Beyond the QMS: Unlocking GMP Intelligence Through a Unified Evidence and Knowledge Layer

The quality decision rarely lives in one system.

A batch is waiting for release.

The deviation record is in the electronic QMS (eQMS) system for deviation management. The executed batch record may be electronic, hybrid, or a scanned PDF with handwritten entries. Lab results are in LIMS. Process parameters may sit in MES or historian data. Material usage is in ERP. The supplier CoA may be attached there, stored in a supplier portal or document system, or received as a PDF by email or file transfer. Equipment cleaning and calibration records sit in another system. Environmental monitoring data may be managed separately. A similar issue occurred three years ago, but under a different deviation code, in a different product family, or at a different site.

Each system may be working as designed.

The problem is that the evidence needed to make the right GMP quality decision is not contained in any one of them alone.

The QMS knows that a quality event occurred. The eQMS system for deviations may manage the deviation workflow, CAPA, approval routing, and formal record.

But the full manufacturing evidence needed to understand what happened, assess risk, confirm compliance, and support batch release often lives across many systems, records, documents, partners, and human knowledge.

This is the core gap facing modern GMP quality teams.

AI-powered eQMS tools can improve the workflows inside the eQMS. But GMP quality decisions require a broader evidence and knowledge layer across the full manufacturing environment.

Executive Summary

Pharmaceutical manufacturers and Marketing Authorisation Holders (MAHs) operate in an environment where quality decisions increasingly depend on evidence spread across many systems, records, sites, and external partners.

The QMS remains essential. It is the formal system of record for deviations, CAPAs, change controls, complaints, audits, training, and controlled quality workflows. AI-powered eQMS tools can make these workflows faster by helping teams draft records, summarise investigations, classify events, search prior records, and complete documentation more efficiently.

But GMP quality decisions rarely depend on an individual QMS record, or even any individual QMS system alone.

A batch release decision may require executed batch records, lab results, supplier lot information, CoAs, equipment records, cleaning logs, environmental monitoring data, training records, process parameters, prior deviations, CAPA effectiveness history, quality agreements, and market-specific requirements. An APQR may require evidence from batch history, deviations, complaints, OOS/OOT events, yield trends, stability data, change controls, supplier quality, regulatory commitments, and product-specific signals across multiple sites or partners. A MAH may rely on CDMOs, CMOs, contract laboratories, packaging partners, and suppliers, while still retaining responsibility for quality oversight across the full supply chain.

This is the architectural gap.

AI inside an individual eQMS system can improve the workflows already inside the eQMS system, for example for deviation management. It cannot fully solve a quality decision that depends on evidence distributed across multiple systems and locations, for example MES, LIMS, ERP, DMS, historian data, supplier systems, paper or hybrid records, spreadsheets, PDFs, and external manufacturing partners.

That fragmentation is not merely operational friction. It is a quality, compliance, and knowledge-management risk.

Regulatory expectations already point in this direction. ICH Q10 demands a lifecycle approach to quality management built on Knowledge Management, Quality Risk Management (QRM), and continuous improvement. EudraLex Volume 4 Annex 16 places a personal obligation on the Qualified Person (QP) to have access to all relevant evidence before certifying every batch for release. The EMA Reflection Paper on MAH responsibilities makes clear that ultimate accountability for product quality across the entire supply chain, even if outsourced, rests with the MAH, regardless of which party physically executes manufacturing and testing. ICH Q9(R1), finalised in 2023 and actively implemented by FDA, EMA, and MHRA, reinforces that effective QRM must be systematic, evidence-based, and free from excessive subjectivity.

The next layer of GMP quality infrastructure is therefore not simply a smarter collection of paper or eQMS systems and processes operating in isolation. It is a unified evidence and knowledge layer that sits across existing systems, ingests structured and unstructured manufacturing evidence, preserves source-level lineage, supports human review, and turns fragmented records into audit-ready GMP intelligence.

This layer does not replace the existing QMS. It complements and supports it.

The QMS defines the system of record and processes for formal quality workflows. The evidence and knowledge layer becomes the intelligence layer that connects the data and context, across formal GxP repositories and the broader manufacturing evidence landscape, needed to make quality decisions faster, more consistently, and more defensibly.

The goal is not autonomous quality approval. The goal is better human decision-making: operationalising the evidence available across the full QMS and manufacturing value chain to reduce risk, improve quality decisions, and drive continuous improvement.

In GMP environments, AI should help qualified experts see the complete evidence picture, identify risks and trends earlier, reduce manual evidence gathering, strengthen audit readiness, and support continuous improvement across the product lifecycle.

The future of GMP quality will not be defined only by smarter workflows inside individual systems. It will be defined by the infrastructure that connects the full evidence landscape and makes that evidence usable at the point of every quality decision.

