GMP quality workflows where every decision carries its evidence
Five connected workflows on one governed record spine — deviation to root cause to CAPA to controlled document to sealed inspection pack — with the WHO, the WHAT and the AI’s WHY captured as structured GxP records, not log files.
What GMP demands of your quality system
GMP doesn’t ask whether you have a quality system. It asks whether you can prove, record by record, that the system worked — and who was accountable at every step. These are the demands your QMS is actually inspected against:
Data integrity (ALCOA+)
Every action attributable, legible, contemporaneous, original and accurate — applied to the records your inspectors will actually pull, not just the SOP that says so.
Electronic records & signatures (21 CFR Part 11 / EU Annex 11)
Controlled access, meaning of signature, and an audit trail that is reviewed, not just retained.
Segregation of duties
The person who raises a deviation cannot investigate it. The person who leads an RCA cannot conclude it. The person who owns a CAPA cannot close its own actions. Inspectors expect these gates enforced by the system — not by memory or convention.
Closed-loop quality events
Deviations triaged by severity, escalated on product or patient impact, investigated to a root cause that survives challenge, and closed through CAPA with effectiveness evidence.
AI accountability
If AI touches a GxP record, regulators will ask what it suggested, what a human decided, and how you can tell the difference. Most systems cannot answer that question. Verixa is built around it.
MIRA never
- Sets a deviation’s severity
- Concludes a root-cause analysis
- Writes a controlled field
How Verixa supports GMP
Every GMP Core workflow runs on the same governance foundation — so compliance is a property of the architecture, not a discipline your team has to re-impose on every record.
01
One record spine, walkable in both directions
A deviation links to its RCA, the RCA to its CAPA, the CAPA to the revised SOP, the SOP to the training that followed. Cross-record links are auditable objects — an inspector (or your own QA lead) walks the chain forward or backward without a document hunt.
The connected workflows02
AI that assists, never decides
MIRA drafts, reviews and flags across GMP Core as labelled advisory content. It cannot set a deviation’s severity, cannot conclude an RCA, does not draft CAPAs, and is not offered for batch disposition. Every suggestion is captured with its disposition — accepted, rejected, or superseded by the human record.
The product behaviour03
Evidence organised as work happens
The schema-level audit trail preserves model or deployment identifier, system configuration, source context, generated output and reviewer disposition as structured records — so QA review and inspection preparation draw on evidence that already exists, not evidence assembled retroactively.
The proof artifactsThe Phase 1 quality-event spine
Phase 1 covers the quality-event spine a GMP site runs on every week. Start with one; add the rest without rebuilding the governance foundation.
Connected beyond the five: training reassignment from CAPA, SOP revisions routed through change control, risk assessments feeding CAPA priority, findings raised from trend review — connected records on the same spine today, with deeper workflow coverage arriving in Phase 2 (2027). Roadmap on /platform.
One deviation, end to end
A QA record review finds that a sterility-critical filling step was executed by an operator whose qualification wasn’t on record. Here’s what happens in Verixa — and who is accountable at each step:
Deviation raised
QA raises the deviation and sets the severity herself — the AI cannot set severity. The batch is quarantined; the execution record, training matrix and affected SOP are linked as evidence, not re-typed into free text.
Independent triage
A second reviewer — the system requires a different person — reassesses the impact and escalates to Critical on sterility and patient-safety grounds, then assigns an investigator. The reporter is blocked from investigating her own deviation.
Root cause, with advisory AI
The investigator runs a 5-Why. MIRA proposes investigation themes and next-why prompts as labelled advisory input — the record does not change until the human acts. The analysis lands on the process, not the person: nothing verified operator qualification before task start.
Independent conclusion, with provenance
A third person reviews and concludes the analysis. The record preserves MIRA’s original suggestion and the human conclusion side by side, each correctly attributed. That’s what AI accountability looks like as a record.
CAPA, where the AI declines
The CAPA rejects the batch, opens a review of same-period batches, and revises the SOP to add a pre-task qualification and training-evidence check. Ask MIRA to draft the CAPA and it declines — deciding what corrects a quality failure is a human judgement, and the refusal is itself part of the governance evidence.
Fix, verified
The revised SOP routes through document control, where the human reviewer — with MIRA’s advisory review — verifies the new gate is actually in the draft before approving. Training is reassigned and evidenced; effectiveness evidence shows the new check holding. (The new check is a procedural pre-task readiness verification; an automated hard-block is target-state on the roadmap.)
The inspection payoff
The whole chain — deviation → RCA → CAPA → revised SOP → training evidence — is already linked, scored on the readiness scorecard, and exportable as a sealed, hash-verified pack. When the inspector asks “show me,” it’s one click, not one week.
Every step exists as a structured record: who acted, what changed, what the AI suggested, and what the human decided. That is the schema-level audit trail — and it is what your inspector reads.
What it changes for the business
Fewer repeat deviations
Root causes that land on process gaps — with CAPA effectiveness verified on the record — instead of “retrain the operator” closures that recur next quarter.
Inspection preparation stops being a project
Evidence accumulates as work happens; readiness is a standing scorecard, not an annual scramble that pulls your best people off the floor.
