This is a ready-to-use log for every call an AI screening tool makes and what the human reviewer did with it. If an AI-assisted review is ever questioned in an inspection, you have to be able to show exactly what the model was given, what it returned, and how the named reviewer dispositioned it. If you cannot reconstruct that chain, the tool does not belong in a GxP workflow. This log is that chain. In practice it is generated automatically by the tool; this template defines the fields it must capture and gives a completed specimen. Replace every <<FILL: ...>> placeholder and treat the log itself as a GxP record under the same integrity expectations as anything else. This content is educational reference, not legal or regulatory advice; adapt it to your validated tool and quality system.
Header
| Field | Entry |
|---|---|
| Log / form number | <<FILL: FORM-ID>> |
| Tool / system name and ID | <<FILL>> |
| Intended use (one line) | <<FILL: what it screens for; it does NOT decide>> |
| Governing WI / SOP | <<FILL: WI-ID / SOP-ID>> |
| Retention | <<FILL: at least the retention of the records the workflow supports>> |
Field definitions
| Field | Format | Required | Captured by | Note |
|---|---|---|---|---|
| Call ID | Unique ID | Yes | Tool | One per model invocation |
| Timestamp | Trustworthy timestamp | Yes | Tool | From a synced clock |
| Input reference | Pointer to the controlled source item screened | Yes | Tool | Not the raw content if sensitive; a resolvable reference |
| Input version | Version of the input screened | Yes | Tool | The effective version at call time |
| Prompt version | Controlled prompt ID + version | Yes | Tool | Ties output to a reviewable prompt |
| Model identifier | Model name + pinned version | Yes | Tool | The exact model, not “the API” |
| Model output | Structured output returned | Yes | Tool | As returned, before human edit |
| Schema valid? | Yes / No | Yes | Tool | No routes to exception, never to a flag |
| Flag / result | The flag raised, or none | Yes | Tool | The screen result |
| Reviewer (named) | Person, not account alias | Conditional | Human | Required where a flag needs disposition |
| Disposition | Confirm / override / needs investigation / N-A | Conditional | Human | The human decision |
| Reason | Free text | Conditional | Human | Required for every disposition |
| Onward action | Deviation / correction / none | Conditional | Human | Where the confirmed flag went |
Instructions
- The tool writes one row per model call automatically. Do not summarize multiple calls into one row; each call must be individually reconstructable.
- The reviewer completes the disposition fields for each flag that needs a decision, with a reason for every disposition, override or confirm alike.
- A row with
Schema valid? = Nomust show the exception handling, never a silently passed flag. - Numbers and exact-match comparisons must be attributable to deterministic code, not to the model output; do not record a model-authored number as the decision value.
- Protect the log from edit: it is a GxP record. Corrections follow your normal record-correction rules, not an overwrite.
- Retain per the header.
Log grid (blank)
| Call ID | Timestamp | Input ref / ver | Prompt ver | Model id | Schema valid? | Flag / result | Reviewer | Disposition | Reason | Onward action |
|---|---|---|---|---|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Acceptance criteria
- Every model call has a row with input reference and version, prompt version, model identifier, output, and timestamp.
- Every flag that required a decision has a named reviewer, a disposition, and a reason.
- Schema-invalid outputs show exception handling, not a passed flag.
- The chain for any call can be reconstructed end to end from the log alone.
- The log is protected from silent edit and retained for the required period.
References
21 CFR Part 11 (electronic records; the log is itself a record). ALCOA+ as described in FDA data integrity guidance (2018), applied to the call log. FDA guidance, Computer Software Assurance for Production and Quality Management System Software. Parent WI / SOP and the tool’s validation summary.
Confirm the current version of each reference before use.
Filled specimen
Selected rows from a document gap-analysis run. Illustrative only.
| Call ID | Timestamp | Input ref / ver | Prompt ver | Model id | Schema valid? | Flag / result | Reviewer | Disposition | Reason | Onward action |
|---|---|---|---|---|---|---|---|---|---|---|
| C-8841 | 18 Jun 2026 09:41:02 | BR-2206-014 step 4.2 / v1 | GAP-2.1 | model-x-2026-05 | Yes | Cites SOP-1142 v3; effective v5 | K. Rao | Confirm | Verified against register: v5 effective since Apr | Record correction RC-2026-118 |
| C-8842 | 18 Jun 2026 09:41:03 | BR-2206-014 step 6.1 / v1 | GAP-2.1 | model-x-2026-05 | Yes | Step has no matching SOP instruction | K. Rao | Override | Instruction is in SOP-1150, cross-referenced; not a gap | None |
| C-8850 | 18 Jun 2026 09:41:11 | BR-2206-021 step 3.4 / v1 | GAP-2.1 | model-x-2026-05 | No | (schema fail) | K. Rao | Needs investigation | Malformed output; item screened manually, real gap found | Record correction RC-2026-119 |
Call C-8841 is fully reconstructable: the exact input and version, the prompt and model, the flag, and the reviewer’s confirmed disposition with a reason and the correction it triggered. Call C-8842 shows a documented override, the reviewer disagreeing with the model, with the reason on record. Call C-8850 shows the negative path handled honestly: schema-invalid output routed to manual review rather than passed, and it found a real gap. An inspector asking “show me you can reconstruct a decision” gets an answer from this log directly.
Common inspection findings this log prevents
- You can show the human’s disposition but not what the model was given or returned, so the chain is unprovable.
- Model-authored numbers were treated as the decision value, making a reproducible task non-reproducible.
- Schema-invalid outputs were passed as flags or silently dropped.
- Overrides were not captured, so there is no evidence the reviewer ever disagreed with the model.
- The log can be edited without control, so it is not trustworthy evidence.
How to adapt this log
- Set your form number, tool ID, governing WI/SOP, and retention in the header.
- Confirm your tool captures every required field automatically; add fields your workflow needs without dropping any required one.
- Make the disposition-with-reason fields mandatory for flags in the tool’s UI.
- Protect the log from edit and confirm it is retained at least as long as the records the workflow supports.