Writing the AI Section of a Site Master File

What the Site Master File Actually Requires, and What It Does Not

The Site Master File is a short document with an unusual job. It is written by the manufacturer, held inside the manufacturer’s own quality management system, and read almost entirely by regulators. PE 008-4 describes it as containing specific information about the quality management policies and activities of the site, the production and quality control operations carried out there, and any closely integrated operations in adjacent and nearby buildings.¹ The same text appears in the European Commission version published under EudraLex Volume 4 Part III,² in the WHO guidance issued as Annex 14 to Technical Report Series 961,⁴ and in the Health Canada guidance for drug establishments.³ Four bodies, one template. That consistency is what makes the SMF worth getting right: the same file often serves inspections in several jurisdictions.

The current version is PE 008-4, with an effective date of 1 January 2011. It is listed among the publicly available PIC/S guidance documents.¹² The revision history in the document itself shows four versions since 2002, and the 2011 change is described as a simplification of the document and implementation of requirements related to quality risk assessment policy. Nothing has been added since. That matters for the premise of this article, so it is worth stating plainly rather than implying it.

A second correction is worth making because it changes where AI competency content can go. Section 3, Personnel, is two bullets long. It asks for the organization chart to be placed in Appendix 5 and for the number of employees engaged in quality management, production, quality control, storage and distribution. There is no training subsection in the SMF template at all. Training expectations live in EU GMP Chapter 2, not here. So a site that wants to say something about AI competency in the SMF is adding a sentence that the template does not ask for, and should make that sentence earn its place. More on that below.

The structure you are working inside

Nine numbered sections and eight appendices. General information on the manufacturer. Quality management system, which breaks into the quality management system itself, release procedure of finished products, management of suppliers and contractors, quality risk management, and product quality reviews. Personnel. Premises and equipment, which breaks into premises with subsections for heating, ventilation and air conditioning, water and other utilities, then equipment with subsections for major equipment lists, cleaning and sanitation, and GMP critical computerised systems. Documentation. Production, with type of products, process validation, and material management and warehousing. Quality control. Distribution, complaints, product defects and recalls. Self inspections.

The appendices carry the bulk: the manufacturing authorisation, the dosage form list, the GMP certificate, the contract manufacturer and laboratory list with supply chain flow charts, the organization charts, production area layouts, water system drawings, and the major equipment list.¹ Appendix 4 is the one that matters most for AI, and almost nobody thinks of it that way. We will come back to it.

Whether an SMF is even mandatory for you

PE 008-4 is careful here. It says manufacturers should refer to regional and national regulatory requirements to establish whether preparing an SMF is mandatory.¹ In practice, EU and PIC/S member authorities routinely request one, and a current SMF is a standard part of the file a competent authority holds on a site. The EMA maintains the compilation of Union procedures on inspections and exchange of information, which forms the basis for national inspectorate procedures across member states,⁶ and coordinates inspections for centrally authorized products.¹³ The United States is the notable exception. The FDA does not operate an SMF system, and the Drug Master File is a different instrument entirely: a submission about a specific facility, process, or article used in drug manufacturing, held for reference in applications.⁹ Do not merge the two documents or reuse text between them.

Why the AI Description Belongs There Anyway

The argument for putting AI content in the SMF is not a compliance argument. There is no clause to cite. The argument is about what the document is for.

The European Commission procedure titled Conduct of inspections of pharmaceutical manufacturers or importers, adopted in May 2023 and in force since 1 January 2024, is explicit about preparation. Before conducting an inspection, the inspector should familiarize themselves with the company to be inspected. The list of what that may include opens with assessment of a site master file, followed by review of products manufactured, previous inspection reports, follow-up actions, the manufacturing authorisation and its variations, recalls, product defects, and sample analyses.⁵ The SMF is first on that list. It is the document that shapes what the inspector expects to find and, in practice, where they choose to spend their days.

Now consider a site where a convolutional model performs the accept and reject decision on a filled vial line, or where a language model produces a first-pass summary of deviations that a reviewer works from during batch record review. Neither is exotic in 2026. Both change the shape of a GMP decision. If the SMF describes only the automated visual inspection machine and the electronic batch record system, the inspector arrives with an accurate but incomplete map. The gap surfaces on day one, on the floor, in front of the model rather than in front of the documentation. That is the worst possible order.

The Annex 22 question, handled honestly

Draft Annex 22 on artificial intelligence went out for consultation alongside the draft Annex 11 revision in 2025. It is a draft. There is no final text and no implementation date. Nothing in it is in force, and nothing in it requires an SMF entry. Sites preparing for it should read our companion pieces on what to practice now rather than treat any of it as settled. The point for SMF purposes is narrower: if and when AI expectations do become binding, the site that already has two clean paragraphs in its SMF will update two paragraphs. The site that has nothing will be writing under time pressure while an inspection date approaches.

