ALCOA+ principles for AI-generated records
How each ALCOA+ principle applies when an LLM drafts an SOP, spec or report: who is the author, what counts as the original, and what the quality unit must keep and sign.
Sources checked October 26, 2026. The draft revised Annex 11 is a draft. The rest of the texts cited here are current. The table is my reading of them, not official guidance.
ALCOA+ applies to an AI drafted SOP, spec or report the same way it applies to any GMP record. The person who prompts, edits and approves is the attributable author, and the large language model (LLM) is a tool they used. Keep the approved document, the AI draft it came from, the model and prompt used, and the human changes, so a reviewer can see what the AI wrote and what a person decided. FDA’s April 2026 warning letter shows the review is not optional.
Do ALCOA+ principles apply to AI-generated records
Yes. Nothing in the data integrity guidance carves out text that a tool wrote. FDA’s data integrity questions and answers (final, December 2018) say that “complete, consistent, and accurate data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA)”. An SOP that an assistant drafted becomes a controlled document the moment it is approved, and from then on those words apply to it.
The harder question is which record each principle points at. When a person types an SOP, the draft, the author and the original are obvious. When an LLM writes the first version, they split apart. I covered where AI drafting fits in GxP work in general in Can you use ChatGPT, Claude or Copilot for GxP work?. This page is about the record that comes out of it.
ALCOA and ALCOA+ in two minutes
ALCOA is five attributes: attributable, legible, contemporaneous, original and accurate. They come from FDA usage and appear in the MHRA GXP data integrity guidance (March 2018) and the FDA questions and answers above.
ALCOA+ adds four more: complete, consistent, enduring and available. PIC/S PI 041-1, Good practices for data management and integrity in regulated GMP/GDP environments (2021), lists all nine as the attributes data should have through its life cycle. Some writers add a tenth, traceable. I stick to the nine that PIC/S lists.
ALCOA+ principles examples for an AI drafted SOP
Say a document owner asks an assistant to draft a new cleaning SOP from an older procedure and a change request, edits the draft, and sends it for approval. Each principle then asks a specific question, and a specific record answers it.
| Principle | The question for an AI draft | The record that answers it |
|---|---|---|
| Attributable | Who is the author when an assistant wrote the first version? | The named person who prompted, edited and submitted it, shown in the document system |
| Legible | Can a reviewer read what the AI wrote, not just the final text? | The AI draft kept in readable form next to the approved version |
| Contemporaneous | Were the draft and the edits recorded when they happened? | System timestamps on the draft, each revision and the approval |
| Original | Which item is the original: prompt, raw output or approved text? | The approved document is the GMP original, and the AI draft is kept as its source record |
| Accurate | Did a person check every statement against the process and the rules? | The review record and comments from the technical reviewer and QA |
| Complete | Is anything missing that shows how the text came about? | Draft, inputs supplied, model and prompt version, edits and approval, stored together |
| Consistent | Do the dates and versions line up across the records? | Version history where the draft date comes before the review and approval dates |
| Enduring | Will the draft survive if the AI tool is retired? | The draft stored in the document system, not only in the tool's chat history |
| Available | Can you show all of it to an inspector on request? | One retrieval path for the approved document and its AI history |
What to keep: draft, model and prompt version, human edits, approval
For the document record, I would keep four things. The AI draft as it came out. The model and prompt version that produced it. The human edits, ideally as tracked changes or a compare. The approval, with signatures.
Guidance does not spell out that list for AI drafts. It is my recommendation, built from what the guidance does say about originals and metadata. The MHRA guidance treats metadata as the context needed to understand data, and expects the original record or a true copy to be kept. FDA’s questions and answers expect the metadata needed to reconstruct the activity. A reviewer who sees only the approved SOP cannot tell which parts a person decided.
The model call itself belongs in a separate log. I described the fields for that in an audit trail for LLM calls, so I won’t repeat them here. Retention and signatures follow the current rules: 21 CFR Part 11 in the US and EU GMP Annex 11 in the EU. The 2025 draft revision of Annex 11 strengthens the audit trail sections, and I covered what it adds in Security is now a GMP requirement. It is a draft, so I treat it as direction, not as a rule.
What the quality unit must sign
The approval is where ALCOA+ turns into accountability. FDA put it directly in April 2026.
“If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP.”
FDA, warning letter to Purolea Cosmetics Lab, April 2, 2026
That letter went to a firm that used AI to create specifications and procedures without that review. One letter does not make a trend, and I explain why in One AI warning letter is not a trend. The rule behind it is old, though. The quality unit approves procedures and specifications, and the signature means a person checked the content. With an AI draft, I would want the approver to have the draft and the compare in front of them when they sign.
If you are deciding what your drafting assistant should keep, I can help you set that up. Get in touch.
Frequently asked questions
Is the LLM the author of the record?
No. Attributable means the record shows who did the work. The LLM is a tool, like a word processor or a template. The person who prompted it, edited the draft and submitted it for approval is the author, and the approvers are attributable for the approval. FDA’s April 2026 warning letter puts the duty to review AI generated documents on the firm.
Do I have to keep the AI draft?
No text I have found says so in those words. I recommend it. Data integrity guidance from MHRA and FDA expects the original record and the metadata needed to reconstruct how a record came about. Without the AI draft, nobody can show which parts of an approved SOP a person wrote and which parts they accepted from the tool.
What is the difference between ALCOA and ALCOA+?
ALCOA is five attributes of good data: attributable, legible, contemporaneous, original and accurate. ALCOA+ adds four: complete, consistent, enduring and available. PIC/S PI 041-1 (2021) lists all nine. The added four matter most for AI drafts, because they cover whether the history is kept together and can still be retrieved after the tool changes.