This is Part 3 of our three-part series on AI use in research documentation.
In Part 1 of this series, we looked at what the FDA, EMA, MHRA, and ISPE have published on AI in drug development and regulated research. We also covered the April 2026 FDA warning letter to Purolea Cosmetics Lab - which, among a range of CGMP violations, included a finding that AI-generated documentation had been used without adequate human review. The FDA cited that as a quality-unit failure under 21 CFR 211.22(c).
Part 2 looked at how existing data integrity principles - specifically ALCOA+ - apply when AI is generating your lab records. Now the practical question: what should your lab actually do about it?
The answer isn't to stop using AI. Regulators aren't calling for that. Across the draft guidances, frameworks, and principles published since 2024, the consistent direction is the same: risk-based use, human oversight, documentation, and validation where the risks warrant it.
That said, some draft frameworks are worth understanding before you build your policy, because they shape what "acceptable use" looks like in practice.
The European Commission's draft GMP Annex 22 is a good example. It covers AI in pharmaceutical manufacturing, but deliberately limits its scope to static, deterministic AI models - the kind that produce the same output every time from the same input. Generative AI and LLMs work differently: they're probabilistic, meaning outputs vary, and that variability creates challenges for validation and reproducibility in regulated environments. For that reason, the draft places them outside its scope for critical GMP applications.
That doesn't mean LLMs are prohibited across the board. The draft does leave room for non-critical uses - situations where there's no direct impact on patient safety, product quality, or data integrity - as long as trained personnel are checking that outputs are fit for purpose.
For most labs using generative AI to help with documentation, the practical implication is this: there is no detailed regulatory rulebook yet for this specific use case. Which means risk assessment, documentation, and human review matter even more.
If you build that framework now, before specific requirements are finalized, you're ahead of the curve. If you wait, you may find yourself trying to explain or reconstruct AI use that was never documented.
Here are some practical tips for putting that framework together.
Important Disclaimer: This post is for informational purposes only and reflects our understanding of publicly available guidance as of the date of publication. It is not legal or regulatory advice. Requirements vary by jurisdiction, product type, and intended use. If you're making compliance decisions, talk to a qualified regulatory professional who knows your specific situation.
What should your lab AI policy cover?
Before getting into the details, a quick orientation. A useful lab AI policy addresses the following: which tools are approved and which aren't, which tasks AI can and can't be used for, what gets documented when AI is used, who reviews AI-generated content and what that actually means in practice, what data and information can't go into external AI tools, and how to handle it when tools change. The steps below work through each of those.
Step 1: Write the Policy
If your lab uses AI in documentation or analysis, a written policy is quickly becoming a practical necessity. It doesn't need to be a 50-page document. A concise, clear policy that people will actually read is worth ten times more than a comprehensive one that lives in a shared drive or ringbinder somewhere.
Approved tools
Which AI tools are authorized in your lab? Deciding this, writing it down, and communicating it to your team is more important than it might seem. Different tools have very different data handling practices, and if scientists are pasting proprietary compound structures or patient information into a public chatbot, that's a problem before you even get to the documentation questions. Your policy should specify which tools are approved, which are prohibited, and why - and the approval should be based on the vendor's data handling and terms of service, not just convenience.
Where you have control over it, also specify which version or model is approved. AI tools update frequently, sometimes without any announcement, and the behavior of one model version can differ meaningfully from the next. Knowing which version was in use when a particular output was generated matters for traceability.
One thing that often catches people off guard: free-tier AI tools, including the public version of ChatGPT, may use data entered into them to train future models. Most offer a setting to disable this, but it's not on by default, it's not always easy to find, and some tools don't offer it at all (especially not on the free tier). Before approving any tool for lab use, read the terms of service and understand what happens to data once it's entered. If there's any doubt, keep proprietary research data, unpublished results, personal data, and confidential information out of it entirely.
For labs using AI in regulated workflows, there's an additional layer: tools used in those contexts may need to be qualified or validated, depending on the risk and intended use. A free-tier chatbot is not the same as an AI feature built into a validated ELN. The policy should make that distinction clear.
Approved use cases
Not all AI applications are the same risk. A tiered approach lets you match the level of oversight to the level of risk.