1. The Regulatory Framework Demands More Than Workflow Automation

Modern GMP regulations increasingly expect quality decisions to be lifecycle-based, evidence-driven, risk-based, and supported by effective knowledge management. This expectation cannot be fully met through workflow automation alone. It requires that relevant product, process, batch, supplier, site, and partner evidence be accessible, traceable, and usable at the point of decision.

1.1 ICH Q10: Knowledge Management and Quality Risk Management as a Formal Requirement

ICH Q10 defines a Pharmaceutical Quality System (PQS) that includes four key elements: process performance and product quality monitoring; corrective and preventive action (CAPA); change management; and management review. Critically, the guideline identifies Knowledge Management and Quality Risk Management (QRM) as key enablers of an effective PQS and defines Knowledge Management as a systematic approach to acquiring, analysing, storing, and disseminating information related to products, manufacturing processes, and components.

ICH Q10 further requires that organisations use product and process knowledge throughout the product lifecycle to support continual improvement. This is not aspirational language. It is a regulatory expectation that knowledge about products and processes is captured, organised, and made accessible to support quality decisions. The practical implication is that knowledge locked in paper, siloed systems, or individual human memory does not constitute an effective knowledge management system and therefore cannot easily be fully leveraged as an enabler of an effective QMS.

The ICH Q10 model also forms the structural foundation of EudraLex Volume 4 Chapter 1, the EU GMP requirement for a Pharmaceutical Quality System, which was revised to align with ICH Q10 and explicitly requires Product Quality Review (PQR) as a systematic tool for continuous improvement. The most recent revision of Chapter 1, released for public consultation in 2025, strengthens the emphasis on knowledge management and risk management across the product lifecycle and embeds the updated ICH Q9(R1) principles on quality risk management as a core expectation.

1.2 ICH Q9(R1): Evidence-Based Risk Management Requires Data

The revision of ICH Q9 to Q9(R1), finalised in 2023, addressed a fundamental weakness in how QRM was being applied across the industry: excessive subjectivity, inconsistent formality, and risk assessments that were disconnected from actual manufacturing data and evidence. The updated guidance reinforces that QRM must be systematic, that risk assessments should be informed by evidence rather than opinion, and that the outputs of QRM should be traceable and defensible.

ICH Q9(R1), Q8(R2) and Q10 are explicitly described by ICH as a trio of guidelines that work together to encourage science and risk-based approaches to quality across the product lifecycle. An updated and expanded briefing pack was published in March 2026 to support implementation. The clear direction of travel across the ICH Quality Guidelines is towards more structured, more evidence-based, and more data-driven quality management. This direction is very challenging for a manufacturing environment where quality evidence is fragmented, not easily accessible, and manually assembled.

1.3 EudraLex Volume 4 Chapter 4 and Annex 11: Documentation and Computerised Systems

EudraLex Volume 4 Chapter 4, currently under revision as part of a coordinated update package with Annex 11 and new Annex 22, establishes that documentation must support GMP compliance irrespective of whether records are held in paper, digital, or hybrid form. Complex systems must be well documented, validated, and adequately controlled. Critically, the PIC/S GMP Guide (PE 009-17), adopted by over 50 regulatory authorities worldwide, specifies that records must provide evidence of actions taken to demonstrate compliance, and that at least all data on which quality decisions are based should be defined as raw data with appropriate controls.

The revised Annex 11, released for consultation in 2025, strengthens requirements for lifecycle management of computerised systems, mandating that Quality Risk Management principles be applied during all steps, including enhanced controls on data integrity, audit trails, electronic signatures, and system security. The companion Annex 22 on Artificial Intelligence, the first dedicated EU GMP annex on AI, establishes requirements for the selection, training, and validation of AI models used in manufacturing, with emphasis on intended use, performance metrics, training data quality, continuous oversight, change control, model performance monitoring, and human review. This regulatory development signals clearly that AI use in GMP manufacturing is not only anticipated but is being actively codified, with the expectation that AI systems operate within a controlled, validated, and human-reviewed framework.

MHRA has issued an active data strategy for 2024 to 2027, which includes a section termed: Safely and responsibly harness the potential of artificial intelligence and advanced analytics throughout the product lifecycle. This further emphasises the growing importance of data governance and responsible AI adoption across regulated product lifecycles.

1.4 EudraLex Volume 4 Annex 16: The QP's Evidence Burden

EudraLex Volume 4 Annex 16, Certification by a Qualified Person and Batch Release, is perhaps the most operationally demanding expression of the knowledge management imperative. It states that the ultimate responsibility for the performance of a medicinal product over its lifetime, its safety, quality and efficacy, lies with the marketing authorisation holder (MAH). However, the QP is responsible for ensuring that each individual batch has been manufactured and checked in compliance with laws in force in the Member State where certification takes place, in accordance with the requirements of the marketing authorisation (MA) and with Good Manufacturing Practice (GMP). Before certifying any batch for release, the QP must ensure that the batch was manufactured and checked in compliance with applicable laws, in accordance with the requirements of the marketing authorisation, the MIA and with cGMP.