The certification hook already in the template

There is one place where the existing template invites AI content without any interpretation at all. Subsection 2.1 asks for information on activities for which the site is accredited and certified, including dates and contents of accreditations and the names of accrediting bodies.¹ A site certified to ISO/IEC 42001:2023, the AI management system standard published in 2023, has an accreditation that belongs in 2.1 by the plain reading of the existing text. No stretch required. Sites pursuing that certification should plan for the SMF line as part of the closeout.

The Sections That Should Carry AI Content

Five sections carry the weight. Four more take a sentence each when relevant. The table below is the mapping we use, and the sections after it explain what to write in each.

2.1 Quality management system: the anchor sentence

This is where you establish that AI is inside the quality system rather than beside it. One sentence does the work: applications using artificial intelligence or machine learning that support GMP activities are managed under the site quality management system, with governance defined in a named procedure. The named procedure is the important part. It tells the inspector that a document exists, that it has an identifier, and that they can ask for it. It also stops the SMF from having to explain your governance model, which it has no room to do.

Resist the urge to describe the framework. A sentence that begins with your governance philosophy will grow to a page and add nothing an inspector can act on. If you want a fuller treatment of what that procedure should contain, that belongs in the procedure, not here.

2.3 Management of suppliers and contractors: where most sites are thin

Subsection 2.3 already asks for a brief description of the qualification system for contractors, API manufacturers and other critical material suppliers, and for use of outside scientific, analytical or other technical assistance in relation to manufacture and analysis.¹ A vendor supplying a model that makes or supports a GMP decision on your product is technical assistance in relation to manufacture and analysis by any reasonable reading. Most SMFs currently say nothing about it because the vendor qualification narrative was written before models were in scope.

What to write: that AI suppliers and model providers are qualified through the same supplier qualification process as other GMP system suppliers, with any additional assessment steps named; whether any model is hosted by a third party and in what geography; and whether any model is retrained or updated by the supplier rather than by the site. That last point is the one inspectors follow up on, and stating it plainly saves an exchange later.

4.2.3 GMP critical computerised systems: the main entry

This is the natural home. The subsection already asks for a description of GMP critical computerised systems. An AI application supporting a GMP decision is a GMP critical computerized system, and describing it here requires no interpretation of the template at all. It is simply a fuller answer to a question already asked.

The practical approach is to keep the existing 4.2.3 content structured as it is, usually a short list or table of systems, and add the AI applications as entries in the same list with a small number of extra fields. Do not build a separate AI subsection under 4.2 unless the site runs enough applications that a subsection genuinely helps the reader. A site with two applications should list two applications.

5 Documentation: the question nobody expects

Subsection 5 asks for a description of the documentation system and whether it is electronic or manual. In 2026 there is a third question hiding inside that one: is any GMP record created, summarized, reviewed, or triaged with AI assistance, and can a reader tell which records those are? A site using a documentation assistant in batch record review has to answer this eventually. Answering it in the SMF, in two or three sentences, is easier than answering it live.

The content is narrow. State whether AI is used in creating, reviewing or approving GMP records. State how a record produced with AI assistance is identified in the record itself or in the audit trail. State who performs the human review and approval. That is all section 5 has room for, and all it needs.

How Much Detail Belongs in a Document That Goes to Authorities

PE 008-4 sets a target: a site master file should contain adequate information but, as far as possible, not exceed 25 to 30 pages plus appendices. It also states a preference for simple plans, outline drawings or schematic layouts instead of narratives.¹ That guidance is the discipline that keeps the SMF useful. An SMF that grows to seventy pages stops being read carefully and starts being skimmed, which defeats the purpose of writing it.

Work backward from the page budget. Nine sections across roughly 27 pages gives about three pages per section, and the sections are not equal: premises and equipment and production take more, self inspections takes a paragraph. AI content across the whole document should be somewhere between half a page and a page and a half, concentrated in 4.2.3. If your AI content approaches three pages, you are writing a governance document inside an inspection preparation document, and the wrong readers will see it.

The test for whether a sentence stays

Ask what an inspector would do with the sentence. If it would change which system they look at, which record they pull, or which person they interview, keep it. If it would only reassure them that you have thought about the topic, remove it. The SMF is a planning document for someone else’s work, not a statement of your position.

This test removes a surprising amount. Statements about your commitment to responsible AI, descriptions of your internal review board’s charter, summaries of the regulatory landscape, and explanations of why your approach is risk-based all fail it. None of them tell an inspector where to go.

