AI saves time, but it does not replace responsibility
For us, AI is a tool that significantly reduces the workload for users in their work within the quality management system (QMS), without compromising regulatory responsibility or expert oversight. Every AI feature in engamp® makes a specific task faster, easier, or safer for users. Functions that fail to do so have no place in a regulated system.
This approach is in line with our principle of “evolution rather than revolution.” A QMS is not a testing ground. It is the system in which approvals are documented, changes are tracked, and responsibilities are defined. It is precisely this structure that makes an eQMS audit-ready, and it is precisely this structure that must not be compromised by AI.
“AI-supported - always compliant”: what’s behind the motto
Our guiding principle for the use of AI in engamp® is “AI-supported – always compliant.” It describes two requirements we have for our own product.
AI-supported: Every feature in engamp® is useful on its own and fully functional. AI makes them faster and easier to use, but it’s never a requirement. No regulated process step in engamp® requires the use of an AI function.
Always compliant: Each AI function is designed so that the QMS remains in a state of compliance at all times. Approvals, audit trails, and responsibilities remain unchanged.
It is important to us to draw a clear distinction here: ‘Compliant’ is a design requirement for our product, not a promise to you as a customer. You remain responsible for ensuring the compliance of your processes. engamp® is designed so that it never gets in the way.
Our principles for AI features in engamp®
Based on this guiding principle, we have derived seven principles against which we evaluate every planned AI feature:
- Human-in-the-loop: The AI makes suggestions; humans make the decisions. No AI result takes effect without being verified.
- Full traceability It is always clear what the AI has done and what an output is based on.
- Controlled usage: AI features are used specifically where they have been shown to add value, not across the board simply for their own sake.
- Transparency: Users know at all times when they are interacting with AI-powered features.
- User control: Users decide whether and when to use an AI feature.
- Integration into existing processes: AI integrates into familiar workflows without causing any disruption.
- AI is a tool, not a prerequisite: Every feature in engamp® can be used fully and effectively even without AI.
Today, we evaluate every planned AI feature against these principles.
“AI-supported” does not mean “AI-controlled”
The following figure illustrates how AI support and professional responsibility complement each other: The AI generates a suggestion; the technical evaluation and approval are left to human judgment, and only then does the result take effect in the QMS and get documented in the audit trail.
The regulatory framework: Annex 22, the EU AI Act, and a First Warning Letter
The regulatory framework for AI in GxP environments is evolving. The authorities have recognized the change, but solid answers are still in the works.
International regulatory requirements and guidelines
Three sets of regulations currently govern the requirements for using AI in a regulated environment:
- EU GMP Guidelines, Annex 22 “Artificial Intelligence” (Draft): On July 7, 2025, the European Commission, in collaboration with the EMA’s GMDP Inspectors Working Group, published for the first time a separate annex on AI for public comment, along with the revised version of Annex 11, “Computerised Systems,” and Chapter 4, “Documentation.” Annex 22 describes how AI models must be validated, monitored, documented, and managed on a risk-based basis when they affect product quality, patient safety, or data integrity. The consultation period ended on October 7, 2025, and yielded approximately 1,300 comments. A final version is expected by the end of 2026.
- ISPE GAMP® Guide: Artificial Intelligence (July 2025): The guide consistently applies quality risk management and the ALCOA+ principles to AI-powered computer-based systems. This applies not only to the output, but to the entire data chain: Raw data, training data, model parameters, prompts, and results. In practical terms, this means keeping a clear record of who or what generated an AI output and on what data set, and retaining this documentation even as the model evolves.
- EU AI Act, Regulation (EU) 2024/1689: Effective since August 1, 2024. The bans on certain practices have been in effect since February 2, 2025, and the transparency requirements for general-purpose AI (GPAI) models have been in effect since August 2, 2025. For high-risk systems as defined in Annex III, the effective date under the Digital Omnibus Agreement of May 7, 2026, has been postponed to December 2, 2027, and for systems embedded in regulated products as defined in Annex I, to August 2, 2028.
In practice, this means: The specific requirements have not yet been finalised, but the general direction is clear. Validation, risk assessment, data integrity, and verifiable human oversight are required.
Why companies are already failing today
Just because the regulations are still evolving doesn’t mean there are no consequences. In April 2026, the FDA issued its first warning letter focusing on the inappropriate use of AI in cGMP processes. The letter was addressed to Purolea Cosmetics Lab in Livonia, Michigan (Warning Letter No. 722591, dated April 2, 2026).
The points raised in the complaint read like a checklist of things that must not happen in a regulated environment:
- Unverified AI-generated content: The company had AI agents generate product specifications, procedure manuals, and master production records.
- Lack of human approval: The Quality Unit had not verified these documents for accuracy and cGMP compliance. In this regard, the FDA cited 21 CFR 211.22(c) and 21 CFR 211.100.
- Overreliance on AI results: When it was pointed out that a required process validation was missing, the company stated that the AI agent had not mentioned this requirement.
In this context, the FDA states that an AI agent’s outputs and recommendations must be reviewed and approved by an authorised representative of the Quality Unit, and that responsibility for cGMP compliance cannot be delegated to an AI tool. The “human-in-the-loop” approach is explicitly identified there as the expected standard for GxP functions that affect product quality or patient safety.
Our principles – in particular, “human-in-the-loop” and full traceability – are a direct response to precisely these risks. That is the goal of “always compliant”: Because AI results in engamp® never take effect without being verified, and every regulated process step can be fully executed even without AI, you remain able to act even if regulatory requirements become more stringent.
