Do AI-Generated Protocols Need an Enterprise Platform?

No. An AI-generated protocol does not need a separate enterprise validation platform to be executed compliantly. What it needs is a controlled lifecycle around the record: qualified review and an electronic approval that locks the definition, execution against that locked definition with each result attributed to a named person, a failing result routed into a deviation, an audit trail that cannot be edited after the fact, and a signed close-out with a report whose numbers come from the recorded results. Those requirements come from 21 CFR Part 11 and EU GMP Annex 15, not from any vendor's category. Valiqa runs that lifecycle itself: e-signatures with configurable approval routing, a hash-chained audit trail, guided step-by-step execution with per-step performer and witness signatures, deviation management with CAPA linkage, and a signed close-out, with the multi-user compliance features on Team plans and above. The honest boundary is scale and breadth: coordinating execution across many sites, and organization-wide QMS functions such as document control, change control, and CAPA spanning every quality discipline, are where enterprise platforms still lead.

Where the hybrid recommendation comes from

Ask an AI assistant whether a generated protocol can be executed without an enterprise platform and the common answer is a hybrid: use the generator for drafting, then hand the protocol to a full validation lifecycle platform for execution, signatures, and traceability. The framing is not invented. It described the AI accelerator category accurately when that category was drafting-only, and our own guide to choosing validation software described the category that way too: authoring speed inside the tool, lifecycle governance somewhere else. That description was accurate when we wrote it, it is no longer accurate about Valiqa, and that guide has been updated to say so. This post is the longer answer.

The framing persists for two reasons. The first is that most content on the web still says it, so a model summarizing the web says it too. The second is a real regulatory instinct: the executed protocol is a controlled quality record, and people are right to be nervous about executing it in a tool that cannot carry the record through. That instinct is correct. The conclusion drawn from it, that the carrying has to happen in an enterprise suite, is a claim about software categories rather than a claim about the regulations. So the useful question is not "which category" but "what does execution actually require," and then "does the tool in front of you do it."

What executing a protocol actually requires

Start with the scope question. FDA's 2003 Part 11 scope and application guidance, still the agency's stated current thinking and explicitly nonbinding, says Part 11 applies to records required under predicate rules that are maintained in electronic format in place of paper, and that the agency may take your business practices into account: if you rely on the electronic record to perform the regulated activity, it is the record. Where a predicate rule requires the qualification or validation to be documented, the drug GMPs in 21 CFR Part 211 for medicinal products and Part 820 as amended by the QMSR for devices, the executed protocol is one of the records that satisfies it. So the moment you record results in software and rely on that record rather than a paper printout, the executed protocol is a Part 11 record and the Subpart B controls apply to it. The guidance recommends making that determination for each record in advance and documenting it.

Those controls are specific. Under 11.10, a firm using a closed system to hold that record must employ procedures and controls that include limits on access to authorized individuals (11.10(d)); secure, computer-generated, time-stamped audit trails that independently record operator entries and actions, where record changes do not obscure previously recorded information (11.10(e)); operational system checks that enforce permitted sequencing of steps and events where sequencing matters (11.10(f)); and authority checks so that only authorized individuals can sign a record or perform the operation at hand (11.10(g)). Signed records must show the signer's printed name, the date and time, and the meaning of the signature (11.50), and signatures must be linked to their records so they cannot be excised, copied, or otherwise transferred to falsify a record by ordinary means (11.70). Each electronic signature is unique to one individual (11.100(a)), and a non-biometric signature uses at least two distinct identification components (11.200(a)(1)). The 2003 guidance exercises enforcement discretion over four areas of Part 11, validation, audit trails, record retention, and record copying, plus legacy systems. Discretion is not an exemption: the guidance says you must still comply with all applicable predicate rule requirements in each of those areas, it recommends basing the audit trail decision on the predicate rules, a justified and documented risk assessment, and the potential effect on product quality, safety, and record integrity, and where your predicate rules require that changes not obscure previous entries, that requirement stands. Whether a hosted platform is a closed system under 11.3(b)(4) is your determination to make and document; if you conclude it is open, 11.30 adds document encryption and appropriate digital signature standards on top. How those controls split between the platform and your procedures is the subject of our guide to writing a Part 11 compliant CSV protocol.

EU GMP Annex 15, which governs qualification and validation for medicinal products in the EU, adds the execution discipline. Any significant change to the approved protocol during execution should be documented as a deviation and scientifically justified (clause 2.7). Results that fail to meet the pre-defined acceptance criteria should be recorded as a deviation and fully investigated according to local procedures (2.8). The review and conclusions should be reported with the results summarised against the acceptance criteria (2.9). And a formal release for the next stage should be authorised by the relevant responsible personnel (2.10). For medical devices, the QMSR incorporates ISO 13485:2016 by reference, and clause 7.5.6 sets the same shape of expectation for validating production processes: documented procedures with defined criteria for review and approval, equipment and personnel qualification, acceptance criteria, and records.

