We Went Looking for an AI GxP Audit Trail Example. It Didn’t Exist. So We Built One.

Why We Built This: An Example That Did Not Exist

The article you are reading started with a simple client request. A quality leader deploying an AI-assisted workflow asked us for an example of what a compliant audit trail for an AI system should actually look like. Not the principles, which are well established, but a concrete example they could hold up next to their own design and say “this is the bar.”

We went looking. We read the regulations, the data integrity guidance, the inspection guidance, and the emerging AI-specific drafts. What we found was a great deal of principle and almost no example. The regulations tell you the outcomes an audit trail must achieve. They do not tell you how to structure one for a system that reasons in multiple steps, calls external tools, and sometimes acts without a human pressing a button at each step. After all that reading, there was no example we could hand the client and say start here.

So we built the model ourselves, tested it against the requirements, and gave it to the client. This article is the generalized, openly published version of that work. In our earlier article, The Audit Trail Architecture for Agentic AI in Manufacturing, we introduced the conceptual five-layer model scoped to pharmaceutical manufacturing. Here we extend it to all of GxP, align each element with the exact regulatory wording, and give you examples you can use.

The Five-Layer Model, Across All of GxP

The model organizes audit-relevant evidence into five layers, coordinated by a workflow ID that links every event in a single workflow so it can be reconstructed as one narrative.

How it generalizes beyond manufacturing

The June article framed this for GMP manufacturing. The same five layers apply across the GxP disciplines, because they all rest on the same reconstruction and ALCOA+ expectations:

• GMP (manufacturing): an agent that drafts a deviation record, adjusts an in-process parameter recommendation, or triages environmental monitoring data.
• GCP (clinical): an agent that reconciles clinical data queries or drafts a monitoring narrative. ICH E6(R3) carries the same metadata and traceability expectations into the trial setting.
• GLP (nonclinical labs): an agent that summarizes study data or flags anomalies for a study director.
• GVP (pharmacovigilance): an agent that triages adverse event reports or drafts case narratives for a safety reviewer.
• GDP (distribution): an agent that dispositions temperature-excursion data for a human decision.

In every case the layers are the same; only the regulated records and the risk profile change.

Examples You Can Copy

The examples in this section are illustrative and synthetic. They do not describe any real system or trial. The two below are narrative walk-throughs; the field-level records follow in the next section.

Field-Level Examples: Every Field an Inspector Sees

The examples above show the structure of the five-layer model. This section shows the field-level detail: the actual records created in the audit trail that an inspector will ask to see. These records are drawn from a clinical (GCP) setting. All values are invented. They do not describe any real system or trial.

A conventional data change, expanded to every field

A site coordinator corrects a systolic blood pressure that was mis-transcribed from the source document. A single compliant audit trail record for that correction, expanded to show every field, looks like this:

The correction does not overwrite the previous value. The original entry (182) stays in the audit trail as its own record, which is what keeps a change from obscuring previously recorded information.

Its field set follows the EMA guideline on computerised systems and electronic data in clinical trials, section 6.2.1: the previous and current value, the field and data identifiers, the user, role, and organization, the date and time, and the reason for change.

The same data point across its life

An audit trail is a sequence, not a single record. Here is the full audit trail for that one field, from first entry through correction and query closure, with every entry shown. This is the kind of record set an inspector asks to see.

All entries below: Study ONC-204, field VS.SYSBP (systolic blood pressure). Each entry is shown as its own record.

Scroll sideways to see all columns.

The original value, 182, is never overwritten. Each state is a new, attributable, timestamped entry, which is exactly what “changes shall not obscure previously recorded information” requires.

An AI transaction with human escalation

Scenario: an AI voice agent is conducting a scheduled check-in call with a clinical trial participant. The participant mentions a new symptom. The agent recognizes a possible adverse event, pauses its autonomous replies, and escalates to a human safety reviewer. Everything in the conventional records still applies. The AI adds fields so that the autonomous behavior stays reconstructable. First, the decision record, expanded to its full field set:

The AI-specific fields, the model version and hash, the system prompt version, the input and output references, the confidence, and the guardrail, are recorded alongside the same who, what, when, and reason fields a conventional record carries.

