Early human verification with a 21 CFR Part 11 signature at the line
Nothing iLEAN captures enters the electronic batch record without a qualified operator signing it electronically first. In every suite and every control room, an industrial tablet shows a 2-second visual summary and collects the 21 CFR Part 11 signature by design. It is the compliance contract's "humans in command" pillar, applied on every capture the system makes.
The fear is not the AI — it is it inserting data into the batch record with nobody seeing it.
In a hormonal pharmaceutical plant, the electronic batch record is the file sustaining every batch's release. Any data entering wrong — a misidentified batch, a badly recorded charge, a mistranscribed in-process control — forces reconstructing the QA-release cycle: deviations, an investigation, Quality hours and, in the worst case, a held batch. That is why the number one cultural brake on digitization in pharma is exactly this:
- The fear of the AI writing on its own — if a system inserts data alone into the batch record and one later turns out wrong, the cost is not correcting a field: it is reopening the investigation of everything that depended on it. It is the first thing Quality and Regulatory ask to see at the first meeting: who signs this before it exists?
- But the operator does not want to type evidence either. If the alternative to the AI is transcribing every event by hand into a form, the evidence arrives late, incomplete or not at all — and the data remains unreliable, only now nobody knows it is.
Full automation does not pass Regulatory. Capturing nothing does not work. The answer is not choosing an extreme — it is putting a third ring between the two.
Connect in early-human-verification mode — the signature putting the person before the batch record, not after.
Everything iLEAN does rests on three safety rings: Connect transports the data as it arrives (photo, voice, parsed email, panel reading), Agents interprets it and decides what action to propose, and the person signs before it crosses into the batch record. That separation is the backbone of the whole iLEAN matrix in pharma — and this piece is where the third ring becomes visible and tactile: an industrial tablet in every suite and every control room, with a 21 CFR Part 11 signature on every capture.
An industrial tablet in every suite and every control room. A 2-second visual summary. An auditable electronic signature — user, timestamp, meaning, hash — before the data crosses into the batch record.
How early human verification operates in a hormonal pharmaceutical plant:
- An industrial tablet in every suite and every control room — a UI designed for validating in 2 seconds, not data entry. No keyboard and no nested menus: a visual summary and a decision.
- A visual summary (product, batch, event) — whether the data comes from a photo, voice, a parsed email or a panel reading, Connect normalizes it to the same simple format before showing it to the operator.
- An auditable electronic signature — every validation records the qualified user, timestamp, meaning and hash of the signed content. It complies with 21 CFR Part 11 by design: the signature is not an added module, it is the condition for the data to exist.
- Latency between capture and a clean batch record: seconds — the signed data reaches the record almost as it is generated, not at the shift's end or the batch review.
- No signature, no batch record — if the operator does not validate, the data stays held and contaminates nothing downstream. The suite continues; the data waits.
Unvalidated data (or uncaptured out of distrust) vs. data signed in seconds
| Aspect | Unvalidated or uncaptured data | Data signed in seconds |
|---|---|---|
| Capture by photo/voice/email/panel | Discarded out of distrust, or entering straight unreviewed | Always passes through a visual summary and a signature before touching the batch record |
| The operator's evidence | Typing and transcribing by hand — arrives late, incomplete or not at all | A 2-second validation plus an electronic signature, without typing |
| Erroneous or doubtful data | Contaminates the batch record and forces reconstructing the QA-release cycle | It stays held — it does not cross into the record until someone signs |
| Traceability of each entry | Diffuse — it is not always known who recorded what or when | User, timestamp, meaning and hash on every signature — a complete audit trail |
| Time between capture and a clean batch record | Hours or shifts, if it gets recorded at all | Seconds |
| Quality's and Regulatory's stance on the AI | Blocked — "we do not know what is entering on its own" | A clean batch record defensible before the FDA: every data point carries a 21 CFR Part 11 signature |
Impact estimate for your plant — to be validated with your own numbers.
The block below is an estimate to be validated against your plant's actual data. We put it forward so the committee has an order of magnitude; we refine it during the assessment.
- It is the transversal enabling piece: every Connect, Edge or Agents case at your hormonal pharmaceutical plant depends on this ring existing so the data they capture can enter the batch record without fear.
- It does not replace work — it replaces doubt. The cost it avoids is not an operator hour, it is the paralysis of "Regulatory will never let us automate this".
