Out-of-Specification Investigations: Digital Workflows That Shorten Lab Review

What FDA’s OOS Guidance Says Today

Before designing any workflow, it helps to be precise about what is in force. The current document is FDA’s Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production, Revision 1, issued by CDER in May 2022.¹ FDA’s guidance database lists it as a final, Level 2 revised guidance under docket FDA-1998-D-0019.² It replaced the October 2006 original. Like all FDA guidance, it is labeled as containing nonbinding recommendations. The requirements behind it are binding, though: they come from the CGMP regulations in 21 CFR Part 211.

The Regulations Underneath the Guidance

The core requirement is 21 CFR 211.192. It says that any unexplained discrepancy, or any failure of a batch or its components to meet specifications, must be thoroughly investigated whether or not the batch has been distributed. The investigation must extend to other batches and products that may be associated with the failure, and a written record must include the conclusions and follow-up.⁴ FDA’s guidance opens its Phase I section by pointing straight at this rule: an investigation is required whenever an OOS result is obtained, and its purpose is to find whether the cause lies in the measurement process or the manufacturing process.¹

Two other rules shape the record. 21 CFR 211.194 requires laboratory records to include complete data from all tests performed, which is why an invalidated result never disappears from the file.⁵ And for products under an approved NDA or ANDA, 21 CFR 314.81(b)(1)(ii) requires a field alert report within three working days when a distributed batch fails to meet an application specification.⁶ FDA’s OOS guidance treats an OOS result on a distributed batch as one kind of information that triggers that report, unless the result is found invalid within the three days. A follow-up report is due when the investigation is complete.¹ That three-day clock is a strong reason to get Phase I evidence in one place fast.

What Revision 1 Changed

The 2022 revision did not rewrite the process. ECA’s comparison of the two versions lists mostly editorial updates: “quality control unit” became “quality unit,” references were brought up to date, and the definition of an OOS result stayed the same.³ Two changes matter for anyone configuring a system:

• Outlier tests are informational only. The 2022 text says an outlier test may help show how far a result is from the mean, but can be used solely in an informational capacity during an investigation.¹ The 2006 wording had allowed that information to be used along with other data to judge the significance of a result.³
• A new caution on replicate injections. Where an approved method defines a reportable result as the average of a set number of replicate injections from the same final preparation, and the method’s variability criteria are met, a single replicate outside the limit should not by itself make the reportable result OOS.¹ The same section keeps the older caution that when several full sample preparations give a mix of passing and failing results within the method’s known variability, the firm should treat the average as OOS even if it falls inside specification.

Both points have direct consequences for how a LIMS or CDS calculates and flags results. We come back to them below.

Scope: What the Guidance Covers and What It Leaves Out

The guidance applies to chemistry-based laboratory testing of drugs regulated by CDER, including tests on active ingredients, excipients and other components, in-process materials, and finished products. It also covers chemistry-based testing of biotechnology products under CDER, and it applies to contract labs, whose responsibility FDA describes as equivalent to that of the manufacturer.¹ It is not intended to address biological assays, and it does not cover in-process tests done only to adjust equipment in real time to prevent process drift. A footnote adds that much of the guidance may be useful for out-of-trend results, which matters for trending later in this article.

How MHRA and EU GMP Add Detail

For companies supplying the UK or EU, two more documents fill gaps. MHRA publishes its OOS guidance as an interactive flowchart that splits the work into Phase Ia, Phase Ib, Phase II, and Phase III investigations, followed by batch disposition.⁷ The flowchart extends the same expectations to out-of-trend and atypical results. MHRA inspector Lesley Graham wrote in 2018 that the most common OOS deficiency she sees is a result “invalidated on the basis of assumptions and theories with no real evidence to support the decision.” She described the challenge as moving from “I think this is the cause” to “I know this is the cause.”⁸

EU GMP Chapter 6 states the trending duty more directly than FDA’s guidance does. Paragraph 6.9 says certain data, including test results, should be recorded in a way that allows trend evaluation, and that “Any out of trend or out of specification data should be addressed and subject to investigation.” Paragraph 6.35, in the on-going stability section, says “Out of specification or significant atypical trends should be investigated,” and confirmed OOS results or significant negative trends affecting released batches should be reported to the competent authorities.⁹

The Phase I and Phase II Structure, Step by Step

A digital workflow should mirror the investigation structure exactly. If the system’s states do not match the phases inspectors expect, people work around the system, and the record stops reflecting what happened. Here is the structure as FDA describes it, with MHRA’s finer split where it helps.