Tier 1 - standard review: grammar and language editing, style formatting, presentation materials, email drafting, literature search and summarization for non-regulatory background reading or internal orientation, drafting non-controlled background text or generic method descriptions that are verified before use. The common thread across Tier 1 is that the AI output doesn't directly feed into a regulated record or decision. The moment it does (e.g a literature summary informing a safety assessment, for example, or a method description copied into a controlled document) it moves into Tier 2 or higher.
Tier 2 - documented AI use, review appropriate to risk: experiment-specific notebook entry drafts, protocol and SOP drafts, experimental result summaries, analysis code, regulatory document drafts. These need documented AI use and review appropriate to the risk, which may include formal sign-off by the author and a qualified reviewer, depending on the workflow, to provide proof of human oversight.
Tier 3 - formal risk assessment required: quantitative data analysis, safety or efficacy interpretation, statistical analysis, quality control decisions, any output directly supporting a regulatory submission. These need a formal risk assessment and documented fitness-for-purpose evidence. Depending on the use, that may include validation, qualification, independent testing, change control, and for high-impact submissions, regulatory engagement.
Tier 4 - not permitted: using AI as the sole source of experimental data, replacing human scientific judgment on critical decisions, entering patient data or personally identifiable information into non-validated tools, accepting AI outputs without any human review. The Purolea failure mode sits here: AI-generated compliance documentation accepted without adequate human verification.
Documentation requirements
When AI is used, what needs to be recorded? At minimum: which tool, what the task was, that the output was reviewed and verified by a qualified person (specify who), and what changes were made. For higher-risk applications, also capture the specific prompt, the raw output, and the final edited version.
Review and approval
Who reviews AI-generated content, and what does that actually mean? For routine Tier 1 use, the scientist who ran the query and reviewed the result may be enough. For Tier 2 and above, a second reviewer or supervisor sign-off is appropriate. The depth of review should scale with the risk tier. And "review" means checking the content against primary data - not just confirming it looks well-formatted and sounds professional.
Data privacy and confidentiality
What cannot go into external AI tools? Proprietary compound structures, patient data, unpublished results, trade secrets - none of this should be pasted into an external AI service unless that service has been thoroughly vetted. Scientists moving fast don't always stop to think about what's in the text they're copying. The policy should be explicit.
AI policy checklist
Before finalizing your policy, check that it covers:
- Which AI tools are approved for lab use
- Which AI tools are prohibited
- How approved tools and their use are categorized by risk tier (Tier 1 to 4 or equivalent)
- What information may not be entered into external AI tools
- What must be documented each time AI is used
- Who reviews AI-generated content and what that review involves
- Which SOPs are affected and need updating
- Training requirements and frequency
- How AI model and tool versions are tracked
- How to handle vendor updates to tools used in regulated workflows
- Where audit evidence is stored and how to retrieve it quickly
Step 2: Train Your Team - and Keep Training Them
A policy on paper is just paper. The team needs to understand not just what the policy says, but why it is important to follow it.
Without training, scientists make predictable mistakes. They accept AI-generated summaries without checking them against source data. They share confidential information with public tools without thinking about data privacy. They miss hallucinated content - because the fabricated version reads just as confidently as the accurate one. It's what happens when people use a powerful, impressive tool without understanding how it fails.
Training should cover ALCOA+ data integrity in the context of AI: what it means when AI generates content, why human review matters regardless of whether the content ends up in a controlled record, and what non-compliance actually looks like. Worth walking your team through the Purolea warning letter as a concrete example. The firm's owner believed she was using AI to achieve compliance. The FDA disagreed - her failure to review AI-generated outputs was cited as a quality unit violation under 21 CFR 211.22(c). The lesson isn't that she was reckless. It's that AI, however powerful, requires human oversight and a clear understanding of what it can and can't do.
Training should also cover practical skills. How to write prompts that produce useful lab documentation. How to review AI output critically - not skim it. How to document AI use in your lab data management system.
The single most important habit to build: treat every AI output as unverified until you've checked it against primary data. A scientist should always be able to point back to the source record that supports an AI-generated statement. If they can't, the statement shouldn't be in the final record.
