FDA 21 CFR Part 11

Part 11 governs an electronic record and an electronic signature in a regulated setting. A team that adds an assistant to that setting must show control over access, change and traceability. This starter provides those controls for the request path and leaves system validation to you.

The recurring question is simple. Who did what, when was it done, and can you prove it later. A validation lead reaches for this starter when an assistant begins to touch regulated records.

The identity check needs a verified user, an organization and a study reference before a prompt proceeds. Redaction then masks patient identifiers, subject numbers and investigator numbers with health record heuristics. Blocking follows for prompts about trial data, adverse event reports, batch records and deviation reports.

Source grounding is required on the way back, with a confidence floor of 0.90. An unverified citation is flagged and the answer still returns, until your team sets that stage to block. Output scoring holds a combined floor of 0.85 and an accuracy floor of 0.90, which is deliberately strict for regulated content.

A qualified person sees the output before anybody else does, and that applies to all of it. The gateway returns no answer to the requester and records an escalation for the reviewer. Plan reviewer coverage for adverse event reports, batch release and deviation assessment, because none of it returns unattended. Signature meaning, signature manifestation and record retention belong to your records system, not to gateway behavior.

Use the European good manufacturing practice starter when an inspector under Annex 11 is the audience rather than a United States record rule. This starter supplies evidence inputs about AI requests, and it validates nothing on its own.