Describing Intended Use and Decision Role Without Overclaiming

The single most common drafting failure in this area is not omission. It is a sentence that describes the model as doing more, or less, than it actually does. Both directions create problems. Overclaiming invites scrutiny the application cannot support. Underclaiming reads as evasive when the inspector sees the system in operation and finds it more consequential than the description suggested.

The pattern that holds up is three parts in one or two sentences: what the model produces, what it does not decide, and who decides. Every element is verifiable on the floor, and none of them requires you to characterize the model’s quality.

Naming the decision, not the technology

Inspectors care about decisions. A useful discipline is to write the decision first and the technology second. Not “we have deployed a vision model, which is used in inspection” but “the accept and reject decision for filled vials on line 3 is made by an automated inspection system incorporating a trained image classification model, with the following human verification step.” The second version tells the reader where the decision lives, and the technology becomes an attribute of the decision rather than the subject of the sentence.

This also makes the SMF entry robust to technology change. If the model is replaced with a different architecture next year, the decision sentence still holds and only the attribute changes.

Proposed Example Text for Two Cases

The text below is written to be adapted, not copied. Placeholders in square brackets are the site’s own identifiers. Both examples assume the model parameters are fixed in production and that retraining occurs only under change control, which is the configuration most GMP sites operate and the one the draft Annex 22 consultation contemplated.

Case one: a QC visual inspection model

Automated visual inspection is the most developed AI application in sterile manufacturing and the one with the most published practitioner work behind it. A PDA Journal review by Veillon and colleagues gathered industry experience with machine learning applied to the visual inspection of filled injectable drug products and set out points to consider for applying it, including the practice of freezing a trained model so that existing qualification strategies remain applicable.⁷ A related case study presented through the Product Quality Research Institute covers the same territory from a single implementation.⁸ That published base is useful when an inspector asks whether your approach is unusual. It is not.

Text for subsection 4.2.3, GMP critical computerised systems

That is seven sentences and roughly 150 words. It names the decision, the boundary of the model’s role, the human verification, the validated state, the ongoing monitoring, and the accountable role. An inspector reading it knows to ask for the qualification protocol, the defect kit records, and the reject reconciliation. That is exactly the outcome you want, because those are the records you have.

Supporting sentences elsewhere

• Section 7, Quality control: one sentence noting that visual inspection of [product types] is performed by an automated system incorporating a trained model, cross-referenced to 4.2.3, so that a reader working through QC activities is not surprised.
• Subsection 2.3: one sentence naming the supplier of the inspection system and whether model training and updates are performed by the supplier or by the site.
• Appendix 8: the inspection system already appears in the major equipment list. No change needed beyond making sure the entry is current.

Case two: a documentation assistant used in batch record review

This case is harder to write because the model touches records rather than product, and because the temptation to overclaim the efficiency benefit is strong. Keep the benefit out of the SMF entirely. It is not the reader’s question.

Text for subsection 5, Documentation

Text for subsection 4.2.3

Three points in that text carry disproportionate weight. Read access only, if it is true, removes a whole line of questioning about record alteration. The statement that outputs are advisory and are not GMP records sets the retention and audit trail expectations correctly. And naming where AI assistance is recorded answers the traceability question before it is asked. Sites that cannot yet make the third statement truthfully should fix that before writing the section, not write around it.

Vendors, Cloud Hosting, and Contract Manufacturers

Three arrangements complicate the drafting, and the template handles all three better than most people expect.

A model you did not build

Most GMP AI applications are bought, not built. The SMF entry does not change much, but two additions become necessary. First, name the supplier in 2.3 as part of the existing supplier qualification narrative. Second, state clearly who controls the model. If the supplier can update the model in your environment, say so and name the change control mechanism that governs it. If updates require your acceptance and revalidation, say that instead. This single distinction determines how much of the validated state you actually control, and an inspector will work it out within an hour of arriving. Writing it down first is straightforwardly better.

Avoid describing the model as a black box, even where the supplier will not disclose its architecture. The word invites a follow-up you cannot satisfy. Describe instead what the supplier does provide: performance specifications, qualification support, the defined inputs and outputs, and the change notification commitment in the agreement. Our companion article on vendor risk management for AI-enabled services covers what to negotiate for.

Cloud-hosted models

The SMF has no cloud section, which trips people up. The right home is a hosting clause inside the 4.2.3 entry for each application, plus a line in 2.3 if the hosting provider is separately qualified. State the hosting arrangement, the region or country where processing occurs, and whether the arrangement is covered by an existing qualification of that provider. Two lines. The detailed treatment lives in your supplier qualification file and your data residency assessment, both of which are pointer targets rather than SMF content.

One caution about scope. The SMF describes a site. A cloud-hosted model serving several sites is a corporate system, and each site’s SMF should describe it as used at that site, not reproduce the corporate description. Subsection 2.4 already makes this distinction for quality risk management, asking which activities are performed at corporate level and which locally.¹ Use the same framing: state that the application is a corporate system, name the corporate governance, and describe local use and local oversight.