Consider running scenario exercises. Give your team an AI-generated experiment summary with two or three subtle errors - a wrong concentration, a literature citation that doesn’t exist, a result that doesn't match the data - and have them find the problems. "Spot the unsupported claim" builds better instincts than a compliance slideshow.
One approach that works well: designate one or two AI champions in the lab. People who know the approved tools well, can answer questions in real time, and run periodic refreshers. It's the same model as ELN champions at high-adoption sites, and it works for the same reason - people adopt things faster when there's a knowledgeable colleague to ask.
Training should be documented and recurring. Annual refreshers are a reasonable starting point for many labs, with ad-hoc updates when guidance changes or new tools come in.
Step 3: Update Your SOPs
If AI is being used in documentation, data review, or other regulated workflows, your SOPs should address it. This doesn't mean rewriting everything - in most cases you're adding a few paragraphs to existing documents.
Documentation SOPs should specify when and how AI assistance can be used for notebook entries, reports, or controlled documents - which tools are approved, what gets recorded, and what the review process looks like. Data review SOPs should specify that reviewers are responsible for verifying AI-generated content against primary data, not just confirming that the document looks complete. It's also worth addressing what happens when a vendor updates a tool used in your workflows - either in your change control SOP or as a standalone procedure. A model update to a Tier 1 tool probably doesn't trigger a formal change assessment. A model update to a Tier 3 analytical application likely does. Your documentation should make that distinction - and when questions come up about what procedure was in place at a given point in time, having version-controlled, electronically signed SOPs with a full approval history makes that straightforward to answer. That's exactly what IGOR's SOP management tools are designed to support.
Step 4: Configure Your ELN and Quality System
Policy and SOPs set the rules. Your systems need to support them.
If your ELN supports custom metadata fields - like IGOR's experiment databases do - add an AI documentation field to your standard entry templates. A dropdown selector ("AI assistance used: yes/no") plus a text field for the tool and a brief description creates a lightweight but auditable record. When someone asks "how are AI-generated records identified and controlled in your system?", you'll have a consistent, documented answer.
Review and sign-off workflows help enforce human oversight in research documentation, which becomes even more important when AI is used. IGOR's electronic signature workflow, for example, requires an author signature followed by witness review and sign-off, after which the entry locks for data integrity. When a witness signs a notebook entry in IGOR, they confirm that they have reviewed and verified the information in the entry and that, to the best of their knowledge, it is true and accurate. In the context of AI-assisted records, that attestation adds a meaningful layer of accountability. The audit trail captures who signed, when, and any comments left by witnesses.
Keep an AI model inventory. A running document of which AI tools and model versions are in use across the lab, what they're used for, and who's responsible for them. When a vendor pushes a model update - and they do this regularly, often without prominent announcements - you need a process to assess whether that change affects anything in your workflows. It's change control applied to AI.
Step 5: Prepare for Questions
The FDA has shown through the Purolea warning letter that AI use can become part of an inspection finding - not just in the future, but already under existing quality system regulations. It's reasonable to expect AI-related questions to become more common in inspections and quality audits going forward. Here are some examples of what to be ready for.
"Does your lab use AI tools in any regulated workflows?" You need to know the honest answer - and that means actually surveying what your team is using and what for, not just what's officially sanctioned. The gap between policy and practice is exactly where problems surface.
"How are AI-generated records identified and controlled?" This is where your policy, SOPs, and ELN configuration come together. You should be able to show your AI use policy, demonstrate how AI involvement is documented in the ELN, and walk through the review workflow. A live example from a recent notebook entry is worth more than describing what the process is supposed to be.
"Has the AI tool been validated for its intended use?" This one depends heavily on context. For AI features embedded in a validated system like your ELN or LIMS, the answer may be more straightforward - if the AI functionality was included in the validated scope and is being used as intended. If it wasn't, or if the intended use has expanded since validation, a separate risk or qualification assessment may be needed. For standalone AI tools used in higher-risk workflows, some form of fitness-for-purpose assessment, with documentation proportionate to the risk, is likely to be expected.
"How do you ensure AI-generated content is accurate?" Walk through your review process. Scientists check AI outputs against primary data, verify completeness, and sign off to confirm review. Showing examples of records where corrections were made to AI content demonstrates the review is genuine rather than a formality.
