Your validation binder.
Pre-built.
AI Lab Services ships with a complete Vendor Validation Package — RTM, a 16-case OQ protocol, IQ/OQ/PQ templates, and the 21 CFR Part 11 documentation behind them. Download it from the Compliance module, execute and sign the protocols, and hand the completed binder to your auditor.
What's in the Vendor Validation Package
Generated on demand from your Compliance module. Every document reflects the current system version with live test evidence — not a static PDF written three years ago.
Requirements Traceability Matrix (RTM)
Every 21 CFR Part 11 requirement mapped to the specific system control that satisfies it — with the test case that verifies it.
16-Case OQ Protocol
An Operational Qualification protocol your quality function executes and signs, covering authentication, audit trail integrity, e-signatures, COA integrity, and access control. Each case ships with its procedure, acceptance criteria, and blank result, tester, and date fields — the evidence is what your team records when they run it.
IQ / OQ / PQ Templates
Pre-structured Installation, Operational, and Performance Qualification protocols. Fill in your site-specific data and sign.
§11.100(c) E-Signature Controls
AILS provides the electronic-signature controls and documentation you need to support your own §11.100(c) certification. The certification to FDA is made by your organisation — the package documents how the system implements signature manifestation, binding, and non-repudiation so you can make it.
GAMP 5 Category 4 Classification
AILS is designed as a GAMP 5 Category 4 configured product; validation is performed by you using the provided IQ/OQ/PQ package. The classification document states the basis for that categorisation and what it means for the depth of testing you are expected to perform.
System Description & Intended Use
Scope statement, out-of-scope uses, intended user roles, and the regulatory context for which the system is intended — required for your PQ and IND/NDA packages.
Generated on demand · Always current
The VVP is not a static document. It is generated from live system state — test run ID, executed date, current version — so it never goes stale between your validation cycles.
21 CFR Part 11 — Clause by Clause
Every clause maps to a specific system control — not a policy you hope the software respects. These are the controls your validation evidences; the validation itself is yours to execute.
AILS is designed as a GAMP 5 Category 4 configured product; validation is performed by you using the provided IQ/OQ/PQ package. The VVP is generated on demand and reflects the current system version, so the protocol you execute matches the software you are running.
Every COA, CAPA, deviation, and audit log is exportable as PDF with a SHA-256 integrity hash verifiable independently.
Every query is scoped to the tenant ID, checked by an isolation test suite on every release. Connection strings, tokens, API keys and two-factor secrets are encrypted at the application level; data in transit uses TLS. Tenants that need their data held separately get a dedicated database through bring-your-own database or EU hosting.
Role-based access control with module-level gating. Training currency enforced — expired training blocks the five signing and issuing actions.
5-year tamper-evident, hash-chained audit trail on every action — user, IP, timestamp, resource. Tamper-evident, append-only, verified in every system test run.
Re-authentication required before every critical signature — COA issue, SOP sign-off, COC acceptance. Session state alone is not sufficient.
Incident Response Policy, Periodic System Validation Review Schedule, and Intended Use Statement available for download from the Compliance module.
The controls and documentation supporting your own §11.100(c) certification to FDA — signature manifestation, record binding, and non-repudiation — included in the VVP.
1232 tests, run before every release.
Results published in the platform.
The System Test Agent runs 1232 end-to-end tests across 102 suites — covering authentication, audit trail integrity, COA integrity, 2FA, e-signatures, and negative-path security checks. It is triggered before every release and on demand from Platform Admin, and every run produces a timestamped report with pass/fail/warn per test case. This is vendor regression evidence you can cite in your periodic review — it does not replace the OQ you execute in your own environment.
- COA SHA-256 hash re-verified on every test run
- Audit trail append-only enforcement probed automatically
- 2FA flows, token expiry, and account lockout exercised each run
- CLIA, SQF, and Pharma/GMP vertical compliance flows included
- Run ID, tenant ID, duration, and health score in every report
Latest system test
Health score · October 1, 2026
1232
Tests passed
0
Failures
102
Suites
Full report available in Platform Admin → System Tests
Platform Reference
What's Actually Built
Live figures — source of truth: platformStats.js · last full run October 1, 2026
AI-NATIVE. · COMPLIANT BY DESIGN. · BUILT FOR TRUST.
Written Policies — §11.10(k)
21 CFR Part 11 requires written policies governing the use of electronic signatures and electronic records. These are available for download directly from the Compliance module.
Incident Response Policy
Detection, containment, investigation, tenant notification, and recovery procedures for security and data integrity incidents.
Periodic System Validation Review Schedule
Annual and trigger-based revalidation schedule covering access controls, audit trail, e-signatures, and change control per §11.10(a).
Intended Use Statement
System scope, GAMP 5 Category 4 classification, intended users, out-of-scope uses, and the electronic-signature controls supporting your §11.100(c) certification.
Ready to hand your auditor
a complete validation binder?
The VVP is generated on-demand from your Compliance module. Book a demo and we'll walk through the full documentation package with you.
Also see: Security Architecture · Platform Overview · Pricing