The documentation and evidence required for QP certification includes, but is not limited to, batch manufacturing records, analytical results, deviation and change control reports, in-process controls, and confirmation that any deviations or out-of-specification results have been properly investigated, resolved, and documented. Physical Importation, Transport and GDP, Importation Testing, Supply Chain Maps, TSE Statements, Post Marketing Commitments, Stability, Serialization, Complaints, Audits and Self Inspections, Quality Technical Agreements, Artwork, APQR, CPV and other data sources may also be relevant to inform the QP's decision on batch certification. Where the QP relies on the quality management systems, including those of other sites, for example a CDMO or contract laboratory, Annex 16 requires that the QP have ongoing assurance that this reliance is well founded, including access to audit reports and critical compliance findings.

In practice, this means the certifying QP bears a personal obligation that extends across the entire supply chain. That obligation cannot be easily met if the evidence itself is fragmented across paper records, disconnected electronic systems, and documents held by third parties in inconsistent formats. Even where QP handshakes or QP to QP agreements are in place, the QP performing the final batch certification and release to market still has responsibility to ensure that they have ongoing assurance that reliance on the systems and data supporting the upstream QP confirmations is well founded.

1.5 EudraLex Volume 4 Chapter 7 and the EMA Reflection Paper on MAH Responsibilities

EudraLex Volume 4 Chapter 7 on Outsourced Activities establishes that the Contract Giver, typically the MAH or sponsor, is ultimately responsible for ensuring that outsourced activities are properly controlled and compliant with GMP. There must be a written contract between the parties defining their duties and technical arrangements. Records must be accessible to the Contract Giver to allow for compliance oversight.

The EMA Reflection Paper on GMP and Marketing Authorisation Holders, Version 2, (EMA/419517/2021) makes the implications explicit. The MAH retains responsibility for product quality regardless of delegation of activities. Responsibilities include, but are not limited to, oversight of outsourcing and technical agreements; audit qualification; communication on MA variations and regulatory commitments; Product Quality Review, specifically noting that full delegation of PQR to a manufacturer is not appropriate; quality defects, complaints and recalls; maintenance of supply; and continual improvement activities. The Reflection Paper further specifies that the MAH must ensure that any person or entity to whom a task is delegated possesses the required competence, information, and knowledge, and that the MAH maintains adequate knowledge of GMP activities throughout the manufacturing and distribution chain.

The FDA's parallel guidance on Contract Manufacturing Arrangements for Drugs: Quality Agreements reinforces this position. The sponsor's quality department retains legal responsibility for approving or rejecting products manufactured by contract partners. Quality agreements must define responsibilities for change control, laboratory controls, documentation, and monitoring of incoming materials. FDA enforcement data from 2026 reflects a continued pattern of Warning Letters linked to inadequate sponsor oversight of CMOs, a direct consequence of sponsors lacking the information infrastructure needed to exercise meaningful oversight.

Taken together, these regulatory expectations point to the same operational requirement: quality teams must be able to access, connect, interpret, and defend the evidence behind GMP decisions. The challenge is that this evidence rarely lives in one system, one format, one site, or even one organisation.

2. The Current State: Why Fragmented Systems Cannot Easily Meet These Obligations

2.1 The Anatomy of Manufacturing Evidence Fragmentation

In most pharmaceutical manufacturing organisations, including those operating modern eQMS platforms, the evidence required to make quality decisions is distributed across a landscape of disconnected systems and records. A typical batch release review may require access to executed batch manufacturing records, lab results, in-process checks, deviation records, change control implementation status, associated regulatory submissions, material usage records, equipment logs, cleaning records, training records, supplier Certificates of Analysis, environmental monitoring data, prior related events, APQR history, audit records, quality agreements, risk assessments, and other product or market-specific evidence.

Some of this data is structured. Much of it may be handwritten, scanned, or held as attachments inside other electronic systems. Some may exist only in site-specific templates that vary by plant, product, or CDMO. Some resides in standalone software platforms from multiple vendors.

The eQMS captures the formal quality event, the deviation record, the CAPA, or the change control workflow. But the full manufacturing truth, the context that allows a quality professional to understand what actually happened and why, is often difficult to access without moving across multiple systems, attachments, documents, and local records. The eQMS may not hold the full evidence needed for efficient and effective investigation, trending, or risk assessment.

For example, a recurring deviation may be recorded in the eQMS as a process excursion. The deviation record may contain the event description, investigation summary, CAPA, approvals, and closure workflow.

But understanding the root cause may require much more than the information that was entered into the accessible fields of this eQMS record. The answer may depend on the executed batch record, raw material lot history, supplier CoA, process parameter trends, equipment cleaning and calibration history, operator training records, environmental monitoring data, prior similar deviations, and CAPA effectiveness history.