Contract manufacturers and laboratories using AI

This is the case sites most often miss. Appendix 4 already requires a list of contract manufacturers and laboratories with addresses, contact information, and flow charts of the supply chains for those outsourced activities.¹ Subsection 2.3 already requires a brief overview of responsibility sharing between contract giver and contract acceptor. If a contract laboratory uses a machine learning model to interpret an analytical result on your product, or a CDMO runs model-assisted inspection on your batches, that is an outsourced GMP activity in which a model contributes to a decision about your material. It belongs in the responsibility sharing description.

What to write is short and specific: whether the technical agreement addresses AI use in the outsourced activity, whether the contract acceptor must notify you of model changes affecting your product, and which party holds validation responsibility. If your technical agreements do not currently address any of this, the honest SMF entry is silent, and the real work is the agreement, not the SMF. Do not write a sentence describing a control you do not have.

What Not to Put in a Site Master File

The SMF is a summary document that goes to authorities. Some content is wrong for it because it is too detailed, some because it is commercially sensitive, and some because putting it in writing in this document creates an obligation the site cannot meet. The list below covers all three categories.

A note on regulatory documents that do want the detail

Some of the excluded material is genuinely required somewhere. Article 11 of the EU AI Act requires technical documentation for high-risk AI systems drawn up before placing on the market and kept up to date, with content specified in Annex IV.¹⁰ That is a different obligation with a different audience, and its high-risk obligations are deferred rather than currently applicable. The NIST generative AI profile, published as NIST AI 600-1, sets out risk management actions for generative systems that many sites use to structure their internal documentation.¹¹ Neither is an SMF input. Keeping these documents separate, with the SMF pointing to them, is what stops the SMF from growing past the point where anyone reads it.

The Supporting Documents the SMF Should Point To

PE 008-4 is built around pointing. The manufacturing authorisation goes in an appendix, the equipment list goes in an appendix, the supply chain flow charts go in an appendix. The body text summarizes and refers. AI content should follow the same habit: a short description in the body, and a named document that holds the detail.

The table below lists what an inspector is likely to ask for after reading an AI entry, and where it should live. Every one of these should exist and be current before the SMF entry names it.

Building the inventory is the piece most sites are missing, and it is the one that makes everything else possible. Our guide to building an AI model registry covers the attributes worth tracking, and the SMF entry then becomes a summary of a list you already maintain rather than a fresh writing exercise every year.

Keeping the Section Current as Models Change

PE 008-4 sets the maintenance expectation directly. The SMF should be part of the quality management system documentation and kept updated accordingly. It should carry an edition number, the date it becomes effective, and the date by which it must be reviewed. It should be subject to regular review to ensure it is up to date and representative of current activities. And each appendix can have an individual effective date, allowing for independent updating.¹

That last clause is the most useful sentence in the document for anyone managing AI content, and it is almost always overlooked. Appendices update independently. If the volatile content is placed in an appendix, the body text stays stable through an annual cycle while the appendix moves at the pace of the technology.

What good maintenance looks like in practice

A site with three GMP AI applications should be able to answer four questions in under a minute: which applications are in GMP use today, which SMF sections describe them, when the SMF text was last verified against reality, and what would trigger an update. If those answers require a search, the maintenance mechanism does not exist yet and the SMF entry will decay. The entry decaying is worse than never having written it, because an inaccurate description in the document the inspector read first is a credibility problem rather than a gap.

Conclusion

The honest position on this topic is the useful one. No regulator requires an AI section in a Site Master File. The template is fifteen years old, it addresses computerized systems in a single line, and nothing about artificial intelligence appears in it. Anyone telling you otherwise has misread the guidance or is repeating something they heard. What is true is narrower and more actionable: the SMF is the first document an inspector reads when preparing, the existing sections already have obvious places for AI content, and a site running models in GMP decisions that says nothing about them in the SMF has chosen to have that conversation in the least favorable setting. Half a page, written once and maintained through change control, changes where the conversation starts.

The wider point is about proportion. Most of the effort in AI compliance work right now goes into building governance frameworks, and comparatively little goes into the two or three paragraphs that a regulator will actually read first. Getting those paragraphs right takes very little time and it is a good test of whether the underlying work is real: if you cannot write six true sentences about what a model does, what it does not decide, and who decides, the governance behind it is not finished. That test is worth running before an inspector runs it for you.

Sakara Digital works with pharma and biotech organizations building the documentation and governance that AI in GxP operations requires. If you are working out how to describe your AI applications to a regulator, or want an independent read on whether your current SMF matches what is happening on the floor, we are happy to have that conversation.

For Further Reading