AI does not remove the requirements for regulated electronic records and signatures. When an AI-enabled quality workflow falls under 21 CFR Part 11, its electronic records, signatures, audit trail, access controls, validation, and human authorization all need to meet the rule.
Part 11 still applies when the operating model is different
An AI quality agent may feel different from traditional software, but the obligations in 21 CFR Part 11 do not disappear. The question is how the intended use creates, changes, keeps, and signs regulated electronic records.
Electronic signatures
An electronic signature is more than a typed name under AI-generated text. It needs a verified signer, the meaning of the signature, re-authentication at signing, and a permanent link to the signed record.
In Ovada, the agent prepares the work and routes it. The qualified person applies judgment and signs. Here is why qualified people keep final authorization.
Controlled record · electronic signature
IMD-2026-0671SignerQualified reviewer · QA Manager
VerifiedMeaning of signatureApproved disposition: quarantine
CapturedRe-authenticationCredentials confirmed at signing
PassedLinked recordEvidence package v3 · 14 sources cited
LockedOvada prepared the package. Only the qualified person could sign it.
14:02:27 package.prepared · IMD-2026-0671
14:09:51 review.opened · qualified reviewer
14:11:08 signature.applied · meaning recorded
Audit trails
A regulated audit trail should let you reconstruct what happened around the record:
- What record was created or changed, and when
- Which user or authorized process acted
- Which evidence and requirements informed the output
- What was routed for review
- What the reviewer approved, rejected, or changed
- Where the approved record is kept
Ovada keeps an append-only audit trail for regulated workflows, recording both human and agent actions.
Validation and intended use
Validation is tied to intended use. Summarizing a nonregulated document carries different risk from preparing evidence for a regulated material disposition. A sound approach covers intended use and scope, user and functional requirements, configuration and interfaces, access boundaries, expected and failure conditions, acceptance criteria, human review steps, testing and traceability, and change control.
Ovada’s validation package includes IQ/OQ/PQ documentation, user and functional requirements specifications, and a traceability matrix.
Repeatability does not require identical wording
AI wording can vary, but the workflow can still be repeatable: the same evidence classes, approved sources, comparison rules, escalation conditions, review steps, and authorization path on every run. The goal is a controlled, testable, reviewable process.
Questions to ask when evaluating an AI quality workflow
- What is the intended use, and which electronic records does it touch?
- Where is the official record maintained?
- How are users authenticated, and how are signatures tied to the record?
- What does the audit trail capture?
- What happens when evidence is missing or contradictory?
- Which decisions require qualified review?
- What validation evidence exists for the intended use?
Questions
Can an AI agent apply an electronic signature?
Not in Ovada. The agent prepares and routes the work. Only an authenticated, qualified person can sign, and the signature records its meaning and links to the signed record.
Do AI outputs have to be identical to be validated?
No. Validation focuses on a controlled process: the same evidence, sources, checks, escalation rules, and review path on every run, with version-pinned models and prompts.