"What training have your staff received?" Show your training records. If your training documentation covers AI use and you have completion records, you're in good shape.
While it's impossible to predict exactly what auditors will focus on as AI use becomes more common in labs, questions around how your quality system was built - and specifically how your team determined what each regulation or guideline actually requires - seem like a natural area of scrutiny.
The Purolea incident has demonstrated that AI should supplement regulatory and scientific knowledge, not substitute for it. The firm's owner was unaware of a fundamental process validation requirement - not because the regulation didn't exist, but because the AI agent she used never flagged it. Your quality team's understanding of what regulations require should come from training, experience, and qualified expertise - not from whatever an AI agent happened to include in a document it drafted.
Where is AI regulation for labs heading?
AI regulation for lab work is heading toward risk-based use, with a qualified person accountable for every AI output, and none of the FDA, EMA or European Commission documents published so far bans AI in regulated research.
The regulatory picture is getting clearer, even if many of the details are still being worked out.
The FDA's January 2025 draft guidance focuses on risk-based credibility assessment for AI used to support regulatory decision-making in drug development. It's still a draft and nonbinding in that form. The European Commission's draft GMP Annex 22 is explicitly cautious: generative AI and LLMs sit outside its current scope for critical GMP applications, which is a useful signal about where the regulatory comfort level is right now. The joint principles published by the FDA and EMA in January 2026 lay out a shared framework - ten principles covering the full drug development lifecycle - that shows both agencies heading in the same direction. And the MHRA's National Commission completed its call for evidence in February 2026 and is expected to publish recommendations in 2026 that will inform UK expectations for AI in healthcare and medical devices.
None of this is a complete rulebook for routine generative AI use in lab documentation. But the direction is consistent across all of them: define what you're using the AI for, assess the risk, document the process, keep a human accountable for the output, and make sure your records can withstand scrutiny.
Putting It Together
A clear policy, a few SOP updates, some ELN configuration, basic training, and a genuine commitment to transparency get you most of the way there.
The direction from regulators is consistent: AI may have a place in regulated life sciences work, but it needs to operate within the same quality, data integrity, and oversight expectations as everything else.
Labs that internalize this now - treating AI as a useful tool within an existing quality framework, not a shortcut that bypasses it - will be the ones that get the most out of what AI has to offer. Start with the policy. Update the SOPs. Train the team. Configure the ELN. When the questions come - and they will - you'll have the answers ready.
If you want to explore how IGOR's audit trail, electronic signatures, and customizable metadata can support your lab's documentation workflows, book a demo and we can walk through how IGOR can support this kind of setup.
Frequently asked questions
Is a lab AI use policy required by law?
No regulation in the United States or the EU requires a document called a lab AI use policy, but the rules that already apply to your records make a written policy the practical way to show control. Under CGMP, 21 CFR 211.22(c) makes the quality control unit responsible for approving or rejecting procedures and specifications, and the April 2026 FDA warning letter to Purolea Cosmetics Lab cited that section because AI-generated specifications and procedures had gone out without review. In the EU, Article 4 of the AI Act, as amended by Regulation (EU) 2026/1744, requires deployers of AI systems to take measures to support the AI literacy of their staff, and a deployer is any organization using an AI system under its authority for professional purposes. A short policy with training records behind it is the simplest evidence for both. In IGOR, the AI policy can sit in the SOP Generator, where it goes through review and approval with electronic signatures and older versions are archived.
Can I paste unpublished data into ChatGPT?
Unpublished data should only go into ChatGPT if your organization has approved the specific ChatGPT plan you are using, because OpenAI handles data differently across plans. At the time of writing, OpenAI states that it may use content from consumer ChatGPT accounts, which includes Free and Plus, to train its models unless the user turns off “Improve the model for everyone” under Data controls. By default, OpenAI does not use inputs or outputs from ChatGPT Business, ChatGPT Enterprise or ChatGPT Edu to train models. Even after opting out, giving a reply a thumbs up or thumbs down can send that whole conversation back for model improvement. So pasting a draft results section, with the compound IDs and IC50 values still in it, into a personal Plus account is a different event from the same paste into a company Enterprise workspace. Patient information and personally identifiable data should stay out of any AI tool your organization has not vetted, and so should material under a sponsor confidentiality agreement.