Phase I: The Analyst and the Supervisor

FDA places the first responsibility for accurate results on the analyst. Analysts should check data against specifications before discarding test or standard preparations. When an unexpected result has no obvious explanation, they should keep the preparations if stable and inform the supervisor, and an assessment of accuracy should start immediately. If an error is obvious, such as a spilled sample solution, the analyst should document it right away. FDA also says analysts should not knowingly finish an analysis they expect to invalidate later just to see what result comes out.¹ MHRA calls this obvious-error check Phase Ia and gives examples: calculation errors, power outages, equipment failure, spills, and wrong instrument settings such as the wrong detector wavelength. MHRA also expects these obvious errors to be trended, even when no further investigation is raised.⁷

The supervisor’s assessment should be “objective and timely,” and FDA is blunt: “There should be no preconceived assumptions as to the cause of the OOS result.”¹ The guidance lists seven steps for that assessment:

1. Discuss the test method with the analyst and confirm the analyst knows and performed the correct procedure.
2. Examine the raw data, including chromatograms and spectra, and identify anything anomalous or suspect.
3. Verify that calculations are scientifically sound and correct, and check whether unauthorized or unvalidated changes were made to automated calculation methods.
4. Confirm instrument performance.
5. Confirm that the right reference standards, solvents, reagents, and solutions were used and met their specifications.
6. Evaluate whether the method is performing as expected based on validation and historical data.
7. Fully document and preserve records of the assessment.

FDA adds that hypotheses (a dilution error, an instrument fault) should be tested, and that retained solutions should be examined as part of the lab investigation. Reinjecting a solution can support a suspected transient instrument fault, though FDA notes such hypotheses are difficult to prove.¹

The Decision Point: Clear Lab Error or Not

Phase I ends in one of two places. When clear evidence of lab error exists, the result is invalidated. When the evidence is unclear, a full-scale investigation follows. FDA states that OOS results should not be attributed to analytical error without an investigation that clearly establishes a laboratory root cause.¹ The guidance also says “Laboratory error should be relatively rare.” Frequent errors point to training, equipment, or careless work, and each identified lab error needs a corrective action.

For contract labs, this decision point is also a handoff. The lab should send its data, findings, and supporting documents to the manufacturer’s quality unit, which then starts Phase II whenever no clearly causative lab error was found.¹

Phase II: The Full-Scale Investigation

Phase II follows a predefined procedure, is led by the quality unit, and involves every department that could be implicated, including manufacturing, process development, maintenance, and engineering. FDA says these investigations “should be given the highest priority” and must evaluate impact on batches already distributed.¹ The written record should include five things: a clear statement of why the investigation was opened, a summary of manufacturing steps that may have caused the problem, the results of the documentation review with an actual or probable cause, the results of a review of whether the problem has happened before, and a description of corrective actions.

Phase II may include more lab testing: retesting a portion of the original sample, or resampling. Both come with tight controls, covered in a later section.

Concluding the Investigation

The quality unit interprets the results and makes the release decision. There are three outcomes.¹ If a cause is found and the result is invalidated, it is not used to judge the batch. If the investigation confirms the OOS result, the batch should be rejected, and the work becomes a batch failure investigation that must extend to associated batches and products. If the investigation is inconclusive (no cause found, OOS not confirmed), the OOS result still gets full weight in the disposition decision. FDA gives a completed example in which seven passing retests, a clean production review, and consistent supporting data might allow release, and it closes with a clear instruction: “In making such a decision, the QU should always err on the side of caution.” FDA also notes that “Batch rejection does not negate the need to perform the investigation.”

MHRA labels the final review stage Phase III: a review of the completed manufacturing and lab investigations, a summary report with a detailed conclusion, an assessment of impact on other batches, ongoing stability studies, validated processes and test procedures, and the CAPA.⁷

What Recent Warning Letters Show About Weak OOS Records

FDA’s warning letters are the most direct public record of how investigators judge an OOS file. Three recent CDER letters, each citing 21 CFR 211.192, show patterns that a better workflow can catch early. The firms differ: an Indian finished-dose manufacturer, a US contract testing lab, and a US manufacturer of over-the-counter products. The deficiencies are similar.