Data processing: What content reaches the AI and what doesn't
In regulated industries, confidentiality is a prerequisite for the use of technology. Therefore, three requirements apply to data processing:
- No training with customer data: Customer data is not used to train models. That is guaranteed by contract.
- No background data: Only content that users consciously select is passed on to the AI. We do not include background data from the system.
- Your account, your contract: Access to the language model is granted via a key that you provide yourself. This means that the contractual relationship with the model provider is with you. OpenAI is currently supported.
engamp® | intelligence as a cross-functional extension
Unlike the other modules, engamp® | intelligence is a cross-functional extension. Once purchased, it unlocks the AI features in all engamp® products that you use.
Customers who do not use engamp® | intelligence still have access to the full range of engamp® features; they simply do not benefit from the acceleration of individual workflow steps.
Use cases: Where AI provides support in everyday work
We prioritise use cases that provide users with significant added value in their day-to-day work. Here are a few examples:
- Document summary: Extensive documents are condensed to their key points before users proceed to a detailed review.
- Document chat: Questions about one or more documents are answered directly within the context of the documents, rather than having to manually search for the relevant passage.
- Smart questionnaires: Support for creating questionnaires, such as in training management.
- Automatic history of changes: An automatically generated, easy-to-understand description of the changes in content between two versions of a document.
The same pattern applies in all four cases: The AI provides a suggestion; the expert evaluation and approval remain the responsibility of the person in charge.
Conclusion: AI is changing the way work is done in the QMS, not the responsibilities
AI will change the way work is done in the QMS, but it will not shift responsibility. The first FDA warning letter regarding the use of AI, issued in April 2026, and the parallel work on Annex 11 and Annex 22 reflect the same expectation from two different perspectives: Traceability and human approval are non-negotiable.
That is exactly why we design AI features in engamp® to ensure they remain secure, efficient, and transparent. You’ll save time on routine tasks, while approvals, audit trails, and responsibilities remain exactly where they belong. As regulatory requirements become more specific – which is expected to happen by the end of 2026 – this architecture will ensure that you are not forced to redesign your processes.
This is how we understand “AI-supported – always compliant”: AI accelerates and simplifies work steps in engamp® when desired, but its use is not mandatory.
Would you like to learn which AI features actually make a difference in your quality processes and how engamp® | intelligence integrates into your existing system landscape? Then please feel free to contact us via our contact form.
Frequently asked questions (FAQs)
- What does “AI-supported – always compliant” mean?
“AI-supported” means that every feature in engamp® is fully functional even without AI, and that AI merely speeds up and simplifies the user experience. “Always compliant” means that the QMS remains in a state of compliance at all times: Approvals, audit trails, and responsibilities remain unchanged.
- Does the AI in engamp® handle approvals or evaluations?
No. The “human-in-the-loop” principle applies throughout: The AI makes suggestions; humans make the decisions. No AI result takes effect without being verified. In its warning letter dated April 2, 2026, the FDA also states that it expects review and approval by an authorised representative of the Quality Unit.
- Who is responsible for ensuring that our processes comply with regulations?
You remain responsible for ensuring that your processes comply with regulations. “Compliant” is a design standard for our product: engamp® is designed so that it never interferes with your compliance. According to the FDA, responsibility for cGMP compliance cannot be delegated to an AI tool.
- How can users tell that they are using an AI feature?
Transparency is one of our principles: Users know at all times when they are interacting with an AI-powered feature. This is complemented by user autonomy. Users themselves – not the system – decide whether and when to use an AI feature.
- Are our documents used to train AI models?
No. Customer data is not used to train models, and this is guaranteed by contract. Only content that users consciously select is passed on to the AI. We do not include background data from the system. Access to the language model is granted via a key that you provide yourself; the contractual relationship with the model provider is therefore yours.
- What does the proposed Annex 22 to the EU GMP Guidelines cover?
Annex 22, “Artificial Intelligence”, describes for the first time how AI models must be validated, monitored, documented, and managed on a risk-based basis when they affect product quality, patient safety, or data integrity. The draft was published for public comment on July 7, 2025; the final version is expected by the end of 2026.
- How does the EU AI Act affect the use of AI in QMS?
The EU AI Act has been in effect since August 1, 2024. There are two key requirements for use in the QMS: Users must be able to recognise when they are working with an AI feature, and the results must be subject to human oversight. Both are set up in engamp®. Whether your specific application is considered a high-risk application depends on your process and is part of your own assessment. The bans will take effect in February 2025, and the GPAI transparency requirements will take effect in August 2025; the requirements for high-risk systems under Annex III take effect on December 2, 2027, and for embedded systems under Annex I on August 2, 2028.
- Do we need engamp® | intelligence to use engamp® effectively?
No. engamp® | intelligence is an optional cross-sectional extension. Customers who do not use intelligence still have access to the full range of engamp® features and simply forgo the acceleration of individual steps. If the add-on is purchased, it unlocks AI features in all engamp® products in use.
- What AI features are already available today?
Document summary and document chat have been implemented as prototypes. The concept includes the smart creation of questionnaires as well as an automatically generated change history between document versions.
- Can we use engamp® even if AI isn’t approved in our company?
Yes. Because no regulated process step in engamp® requires an AI function, the full range of features remains available even without engamp® | intelligence. Companies whose internal policies currently restrict the use of AI can use engamp® without any restrictions and can add the extension later.
