated, who supplied it, and whether its use is authorized.

Where relevant, the organization should maintain traceability between source records, processed datasets, and the final data used to develop or evaluate the model.

2. Data Completeness and Accuracy

Incomplete or inaccurate datasets may produce misleading results. Auditors should review whether data quality checks identify missing values, duplicate records, incorrect entries, and inconsistencies.

They should also verify that corrections and data exclusions are documented and justified rather than performed without appropriate oversight.

3. Data Preprocessing and Transformation

AI development often involves cleaning, filtering, labelling, normalizing, or transforming datasets. Each step can affect the information available to the model.

Auditors should check whether preprocessing methods are documented, reproducible, and appropriately reviewed. Important transformations should preserve traceability to the source data.

4. Bias and Representativeness

Training data should be appropriate for the intended application. If the dataset does not adequately represent the conditions in which the model will operate, the results may be unreliable.

Auditors should review whether the organization has assessed relevant data limitations, potential bias, and the suitability of the dataset for its intended use.

Operational Data Integrity: What Auditors Should Review

After an AI system is deployed, its operational data must remain controlled and traceable. Auditors should examine the records generated during routine use and determine whether the organization can reconstruct important activities when required.

1. Audit Trails and Event Logging

Audit trails and system logs can help establish who performed an action, when it occurred, and what changed. Auditors should verify that relevant events are recorded and that logs are protected against unauthorized modification or deletion.

They should also assess whether the organization reviews audit trails according to documented procedures and investigates relevant discrepancies.

2. Access Controls and User Permissions

Access controls help prevent unauthorized changes to data, configurations, and AI models. Auditors should review user roles, authentication measures, privileged access, and periodic access reviews.

Where applicable, they should verify that access permissions follow the principle of least privilege and that inappropriate access is removed promptly.

3. AI Outputs and Human Oversight

AI-generated outputs should be reviewed according to the risk and intended use of the application. In regulated activities, organizations should define when human review, verification, or approval is required.

Auditors should check whether users can understand the limitations of the system and whether unexpected or questionable outputs are investigated before being used in important decisions.

4. Data Retention and Availability

Organizations should retain required records for the applicable retention period and make them available for quality investigations or regulatory review.

Auditors should confirm that backup, restoration, archival, and retrieval procedures are documented and tested where appropriate. They should also check that retained records remain readable and usable.

Common AI Governance and Data Integrity Audit Findings

Several weaknesses can affect the reliability and compliance of AI applications in GxP environments. Common areas for review include:

• Missing or incomplete AI governance policies.
• Unclear ownership of AI systems and their outputs.
• Insufficient documentation of training data sources.
• Inadequate records of data preprocessing and transformation.
• Missing, incomplete, or poorly reviewed audit trails.
• Uncontrolled AI model or configuration changes.
• Inadequate access controls and user permission reviews.
• Limited evidence supporting model performance and intended use.
• Incomplete procedures for investigating unexpected AI outputs.
• Weak change control, corrective action, and follow-up processes.

These examples are potential audit findings, not a claim that every AI implementation has these deficiencies. Their relevance depends on the system, its intended use, and the applicable regulatory requirements.

Organizations should document each confirmed finding, assess its impact, identify the underlying cause, and establish appropriate corrective and preventive actions (CAPA).

How GxP Cellators Supports AI Governance and Data Integrity Audits

GxP Cellators provides specialized auditing and compliance support for organizations operating in regulated life sciences environments. Its AI governance and data integrity audit services can help companies assess whether appropriate controls, documentation, and oversight are in place for their AI applications.

AI Governance and Data Integrity Audit Services

Depending on the project scope and system requirements, support may include:

• AI governance framework assessments.
• ALCOA+ compliance reviews for AI systems.
• Training data quality and traceability audits.
• Operational data integrity audits.
• Audit trail and event logging reviews.
• User access control assessments.
• AI system documentation and change control reviews.
• Mock AI audits and inspection readiness support.
• CAPA review, verification, and follow-up.

