Deviation investigation in pharma with AI: what AI drafts and what QA decides

Sources checked October 26, 2026. The US and EU rules cited are current. Annex 22 is a draft and the EMA workshop report is a meeting record, so neither is a requirement. The table is my reading, not official guidance.

AI can read deviation records, draft the description, suggest a classification and propose root causes and corrective and preventive actions (CAPAs). A qualified QA person still decides the classification, the root cause, the CAPA and its effectiveness, and signs. EU and US GMP put those decisions with the quality unit, and EMA’s 2026 Annex 22 workshop used deviation support as an example where human involvement stays high. Pilot in shadow mode and measure how often the AI under classifies.

Deviation investigation in pharma: where AI fits

Deviation work is mostly reading and writing. Someone has to pull the batch record, the equipment logs and past similar events, write up what happened, and argue for a cause. That is the kind of work current AI tools do well, and it is why vendors are moving into it. Agents add the ability to fetch records and fill fields on their own, which raises the stakes. I wrote about when a fully agentic setup is worth it in Full agentic workflows: when they are worth it.

The line I draw is between preparing a decision and making it. An agent can prepare almost everything. The decisions stay with QA, and the rest of this page explains why and what that looks like in the record.

What the regulations already assign to the quality unit

None of this is new. 21 CFR 211.22 gives the quality control unit “the authority to review production records to assure that no errors have occurred or, if errors have occurred, that they have been fully investigated.” 21 CFR 211.192 says any unexplained discrepancy “shall be thoroughly investigated” and that “A written record of the investigation shall be made and shall include the conclusions and followup.”

EU GMP Chapter 1 says “An appropriate level of root cause analysis should be applied during the investigation of deviations, suspected product defects and other problems”, that CAPAs “should be identified and taken in response to investigations”, and that “The effectiveness of such actions should be monitored and assessed”. ICH Q10 places the CAPA system inside the pharmaceutical quality system, under management review.

Each of those is a judgment about product and patients. An AI can feed it. The regulations expect a person in the quality unit to make it.

Deviation investigation report example: what AI drafts and what QA decides

Say a site wants an agent to support deviation investigations from the first report to closure. The split I would use runs in the order of a real investigation.

Decision rights in a deviation investigationSeven steps in investigation order, with what AI may do and what QA must decide at each.

Step	What AI may do	What QA must decide
Detection and description	Draft the event description from the initiator's notes and linked records	Whether the description is accurate and complete
Classification	Suggest a classification with the reasons and similar past events	The classification, and whether product impact assessment is needed
Investigation	Gather batch, equipment and training records and summarize them	The scope, including other batches that may be affected
Root cause	Propose candidate causes, each with its supporting evidence	The root cause or most likely cause, and the conclusion
CAPA	Draft CAPA options and flag past CAPAs for the same cause	Which CAPAs to take, owners and due dates
Effectiveness check	Pull the data for the check and draft the summary	Whether the CAPA worked
Closure	Check the record for missing fields and draft the closure text	Approval of the report, by electronic signature

Classification is where I would be strictest. A suggestion that rates an event lower than it deserves can skip the product impact assessment, and the reviewer may not notice. How much testing the agent needs depends on what it touches, which I cover in How much validation does your AI need.

Complaints: the same split

Complaint handling is getting the same treatment. On October 21, 2026, Honeywell announced a TrackWise Digital AI Processing Agent for customer complaint processing “with less manual oversight needed”. The company says it has run in production “for five months at a leading medical device company, where it successfully processes thousands of complaints per day”. Those are the company’s claims, and I have not seen independent data on them.

The split in the table carries over. An agent can sort incoming complaints, pull the product history and draft the evaluation. Whether a complaint is reportable, and whether it opens an investigation, stays a human decision. Device complaints also have their own rules under 21 CFR Part 820, which I don’t cover here.

Records that prove a human decided

If an inspector asks who decided, the record has to answer without anyone’s memory. I would keep four things for every AI assisted step. The AI output as produced. The human edits to it. The electronic signature on the decision, under 21 CFR Part 11. The audit trail linking them. The model call itself goes in its own log, as I described in an audit trail for LLM calls.

The EMA workshop pointed the same way. Asked how oversight can be shown in an inspection, responses named “audit trails, recording of AI outputs and human modifications, and monitoring of human-AI team performance as potential evidence.” Draft Annex 22 section 10.5 adds that where testing was reduced because a human reviews the output, “records should be kept from this process.”

“A deviation management support use case illustrated how human involvement might be high when a model has high impact, variable uncertainty and complexity, even if the AI influence is initially more informational.”

EMA, multistakeholder workshop report on Annex 22, EMA/156789/2026, June 30, 2026

Piloting in shadow mode

Before an agent’s output goes anywhere near a real record, I run it in shadow mode. The steps I use:

1. Run the agent on live deviations alongside the normal process. Nothing it produces enters the record.
2. Record each AI suggestion and the decision QA made on its own, without showing QA the suggestion.
3. Compare the two. The measure I watch most is the under classification rate: how often the AI rated an event lower than QA did.
4. Look at the cases where they differ with the deviation owners, and fix the acceptance rules or the agent.
5. Only then show suggestions to reviewers, and keep sampling decisions to check that reviewers still disagree with the AI when they should.

The last step is about automation bias. Regulators at the EMA workshop asked “how to manage automation bias” and how to monitor “the performance of the human performing oversight”. New roles are forming around this kind of oversight, which I looked at in Pharma is hiring people to steer AI agents.

Does a Copilot drafted deviation report need validation?

It depends on what the tool does in the process. A general assistant that helps a person write text the person then owns is usually handled through the review and approval of the document, with controls on the tool. An agent that writes into the electronic quality management system (eQMS), or whose suggestion drives a classification, is part of a GMP computerized system and needs validating to its risk. I set out where the line falls in Can you use ChatGPT, Claude or Copilot for GxP work?.

If you are planning an AI pilot in deviation or CAPA work, I can help you set the decision rights and the shadow run. Get in touch.

Frequently asked questions

Can AI decide a deviation's classification?

It can suggest one, with its reasons. The quality unit decides and signs. 21 CFR 211.22 gives the quality control unit authority to review production records and make sure errors are fully investigated, and EU GMP Chapter 1 expects deviations to be investigated within the quality system. A classification decides how deep the investigation goes, so it stays with QA.

Can AI name the root cause?

It can propose candidate causes, each with the evidence behind it. The conclusion belongs to the investigation, which 21 CFR 211.192 says must be written up with “the conclusions and followup”. EU GMP Chapter 1 allows identifying the most likely root cause when the true one cannot be found. That call, and the reasoning behind it, is a QA judgment.

What should be included in a deviation report?

At minimum, a description of what happened, the investigation and its scope, including other batches that may be affected, the root cause or most likely cause, the CAPAs and the conclusion. 21 CFR 211.192 requires a written record with the conclusions and follow up. EU GMP Chapter 1 adds that the effectiveness of CAPAs should be monitored and assessed.

What is shadow mode?

Shadow mode means the AI runs alongside the normal process on real cases, but nothing it produces is used in the record. Its outputs are logged and compared with the decisions people made on their own. I use it to measure how often the AI disagrees with QA, especially when it under classifies, before any reviewer sees a suggestion.