# Ready for the inspector, every day

> Life sciences and pharma. SOPs, deviations, CAPA, change control and training records for manufacturers, sponsors and contract manufacturers. Agents draft, named people sign, and an inspector can verify the record offline.

## What gets asked: What the inspector asks.

A GMP inspection comes down to a few questions about data integrity. Each one needs evidence, not a promise.

- **The SOP in force.** For this batch, this deviation or this cleaning: which version of the procedure applied on that date, and was it the approved one?
- **Training before the task.** Whether the person had acknowledged the current version of the procedure before performing it.
- **The meaning of a signature.** Who approved the change, what the approval meant, and whether it is tied to the exact content they reviewed.
- **Changes after the fact.** Whether a record, an audit trail entry or a signed version was altered after the fact, and how anyone would know.
- **The role of AI.** Which steps an AI agent performed, for whom, and which qualified person took responsibility for the output.
- **Validation of your configuration.** Validation evidence for the lifecycles, roles and rules you actually run, not only for the product in general.

## How Tabellix answers: Each answer, from the record.

Numbered to match the questions above.

- **Pinned to the version in force.** An event record links to the procedure version in force when it happened, and that link never moves. Release and supersession are transitions on the ledger, so the version in force on any date is a lookup.
- **Training starts at release.** A version going into force starts a training campaign for the people in the role. Each acknowledgement becomes a training record linked to that exact version.
- **Signatures with meaning.** Each signature records its meaning, binds the version and the viewing copy the signer saw, and requires a fresh sign-in. It adds a signature page to a new PDF/A.
- **Tamper-evident, verified offline.** Versions are never edited, captured fields lock at capture, and a correction is an amendment with a reason. Signed, timestamped checkpoints let an inspector [verify the history offline](https://tabellix.dev/trust/).
- **Agents draft, people sign.** Tabellix is built for the human oversight the draft EU GMP Annex 22 expects for generative AI: under the regulated preset, only named people approve and sign. Every [agent action](https://tabellix.dev/agents/) is recorded with the person it acted for.
- **Evidence for your configuration.** Exhaustive transition tables are generated from each lifecycle you configure. An IQ/OQ package and a traceability matrix are generated from the same traces as the code, and 36 installation checks qualify each deployment.

## Typical records: The GMP record set, as configuration.

Each type below is configuration: its fields, lifecycle, signature meanings and retention. The engine knows nothing about GMP.

| Record | Kind | What it holds |
| --- | --- | --- |
| SOP-0042, equipment cleaning | document | Draft, review and approval into a new major version, effective now or on a scheduled date; the previous version superseded in the same step; periodic review on schedule. |
| Quality agreement with a contract manufacturer | document | Versioned and shared with the supplier under an agreement and watermarks, with a report of what they fetched. |
| Temperature excursion, cold room 2 | event record | Value, limit, time and equipment, locked at capture and linked to the monitoring SOP version in force. |
| Deviation DV-0193 | case record | Opened from the excursion. Investigation, impact assessment and QA approval are lifecycle steps; the excursion and its evidence are members. |
| CAPA | case record | Actions with owners and due dates as workflow tasks; each completion takes the assignee's own signature with the meaning of the step. |
| Change request | case record | Affected documents linked and pinned to their versions; approvals signed with their meaning; an author cannot approve their own change. |
| Training record | event record | Created by each acknowledgement and linked to the version the person read. |

[Documents, records and the evidence about both](https://tabellix.dev/records/)

## Mapped frameworks

**Controls map to:** 21 CFR Part 11, EU GMP Annex 11, GDPR, EU AI Act.

Product controls map to these regulations and standards and provide evidence for your own validation and audits.

[How the evidence is produced and verified](https://tabellix.dev/trust/)

## Go deeper

- [Agents](https://tabellix.dev/agents/): AI agents act for a person, never above that person, and named people stay accountable.
- [Trust and verifiability](https://tabellix.dev/trust/): A hash-chained ledger, signed checkpoints and evidence an auditor verifies offline.
- [Records, not files](https://tabellix.dev/records/): Documents, records and the evidence about both, and what belongs in a system of record.
- [OEM and white label](https://tabellix.dev/oem/): Embed Tabellix as the record layer of your product and ship it under your own brand.
- [Medical devices and healthcare](https://tabellix.dev/industries/medical-devices/): Design history, complaints, and access records with controls that map to ISO 13485 and HIPAA.

## FAQ: Common questions.

### Is Tabellix a QMS?

No. Tabellix is the record layer a QMS is built on: documents, records, signatures, workflows, training, retention and the audit trail. The QMS vendor builds the screens and ships the product under its own brand.

### What does Tabellix do for the draft EU GMP Annex 22?

The draft keeps generative AI out of critical GMP applications and expects qualified people to stay responsible for AI outputs. Tabellix is built for that human oversight: under the regulated agent preset, agents draft and named people review, approve and sign, and every agent action is on the audit trail. Validating an AI model remains the regulated user's responsibility.

### Can an inspector get access without a user account?

Yes. An inspector session gives a regulator or auditor read-only access, fixed in scope, for at most 72 hours, closed by the clock or on demand. A sealed disclosure lets them verify what they received offline.

### How do contract manufacturers see our documents?

Through invited accounts and shares: expiring, watermarked, with an agreement before any content and a report of what each recipient fetched. A share never serves more than the sharer may still read.

### How does a QMS vendor keep validation current?

Configuration changes ship as releases that are reviewed as a diff, approved by people other than the author, and checked against existing data. The release in force is stamped on every audit entry, and the validation evidence is regenerated from the same traces as the code.

## Contact

Tell us what you build and who audits it. We'll show you how Tabellix fits into your product and how it answers your auditors' most common questions.

Contact form: https://tabellix.dev/contact/

---

This page as HTML: https://tabellix.dev/industries/life-sciences/ · [Site guide for language models](https://tabellix.dev/llms.txt)