If those records sit across paper files, LIMS, MES, ERP, QMS attachments, local site folders, and supplier documentation, the quality team is forced into a manual evidence hunt and then perhaps a manual upload of the relevant files as attachments to the eQMS record. The risk is not only that the investigation takes longer. The greater risk is that relevant evidence is missed, a recurring signal is not recognised, or a CAPA is closed without fully understanding whether the underlying issue has been addressed.

This fragmentation is not limited to paper-based environments. A manufacturer may have an eQMS including various software solutions, MES, LIMS, ERP, DMS, historian, and data lake, yet still lack a unified GMP evidence layer. Each system may be validated and useful for its intended workflow, but quality decisions often require context across all or many of them.

The problem is not simply whether the data is digital. The problem is whether the evidence is connected, traceable, interpretable, and available at the point of decision. This links directly back to Knowledge Management and Quality Risk Management as key enablers of an effective Pharmaceutical Quality System.

2.2 The Annual Product Quality Review: A Manual Data Reconciliation Exercise

The Annual Product Quality Review (APQR) process, required under EudraLex Volume 4 Chapter 1, as well as the PIC/S GMP guide, and with segregated but shared responsibilities between MAH and manufacturers under the EMA Reflection Paper and Chapter 1, exemplifies the challenge most acutely.

Regulatory requirements specify that the APQR must cover batch history, deviations, complaints, OOS/OOT events, yield trends, stability data, laboratory results, change controls, CAPA effectiveness, supplier quality data, regulatory filings and variations, regulatory commitments, product-quality-related returns, recalls and defect reporting, and market-specific quality signals and more. In most organisations, assembling this evidence requires manual data extraction across multiple systems, multiple sites, manual reconciliation of data from different sources, and significant time investment from senior QA staff, often hundreds of person-hours per product per year.

This manual process introduces inherent limitations. Data aggregation errors, inconsistent scope, and variable depth of analysis mean that the completed APQR may not reflect the full quality picture. More fundamentally, signals that might be visible if all data were analysed together like cross-batch trends, supplier correlations, equipment patterns, or process drift may remain invisible when data is assembled manually from disconnected sources. The hard part of the APQR is not writing the report. It is assembling, validating, tracing, and interpreting the evidence behind the report and identifying signals that require action before they become compliance failures or patient safety risks. Effective APQR should confirm compliance but also identify risks and areas for potential improvement and drive CAPA to track implementation of the associated improvements.

For example, a product team may prepare an APQR by manually pulling deviations from the eQMS, batch execution data from MES or paper records, laboratory results from LIMS, stability data from spreadsheets or paper records, complaints from another system, supplier quality information from procurement or ERP records, and change controls from yet another system.

Each source may be accurate in isolation. But when the evidence is reviewed separately, cross-product and cross-site signals can remain hidden. A supplier pattern may not be visible inside the deviation system. A yield trend may not be obvious from the batch record alone. A recurring OOT signal may not be connected to a prior process change. A CAPA may appear effective in one system or site, while related events continue to appear elsewhere.

This is why APQR should not be treated only as a report-generation exercise. Its real value is in creating a holistic, evidence-based view of process performance, product quality, recurring risk, and opportunities for continual improvement.

2.3 Outsourced Manufacturing and the MAH Oversight Gap

For MAHs that rely on CDMOs, CMOs, contract laboratories, and packaging partners, the evidence fragmentation problem is compounded by organisational and geographical boundaries. The sponsor may maintain a modern QMS, but manufacturing evidence arrives from external partners in inconsistent formats, PDFs, batch record packages, lab summaries, Certificates of Analysis, deviation reports, attachments, and scanned documents. The sponsor retains legal and regulatory oversight responsibility under Chapter 7, Annex 16, and the EMA Reflection Paper for example, but the practical infrastructure for exercising that oversight, the ability to access, review, and analyse evidence from third-party sites in real time is typically very challenging.

PIC/S GMP Chapter 4 documentation requirements confirm that batch documentation must be retained and accessible for defined periods, with raw data preserved throughout. But accessibility in a fragmented landscape means manual requests, file transfers, format conversions, and reconciliation, not instant, structured access to evidence. The result is that oversight is reactive rather than proactive, and the MAH's ability to detect quality signals, identify trends, or assess CAPA effectiveness across the extended supply chain is severely limited and managed through audits, sample review of documentation, oversight meetings and a significant amount of trust in the relationship and data integrity.

For example, a sponsor reviewing a CDMO batch package may receive hundreds or thousands of pages of PDFs, batch record attachments, CoAs, deviation summaries, laboratory reports, and investigation documents. The sponsor's own QMS may contain the final approval workflow or even a number of quality event records, but not the complete batch-level evidence generated by the external manufacturing partner.

The sponsor still needs to determine whether the batch was manufactured and checked in accordance with the approved process, whether deviations were investigated appropriately, whether supplier or laboratory signals require follow-up, and whether similar issues are emerging across products, sites, or partners.