Invalidation Without Evidence

In a March 30, 2026 letter, FDA described a firm that invalidated a low assay result on a control sample as a “solution preparation error” without conclusive supporting evidence, even though its own Phase I investigation had rated the sample preparation satisfactory. The firm also discarded the initial OOS result with insufficient documentation and left it out of the final reported result.¹¹ In a separate finding in the same letter, the firm attributed a 12-month stability failure to “product behavior,” then retested with a revised method that gave different results. FDA’s response: “Attributing a failure to inherent drug product behaviors is not scientifically sound when a change in the test method yields a different outcome.”

The Same Root Cause, Again and Again

A November 12, 2025 letter to a contract testing lab described microbial OOS investigations that named a root cause of “unknown laboratory error” and concluded “contamination of an unknown source,” with retraining as the CAPA. FDA wrote: “You repeatedly accepted this conclusion and CAPA in at least five investigations without sufficient scientific justification to support your identified root cause.” The lab also relied on retest data before investigating the possible contamination source, and it did not check whether the CAPA worked.¹² FDA asked for a retrospective, independent review of all invalidated OOS results for US products over three years, plus remediation covering quality unit oversight and “Identification of adverse laboratory control trends.”

Fixing the Specification Instead of the Cause

A September 17, 2026 letter cited a manufacturer that failed to identify the root cause of a stability assay OOS at 24 months and a pH OOS at 36 months. As a CAPA for the pH failure, the firm widened the pH specification range without scientific justification. FDA said the investigations failed to find root cause, put in place appropriate CAPA, or extend to other batches and products, and it pointed the firm to the OOS guidance by its download link.¹³

The Scale of the Problem When It Goes Unwatched

Data integrity consultant R.D. McDowall, writing in LCGC, described a 2017 case in which the Form 483 observations showed that 97% of stability OOS results had been invalidated. He noted that this meant the company avoided field alerts that could have led to a recall.¹⁴ That figure comes from his reading of the 483, not from a general survey, but it shows why invalidation rate is the single most useful OOS metric a lab can watch.

Triggering the OOS Record From LIMS or CDS

The first digital control is the simplest and the most valuable: the system, not a person, opens the OOS record. On paper, the investigation often starts when an analyst decides a result is worth reporting. That gap is where results get “checked” informally before anyone writes anything down. When the LIMS or chromatography data system (CDS) compares each reportable result against the approved specification and opens a record automatically on failure, the start time, the original value, and the people involved are fixed from the first minute.

Where the Specification Check Should Happen

The check belongs wherever the reportable result is calculated. In many labs that is the CDS, which then sends the result to LIMS. In others, LIMS calculates from raw values. Either works, provided three conditions hold:

• One source of specification limits. The limits should come from LIMS master data under change control, tied to the product, test, method version, and stage (release, stability, in-process). If the CDS holds its own copy of limits, the two will drift.
• The check uses the reportable result as the method defines it. Revision 1’s caution on replicate injections means a system that flags any single replicate outside the limit will open OOS records the guidance says should not exist, when the method defines the average as the reportable result and variability criteria are met.¹ The opposite error matters more. A system that averages full sample preparations and flags only the average will miss cases FDA says should be treated as OOS.
• The check runs before the result can be released or reprocessed. Once a result is flagged, any later change to processing (integration, reprocessing, recalculation) should be tied to the open record.

What Is in Scope for an Automatic Trigger

FDA’s definition covers results outside specifications or acceptance criteria in applications, drug master files, compendia, or set by the manufacturer, and all in-process lab tests outside established specifications.¹ MHRA’s flowchart lists batch release and starting material testing, in-process tests whose data feed batch decisions or certificates, stability studies on marketed batches, reference batches that give suspect results during an investigation, and clinical trial batches. It excludes in-process tests used to reach a manufacturing end point, such as pH adjustment.⁷ Configure the trigger by test and stage so these distinctions are made once, by design, rather than case by case at the bench.

Holding Test Preparations

FDA asks that the first assessment happen before test preparations are discarded where possible, so hypotheses can be tested on the same material.¹ MHRA goes further and says all solutions and reagents should be kept until all data has been second-person verified, and for microbiology, all items related to the failure (plates, dilutions, media, temperature data) should be retained until the investigation is done.⁷ A digital workflow can help in a practical way: when the record opens, it notifies the analyst and supervisor and puts the sample, standard, and solution IDs on hold in the inventory or LIMS, so nobody disposes of them by routine.

