Industries / Life sciences
AI answers your quality unit can defend.
You work under FDA oversight. Every answer your AI gives traces to a controlled document, the person who approved it, and a date.
The problem
Which version is in force?
“Adopting AI only helps if it makes execution more consistent, not more chaotic.”
Before an AI system goes live, your quality unit, regulatory affairs, and the review committee each ask whether the right people signed off first.
Procedures live in several places and disagree. A site follows a superseded version because the update never reached it.
An assistant reading uncontrolled content answers from a draft procedure on a shared drive, labeling that was replaced, and a medical information response retired two revisions ago.
Nobody signed off on those answers, and no record says what was served to whom. That is a records problem, and your teams already know what one costs in an inspection.
Why this industry
The properties you already expect.
Your teams already hold electronic records to a standard: attributable, legible, recorded as things happen, original, and accurate.
Those properties have mostly skipped the working knowledge an assistant now serves. This applies them to it, across the document classes your quality system already controls: procedures, labeling, medical information, deviations, and clinical study documents.
Every entry names who approved it and when, keeps each superseded version rather than overwriting it, and records the controlled document it came from.
- Attributable. Every action is tied to an identified person, not to an account somebody shares.
- Recorded as things happen. The history is written as events occur, rather than assembled afterwards.
- Original. Superseded versions are retained, so what an entry said on a date in March is a lookup.
- Accurate. The loop updates, merges, and reconciles entries continuously, rather than letting the library decay between audits.
What we will not claim
This does not make you compliant with 21 CFR Part 11 or GxP requirements, and no software could. Those duties attach to your records, your processes, and your quality system.
What you get is evidence toward them: numbered entries, approvals attached to named people, and a change history for the knowledge your AI answers from. Your quality unit decides how that evidence fits your position.
What it does here
Five things that need approving.
The knowledge an AI system serves here is drawn from document classes that already require controlled review. An answer taken from them inherits that requirement.
Labeling
Language that was negotiated
An answer that repeats replaced labeling contradicts the approved label, confidently and with no warning. The entry carries the current text.
Procedures
A version, with a date
A procedure in force is one revision with one effective date. An answer built on the previous one tells someone to do the wrong thing correctly.
Medical information
Reviewed responses only
Each response to an unsolicited request is reviewed language. Serving a draft through an AI channel undoes the review that made it usable.
Deviations
As recorded, not remembered
How a deviation was classified, investigated, and closed is knowledge other studies need. It is served the way it was written down.
Clinical
The protocol in force
A protocol and its amendments are controlled documents, and a study question answered from a superseded amendment is answered wrong. The entry names the amendment it came from.
Returned word for word
“These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease.”
D-102 · v4
- PDP template Unchanged
- Support macro Unchanged
- AI assistant Refused
What was refused
Asked to send “isn’t meant to” in place of “is not intended to”. Rewording approved text is refused, not corrected.
Verbatim enforcement
Labeling text, returned as written
Approved labeling is approved as written. A summary of it is a new claim, and a new claim is a regulatory event. A language model rephrases by default, so this is designed against rather than policed.
That text is marked as fixed. Cognatum returns it word for word from the current approved revision, in full, or not at all. An assistant drawing on it quotes rather than restates.
Self-flagging staleness
When a controlled document is superseded
A new revision does not only change that document. It changes every answer taken from it, and those sit with teams who will not hear about the revision.
Cognatum knows which entries came from which sources. Change the source and every dependent entry is flagged for re-check, not just the one somebody remembered. Until a person signs off, the approved version stays live with its date visible, so nothing switches quietly during an inspection.
Frameworks
What each framework asks.
Written as pairs, because a list of framework names is one screenshot away from reading as a claim to hold them.
| Instrument | What it asks of you | What we supply toward it |
|---|---|---|
| 21 CFR Part 11 | That electronic records and signatures are attributable, legible, contemporaneous, original, and accurate. | Approvals are recorded with the approver, the timestamp, and the source version, and the record is kept rather than overwritten. |
| The Food, Drug, and Cosmetic Act | That claims about a product match what has been reviewed and authorised. | Regulated wording is returned word for word rather than paraphrased, so an approved claim cannot drift in the retelling. |
| European Medicines Agency requirements | That documentation submitted and relied on is controlled and current. | Change a source and every entry depending on it is flagged and routed for re-check, so a superseded version stops being served. |
| ISO 13485 | For medical devices, that documents are controlled and that changes are reviewed and approved. | Version history and approval sit on the entry itself, not in a separate spreadsheet that has to be reconciled. |
| GMP, GCP, and GxP | That the practice you followed can be evidenced after the fact. | The evidence is produced as the work happens rather than assembled before an inspection. |
This table describes obligations that fall on your organization, and the evidence Cognatum produces toward them. It is not a claim of certification or conformity, ours or yours.
Why not search
Your document system governs documents.
You already run a document management system and it is doing its job. The gap sits one level below it.
AI systems do not serve documents. They serve answers pulled out of documents, and that is where control is lost today.
This governs at the level the AI answers. An entry is numbered, approved, and records the controlled document behind it.
Move that document to a new revision and every entry built on it is flagged for review, instead of quietly going out of date.
Cognatum governs the entry
source · version · approver · permissions
In practice
Which procedure is in force?
One regulated exception, and a team two time zones from the people who changed it.
A regional operations team needs the current procedure for a regulated exception process, and the last update never reached their site.
They ask, and the answer comes from the revision in force, with its effective date and the person who approved it attached, and the passages that must not be reworded returned as written.
Where two approved sources disagree, neither is served as approved. Both go to a named person to settle.
Before the audit, your quality unit reads the usage and conflict reports rather than assembling evidence from scratch.
Common questions
What quality teams ask first.
Does this make us compliant with 21 CFR Part 11?
No, and no software can. Part 11 attaches to your records, signatures, and procedures, and an inspector assesses how you operate rather than what you bought. What you get is evidence toward your duties: numbered entries, approvals attributed to identified people, and a change history.
How does the history work for a knowledge entry?
Every entry is an electronic record with a full history: who created it, who changed it, who approved it, when each event happened, and which version was live at any time. Superseded versions are kept rather than overwritten.
Our controlled documents already live in a document management system. Why another store?
That system governs the document. AI does not serve documents, it serves answers taken out of them, and that extraction is where control is lost. This governs the answer, and records the controlled document behind it.
What happens when the review committee changes approved language?
The old entry is archived with its history intact, and the newly approved language becomes the live entry with its own approval record. Every channel serves the new language from the same moment, because they all read one entry rather than copies.
What does inspection readiness look like for an AI answer?
An inspector asks what they ask of any record: where did this come from, who approved it, and was it current at the time. Each answer traces to an entry, and the entry carries the approver, the date, and the controlled document behind it. Producing that trail is a query.
Can medical information responses be served through AI without losing control?
That is the design case. The approved response is the entry. It is permissioned, versioned, and served over the same controlled interface as every other entry, so an assistant answering a request draws only on approved language, never on a draft.
Knowledge governed. Intelligence everywhere.
See it on your own content, in your own environment.