Without a unified evidence layer, this oversight becomes periodic, manual, and reactive. With one, the sponsor can move toward more continuous and evidence-based oversight of external manufacturing quality, while preserving human accountability for final decisions.

2.4 The Knowledge Management Deficit

ICH Q10's knowledge management requirement is not effectively met just by having a validated eQMS with a document management module and other digital QMS tools for processes like change control, deviations, complaints etc. Genuine pharmaceutical knowledge management requires that the institutional knowledge accumulated over years of manufacturing, the site-specific operating experience, the historical deviation patterns, the CAPA history, the process drift data, the supplier quality histories etc. is structured, accessible, and usable to support current quality decisions, proactive risk identification and reduction as well as continuous improvement opportunities and process optimisation. In most organisations, this knowledge is distributed across the minds of experienced personnel, buried in investigation archives, various risk assessments and reports and locked in paper, SharePoints, Google Drive folders, or disconnected electronic records. When experienced staff leave, that knowledge often leaves with them.

The regulatory and industry direction of travel is clear: the revised EudraLex Volume 4 Chapter 1, the revised ICH Q9(R1), the forthcoming EU GMP Annex 22 on AI, and MHRA's data strategy all point towards an expectation that organisations will move progressively towards technology-enabled, data-driven quality management throughout the product lifecycle and value chain. The question is not whether this transition will be required. It is whether organisations have the infrastructure to achieve it.

3. The Solution: A Unified GMP Evidence and Knowledge Layer

3.1 Why Disconnected AI-Powered eQMS Tools Alone Are Not Sufficient

Embedding AI capabilities within an existing eQMS platform, for example just for deviation or complaint management, provides genuine operational benefits: faster deviation drafting, intelligent CAPA suggestions, smarter search across eQMS records, and improved workflow efficiency. These improvements are real and worth pursuing. But they address the workflows that already live inside the various eQMS systems supporting the overall QMS, they do not resolve the broader problem of evidence fragmentation across multiple systems and locations.

A deviation may have its root cause visible only in the paper batch record, the equipment log, and the supplier CoA, none of which may be typically held in the eQMS fields with the AI software added to support the investigation. An AI model operating within that eQMS boundary can summarise the record and suggest similar prior events inside the eQMS based on the information entered into the system. It cannot connect the eQMS record to the broader manufacturing evidence landscape if it cannot access that evidence. AI inside one system cannot fully solve a decision that depends on evidence across many systems.

This is the fundamental architectural limitation. The evidence needed to make good quality decisions in GMP manufacturing does not reside in any single system. It is distributed across the full manufacturing environment. Solving the quality intelligence problem requires a layer that can reach across all those systems and often across multiple sites, locations and organisations.

3.2 The Architecture of an Effective GMP Intelligence Layer

An effective AI-powered evidence and knowledge management layer for GMP manufacturing must do more than automate isolated processes, systems and workflows. It must sit across the manufacturing evidence landscape, connect existing systems, preserve source-level traceability, and support qualified human decision-making. Such a layer should have several core capabilities.

Breadth of data ingestion. The platform must be capable of ingesting data from structured systems such as MES, LIMS, ERP, eQMS software and processes, DMS, historians, and data lakes; semi-structured sources such as batch records, investigation reports, CAPA files, quality agreements, and APQR packages; and unstructured documents such as scanned PDFs, handwritten records, lab attachments, supplier files, and data from external manufacturing partners in varying formats. The ability to read paper and hybrid records, rather than requiring full digital transformation first, is essential for real-world ease of use and applicability.

Evidence lineage and auditability. Every output generated by the platform must be traceable back to source records and align with data integrity ALCOA+ principles. The system must maintain audit trails for both AI-assisted and human actions, preserve source-level evidence, and support explainability, enabling quality professionals and regulatory inspectors to understand how any conclusion was reached. This aligns directly with the requirements of the forthcoming EU GMP Annex 22 on AI, which requires continuous oversight of AI systems, change control, performance monitoring, and human review procedures.

Human oversight architecture. The platform must be designed to augment human decision-making rather than replace it. Uncertain or low-confidence outputs must be routed to human reviewers. Final quality decisions like batch certification, CAPA approval, deviation closure, APQR conclusions etc. must remain with qualified human experts. This architecture is consistent with the QP's personal certification obligations under Annex 16 and reflects the principle that AI in GMP environments should provide better evidence to human decision-makers, not autonomous approval.

Deployment flexibility and customer control. Regulated manufacturers have legitimate requirements for where manufacturing data is processed, stored, and governed. The evidence required for GMP decisions may include proprietary process knowledge, batch records, supplier information, regulatory commitments, CDMO records, analytical data, and years of site-specific operating history. This data cannot be treated as generic enterprise content. A GMP intelligence layer should therefore support customer-controlled deployment models, including validated SaaS, customer cloud, private cloud, on-premises, and, where required, restricted or air-gapped environments. It should also provide clear controls around data residency, access, retention, model use, and whether customer data is used for model training. In regulated manufacturing, private AI is not only a security feature. It is part of the trust architecture required for adoption. Deployment flexibility, data governance, source-level traceability, and human oversight must work together.