What the Automatic Record Should Contain

When the trigger fires, the record should already hold what the supervisor needs, without anyone retyping it:

• Sample ID, batch, product, test, and stage
• Specification version and method version in effect at the time of the test
• The original reportable result and the individual values behind it
• Analyst identity, date and time of acquisition and calculation
• Instrument ID, column or consumable IDs where tracked, and links to the CDS sequence and result set
• Reference standard, reagent, and solution lot numbers from inventory
• For stability samples, the study, time point, and storage condition

Contract Labs and the Sponsor’s Quality Unit

For sponsors using contract labs, the trigger is only half the design. FDA says the contract lab should send data, findings, and supporting documents to the manufacturer’s quality unit, and it recommends that OOS investigation reports be provided to the customer. When a contract lab finds no assignable cause, all results should be reported on the certificate of analysis.¹ The quality agreement should state how fast the lab notifies the sponsor, in what format, and what evidence comes with the notice. For a product under an NDA or ANDA, a slow notice can eat most of the three-working-day field alert window before the sponsor even knows there is a problem.

Guided Phase I Checklists and Linked Evidence

Most Phase I time on paper goes to gathering evidence, not weighing it. The supervisor pulls the chromatograms, prints the audit trail, checks the instrument logbook, looks up standard lots, and confirms the analyst’s training. Each step means opening a different system. A guided checklist that pulls this evidence into the record does two things: it shortens the assessment, and it makes the record show what was checked instead of just asserting it.

Turning the Seven Steps Into Structured Fields

FDA’s seven supervisor steps translate directly into checklist items, and MHRA’s laboratory investigation checklist adds detail: correct method version, correct sample and sampling procedure, sample integrity and chain of custody, equipment calibration dates, logbook review, standards and controls performing as expected, system suitability before and during the run, glassware and volumetric checks, correct specification applied, reagent expiry, analyst training and an interview, raw data review, prior issues with the assay, other activity in the lab at the time, environmental conditions, other batches in the same analysis set, and method validation.⁷

The value of a digital checklist lies in how each item gets answered. A tick box that says “instrument calibrated: yes” adds nothing a paper form did not. A field that shows the instrument’s calibration status pulled from the asset system on the date of the test, with a link to the certificate, is evidence. The same applies to training: the system can display the analyst’s qualification on the method version used, from the training record, rather than relying on the supervisor’s memory.

Hypothesis First, Then Testing

MHRA is specific about sequence. In Phase Ib, the analyst and supervisor review data, equipment, and the analysis. Re-measurement starts only once a hypothesis plan is documented, and it is only to support the investigation. Initial hypothesis testing can use the original working solutions but should not include a new preparation from the original sample, because that is a retest.⁷ MHRA also says investigational testing may only confirm or discount a probable cause and may not replace the original result, and that a description of the testing should be written and approved by QA (or the contract giver) before investigational testing starts.

A workflow can enforce this order. The “hypothesis testing” step stays locked until a hypothesis is entered with the test that would prove or disprove it and the expected result. Results from that testing are labeled as investigational in LIMS, so they cannot flow into a reportable result by accident.

Making “No Assignable Cause” an Easy Answer to Give

Paper systems often push supervisors toward finding a lab cause, because a lab cause closes the record and releases the batch faster. A digital form should make “no assignable cause found” a normal, quick choice that hands the work to the quality unit with the evidence already attached. The record should also refuse an “assignable cause” conclusion without a linked piece of evidence: a specific chromatogram feature, a calibration failure, a logbook entry, a confirmed hypothesis test. That single rule would have stopped the invalidation FDA described in the March 2026 letter, where the firm’s own Phase I had rated the preparation satisfactory.¹¹

Linking Raw Data, Not Pasting Screenshots

FDA’s second supervisor step is to examine the raw data, including chromatograms and spectra. A screenshot pasted into an investigation form is a copy, and it shows only what the person choosing it wanted shown. A link to the CDS result set lets the reviewer open the actual injections, the processing method, and every version of the result. FDA’s data integrity guidance makes the stakes clear: “Invalidating test results to exclude them from quality unit decisions about conformance to a specification requires a valid, documented, scientifically sound justification.” Even when a result is legitimately invalidated, the full record given to the quality unit should include the original data along with the investigation report.¹⁰

Audit Trail Review Scoped to the Event

FDA’s data integrity guidance says that when a regulation sets a review frequency for the data, the audit trail review should follow it, and it gives 21 CFR 211.22’s data review before batch release as an example.¹⁰ For an OOS, that means the audit trail entries for the affected sequence and result should be reviewed as part of Phase I, not left for a later periodic review. A useful workflow filters the CDS audit trail to the sample set and time window of the event and shows the reviewer the entries that matter most: reprocessing, manual integration, changes to processing methods, aborted or deleted injections, and changes to sample or standard weights.

