SOP: AI-Assisted Code, Test, and Documentation Review in GxP CI/CD Pipelines

This is a ready-to-use SOP for reviewing AI-assisted code, automated tests, and documentation before any of it enters a GxP CI/CD pipeline. Replace every <<FILL: ...>> placeholder with your own specifics and route it through your normal document control, review, and approval. A worked filled specimen follows the template. Verify each cited regulation against the current source before you rely on it.

Document control header

1. Purpose

This procedure defines how <<FILL: COMPANY NAME>> reviews code, automated tests, and documentation that an AI coding assistant, AI agent, or generative AI tool drafted or helped draft, before that artifact enters a CI/CD pipeline feeding a validated GxP computerized system. The objective is to make sure AI assistance speeds the work without substituting for qualified human judgment on correctness, completeness, and compliance, consistent with 21 CFR 211.22(c).

2. Scope

This procedure applies to GxP-impacting code, configuration logic, automated test cases, and documentation (release notes, validation narratives, draft specifications, acceptance criteria text, draft SOPs) produced in whole or in part by an AI tool, anywhere in the Agile/DevOps delivery model described in the Agile and DevOps CSV article.

It does not cover AI embedded as a production feature of the GxP system itself; that is governed by the organization’s AI system validation and governance program (see <<FILL: AI governance SOP/program reference>>). This procedure covers AI used as a development or documentation tool to build or describe that system, not AI running inside it.

3. Responsibilities

4. Definitions

• AI-generated artifact: code, a test, or a document produced by an AI tool with no human first draft; a human only reviews, edits, or rejects it afterward.
• AI-assisted artifact: code, a test, or a document a human drafted with AI-suggested completions, refactors, or edits incorporated into the final version.
• Disclosed AI involvement: a recorded statement of which artifact was AI-generated or AI-assisted, which tool and, where available, which version produced it.
• Substantive review: a check of the artifact’s actual content against its requirement (the acceptance criteria, the regulation, the source document), not a check that it compiles, runs, or reads fluently. A passing automated test is not, by itself, a substantive review of that test.

5. Procedure

5.1 Disclose the AI involvement

1. Before submitting code, a test, or a document for review, the author records whether it is AI-generated, AI-assisted, or not AI-involved, and which tool (and version, if tracked) was used.
2. This disclosure is attached to the story, pull request, or document record; it is not left in a chat log or an AI tool’s own history.

5.2 Assign the review tier

Use the GxP risk tier already assigned to the story (see <<FILL: reference to your definition-of-done / risk-tiering standard>>). AI involvement does not lower the tier. A disclosed AI-generated artifact on a High GxP story gets the High GxP review in section 5.3-5.5 regardless of how confident the output looks.

5.3 Review AI-assisted or AI-generated code and configuration logic

1. Trace the logic against the acceptance criteria line by line; do not rely on “it compiled” or “it ran once.”
2. Check explicitly for the failure modes AI tools commonly produce: a plausible branch that mishandles an edge case, a comparison operator that reads correctly but is wrong, a missing null or boundary check, a hardcoded value that should be configurable.
3. For Medium and High GxP tiers, the reviewer records that the review was performed knowing the content was AI-generated or AI-assisted (not reviewed as if human-authored).

5.4 Review AI-assisted or AI-generated test code

1. Open the acceptance criteria the test is meant to verify.
2. Confirm the test would fail if the requirement were broken. Do this by inspection (read what the assertion actually checks against what the criterion requires) or, for High GxP, by deliberately breaking the implementation and confirming the test catches it.
3. Reject any test that asserts a weaker condition than the acceptance criteria state, even if it currently passes.

5.5 Review AI-assisted or AI-generated documentation

1. Check every factual claim, number, limit, date, and regulatory citation in the document against its real source. Do not accept a citation or figure because it reads correctly.
2. Confirm no claim is present that the source does not actually support (a fabricated or inferred detail presented as fact).
3. A named human author takes ownership of the final document; the AI tool is never recorded as the author of record.

5.6 Record the review

1. Record, against the story or document: the AI-involvement disclosure, the reviewer’s name, the tier applied, the outcome (pass, or return for rework with reason), and the date.
2. Retain this record with the other story evidence under <<FILL: retention reference>>, the same way a peer code review record is retained.

5.7 Handle a failed review

1. Return the artifact to the author with the specific gap identified (which line, which assertion, which claim).
2. The artifact is reworked, by the AI tool, the human, or both, and resubmitted through the same review.
3. If a High GxP artifact reaches production despite a failed or skipped review, treat it as a quality event under <<FILL: deviation SOP reference>>.

6. Acceptance criteria

A review under this procedure is acceptable when: the AI involvement was disclosed before review, the review was performed at the artifact’s actual GxP tier with the reviewer aware the content was AI-assisted, the specific checks in section 5.3, 5.4, or 5.5 were applied (not a general read-through), and the outcome is recorded and retained with the story’s other evidence.

7. References

21 CFR 211.22(c), quality unit review and approval of procedures affecting product. FDA warning letter to Purolea Cosmetics Lab, issued 2 April 2026 (CDER, drug CGMP): cites 21 CFR 211.22(c) for use of an AI agent to draft specifications, procedures, and master production and control records without qualified human review of the output. ISPE GAMP 5 (2nd ed.), software tools and iterative development (referenced by title; described in original wording). FDA Computer Software Assurance for Production and Quality Management System Software (current version issued 3 February 2026), for risk-based test evidence.

Confirm the current version and status of each reference before issue.

8. Record generated: AI-assisted artifact review record

9. Revision history

10. Approvals

Filled specimen

The following shows the review record completed for one AI-assisted test, so you can see the level of detail expected. Illustrative, continuing the US-1042 example used in the related article.

The reviewer did not accept a passing test run as proof the requirement was verified. The draft test compiled, ran, and showed green, and still missed half of the acceptance criterion. Catching that before the increment reached production is the entire point of this procedure: the gap is in what the AI tool did not think to assert, not in a visible bug.

Common inspection findings this SOP prevents

• AI-generated code, tests, or documentation merged or published with no record that anyone disclosed or reviewed the AI involvement.
• A reviewer treating a passing AI-generated test as sufficient evidence that the requirement was verified.
• AI-drafted documentation (release notes, validation narratives, SOP text) approved on a fluency read rather than checked claim by claim, the same gap FDA cited at Purolea Cosmetics Lab.
• No named human of record for an AI-drafted document, so accountability for its content is unclear.
• Low-GxP review applied to a High GxP artifact because it “looked AI-generated and probably fine.”

How to adapt this SOP

1. Point section 5.2 at your own GxP risk-tiering standard (for example your definition-of-done checklist) rather than restating it here.
2. Name your actual AI coding and documentation tools where the procedure is taught, so reviewers know what disclosure should look like in practice.
3. Wire the disclosure field in section 5.1 into your pipeline or pull-request template so it cannot be skipped silently.
4. Cross-reference your deviation SOP in 5.7 and your retention schedule in 5.6.
5. Confirm the Purolea letter citation and every regulation in section 7 against the current published source before issue.