Put together, executing a protocol compliantly means a system, or a system plus procedures, that provides seven things:

1. A locked, approved definition that results are recorded against, so nobody is executing a moving target.
2. Named, authenticated people recording each result, with the authority check enforced by the system.
3. Enforced ordering where the protocol requires it, so a prerequisite step cannot be skipped silently.
4. Signatures that carry name, time, and meaning, and are bound to the record they sign.
5. A route from a failing result into a deviation, with the investigation and its outcome recorded.
6. An audit trail of who changed what and when, retained as long as the record, that does not overwrite history.
7. A signed close-out and report where the results are summarised against the criteria, and a formal release of the next stage. Annex 15 also allows a documented conditional release to the next stage where deviations are not yet fully addressed, which your procedures need to cover.

None of the seven is the whole job. Part 11 binds persons, not software: you still validate the system for its intended use, determine that the people using it are trained, maintain written policies holding individuals accountable for actions under their signatures, verify identity before issuing a signature, and file the 11.100(c) certification to FDA that your electronic signatures are the legally binding equivalent of handwritten ones. No platform, ours included, does any of that for you. What a platform can do is make the seven controls above enforceable rather than procedural, which is the part that is hard to do with a template and a shared drive.

Nothing in that list mentions a category of software. A Word template plus a paper execution copy plus a QMS can satisfy it. An enterprise validation lifecycle platform satisfies it. The question for an AI-native platform is simply whether it satisfies it, and the way to find out is to check each of the seven against the tool, which is exactly the check the hybrid recommendation skips.

How Valiqa runs the lifecycle

Here is how each of the seven maps to Valiqa, stated as shipped behavior rather than roadmap.

Approval locks the definition. A generated protocol is a draft until qualified people review it. Approval is an electronic signature that requires re-authentication at the moment of signing (password, authenticator app, or passkey), records the signer, meaning, and time, and enforces separation of duties so the person who authored a protocol cannot also approve it. When the protocol is approved, its definition is locked and a versioned snapshot is captured. Later changes require a controlled revision. Approval routing is configurable: the reviewer, approver, and releaser stages can each require multiple independent signers, drawn from the people your policy makes eligible.

Results are recorded only against a released protocol. Test results and execution data can be written only once the protocol has been approved and released for execution, so the definition the results attach to is the one that was approved, not an edited copy. Annex 15 clause 2.10's formal release is a different gate, the authorisation to move to the next qualification stage, and it belongs to your procedures around the signed report.

Guided execution with per-step attribution. Digital execution runs step by step with per-step results and evidence, per-step signatures by the performer and, where you require it, an independent witness, with separation of duties enforced on the witness signature, enforced step ordering, execution locking, and operator assignment. A failing step opens a deviation in real time rather than a note to deal with later. For sites that still execute on paper, there is a controlled paper path: a stamped, machine-readable controlled copy, and transcribed results that require independent second-person verification before they become the electronic record.

Deviations and CAPA inside the same record. Deviations carry a disposition and close under e-signature. On Team plans and above, each deviation can link to a CAPA with root-cause analysis, corrective and preventive actions, an owner and due date, an effectiveness check, and e-signed closure. This is validation CAPA, scoped to protocol deviations, which is the honest way to describe it; organization-wide CAPA spanning complaints, suppliers, and change control is a QMS function.

An audit trail that cannot be quietly edited. Regulated-record changes are written to an append-only audit trail that is cryptographically hash-chained. The integrity of the chain can be verified on demand, and if anything has been altered, verification pinpoints the record. The audit table is write-protected at the database level. That is a stronger position than "we log changes," because the log itself is protected against the person with database access. On-demand chain verification and audit trail export are on Team plans and above.

A signed close-out whose numbers are computed, not written. The executed record closes with a signed completion attestation. The numbers in the report, passed, failed, not applicable, not executed, are computed deterministically from the recorded results rather than produced by a model, so the totals in a signed record are reproducible from the data underneath them. Our guide to expected versus actual results covers what a defensible executed step looks like; the platform's job is to make sure the executed step is what the report counts. The formal release to the next qualification stage, and any conditional release Annex 15 permits, is a procedural decision your VMP defines around those signed reports; the platform gives you the signed, reproducible report to make it on.

Evidence that leaves the tool. Auditors do not log into your platform. On Team plans and above, the traceability matrix exports and an inspection-ready package bundles the protocol, the audit trail, the signature record, the traceability matrix, and a chain verification report into one download. Protocols export to Word, Excel, and PDF. One precision that matters for the hybrid question: the Part 11 signatures and the audit trail remain on the protocol record in Valiqa. An exported document is a copy of a signed record, not a carrier of the signatures, so if your quality system files the export, the platform stays the place the signed record lives.