The five linked records

One workflow ID ties the participant’s words, the model’s reasoning, the system’s action, the data state, and the human decision into a single reconstructable chain. Each record is shown with its key fields.

The highlighted Workflow ID column is the key: every record below carries the same value, WF-7741. That shared ID is how the system links the participant’s words, the model’s decision, the action it took, the data state, and the human review into one event it can reconstruct end to end (here, for Subject 1017).

Scroll sideways to see all columns.

This is the level of detail an inspector actually works from. The participant’s exact words are preserved, the model version and the guardrail that made the call are recorded, the escalation and the case it opened are traceable, and a named Drug Safety Physician made the clinical decision, not the agent. One workflow ID reconstructs the whole event.

What a GxP Audit Trail Actually Has to Do

Strip away the technology and a GxP audit trail exists to answer four questions about any change to a regulated record: who did it, what they did, when they did it, and, where relevant, why. Above those four sits a fifth expectation that ties them together: the trail must allow you to reconstruct the course of events, so an inspector can rebuild what happened without relying on anyone’s memory.

That reconstruction standard is the heart of the matter, and it is the one that traditional audit-trail designs struggle to meet for AI. A conventional system records a user action and the record value before and after it. An AI system may take an action that is the product of several internal steps, drawing on retrieved data and a model’s output, sometimes calling external tools, sometimes without a human trigger at each step. If the trail records only the final action, it cannot reconstruct why the system did what it did. The reconstruction standard is exactly what pushes an AI audit trail beyond the single-record design.

The regulation reference table below gives the exact wording behind each of these expectations.

The Regulation Table

This is the table to bookmark. For each source we give the exact wording, what it means in practice for an AI or agentic system, and whether it is a hard requirement, a best practice, or directional draft guidance. Quotations are verbatim from the cited source; where a source is a draft or a nonbinding guidance rather than a binding rule, we say so.

Draft items (Annex 11 revision, Annex 22) are directional and not yet enforceable. Guidance items reflect regulator and inspection-body expectations rather than statute. We cite the binding rule wherever one exists.

ALCOA+ Mapped to AI Systems

ALCOA+ is the shorthand for the data integrity attributes that underlie every audit-trail expectation: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available. The five core letters trace to specific regulatory requirements; the “+” four come from data integrity guidance (MHRA, PIC/S, WHO). Here is how each applies when the actor is an AI agent rather than a person.

Critical vs Non-Critical: Is Your Use Case in Scope Today?

Before you design the audit trail, decide whether your use case belongs to critical or non-critical GxP. This matters because the EU’s draft Annex 22 currently states that generative AI, large language models, dynamically learning models, and probabilistic-output models should not be used in critical GMP applications. Agentic AI generally falls into those categories, so the defensible near-term applications are non-critical and human-supervised.

The dividing line is simple: in every non-critical case, the human, not the agent, makes the GxP decision. That boundary is what keeps the use defensible under current expectations, and it is exactly what the Human Override layer is designed to evidence.

Using This in an Inspection

An audit trail is only as good as your ability to produce it under scrutiny. The patterns below separate designs that hold up from designs that do not.

• Reconstruct any single workflow end to end, drawing from all five layers, in a view an inspector can read.
• Pre-build standardized inspection views rather than assembling them under pressure.
• Review sample AI workflows as routine quality oversight, not only when an inspection is announced.
• Document the audit-trail architecture in the system’s validation package and map it explicitly to ALCOA+.
• Design retention deliberately for the record’s full regulatory period, including the storage cost of high-volume AI execution.
• Be ready to state clearly which uses are non-critical and human-supervised, and why.

Frequently Asked Questions

Glossary

• Audit trail: a secure, timestamped record that allows reconstruction of the events that create, modify, or delete a regulated record.
• ALCOA+: the data integrity attributes Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available.
• Reconstruction: the ability to rebuild what happened in a workflow end to end from the recorded evidence.
• Workflow ID: a shared key that links every event in a single workflow across the five layers.
• Agentic AI: AI that takes autonomous action across multi-step workflows, often calling external tools or other agents.
• Critical GMP application: a use with direct impact on product quality, patient safety, or data integrity.

References & Sources