System agnosticism. The platform must complement existing infrastructure rather than requiring wholesale replacement. Paper or eQMS software and processes, LIMS, MES, ERP, DMS, historians, and data platforms represent significant investment and are deeply embedded in validated processes. The intelligence layer should sit across these systems, read and structure their outputs, and connect their evidence without forcing a disruptive rip-and-replace transformation.

Institutional memory and continuous improvement. The layer should accumulate structured manufacturing knowledge over time. Historical deviations, CAPA outcomes, change effectiveness, supplier patterns, process drift, recurring risks, site-specific operating knowledge, and prior quality decisions should become searchable and reusable. This turns knowledge management from document storage into an operational capability that supports QRM, APQR, investigation quality, management review and continuous improvement. Effective and efficient AI-powered knowledge management, risk management and continuous improvement becomes a competitive advantage.

In practical terms, a GMP evidence and knowledge layer should be able to:

• •Connect to existing QMS, LIMS, MES, ERP, DMS, historians, data lakes, and paper or hybrid records.
• •Ingest structured, semi-structured, scanned, handwritten, and externally supplied evidence.
• •Preserve source-level lineage for every observation, conclusion, and recommendation.
• •Identify missing, inconsistent, or conflicting evidence.
• •Highlight uncertain or quality-critical findings to human reviewers.
• •Maintain audit trails for AI-assisted and human actions.
• •Support customer-controlled deployment and data governance.
• •Accumulate institutional manufacturing knowledge over time.
• •Support workflows such as batch release, APQR, deviation investigation, change control, CAPA, QRM, tech transfer, supplier quality, audit readiness, and MAH oversight.

This layer complements the QMS and eQMS. The QMS defines the formal system of record, archival or data storage and the processes that must be followed whether using eQMS systems, paper records or a mix of both. The GMP intelligence layer connects the broader evidence required to make those processes and workflows faster, more complete, more valuable and more defensible.

3.3 Key Use Cases Enabled by a Unified Knowledge and Evidence Layer

Batch Release and QP Certification Support. The QP's evidence burden under Annex 16 requires access to the full spectrum of batch evidence before certification. A unified platform that automatically assembles, cross-references, and structures batch evidence from MES, LIMS, eQMS, regulatory filings, paper records, supplier files, and environmental monitoring systems and flags deviations, trends, missing records, or anomalies for human review transforms batch release from a manual evidence hunt into a structured, risk-stratified review. Review-by-exception becomes more accessible and risk based: the QP focuses attention on the records and signals that most require human judgement, with the platform providing the complete underlying evidence picture in a fully auditable way, compliant with data integrity principles.

APQR Generation and Trend Intelligence. The APQR process is one of the most data-intensive recurring quality exercises in pharmaceutical manufacturing. A unified evidence layer that automatically aggregates batch history, deviation trends, OOS/OOT patterns, yield data, stability signals, complaints, CAPA effectiveness, supplier quality patterns, and change control, variation and regulatory commitment histories across the full evidence landscape rather than leveraging exports from disparate QMS records and systems, transforms the APQR from a manual reconciliation exercise into a structured intelligence, continuous improvement and risk management activity. Signals that could be invisible when data is assembled manually, cross-batch correlations, supplier-linked process drift, CAPA recurrence patterns etc. can become more easily detectable and actionable. It also allows for the possibility of more frequent APQR type data gathering and review, since the associated workload can be significantly reduced by leveraging the unified evidence and knowledge layer and associated AI capabilities.

Quality Risk Management. ICH Q9(R1) requires QRM to be systematic and evidence-based. A platform with access to historical manufacturing data, regulatory filings, batch records, deviation histories, process parameter trends, supplier performance, equipment maintenance records etc. enables genuinely evidence-informed risk assessments, supports the change from subjective expert estimation to structured data analysis, and supports the traceability and defensibility of risk management outputs that Q9(R1) requires.

Knowledge Management and Institutional Memory. The platform accumulates structured manufacturing knowledge over time. Historical deviation patterns, effective CAPA approaches, site-specific process sensitivities, and supplier quality histories are preserved, searchable, and available to current quality professionals regardless of staff turnover. This constitutes genuine knowledge management in the ICH Q10 sense, not just document storage, but accessible, actionable manufacturing intelligence that improves over time to drive risk reduction, continuous improvement, innovation and regulatory compliance.

MAH Oversight of Contract Manufacturers. The evidence oversight requirement under Chapter 7, Annex 16, the EMA Reflection Paper, and the FDA CMO Quality Agreement guidance requires that MAHs can access and review quality evidence from contract manufacturing sites. A platform that ingests and structures data from CDMOs and contract laboratories, regardless of format, enables the MAH to exercise genuine, continuous quality oversight rather than periodic manual review. Batch-level evidence, deviation trends, CAPA status, and quality signals from the extended supply chain can become visible and actionable in near real time.