Start small, without integration debt
One workflow first; related workflows join the same governance foundation without re-platforming — matching how the product is priced.
See how it’s pricedAI acceleration you can defend
Drafting and review assistance with a provable human-decision boundary — speed without creating a new regulatory exposure.
Built for both sides of the site
QA · Governance
For the Quality team
- Segregation of duties enforced by the system: reporter ≠ investigator, RCA lead ≠ concluder, CAPA owner ≠ item closer. Authority gates are architecture, not SOP promises.
- Severity, escalation and disposition stay human. MIRA cannot set severity, conclude analyses, draft CAPAs, or touch batch disposition — and the record proves it.
- Trend candidates surface for QA review on the dashboard; a human raises the finding and decides the systemic action. Verixa surfaces — it does not auto-determine.
- Audit-trail review becomes tractable: structured records with attributed AI suggestions and human dispositions, instead of free-text notes an auditor has to reconstruct.
The floor
For the Operations team
- Raise a deviation in minutes, at the point of occurrence — link the execution record and training evidence instead of re-typing them.
- Clear ownership, due dates and status on every action — no chasing closure across shifts and spreadsheets.
- Procedural pre-task readiness verification written into revised SOPs, so qualification gaps surface before a sterility-critical step is executed, not after. (Automated hard-block is target-state on the roadmap.)
- The floor sees the same truth QA sees — cross-linked records mean one version of events, visible to both sides.
Where AI helps — and where it holds the line
MIRA inside GMP Core
Where MIRA assists
drafts deviation summaries · proposes RCA themes and next-why prompts · reviews SOP drafts against the triggering record · surfaces gaps and trend candidates. All advisory, labelled, disposition-tracked.
The hard lines
never sets severity · never concludes an RCA · does not draft CAPAs · not offered for batch disposition · never writes a controlled field.
These refusals are not limitations. They are the governance evidence — each one is a boundary you can show an inspector, on the record.
How MIRA works, in fullEvidence & Validation Pack
What it is
Validation is a shared responsibility. We show up prepared. A structured supplier-assurance pack organised as work progresses — so your CSV/CSA assessment starts from evidence, not a questionnaire filled in later.
In the pack
SDLC · AI-development controls · Part 11 controls · security & tenant isolation · supplier qualification · known defects · change control · requirements traceability · verification evidence.
Phase 1 is pre-validation; the pack states verified control status honestly, workflow by workflow.
What’s in the packOne spine, four layers
AI layer · MIRA (advisory-only)
Governance layer · SoD & role-authority gates
Workflow layer
Evidence layer · schema-level audit trail
Sealed pack — export
Workflow layer
the five GMP Core workflows, each entered by its own real trigger, cross-linked to the same quality theme. No record is forced through every module.
Governance layer
role-authority and segregation-of-duties gates enforced at the platform level; human e-signature on approvals (controls under verification).
AI layer
MIRA, advisory-only: suggestions flow to qualified humans; nothing flows from MIRA into a controlled field.
Evidence layer
the schema-level audit trail beneath everything, and the sealed inspection pack as its on-demand export: hash-verified, bound to the pack identity and disposition timestamp, tamper-evident by construction.
Straight answers, no hedging
Phase 1 is pre-validation, in design-partner stage — and we say so on every page. The Evidence & Validation pack documents architecture, controls and verified status workflow by workflow, so your assessment starts from evidence. Validation responsibilities that remain with your organization are stated explicitly in the walkthrough.
No. MIRA is advisory: it drafts and suggests for qualified human review, and a human accepts before any GxP impact. It never writes a controlled field, never sets severity, never concludes an RCA, does not draft CAPAs, and is not offered for batch disposition. Both the suggestion and the human decision are preserved as attributed records.
Controlled access, human e-signatures on approvals (e-signature controls under verification), and a structured audit trail designed for review — model/deployment identifier, configuration, source context, output and reviewer disposition as structured records.
No — that’s the operating model and the pricing model. Start with one workflow — many teams begin with Deviation Management or Document Control — and add related workflows on the same governance foundation when the operating value is clear.
See how it’s pricedYou open Inspection Readiness: a sealed evidence pack assembled from live records — readiness scorecard, controlled documents, deviation and CAPA chains with closure status, and an exceptions summary up front (open critical deviations, overdue CAPAs, unresolved gaps — a factual list, not a verdict). The export carries a verification hash, so what you show is provably what was sealed.
On the published roadmap: GMP Depth arrives in Phase 2 (2027), including Findings, Change Control, OOS/OOT, Complaints, Audit & Inspection Management, Supplier Quality, APQR and more. Today, change-control routing and training reassignment already operate as connected records on the Phase 1 spine.
See the roadmapMid-market pharmaceutical manufacturers, CDMOs and CROs with FDA/EU exposure — quality teams that need inspection-grade evidence without an enterprise implementation program.
You pick one current quality process. We show how Verixa could support it, where AI assists, where human decisions remain mandatory, and which validation responsibilities stay with your organization. No generic demo deck.
More questions? See the full FAQ →
See your own process in it
Bring one deviation, one SOP revision, or one CAPA that frustrated you this quarter. We’ll walk it through GMP Core end to end — where AI assists, where humans decide, and what the evidence looks like when it’s done.