These activities can help organizations identify control weaknesses, improve documentation, and prioritize remediation before a formal inspection or internal quality review.

Why Choose GxP Cellators?

GxP Cellators focuses on practical auditing and compliance support for regulated organizations. Its approach can be tailored to the AI application, relevant risks, existing quality systems, and project objectives.

Key considerations include:

• A risk-based approach suited to the intended use of the AI application.
• Assessment of GxP processes, documentation, and data integrity controls.
• Practical findings with clear recommendations for remediation.
• Support for quality system improvements and CAPA follow-up.
• Confidential handling of project information, subject to agreed arrangements.

Regulatory expectations differ according to the applicable jurisdiction, product, process, and intended use of the system. Therefore, organizations should assess relevant FDA, EMA, Health Canada, MHRA, WHO, and other applicable requirements rather than assume that one checklist covers every situation.

Best Practices for Maintaining ALCOA+ Compliance in AI Systems

Organizations can strengthen AI governance and data integrity by building appropriate controls into the entire system lifecycle.

1. Define intended use: Document what the AI system is designed to do and identify the GxP processes it may affect.
2. Assess risks: Evaluate potential consequences of inaccurate data, unreliable outputs, unauthorized changes, and system failure.
3. Maintain data traceability: Preserve appropriate records showing where data originated and how it was transformed.
4. Control changes: Review and approve significant changes to models, datasets, configurations, and supporting software.
5. Protect audit trails: Ensure relevant events are recorded, retained, and reviewed according to approved procedures.
6. Train personnel: Help users understand system limitations, data integrity responsibilities, and escalation procedures.
7. Monitor performance: Establish appropriate monitoring and review processes to identify unexpected changes in performance.
8. Perform periodic audits: Reassess controls as the system, data, risks, and regulatory expectations evolve.

These practices should be proportionate to risk and supported by documented procedures and evidence.

Frequently Asked Questions

1. What is ALCOA+ and how does it apply to AI?

ALCOA+ is a data integrity framework covering Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, and Available records. In AI systems, these principles help organizations assess the reliability and traceability of training data, operational data, and system-generated records.

2. What should GxP auditors check for AI governance?

GxP auditors should review the AI governance framework, assigned responsibilities, risk assessments, change control, model updates, documentation, and human oversight. They should also determine whether controls are appropriate for the system’s intended use and potential impact on GxP activities.

3. What should auditors check for training data integrity?

Auditors should examine data sources, traceability, completeness, accuracy, preprocessing documentation, and dataset suitability. They should also review how the organization assesses potential bias, records data transformations, and protects source information.

4. What should auditors check for operational AI data integrity?

Auditors should review audit trails, access permissions, timestamps, data retention, model changes, and the traceability of AI inputs and outputs. They should also assess whether unexpected results are investigated and whether records remain available for quality reviews and regulatory inspections.

5. Why are AI governance and data integrity audits important in pharmaceutical companies?

These audits help pharmaceutical companies identify weaknesses in data controls, documentation, system oversight, and change management. They can support risk reduction, improve inspection readiness, and provide evidence that AI applications are managed appropriately for their intended GxP use.

6. How does GxP Cellators support AI governance and data integrity audits?

GxP Cellators offers specialized audit support covering AI governance frameworks, ALCOA+ principles, training data quality, operational data integrity, audit trails, access controls, and CAPA follow-up. The scope can be tailored to the organization’s AI applications and compliance objectives.

7. How can I contact GxP Cellators for AI auditing services?

Visit the GxP Cellators contact page to discuss your AI governance, ALCOA+ compliance, and data integrity audit requirements.

Contact GxP Cellators

AI governance and data integrity are important considerations when AI systems support regulated activities. By reviewing data traceability, access controls, audit trails, change management, and human oversight, organizations can identify potential weaknesses and strengthen their compliance processes.

GxP Cellators provides auditing and compliance support to help life sciences organizations assess AI governance and data integrity controls. If your organization needs support with AI governance assessments, ALCOA+ reviews, or GxP data integrity audits, visit the GxP Cellators contact page to discuss your requirements.