--- title: "The Six Questions an Inspector Will Ask About Your AI" description: "Is your AI use inspection-ready? Explore six questions GMP inspectors may ask about AI governance, human oversight, model changes and validation." url: https://qbdgroup.com/en/blog/six-gmp-inspection-questions-ai-governance type: "Blog post" language: en published: 2026-10-14 author: "Elias Muys & Jan Appelmans" category: "Software Solutions & Services" publisher: "QbD Group" citation: "QbD Group, \"The Six Questions an Inspector Will Ask About Your AI\", https://qbdgroup.com/en/blog/six-gmp-inspection-questions-ai-governance" --- # The Six Questions an Inspector Will Ask About Your AI > Is your AI use inspection-ready? Explore six questions GMP inspectors may ask about AI governance, human oversight, model changes and validation. Inspectors do not need to be AI experts to probe how your organisation uses artificial intelligence. They only need to ask the right questions. In a GMP environment, the central issue is not whether an AI tool sounds impressive. It is whether the organisation understands **where it is used, what it can affect, who remains accountable and how its performance is controlled**. Here are six questions worth preparing for before an inspector asks them.

In This Blog Post:

## 1. What AI Tools Are in Use at This Site? It sounds like an inventory question, but the answer needs to go beyond a list of software licences. A single LLM might be used to summarise supplier emails, draft training material and assist with deviation documentation. Those are different uses, with different risks. **List the jobs, not just the tools.** Identify the purpose, users, information involved and any GMP-relevant outputs for each use case. An inventory that only names vendors may miss the activities that matter most. ## 2. Which of These Touch Product Quality or Release? Not every AI-assisted task has the same potential impact. Summarising a routine administrative email is different from supporting a deviation assessment that could influence a batch disposition decision. The inspector may want to see how the organisation distinguishes these activities and decides which controls are proportionate. A useful assessment considers the **intended use, potential consequences of an incorrect output and the point at which a qualified person makes the decision**. Simply labelling an application "AI-assisted" does not resolve those questions. ## 3. Who Reviewed This AI Output, and What Qualifies Them? "A human reviewed it" is not a complete answer. Meaningful oversight depends on the reviewer being able to recognise errors, challenge conclusions and check the output against appropriate source material. For GMP-relevant uses, organisations should be able to explain **who reviewed the output, what competence they had, which information they checked and where the review was recorded**. The objective is not to create paperwork for its own sake. It is to make the review process demonstrable and testable. ## 4. Show Me a Case Where a Reviewer Rejected an Output This is the question most likely to catch teams out. If an organisation has never rejected an AI-generated output, there are at least two possible explanations: the model has always been correct, or reviewers have not been sufficiently critical. **An inspector is unlikely to assume the first.** For example, imagine an AI-generated deviation summary that omits a relevant batch record entry. A qualified reviewer identifies the omission, rejects the draft and records the correction before the assessment continues. A documented rejection can demonstrate that the control is functioning. This does not mean teams should manufacture rejections or aim for an arbitrary rejection rate. It means they should be able to show **how errors are detected, handled and learned from when they occur**. ## 5. How Would You Know If the Model Changed? Cloud-based AI services can change through model updates, configuration adjustments, system prompts or provider-side routing. The interface may look the same even when the behaviour changes. That raises a practical question: how would your organisation detect a relevant change and decide whether the original assessment remains valid? The answer may involve vendor notifications, documented configurations, performance checks, change assessment and a named owner for ongoing monitoring. **A metric nobody owns is just telemetry.** Monitoring needs responsibility, thresholds and a defined response when something changes. ## 6. What Was Your Baseline for Comparison? To claim that AI improves a GMP process, you need to know what you are comparing it with. Was the baseline an existing manual workflow, an approved rule-based system or a defined set of representative cases? What was measured: accuracy, completeness, consistency, review time or another relevant outcome? Without a baseline, performance claims become difficult to interpret, and changes over time are harder to recognise. The comparison should reflect the **actual intended use and associated risks**, rather than an impressive but unrelated benchmark. ## How to Be Ready: Six Practical Controls The author's recommendations are deliberately practical. Together, they provide a starting point for turning AI use into something an organisation can explain and defend.
## AI Governance Starts With Data Quality Even a well-controlled model cannot compensate reliably for poor source information. **Garbage in means garbage out.** Before pointing AI at a collection of GMP records, organisations should consider whether the information is sufficiently accurate, complete, structured and labelled for the intended task. Clean inputs, clear provenance and controlled access make it easier to verify the resulting outputs. They also help reviewers understand what the model did and did not have available. ## The Choice Is Governed AI or Ungoverned AI The six questions are not an argument against using AI in GMP. They are a reminder that AI use must be visible, risk-assessed and supported by evidence. A tool inventory, an intended-use assessment, qualified human review, documented performance criteria and ongoing change monitoring are not separate administrative exercises. Together, they make AI use explainable and controllable. **The choice was never AI or no AI. It is governed, or ungoverned.** ## Make Your AI Use Inspection-Ready QbD Group helps life sciences organisations evaluate AI use within GMP environments, bringing together expertise in quality management, computerised system validation, data integrity and risk-based governance. --- Source: https://qbdgroup.com/en/blog/six-gmp-inspection-questions-ai-governance — © QbD Group. Quote freely with attribution and a link back.