Maintain the site file behind an external-manufacture relationship — what the site is qualified for, its audit cycle, open findings and certificate currency — and hold it for the Qualified Person who signs.
A site is qualified for named activities, and its file is pulled from the supplier, quality and MA systems.
02
A site record is normalised across those systems, and each fact is carried with the source it came from.
Reason
03
An audit falls due on the risk-based cycle your own procedure sets, and the date is read against it.
04
A finding stays open against the due date it was given, with whatever was supplied to close it beside it.
05
A quality agreement is mapped activity by activity onto who performs each step, as Chapter 7.15 requires.
Decide
06
A certificate is read from its inspection date under the EMA rule in force since 1 January 2024.
07
A third-party audit is recorded against the body that performed it, as Part C has required since 11 April 2025.
Out
08
A register entry — EudraGMDP, Actions on CEPs, Import Alert 66-40 — is watched and raised as an alert.
09
Write actions run only inside the boundaries agreed at implementation, never onto a qualification record.
→Product statement
The agent assembles and makes no critical GMP determination; a named quality head approves the supplier, and a named Qualified Person signs the declaration.
Example workflow
One site, audit to declaration
AgentHuman
1Site in scopeSupplier master, quality agreement, MA dossier or contract-site notice
2Evidence assembledAudit reports, findings, certificates, licences and written confirmations, each with its source
3File draftedQualified scope, audit currency, open findings, register status and confidence
4Controls appliedCompleteness checks, Chapter 7 and Annex 16 checks, currency checks and confidence threshold
No human action required
Stages 1 to 4 run unaided, and nothing is qualified at any of them — the agent is assembling, and the quality head's lane opens at the confidence gate.
5DecisionBranches at the confidence threshold
High confidence
Goes to the quality head to approve.
Low confidence
Adds a second QA read first.
Quality-head approval
The file is held with its evidence, its gaps and the confidence.
Approve · Amend · Send to QP review
Approved — qualification current▼
6Supplier systems updatedOnly where write access and approval policy allow it
7Outcome evaluatedFile completeness, finding-closure outcomes, audit currency and inspection findings
Amendments
An amendment lands on the quality head's record, and on the file inspected later.
What should not run autonomously
Human approval stays in control
Outside the boundary — human approval required8 items
Qualifying a site, or declaring one requalified.
Signing the QP declaration on a third-country site.
Accepting an audit finding as closed.
Writing the final assessment of a third-party audit report.
Automation boundaryAgent acts unaided
✓Assemble the site file and the evidence behind it.
✓Track audit dates, finding due dates and the certificates behind each site.
✓Map the quality agreement onto who performs each activity.
✓Test the file for completeness and hold it for the quality head.
Writes stay inside the boundaries set at implementation, never onto a qualification record.
Deciding a change notification has no regulatory impact.
Deciding which entity is named as the auditing body.
Authorising a sub-tier site under Chapter 7.11.
Changes to audit, currency or approval rules.
Example output
One site, annotated
Everything the agent assembles is attached to the record it was drawn from.
Supplier-evidence output · single siteIllustrative example
Site
Assembled line
Rule cited
Source of date
Confidence
Currency
Third-country API site
The last audit of this site was performed by a body the file does not name
Annex 16 §2.2(iv)
Auditor-supplied
86%
Runs from the inspection date
As receivedTaken from the supplier, quality and regulatory systems — nothing on this side is written by the agent.
Evidence usedAudit report on fileGMP certificateWritten confirmation
Why this ruleIt is what the EU rule asks the QP to hold in writing and a person still decides.
ActionApproveAmendSend to QP review
What the score decidesBelow the configured threshold the file picks up a second QA read before it goes up.
Value
Where AI adds value
The same four claims, placed at the point in the workflow where each one applies.
Where the value landsValue 01 – 04
Every siteFrom the supplier master
03Assembly
Take the site as it stands today
The batch-release page works one executed record; this one works the site relationship across the audit cycle.
01Approved path
The declaration is personal
A named Qualified Person signs it on a filing, largely on audits they did not conduct.
02Human review
Currency, not audit count
No regulator publishes supplier audit-cycle adherence or change-notification timeliness, and we will not borrow a vendor figure.
04Build an evidence trail
The site, the audit behind it and the person who declared stay on the qualification file.
Integrations
Typical integrations
Five system groups connect to the same agent. Which of them are in scope is decided in discovery.
A network-wide audit-currency figure can read as settled while a few site types absorb most of the file gaps and the late notifications. Nestack reports the file-gap rate by site type, not only in total.
Slice performance — reported separately, not only in aggregateIllustrative example
Slice
Failure rate
Lift
Lift vs. threshold
Status
Third-country API sites
8.1%
3.7×
Review
Broker-audited sites
5.7%
2.6×
Review
Sub-tier contract sites
3.4%
1.5×
Watch
Long-standing EU sites
1.3%
0.6×
Normal
Bar: file-gap-rate lift vs. the long-standing EU baseline · scale 0–4.0× · tick marks the 2.0× review threshold2 of 4 slices over threshold
Evidence-linked improvement
Nothing closes until a case is added
The loop shuts when the stale audit is a regression case. That suite is what the next declaration supported is measured against.
