An investigator from the FDA's district office is sitting in a conference room at your sponsor's site, and she has asked a question that sounds simple and is not: "Show me how this paragraph in the Module 2.5 Clinical Overview was produced." The paragraph was drafted by an AI tool, edited by a writer, reviewed by a co-author, and reconciled against the TLF, and the only acceptable answer is a record that lets her reconstruct every one of those steps without taking your word for any of them. That record is the AI output audit trail, and building it is the discipline that separates an AI-assisted document that survives an inspection from one that becomes a Form 483 observation and, if mishandled, a line in the Establishment Inspection Report that follows the product through its lifecycle. This lesson specifies what gets logged, where it lives, and in what format, and ties every element back to the two regimes that govern it: 21 CFR Part 11 in the United States and EU Annex 11 in Europe. The framing throughout is ALCOA+, the nine attributes of data integrity that a regulator applies to every record, and the run-capture discipline introduced in Level 1 is the raw material the audit trail is built from. The model drafts; the audit trail is how you prove the human stayed in command.

What the Audit Trail Is Actually For

The audit trail exists to answer one question under adversarial conditions: can an independent party reconstruct how this record came to be, without trusting the people who made it? That framing matters because it changes what counts as adequate. A note in a writer's email saying "I used the company AI for the first draft" is a recollection, not a record, and it collapses the moment an investigator asks for the specific prompt, the model version, or the sources that were loaded. Part 11 governs the trustworthiness and integrity of electronic records and electronic signatures, and Annex 11 governs computerized systems in the EU GxP environment, and both demand that the trail be contemporaneous, attributable, and tamper-evident, which a reconstructed-after-the-fact story can never be. The audit trail is the engineered answer to a question you will be asked under pressure, by someone whose job is to disbelieve you until the record proves otherwise.

There is a structural reason AI makes this harder than traditional document authoring, and naming it sharpens the whole design. In a conventional workflow, the document and its track-changes history are the record of who wrote what. In an AI-assisted workflow, a generative step sits between the source data and the human-edited text, and that step is non-deterministic, invisible by default, and capable of introducing content that exists in no source. The audit trail must therefore capture not just the human edits but the generative event itself, the conditions under which the AI produced its output, so that a reviewer can distinguish text that was transcribed from a source, text that was generated and then verified, and text that was generated and accepted. Without that capture, the document is a black box, and a black box fails Part 11 and Annex 11 on first principles, because neither regime permits a record whose origin cannot be examined.

ALCOA+ Applied to a Generative Event

ALCOA+ is the lens that tells you whether your audit trail is complete, and applying its nine attributes to an AI generative event turns an abstract principle into a concrete checklist. Attributable means the record ties to a specific human and a specific system: the named author who accepted the output and the identified AI tool, model, and version that produced it. Legible and Enduring mean the log is human-readable and durable across the retention period, not locked in a vendor format that expires when the contract does. Contemporaneous means the run metadata is captured at the moment of generation, not reconstructed at lock, because a timestamp written after the fact is precisely the kind of record both regimes treat as suspect.

The remaining attributes are where AI-specific failure modes hide. Original means the audit trail preserves the actual AI output as generated, before human editing, so a reviewer can see what the model produced versus what the author changed; losing the raw generation and keeping only the final text destroys the ability to assess whether verification actually happened. Accurate and Consistent mean the logged metadata correctly describes the event and agrees across the system, so the recorded model version is the one that actually ran. Complete means no step is silently dropped: if the writer regenerated the section three times and kept the third, all three runs and the selection decision belong in the trail, because the absence of the discarded runs hides the variation that is itself a quality signal. Available means the trail can be produced on request during an inspection without a multi-week reconstruction project. Run ALCOA+ against any proposed logging scheme and the gaps reveal themselves immediately, which is exactly why it is the framing the FDA-EMA principles inherit.

What Gets Logged: The Generative Event Record

The core unit of the AI audit trail is the generative event record, the structured capture of a single AI run, and specifying its fields precisely is the heart of this lesson. At minimum it captures the prompt as submitted, the system prompt identity and version, the model name and version, the temperature and any other sampling parameters, the exact set of source documents loaded into the context window, the timestamp, the identity of the human operator, and the verbatim output the model returned. Each field answers a question an investigator will ask: the model and version answer "which system produced this," the loaded sources answer "what could it see," the temperature answers "how deterministic was it," and the verbatim output answers "what did it actually say before you edited it." A generative event record missing any of these is a record that cannot fully reconstruct the event, and partial reconstruction is the failure mode that turns an inspection finding into a credibility problem.