McDowall’s examples include firms that had no CDS audit trails or had turned them off.¹⁴ FDA’s third supervisor step asks specifically whether unauthorized or unvalidated changes were made to automated calculation methods.¹ Both point to the same design choice: the audit trail view in the OOS record should highlight changes to calculations and processing, not only changes to final values.

Retest and Resample Controls Built Into the Workflow

Retesting and resampling are where OOS investigations most often go wrong, and where configuration can do the most good. FDA’s guidance is direct about the failure mode. Inspections have found firms that repeat testing until they get a passing result and then disregard the OOS without justification. FDA writes: This practice of “testing into compliance” is unscientific and objectionable under CGMP.¹ FDA’s data integrity guidance adds that using actual samples in system suitability, test, prep, or equilibration runs to disguise testing into compliance is a violative practice.¹⁰

Retest Limits Set in the SOP and Locked in the System

FDA says the maximum number of retests should be specified in advance in a written SOP, based on sound science and the variability of the method. “The number of retests should not be adjusted depending on the results obtained.” The procedure should include a point at which testing ends and the batch is evaluated. Any departure from the SOP should be rare, recorded and justified, and preceded by a QU-approved protocol describing the extra testing and how the data will be handled.¹ MHRA adds that the number of retests should be statistically valid and notes that published papers have suggested 5, 7, or 9.⁷

In a digital workflow, the retest count is a configured value per method, set through change control. The system creates exactly that many retest tasks after the quality unit approves the Phase II plan, and it will not create more without a separate, approved protocol. Practitioner guidance in a 2026 column on OOS files makes a related point worth building in: the approved test plan should state in advance what the firm will do if the retests pass, not only if they fail.¹⁵

The Rules, Configured

Each card reflects specific text in the guidance. On retests, FDA notes that the predefined plan should often include retests by an analyst other than the original one, and MHRA adds that if an investigation finds analyst error, all analyses by that analyst using the same technique should be reviewed.^{1 7} On resampling, FDA says control of additional specimens must follow predetermined procedures and sampling strategies, and if the original sampling method was inherently inadequate, a new method must be developed, documented, and approved by the quality unit.¹

Why Averaging Controls Matter So Much

FDA’s averaging example is worth building into training and system tests. With a specification of 90 to 110 percent, an initial result of 89 followed by retests of 90 and 91 averages to 90. So does an initial result of 80 followed by 85 and 105. The averages are the same and both pass, but the first set tends to confirm the original OOS while the second shows variability so high the results may not be reliable. In both cases, FDA says, the individual results, not the average, should be used to judge the product.¹ A system that displays only an average hides exactly the information the quality unit needs. FDA also says the laboratory must provide all individual results for the quality unit’s review, which is the QU’s job under 21 CFR 211.22.

FDA’s statement on the default outcome is short and should appear on the Phase II screen: “If no laboratory or calculation errors are identified in the first test, there is no scientific basis for invalidating initial OOS results in favor of passing retest results.” All results, passing and suspect, should be reported and considered in the batch decision.¹

Borderline Results Inside Specification

The guidance also warns that a low assay result that is still within specification should raise concern, since batches must be formulated to provide not less than 100 percent of the labeled amount of active ingredient. A footnote adds that the firm should assess whether a low value may project to a subpotency failure before expiry.¹ This is not an OOS, and the system should not open an OOS record for it. It is a good candidate for an OOT or atypical-result flag, which brings us to trending.

