Nothing left uncovered
A corporate system is validated with hundreds of requirements, risks and test cases. Going faster cannot leave any of them uncovered or repeated, and each one has to be traceable from start to finish.
OqoVal: AI drafts the validation documentation and the consultant reviews, approves and signs it
Oqotech, a CSV validation and GxP training company, commissioned the ComplAI team to build a platform that would draft the complete validation documentation. Today it uses it on real validation projects.
A GxP tool, built as a GxP system
OqoVal is a SaaS platform that automates the validation of computerized systems. OqoVal prepares the complete documentation, and the consultant keeps the work that takes judgment: reviewing, approving and signing. Because it drafts documents that get signed and audited, OqoVal is a GxP system in its own right, and it is validated as one: custom software, GAMP 5 category 5. The ComplAI team built it for Oqotech, which uses it on real validation projects.
The challenge
Automate the validation process so that every project is done faster and costs less, without losing anything you defend in an audit.
In a CSV validation, much of a consultant's work is not deciding but writing: the validation plan, the user requirements, the risk assessment, the qualification protocols, the traceability matrix and the final report. They are long documents with demanding formatting, linked to one another: if a requirement changes, so do its risks, its tests and its traceability.
Oqotech wanted the machine to do that work. AI would draft and format all the documentation, and consultants would spend their time on what only a person can do: review, correct, approve and sign. Fewer hours per project means a cheaper validation for the client and more projects with the same team.
Automation, yes, but on three conditions:
A person signs
AI proposes and a person decides. Every document carries a 21 CFR Part 11 electronic signature and cannot change once signed.
AI gets audited too
Just as you know who reviewed each document, you have to be able to say which model drafted it and from which regulatory sources.
The solution
A platform that drafts the complete documentation, from the validation plan to the final report, and maintains it after the system is released.
01 · The userSets up the project (system, GAMP category and intended use) and uploads manuals, screenshots and videos02 · AIDrafts the validation plan (VP) and proposes the user requirements (URS) from the resources03 · The userConfirms each requirement (editing one takes a reason) and signs the VP and the URS (signed with a PIN)04 · AIDrafts the technical specification with the regulatory library, assesses the risks of each confirmed requirement and writes the DQ protocol05 · The userAdjusts severity, probability and detectability with a justification, confirms each risk and signs the TS, the RA and the DQ protocol (signed with a PIN)06 · AIWrites the IQ, OQ and PQ protocols with the confirmed risks for each stage07 · The userApproves each protocol and provides the evidence for each step (signed with a PIN)08 · AIAssesses each step against its evidence and proposes pass or fail09 · The userConfirms each result; a manual pass takes a reason10 · OqoVal, no AIOpens a deviation for every fail and generates the execution, the deviations and the report with its conclusion11 · The userSigns the execution, the deviations and the report of each qualification (signed with a PIN)12 · OqoVal, no AIComputes the residual risk and the traceability matrix13 · AIDrafts the justification of the residual risk and the validation report14 · The userSigns the RRA, the matrix and the validation report: the new baseline is set (signed with a PIN)15 · OqoVal, no AISends reminders 30 and 7 days before each periodic review and on the day it is due, and escalates delays16 · AISuggests the impact of each change, line by line17 · The userDecides each line, with a justification when taking no action, and signs (signed with a PIN)
- 1. PlanningThe userSets up the project (system, GAMP category and intended use) and uploads manuals, screenshots and videos
- AIDrafts the validation plan (VP) and proposes the user requirements (URS) from the resources
- The userConfirms each requirement (editing one takes a reason) and signs the VP and the URSSigned with a PIN
- 2. DesignAIDrafts the technical specification with the regulatory library, assesses the risks of each confirmed requirement and writes the DQ protocol
- The userAdjusts severity, probability and detectability with a justification, confirms each risk and signs the TS, the RA and the DQ protocolSigned with a PIN
- 3. ExecutionAIWrites the IQ, OQ and PQ protocols with the confirmed risks for each stage
- The userApproves each protocol and provides the evidence for each stepSigned with a PIN
- AIAssesses each step against its evidence and proposes pass or fail
- The userConfirms each result; a manual pass takes a reason
- OqoVal, no AIOpens a deviation for every fail and generates the execution, the deviations and the report with its conclusion
- The userSigns the execution, the deviations and the report of each qualificationSigned with a PIN
- 4. ClosureOqoVal, no AIComputes the residual risk and the traceability matrix
- AIDrafts the justification of the residual risk and the validation report
- The userSigns the RRA, the matrix and the validation report: the new baseline is setSigned with a PIN
- 5. Validated stateOqoVal, no AISends reminders 30 and 7 days before each periodic review and on the day it is due, and escalates delays
- AISuggests the impact of each change, line by line
- The userDecides each line, with a justification when taking no action, and signsSigned with a PIN
Everything stays in the audit trail: what AI proposed, with which model and sources, and who confirmed, corrected and signed each document, with its verification QR code.
AI with a trail
A regulatory library provides the context the AI drafts from. Every generation records which model produced it and which sources it used, and changing the model requires change control.
Verifiable electronic signatures
Signatures under 21 CFR Part 11: a personal PIN for every signature, a SHA-256 fingerprint of the document and a manifest with the meaning of each signature. A QR code in the PDF lets any inspector check that the signature is authentic. A signed document is never overwritten: a new version is a new document.
The validated state, after release
Periodic review by system criticality (6, 12 or 24 months), change control, retirement and migration, as Annex 11 requires.
Benefits
What changes for the consultant and their client when AI drafts and a person decides.
More control
OqoVal does not allow signing with gaps: a confirmed risk without a test that covers it, or without a waiver justified by a person, blocks the signature. A deviation only counts as resolved if its step passes in the latest run, and a signed document is never overwritten.
Less time
AI generates in minutes what the consultant would otherwise write by hand. On a real project, the design qualification protocol, with 486 test cases, was generated in 5 minutes and 44 seconds, and the assessment of 486 risks in 8 minutes and 20 seconds, with the Word and PDF files ready to review.
More projects with the same team
Consultants no longer draft or format: they review, correct, approve and sign. The hours that went into writing are freed up, and the same team takes on more projects without adding staff.
Lower cost
Fewer consultant hours per project means a cheaper validation for the client. What remains is the work that takes expert judgment, which is what defends the system in an audit.
Also
- A change does not mean starting over: when requirements are regenerated, OqoVal keeps the ones already confirmed and flags what conflicts or becomes obsolete, so a person can decide.
- Documentation comes out in Spanish, English or Portuguese, including both languages in the same document: it works in Spain, Portugal and Latin America.
- The validated state is not forgotten: OqoVal sends a reminder 30 and 7 days before each periodic review and on the day it is due, and escalates it if it is 15 days late.
- Every generation is recorded with the model that produced it, what it was asked, what it answered, how long it took and what it consumed. The real cost of each project can be measured.
- Every document follows the same structure, with configurable, versioned Word templates for each document type.
“We wanted our consultants to stop writing documents and spend their time on what only an expert can do: review, decide and sign. With OqoVal, AI prepares the validation documentation and every decision is still made by a person, with everything on record for the audit. We validate faster and at a lower cost, without giving up anything on regulatory compliance.”
How we built it
Its development follows a GxP quality system.
- Documented change control for every change.
- An independent quality lead, formally appointed, with the authority to reject changes.
- Every regulated change is reviewed blind by a second, independent session with the right of veto, and verified with tests before it is accepted.
- An audit trail that admits no changes: the database itself refuses to modify or delete its records.
Let's talk about your system
If you need a GxP tool with AI built with the same rigor, tell us which process you want to solve.