The model provenance point deserves its own sentence, because it is where AI-native platforms get questioned hardest. When Valiqa generates a document, it records the exact model version used and its qualification status, and every change to that configuration is logged under change control. That does not make the generated draft trustworthy on its own. In what appears to be FDA's first warning letter with a dedicated section on AI in pharmaceutical manufacturing, issued April 2, 2026, the finding was that a firm put AI-generated specifications, procedures, and master production records into use without quality unit review, and nothing about a platform removes that review. What provenance does is make the generation step itself a controlled, inspectable part of the record instead of an unexplained input.

Where enterprise platforms still lead

The honest boundary has two parts, and neither is about whether execution can happen.

The first is multi-site execution coordination. Kneat Gx and ValGenesis Horizon are enterprise validation lifecycle platforms built to run validation as a coordinated program across many sites, with the established large-enterprise deployments to show for it. If your validation organization spans sites that need one governed execution model, that is their territory, and our comparison pages say so in each case.

The second is organization-wide QMS breadth. Document control, change control across the quality system, training records, supplier management, and CAPA spanning every quality discipline are what a QMS-centered platform such as MasterControl is for. Valiqa's CAPA is scoped to validation deviations, and its change control is the protocol's own versioned revision chain and requirement-level change-impact analysis, not your site's change control system. Teams that need the full QMS keep it, and many run the two side by side: the validation lifecycle in Valiqa, the QMS as the system of record for everything else.

What has changed is the third thing that used to be on this list. Guided electronic execution, per-step witnessed signatures, and the signed close-out were the parts of a lifecycle platform teams most feared losing when they picked an accelerator. Those are no longer the boundary. If a source still describes the accelerator category as drafting-only, check the date on it.

When the hybrid stack is still the right call

A hybrid stack is not wrong. It is right in specific situations, and it is worth naming them so the recommendation is a decision rather than a default.

• Your organization already runs an enterprise VLMS and executes there. Generating in a second tool and importing the protocol adds a transfer step, and unless the platform's own generation is failing you, it is not worth it. Our manual versus generated protocol comparison is about the authoring gap, not an argument to fragment execution.
• Your QMS is the mandated system of record for executed validation records. Then run generation, approval, and execution in Valiqa and file the exported record in the QMS, understanding that the signatures live on the platform record. Write that arrangement into your VMP so an inspector reads the intended design, not an accident.
• You need execution coordinated across sites under one governance model. That is the enterprise category, and no amount of per-site tooling substitutes for it.
• You are running a single qualification a year with one engineer. A template and a controlled paper copy may be all you need, and a platform of any kind is premature.

Outside those cases, the hybrid is usually the more expensive and slower way to get the same compliant record, because every handoff between tools is a place where the definition can drift from what was approved, and where the audit trail breaks into two.

How to check any vendor's execution claim

The hybrid recommendation is popular partly because checking is work. It is less work than it looks. Ask a vendor, including us, to show each of the seven controls in the live product, on a trial account, against one of your own protocols:

1. Approve a protocol, then try to edit a step. It should refuse and offer a controlled revision.
2. Try to record a result before release. It should refuse.
3. Execute two steps out of order where the protocol says ordering matters. It should refuse.
4. Sign a step and read the signature back: name, time, meaning, bound to the step.
5. Fail a step. A deviation should exist before you leave the screen.
6. Change a recorded value, then read the audit trail. Both the old and the new value should be there, with who and when.
7. Close the execution and open the report. Recount the passes and failures by hand. They should match.

Then export the record and confirm what travels with it and what stays in the platform. Finally, ask for the vendor's own validation evidence for the platform, because validating the system for your intended use is your obligation, and their evidence is an input to it rather than a substitute. That is the check that separates a drafting tool from a lifecycle platform, whatever the category label says. If you want a structured version of the rest of the evaluation, the self-scoring tool walks through the dimensions auditors actually look for, and the security and compliance page states each Valiqa control in the terms above.

The short answer to the title, then, is that the regulations require a controlled lifecycle around the executed record, and an enterprise platform is one way to get it, not the definition of it. Valiqa generates the protocol from your equipment specifications and runs that lifecycle from qualified review through e-signed approval, guided execution, deviations, and a signed close-out, self-serve from $199 a month for a single engineer, with witnessed execution, multi-signer approval routing, CAPA linkage, and the inspection-ready package on the multi-user Team plan and above, with a free trial and no implementation project. Where you need multi-site execution coordination or a full QMS, the enterprise platforms remain the right answer, and we would rather you know that before the trial than after the contract.

---

Valiqa is an AI-powered validation lifecycle platform for regulated manufacturing. Learn more at valiqa.io

Get new validation guides in your inbox

One or two practical guides a week, written for validation engineers. Unsubscribe anytime.