Two fields deserve special emphasis because they are the ones teams most often omit. The exact source set is critical because the central risk of generative AI in this domain is content that exists in no source, and you cannot assess that risk without knowing precisely what was loaded; "the relevant CSR sections" is not a source set, the specific document versions and identifiers are. The verbatim pre-edit output is critical because it is the only evidence that verification was a real act rather than a claim: when the trail shows the model generated a hazard ratio of 0.68 and the author changed it to the source value of 0.71, that delta is the documented proof of a working verification step, and when the trail shows the model wrote 0.68 and the final document says 0.68, the reviewer can confirm that value against the TLF. The generative event record is, in effect, the deposition of the AI, taken contemporaneously, and a deposition with missing answers is worth little when the questions get hard.

Where It Lives: System of Record, Not a Side File

A correct audit trail that lives in a spreadsheet on a writer's laptop is not a correct audit trail, because location determines whether the record is attributable, tamper-evident, and available, three ALCOA+ attributes that a side file fails. The generative event records must be bound to the document they produced inside a validated, access-controlled system of record, in practice the regulatory or quality content platform such as Veeva Vault that already holds the document under change control and electronic signature. Binding the AI run metadata to the document version means that when an investigator opens the Module 2.5 in the system and asks how a paragraph was produced, the generative event record is one navigation away and provably associated with that exact version, not asserted to be associated by a human who could be wrong or worse. The platform's existing Part 11 controls, the audit trail of who accessed and changed what, the electronic signatures, the version history, then extend to cover the AI provenance, which is exactly the integration the August 2026 Veeva Vault release and the Certara CoAuthor + Vault RIM integration are built to provide.

The format discipline matters as much as the location. The generative event record should be structured and machine-readable, a defined schema with named fields, not free text, because a structured record can be queried, validated for completeness, and reliably retrieved, while free text invites omission and ambiguity. The structured-output discipline from earlier in this level is the same discipline applied to provenance: the same rigor that produces a machine-readable claim-to-cell map should produce a machine-readable run record. Where the AI tool and the content platform are integrated, this capture should be automatic, written by the system at generation time rather than typed by the writer afterward, because Contemporaneous and Accurate are far better served by machine capture than by human memory. The design goal is a trail that the system produces as a byproduct of the work, so that doing the work correctly and creating the record are the same action.

How the Document Survives the Inspection

Trace the inspection scenario end to end and the audit trail's purpose becomes concrete. The investigator selects the Module 2.5 efficacy paragraph and asks for its provenance, and a defensible workflow answers in four moves: here is the generative event record showing the model, version, temperature, loaded sources, and verbatim output; here is the document version history showing the human edits applied to that output; here is the claim-reconciliation log showing each factual claim verified against its TLF source; and here is the electronic signature of the named author who accepted the final text. Those four artifacts together let the investigator reconstruct the paragraph's life without trusting anyone, which is the entire point. The sponsor's position is not "trust our AI"; it is "examine our record," and the strength of that position is the difference between a clean inspection and a 483.

Understanding the inspection's named outputs sharpens why this matters. During an FDA inspection, observations of objectionable conditions are issued on a Form 483 at the close-out, and the investigator's full narrative is the Establishment Inspection Report, the EIR, which classifies the inspection and persists in the agency's record. An AI-assisted document with an inadequate audit trail is a candidate 483 observation, because the inability to show how a record was produced is itself a data-integrity deficiency under Part 11, independent of whether the content turned out to be correct. The danger compounds: a single observation that the AI provenance for one paragraph cannot be reconstructed invites the investigator to question every AI-assisted record, and the EIR classification can shift from "no action indicated" toward "voluntary action" or worse. The audit trail is not paperwork; it is the control that keeps a tool-assisted efficiency from becoming a regulatory liability.