Deviation and Complaint Investigation and CAPA Intelligence. Root cause investigation is most effective when the investigator can access the full manufacturing context, not just the fields that were entered in the QMS or eQMS record of the event, but the full set of batch records, equipment history, raw material traceability, operator records, environmental monitoring data, and prior related events. A platform that automatically assembles and cross-references this evidence at the point of investigation, and that applies pattern recognition across historical events to identify potential recurring root causes or CAPA ineffectiveness, transforms the quality of investigation and reduces the risk of repeat deviations and product quality issues.

4. Regulatory Readiness and Validation Considerations

The forthcoming EU GMP Annex 22 on Artificial Intelligence, developed alongside the revised Annex 11 and Chapter 4 as an integrated update package, provides the first explicit EU GMP framework for AI use in pharmaceutical manufacturing. Its requirements for AI model selection, training data quality, performance metrics, intended use definition, continuous oversight, change control, and human review procedures are directly applicable to a platform of the type described in this paper.

Organisations deploying AI-powered quality intelligence should ensure that:

• •The intended use of the AI system is clearly defined and documented, with explicit boundaries on the scope of automated outputs and the human review obligations that apply at each decision point.
• •Training data quality is assessed and documented, with particular attention to the representativeness of historical manufacturing data used to train or calibrate the system.
• •Validation is performed in accordance with the revised Annex 11 lifecycle principles, with Quality Risk Management applied throughout.
• •Audit trails are maintained for all AI-assisted and human actions, supporting both internal review and regulatory inspection readiness.
• •Change control processes are defined for model updates, retraining events, and significant changes to system configuration.
• •Human review procedures are defined and enforced for low-confidence outputs, exceptions, and quality-critical decisions.

The GxP data integrity framework applies equally to AI-generated records. All outputs used to support quality decisions must satisfy ALCOA+ principles: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring and Available, and be retained in a way that supports regulatory review throughout the required retention period.

Critically, the validation and governance requirements for an AI evidence and knowledge management layer are manageable and proportionate when the system is designed for GMP use from the outset. The alternative, attempting to exercise quality oversight across fragmented paper records and disconnected electronic systems without adequate analytical infrastructure, carries compliance risks that are demonstrably greater, as reflected in the pattern of regulatory action from FDA and other agencies linked to inadequate data governance and CMO oversight.

5. The Strategic Case for a Unified GMP Evidence and Knowledge Layer

The regulatory obligations described in this paper, ICH Q10 knowledge management, QRM and continuous improvement, ICH Q9(R1) evidence-based QRM, PIC/S GMP Guide, EudraLex Volume 4 Chapter 1 and the PQR requirement, Annex 16 QP certification and the evidentiary burden it carries, Chapter 7 and MAH oversight of outsourced manufacturing, and FDA CMO Quality Agreement expectations, collectively describe a regulatory environment in which evidence-based, risk-based, data-driven quality management supported by effective and operationalised knowledge management is not optional. It is required.

The gap between this regulatory expectation and the current operational reality frequently involving paper records, disconnected electronic systems, manual data assembly, and inaccessible institutional knowledge represents a systemic quality and compliance risk. This risk manifests as slow deviation investigations, incomplete APQRs, ineffective QRM, missed trend signals, ineffective knowledge management, reactive rather than proactive quality management, and inadequate oversight of contract manufacturing partners. It is, at its core, an information infrastructure and knowledge management problem.

The solution is not to replace existing systems. It is to build the intelligence layer that connects them.

Such a layer ingests the full manufacturing evidence landscape, structures and preserves source-level data, surfaces trends and signals that manual analysis may miss, supports human decision-makers with complete and auditable evidence packages, and accumulates institutional manufacturing knowledge over time.

This turns knowledge management, QRM, risk reduction, and continuous improvement into continuous operational capabilities rather than periodic manual exercises. This is the architecture of effective GMP quality management for organisations operating in the current regulatory environment. It is the architecture that turns the regulatory obligations of ICH Q10, Q9(R1), Annex 16, Chapter 7, and the EMA MAH Reflection Paper from burdens into competitive advantages enabling faster, more confident quality decisions, lower compliance risk, better CAPA effectiveness, and a continuously improving quality system grounded in the full evidence landscape of data that is available across the entire QMS, manufacturing, testing and associated value chain.

About the Authors

Anil Chandrupatla is Founder and CEO of Litewave AI, a company building AI infrastructure for regulated manufacturing evidence, quality review, and GMP intelligence across life sciences manufacturing environments. He has spent his career building cloud, AI, compliance, and mission-critical infrastructure platforms for regulated and large-scale enterprise environments. Prior to Litewave, he held senior engineering and cloud leadership roles at Hewlett Packard Enterprise, Broadcom, and Cisco, with work spanning private cloud, edge deployments, AI and machine learning operations, continuous compliance, and regulated infrastructure.