Trending OOS and OOT Results

A single OOS investigation asks what happened to one result. Trending asks whether the lab, the method, or the process has a pattern. FDA tells laboratory management to be “especially alert to developing trends” and says upper management should monitor them and ensure problem areas are addressed.¹ The contract lab letter shows what happens when nobody does: FDA asked for remediation that included identifying adverse laboratory control trends.¹²

OOS Measures That Reveal Real Problems

Once every OOS record is structured, trending becomes a query rather than a project. The measures worth watching each month are:

• Invalidation rate. The share of OOS results invalidated as lab error, broken down by method, analyst, instrument, product, and site. Because FDA says lab error should be relatively rare, a high or rising invalidation rate is a warning in itself, whatever the individual records say.
• Repeat root causes. How often the same assigned cause (for example, “analyst error” or “unknown laboratory error”) appears for the same method. The contract lab letter cited at least five investigations with the same conclusion.¹²
• Obvious-error codes. MHRA expects Phase Ia errors to be trended even when no formal investigation was raised.⁷ A cluster of “wrong wavelength” or “calculation error” codes on one method suggests a method, template, or training problem.
• Inconclusive investigations. How often investigations end with no cause and no confirmation, and what disposition followed. Each one is a batch released despite an OOS that was never explained, which deserves quality unit attention as a group.
• CAPA recurrence. Whether OOS results recur after a CAPA closes on the same method. Both the March 2026 and November 2025 letters faulted CAPAs that did not stop recurrence or were never checked for effect.^{11 12}

Cycle time belongs on the list too, but with care. A lab measured mainly on how fast OOS records close will close them faster, often by finding a lab cause. Speed should be read alongside invalidation rate, never in place of it.

OOT Results: Catching Problems Before They Are Failures

FDA’s guidance does not define how to identify out-of-trend results, though a footnote says much of it may be useful for examining them.¹ The most widely used framework comes from the PhRMA CMC Statistics and Stability Expert Teams, published in Pharmaceutical Technology in 2003 and 2005. The 2005 paper reports that a workshop with FDA and industry participants concluded OOT work should focus on annual, routine production stability studies rather than primary NDA batches, because historical data is needed to set alert limits. Participants also wanted a simple approach that allows real-time detection at the bench, so investigation can start promptly.¹⁶

The paper sorts OOT stability alerts into three levels. In its words: “As the alert level increases from analytical to process control to compliance alert, the depth of investigation should increase.”¹⁶ MHRA’s flowchart uses the same three categories.⁷

MHRA adds two practical points for stability: when an abnormal result predicts an OOS before the next time point, schedule additional testing before that time point, and link the stability OOS process to recall procedures.⁷

Choosing a Detection Method

A 2025 article in ISPE’s Pharmaceutical Engineering notes that FDA’s guidance does not set out how to identify OOT results in stability data. It reviews simple rules that many labs still use (for example, a result more than 5% from the initial value) and observes that these lack a statistical basis.¹⁷ It then describes the three methods the PhRMA teams outlined: the regression control chart, which works within a batch and across batches; the by-time-point method, using tolerance intervals from historical batches at each time point; and the slope control chart, which compares each batch’s slope with historical slopes. ECA’s Analytical Quality Control Working Group has also published a laboratory data management guidance on out-of-expectation and OOT results of more than 70 pages, covering control charts, statistical process control for continuous and discrete data, and trend limits for stability testing.¹⁸

The method matters less than three design choices. The limits should be set from enough historical data and fixed under change control, so nobody adjusts them after seeing a result. The check should run when the result is entered, while preparations still exist, not at the annual product review. And OOT alerts should open a lighter-weight record than an OOS, with its own route, so the lab does not learn to ignore them.

From Trend to Action

Trend reports only help if someone with authority reads them and acts. Set a monthly review where the quality unit and lab management go through invalidation rates, repeat causes, and open OOT alerts, and record the decisions as part of management review. EU GMP paragraph 6.16 asks that results for quality attributes or critical parameters be trended and checked for consistency, so this review is part of meeting existing GMP expectations, not an extra.⁹

Where AI Drafting Can Help, With People Still Accountable

Generative AI is now being offered for almost every part of quality documentation, and OOS investigations are an obvious target. This section stays on the OOS lab process. The question is narrower than drafting a full deviation report: which parts of a Phase I or Phase II OOS record can a language model help prepare, and which parts must a named person decide?