- The indicators measurable from the first pilot — as estimates to be validated at each plant: the percentage of captures signed in under 5 seconds, and the percentage of held data that turned out to be real corrections — the latter measures whether the capture is well calibrated, not whether "the AI fails".
- We do not propose a payback in months here — that would be inventing a number only your plant's assessment can give. What we can state is that, without this piece, the rest of the IRIS roadmap at your plant stays a pilot and does not scale.
And the fair question from Quality and Regulatory
"Why not automate fully, if we already have AI that reads well?" — because reading well is not the same as deciding well, and deciding well is not the same as having authorization to write into the batch record with nobody seeing. iLEAN separates the three functions on purpose: Connect transports the data as it arrives, Agents interprets it and proposes the action, and the person signs before it crosses into the record. They are the three safety rings, and this piece is where the third becomes physical: a tablet, a 2-second summary, a qualified human signature. Hallucination is a problem of free generation, not of anchored tasks — in tasks where the AI limits itself to recontextualizing a data point (reading a panel, transcribing a label, parsing an email), the best models brought the error below 1.5% [1]. And even then, in pharma the critical does not sign itself: that is why the tablet exists.
[1] OpenAI paper "Why Language Models Hallucinate", 2025 — on the reliability of AI in anchored tasks.
What people ask about human verification with a 21 CFR Part 11 signature
Why not automate fully if there is already AI capable of reading the data well?
Because "reading well" is not the same as "having permission to write into the batch record with nobody seeing". iLEAN separates Connect (transports the data as it arrives), Agents (interprets and decides what action to propose) and the person (signs electronically before the data crosses into the batch record) — the system's three safety rings, and none replaces another. Full automation sounds faster, but it moves the risk from a one-off error to a systemic one: if the AI errs alone, it errs on every batch until someone detects it, and in pharma that means reconstructing the QA-release cycle. With the tablet, every data point entering the batch record carries a qualified human signature — it is the compliance contract's "humans in command" pillar, and exactly what Quality and Regulatory ask to see at the first meeting.
What exactly does the 21 CFR Part 11 electronic signature record?
Every signature is recorded with the four elements an auditable electronic record demands: user (the qualified operator, individually authenticated — the signature is attributable, not an anonymous click), timestamp (the validation's exact date and time), meaning (the signature's significance: verification of the capture, a correction, a hold) and a hash of the signed content, binding the signature indissolubly to that specific data point — if the data changed afterwards, the signature would no longer correspond to it. The set forms part of the system's audit trail: who signed what, when and why, queryable at an inspection. It is 21 CFR Part 11 by design: the signature is not an added module, it is the condition for the data to exist in the batch record.
What happens when the operator corrects a data point — is the AI's original lost?
No. When the operator corrects, the original data Connect captured is archived together with the correction, not overwritten — the batch record receives the validated data and the history keeps both, with the signature and meaning attached to each step. That matters for two reasons: first, data integrity in pharma demands being able to prove what happened, not only what was corrected — a deleted original data point is precisely what an inspector does not want to find. Second, it lets Quality audit whether the capture errs recurringly at a specific point (a label with a reflection, a badly lit panel) and adjust it with evidence, instead of impressions.
Does the same tablet work for all capture origins (photo, voice, email, panel)?
Yes — that is precisely this piece's point. The tablet is not channel-specific: it is the convergence point where the visual summary arrives, whether the data comes from a photo (a label, a panel, packaging material), from voice (the suite's lead dictating an observation), from a parsed email (a certificate of analysis a supplier sends) or from a direct panel reading. Connect normalizes each origin to the same simple summary — product, batch, event — so the operator does not learn a different interface per data source. A single validation gesture and a single 21 CFR Part 11 signature mechanic, whatever the capture channel.
How many tablets are needed per suite?
The usual start is one tablet per suite and one in each control room, at the station where the critical events concentrate: batch startup, material charges, in-process controls, stage closures. The exact number depends on where captures needing early validation are generated, not on the plant's square meters — an estimate to be validated at each case's initial assessment. The practical rule: cover the points where, if the data entered wrong, the impact would propagate to the batch record and force reconstructing the QA-release cycle. Expanding later is trivial, because the signature mechanic is identical on every tablet.
An early human signature, a clean batch record always — tell us your case and we will show you the tablet working at a plant like yours.
We work on your plant's real data, not ours. Assessment with no commitment.
See the tablet at the line in real operation ‹ See all 13 hormonal pharma cases See pharma