Eoin Duff is an experienced pharmaceutical quality leader with twenty years of experience across GMP and GDP quality, external quality and MAH oversight, operational excellence, microbiology, sterile and non-sterile manufacturing and packaging, validation, tech transfers and quality systems. He is a Qualified Person (QP), Responsible Person (RP), and Certified Lean Six Sigma Black Belt. He currently serves as Director, Quality Compliance and Operational Excellence at Amicus Therapeutics. His prior experience includes quality and manufacturing roles at MSD/Merck, Alexion, Pfizer/CPL, Schering-Plough/MSD, Biotrin, and Trinity Biotech. Eoin advises Litewave AI on GMP quality, manufacturing, and regulated operations.

References

• •European Commission. EudraLex Volume 4: Good Manufacturing Practice (GMP) guidelines. Brussels: European Commission. Available at: https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en (accessed 13 July 2026).
• •European Commission. Stakeholders' Consultation on EudraLex Volume 4 Good Manufacturing Practice Guidelines, Chapter 1. Public consultation on revision of Chapter 1: Pharmaceutical Quality System. Brussels: European Commission, 2023. https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-1_en (accessed 13 July 2026).
• •European Commission. Stakeholders' Consultation on EudraLex Volume 4 Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and Annex 22. Brussels: European Commission, 2025. https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en (accessed 13 July 2026).
• •European Commission. EudraLex Volume 4, Part I, Chapter 7: Outsourced Activities, 2012. https://health.ec.europa.eu/document/download/58b5106a-cf6f-4352-9dca-1caf5d27d97e_en (accessed 13 July 2026).
• •European Commission. EudraLex Volume 4, Annex 16: Certification by a Qualified Person and Batch Release. October 2015. Brussels: European Commission. https://health.ec.europa.eu/document/download/20c41532-33d5-4635-ae80-8735d3d09fe0_en (accessed 13 July 2026).
• •European Medicines Agency (EMA). Reflection Paper on Good Manufacturing Practice and Marketing Authorisation Holders. EMA/457570/2019, updated January 2022 as EMA/419571/2021. Amsterdam: EMA. https://www.ema.europa.eu/en/documents/scientific-guideline/reflection-paper-good-manufacturing-practice-marketing-authorisation-holders_en.pdf (accessed 13 July 2026).
• •ICH. Harmonised Tripartite Guideline Q8 (R2): Pharmaceutical Development. Step 5. Geneva: ICH, 2009. https://database.ich.org/sites/default/files/Q8%28R2%29%20Guideline.pdf (accessed 13 July 2026).
• •ICH. Updated and Expanded ICH Q9(R1) Quality Risk Management Briefing Pack Now Available. ICH news release. Geneva: ICH, 2022. https://www.ich.org/news/updated-and-expanded-ich-q9r1-quality-risk-management-briefing-pack-now-available (accessed 13 July 2026).
• •ICH. Harmonised Tripartite Guideline Q10: Pharmaceutical Quality System. Step 5. Geneva: ICH, 2008. https://www.ema.europa.eu/en/ich-q10-pharmaceutical-quality-system-scientific-guideline (accessed 13 July 2026).
• •Intuition Labs. Contract Manufacturing Oversight: 2026 FDA Enforcement Data. 2026. https://intuitionlabs.ai/articles/contract-manufacturing-oversight-fda-enforcement-2026 (accessed 13 July 2026).
• •MHRA. MHRA Data Strategy 2024-2027. London, 2024. https://www.gov.uk/government/publications/mhra-data-strategy-2024-2027/mhra-data-strategy-2024-2027 (accessed 13 July 2026).
• •MHRA. GXP Data Integrity Guidance and Definitions. London, 2018. https://assets.publishing.service.gov.uk/media/5aa2b9ede5274a3e391e37f3/MHRA_GxP_data_integrity_guide_March_edited_Final.pdf (accessed 13 July 2026).
• •PIC/S. Guide to Good Manufacturing Practice for Medicinal Products. 2023. PE 009-17. Geneva. https://picscheme.org/en/publications?tri=gmp#zone (accessed 13 July 2026).
• •PIC/S. Guide PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. 2021. https://picscheme.org/docview/4234 (accessed 13 July 2026).
• •Pharmaceutical Technology. FDA Guidance Helps Further Clarify Quality Agreements. 2016. https://www.pharmtech.com/view/fda-guidance-helps-further-clarify-quality-agreements (accessed 13 July 2026).
• •U.S. Food and Drug Administration (FDA). Guidance for Industry: Contract Manufacturing Arrangements for Drugs: Quality Agreements. Silver Spring, MD: FDA, November 2016. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/contract-manufacturing-arrangements-drugs-quality-agreements-guidance-industry (accessed 13 July 2026).