Where It Can Help

Once the workflow above is in place, the evidence is already structured and linked. That makes some drafting and checking tasks reasonable to support with AI, under review:

• Summarizing the evidence package. Turning the linked instrument status, standard lots, analyst qualification, and same-sequence results into a short factual summary for the supervisor, with every statement linked back to its source record.
• Summarizing the filtered audit trail. Listing reprocessing, integration changes, and aborted injections in plain language for the reviewer, who still opens the underlying entries.
• Completeness checks. Flagging checklist items answered without linked evidence, hypotheses recorded after testing began, or a specification version in the record that differs from the one LIMS used.
• History search. Finding earlier OOS records for the same method, product, or instrument, which supports the Phase II requirement to review whether the problem has occurred before.¹
• Drafting the factual narrative. Writing up what was done, in order, from structured fields the investigator already completed.

What Stays With People

Some decisions in an OOS investigation carry the whole weight of the record, and none of them should come from a model’s output:

• Whether a result is invalid, and what evidence supports that
• The hypothesis to test and what result would confirm or reject it
• The assigned root cause, or the conclusion that no cause was found
• The Phase II plan, including retest count and whether to resample
• Batch disposition and impact on distributed batches
• Whether a field alert report is required

The reason is not that AI is always wrong. It is that a fluent draft that proposes “probable analyst error” gives the investigator a conclusion to agree with before the evidence has been weighed. That is the exact pattern every warning letter in this article describes. FDA’s demand that supervisors start with “no preconceived assumptions” applies to suggestions from software as much as to suggestions from colleagues.¹

What Regulators Have Said

The EU’s draft Annex 22 on artificial intelligence, released for consultation and not yet final, says it does not apply to generative AI and large language models, and that “such models should not be used in critical GMP applications.” In non-critical applications without direct impact on patient safety, product quality, or data integrity, qualified and trained personnel should always be responsible for ensuring outputs are suitable, which the draft calls human-in-the-loop.²⁰ An OOS decision has a direct impact on product quality and data integrity. The careful reading is that an LLM may help assemble and summarize evidence that a qualified person then verifies, but it should not produce or rank the conclusions. Because the text is still a draft, each company should document its own position on where that line falls in its quality system.

MHRA’s Inspectorate published its current thinking in June 2026 on AI-drafted inspection responses. The post is about responses to inspection findings, not OOS records, but its principles carry over. MHRA said it had received responses citing guidance that does not exist, and in one case the review of an AI-generated response grew from around 4 hours to over 20 hours. The post states that firms have always been responsible for the accuracy of what they submit: “These responsibilities do not change because drafting tools have.” Its stated concern “isn’t whether you use AI; it’s whether your submissions are accurate, verifiable, and prepared under appropriate oversight.”¹⁹ MHRA also wrote that AI tools may support elements of CAPA work but cannot substitute for the technical understanding and site knowledge needed to develop meaningful corrective actions.

Controls That Make AI Use Defensible

If a company does add AI assistance to its OOS workflow, a few controls keep it on the right side of the line:

• Limit the model’s input to the linked records for that investigation, so its summaries can be checked against a known source.
• Keep AI output out of fields that hold decisions. The root cause, invalidation, and disposition fields accept only entries typed and signed by the responsible person.
• Record which sections had AI assistance, the tool and version, and who verified the output, in the same audit trail as the rest of the record.
• Sample AI-assisted records in periodic quality review and check summaries against source records, the same way a lab checks any calculation tool.
• Trend invalidation rates before and after the tool goes live. If invalidations rise, find out why before expanding use.

Conclusion

FDA’s OOS guidance has kept the same structure for two decades, and the 2022 revision only sharpened it: test the lab first, escalate to a full investigation when no clear lab error is found, and never let averaging, outlier tests, or extra retests stand in for a cause. The firms in recent warning letters did not lack procedures. Their records let conclusions arrive before evidence. A digital OOS investigation workflow shortens lab review by removing the hours spent hunting for data and rebuilding timelines, while making the shortcuts inspectors cite harder to take: the record opens itself, evidence is linked rather than described, retest limits come from the SOP, every individual result stays visible, and invalidation trends are visible to the people accountable for them. AI can help assemble and check that record. It should not write the conclusions.

Sakara Digital works with pharma and biotech quality and lab teams on exactly this kind of work: mapping the OOS process to LIMS and CDS configuration, setting up trending that management will use, and deciding where AI assistance fits under GMP. If you are rethinking how your lab handles OOS and OOT results and want an independent perspective on where to start, we are happy to have that conversation.

For Further Reading