Who is responsible if AI-generated text in a lab record is wrong?
The scientist who signs a lab record is responsible for any AI-generated text in it, together with the reviewer or quality unit that approves it, because an AI tool cannot take responsibility for a record. Under 21 CFR 11.50, a signed electronic record must show the printed name of the signer, the date and time of signing, and the meaning of the signature, such as review, approval, responsibility or authorship. The FDA applied the same logic in the April 2026 Purolea warning letter, where the failure to review AI-generated procedures and specifications was cited against the firm's quality unit under 21 CFR 211.22(c). So the author checks every AI-drafted sentence against the raw data before signing: the plate reader export, the gel image, the lot number on the tube. A witness who signs afterwards should be checking against the same data. In IGOR, the author signs a notebook entry with an electronic signature, assigned witnesses review and sign, and the approved entry locks.
What should be documented when AI is used in a lab workflow?
When AI is used in a lab workflow, the record should show which tool and model version were used, what task the tool was given, who reviewed the output, and what was changed before the content was finalized. That is the minimum for lower-risk uses such as a draft methods paragraph. For higher-risk uses, such as a summary of assay results or a piece of analysis code, also keep the exact prompt, the raw output before editing, and the final version that went into the record, because a reviewer or inspector may need to see both what the AI produced and what the scientist corrected. The model version and the date matter because vendors update models often, and the same prompt can give a different answer a month later. In IGOR, every save of a notebook entry creates a timestamped version, so if the AI draft is saved before it is edited, the draft and the corrected entry both stay in the version history.
What is an AI model inventory and how do you keep one?
An AI model inventory is a running list of every AI tool and model version your lab uses, what each one is used for, which risk tier it sits in, and who is responsible for it. It lets you answer two questions quickly: which records did a given tool touch, and does a vendor update change anything that matters. A shared spreadsheet or a controlled document is enough for most labs. Give each row the tool name, the plan or license (a personal free account and a company Enterprise workspace count as different tools here), the model version, the approved use cases, the owner, and the date it was last reviewed. Check it when a vendor announces a model change and at least once a year, and add new tools before anyone starts using them, not after. Keep the earlier versions of the list too, because a reviewer may ask which model was in use on a particular date months ago.
Does the FDA allow AI in GMP and GLP labs?
The FDA does not ban AI in GMP or GLP labs. Its January 2025 draft guidance describes a risk-based credibility assessment for AI used to support regulatory decisions, and the ten FDA and EMA principles from January 2026 start with human-centric design and a risk-based approach. AI output still needs review by a qualified person.
How do you record AI use in IGOR?
Labs record AI use in IGOR by adding custom metadata fields to an experiment database, for example a dropdown for “AI assistance used” and a text field for the tool and model version. Every experiment in that database then carries the answer, and the field can be searched across the database when someone asks which records involved AI.
References
- FDA, "Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products," Draft Guidance, January 2025. Docket No. FDA-2024-D-4689. fda.gov
- EMA, "Reflection Paper on the Use of Artificial Intelligence (AI) in the Medicinal Product Lifecycle," EMA/CHMP/CVMP/83833/2023, adopted September 2024. ema.europa.eu
- FDA and EMA, "Guiding Principles of Good AI Practice in Drug Development," January 2026. fda.gov
- MHRA, "Impact of AI on the Regulation of Medical Products," April 2024. gov.uk
- ISPE, "GAMP Guide: Artificial Intelligence," July 2025. ispe.org
- FDA Warning Letter to Purolea Cosmetics Lab, MARCS-CMS 722591, April 2, 2026. fda.gov
- European Commission, Draft EU GMP Annex 22: Artificial Intelligence, July 2025. health.ec.europa.eu
- eCFR, "21 CFR 211.22: Responsibilities of quality control unit." ecfr.gov
Important Disclaimer: This post is for informational purposes only and reflects our understanding of publicly available guidance as of the date of publication. It is not legal or regulatory advice. Requirements vary by jurisdiction, product type, and intended use. If you're making compliance decisions, talk to a qualified regulatory professional who knows your specific situation.