Improvement cycle · five stagesSwitchback — the path turns at Improve and returns at Learn
01Detect
File-gap rate rises in one site type.
02Diagnose
The contract site audited two years ago by somebody nobody could name is read back until the cause narrows to one.
03Improve
Any change ships numbered, with the sites that caused it attached.
04Verify
One qualification case still failing is enough to hold the release.
05Learn
One case joins the suite, one line joins the supplier record.
Learn → DetectThe return edge. The next detection runs against a suite one case longer.
Typical build scope
Twelve workstreams across six weeks
The build scope read against the delivery timeline. Week structure follows the six-week plan — discovery, sources, site workflow, evaluation, integration, then production validation and handover.
WorkstreamWeek 1Week 2Week 3Week 4Week 5Week 6
01Supplier oversight discovery and boundary work.
02Supplier and quality source assessment.
03Quality-agreement and audit-cycle procedure mapping.
04Site ingestion and evidence normalisation.
05Assembly logic and source binding.
06Confidence scoring and exception routing.
07Quality-head approval workflow.
08Supplier-system and register integration.
09Audit and currency cases.
10Guardrails and declaration controls.
11Site-trail instrumentation.
12Deployment, documentation and Agent Care handover.
12 workstreams · 6 weeks · bar shows the weeks a workstream is active — several run in parallelFinal scope and sequence confirmed in discovery
Engagement tiers
What each tier includes
Rows are the capabilities named in each tier's scope. Higher tiers include everything below them.
Capability✓ in scope · — not at this tierPilotOne site, one supplier typeProductionProduction supplier systemsAdvancedMultiple sites / regions
Introduced at Pilot
Assembly to your site file✓✓✓
Quality-head approval✓✓✓
Audit-currency baseline✓✓✓
Introduced at Production
Reporting by site—✓✓
Approval workflow in your systems—✓✓
Approved write-back—✓✓
Supplier-system integration—✓✓
Introduced at Advanced
Multi-region agreement sets——✓
Multi-stage quality approvals——✓
High site volume——✓
Multi-site qualification controls——✓
Build priceFrom $5,000From $8,000Custom quote
Final build priceConfirmed after discovery based on integrations, workflow complexity, transaction volume, approval controls and deployment requirements.
Separate from buildBuild pricing is separate from recurring Agent Care, which covers managed monitoring, evaluations, incidents and verified improvements after launch.
What we need from you
What you bring, and what we build with it
Each input maps to a piece of build scope and a week in the delivery timeline.
You bringWe build with it
01Your supplier master and site records→Site ingestion and evidence mappingWeek 1
02Representative qualification files→Assembly baseline, scope extraction and source bindingWeek 2
03Your audit-cycle and escalation procedure→Agreement mapping and automation-boundary definitionWeek 1
04Access to relevant APIs, feeds or exports→Supplier, quality and register assessment, then integration setupWeek 2
05Files you would not want inspected→Audit cases and failure-mode testingWeek 4
06What no declaration may take on trust→Confidence scoring, exception routing, guardrails and approval controlsWeek 3
07Named quality-head reviewers to approve files→Quality-head approval workflow, then pilot and production validationWeeks 5–6
Nothing else is requiredDeployment, documentation and Agent Care handover are ours.
Delivery timeline
Four phases across six weeks
Every band is exactly as wide as the weeks its phase consumes, so week five legitimately doubles.
PhaseW1W2W3W4W5W6
DiscoveryW1
BuildW2 – W3
EvaluateW4 – W5
Pilot & LaunchW5 – W6
Week focusW1Supplier oversight discovery, agreement mapping and the automation boundaryW2Supplier-system integration and the assembly baselineW3Assembly workflow, confidence logic and approval controlsW4Evaluation suite, currency checks and failure-mode testingW5Register integration, pilot sites and targeted correctionsW6One qualification cycle run under the Qualified Person, then Agent Care handover
Reading the bandA bar covers only the weeks its work is named in. The week 5 overlap is two phases at once, not padding.
At the end of W6Once the supplier file validates, Agent Care assumes the agent.
DurationSix-week plan shown · typical delivery 4–6 weeks depending on scope confirmed in discovery.
Next step · Biotechnology AI agent
Build a supplier-evidence agent around your Qualified Person.
Show us your supplier master, your quality agreements and who signs. The file has to survive an inspection three years from now, read by somebody who was not there when it was built. Qualifying a site, accepting a finding as closed and signing the QP declaration stay with the named humans who do them. Draft EU/PIC/S GMP Annex 22 — consultation closed 7 October 2025, with no final text published as at August 2026 — says generative models should not be used in critical GMP applications, and this agent is built so that it is not one. If your batch-release work ends at the release package for one batch, this page holds the site relationship behind it.