The Run-Capture Discipline as Daily Practice

The audit trail is only as good as the discipline that feeds it, and that discipline is run-capture: the habit, ideally automated, of recording the generative event at the moment it happens. The Level 1 insight was that temperature makes output vary run to run, so the prompt alone is not a record; the specific run is the record. At Level 3 that insight becomes an operational requirement, because you are now designing the workflow that enforces capture rather than merely practicing it yourself. The design principle is that no AI output may enter the document pipeline without an associated generative event record, enforced as a gate the same way the hallucination protocol gates on unresolved flags. A draft that arrives without provenance is not a fast draft; it is an undocumented one, and an undocumented draft is a future inspection finding wearing the disguise of saved time.

The hardest part of run-capture is the discarded runs, and getting this right is what distinguishes a sophisticated audit trail from a naive one. When a writer generates a section, dislikes it, regenerates, and keeps the second version, the naive instinct is to log only the kept version, but Complete under ALCOA+ requires capturing that a selection happened and on what basis. Logging the discarded runs is not bureaucratic overhead; it is the record that the variation was seen and a deliberate choice was made, which is precisely the evidence of human command that the accountability principle demands. It also preserves the cheap hallucination signal from Level 1, because the discarded runs may disagree with the kept one on a factual value, and that disagreement is a flag the audit trail should carry forward to reconciliation. The mature workflow treats every generation as an event worth recording, selects among events deliberately, and documents the selection, so that the audit trail tells the true story of how the human navigated the model's variation rather than a sanitized story of a single clean run that never happened.

Building the Trail Into the Workflow, Not Onto It

The final design principle is that an audit trail bolted on after the work is brittle and an audit trail built into the work is durable, and the entire Level 3 posture follows from choosing the latter. A bolted-on trail depends on writers remembering to record metadata they cannot easily reconstruct, which fails Contemporaneous and Complete the first time a deadline compresses; a built-in trail is produced by the system as the writer works, which satisfies both attributes by construction. This is why the integration of the AI tool with the validated content platform is not a convenience but a control: when generation, editing, signing, and provenance capture all happen inside one Part 11 system, the audit trail is a structural property of the workflow rather than a task the writer might skip. The validation obligation extends to this integration, because under the IQ/OQ/PQ mindset you must demonstrate that the capture mechanism reliably records the right metadata for the right document version every time, not just when someone remembers to check.

The principle generalizes beyond the Module 2.5 example to every AI-assisted artifact this program touches, the ICSR narrative, the PSUR section, the comparability protocol, the briefing book, because the regulatory logic is identical: any record whose origin includes a generative AI step must carry the provenance to reconstruct that step, or it is not a defensible record. The cover-letter disclosure of AI involvement, which earlier lessons treated as emerging practice, is in this light simply the human-readable summary of an audit trail that already exists in the system; if the disclosure says AI assisted the drafting, the audit trail is what backs that statement when the investigator asks to see it. The discipline scales because it is grounded in two regimes that are not changing, Part 11 and Annex 11, read through ALCOA+, and the sponsor that builds capture into its AI workflows now is building the only foundation on which every later claim of GxP-defensible AI use can stand. Design the trail first, and the document defends itself.

Key Takeaways

• The AI audit trail exists to let an independent party reconstruct how an AI-assisted record was produced, without trusting the people who made it. Part 11 and EU Annex 11 demand a contemporaneous, attributable, tamper-evident record, which a reconstructed-after-the-fact story like "I used the company AI" can never satisfy.
• The core unit is the generative event record: prompt, system prompt version, model and version, temperature, exact loaded sources, timestamp, operator identity, and verbatim pre-edit output. The exact source set and the verbatim output are the two fields teams omit most, and they are the ones that prove what the model could see and that verification was real.
• ALCOA+ applied to a generative event is the completeness check. Original requires preserving the raw output before editing; Complete requires logging discarded runs and the selection decision; Contemporaneous requires capture at generation time, not at lock; and a side file on a laptop fails Attributable, Available, and tamper-evidence on location alone.
• The trail must live bound to the document version inside a validated Part 11 system of record, in a structured machine-readable format. Binding the run metadata to the exact document version in the content platform extends the platform's existing audit-trail, signature, and version controls to cover AI provenance, which is what makes the document one navigation away from defensible during an inspection.
• Build the trail into the workflow, not onto it. An AI-assisted document survives an inspection when the generative event record, the version history, the claim-reconciliation log, and the named author's signature together reconstruct the paragraph; an inadequate trail is a candidate Form 483 observation and can shift the Establishment Inspection Report classification, independent of whether the content was correct.