No-code AI builders in regulated life sciences, explained.

A no-code AI builder turns one person's knowledge of the data into an assistant other people can question

Five steps from a plain-language question to an assistant people may rely on

1. Triage the useBefore anything is built: is this answer going to feed a GxP decision or record, or is it business reporting? The answer decides everything after it.
2. Describe and draftThe builder describes the questions; the software proposes tables, join keys, rules and a query for each question.
3. Test against trusted answersEach question is run against figures someone has already signed off. A failure is explained, fixed and re-run. This step and the next are the subject of this guide.
4. Review and signA named person confirms each question and its query; for regulated uses a second person, and quality where the procedure says so.
5. Release and keep under controlThe assistant goes live under the change procedure, its tests re-run, and every change goes back through steps 3 and 4.

Steps 3 and 4 are where business-built tools usually fail an audit. The people, company and figures in the example are fictional.

Four things that catch out the first business-built assistant in a GxP company

Four words to know first: builder, test set, confirmation and change

Fourteen terms are defined in the one-page summary.

Inside a no-code AI builder: catalog, draft query, test, confirmation and routing

In shortUnder the plain-language surface, a no-code AI builder for data does six things: it reads the catalog, proposes tables and joins, writes the rules down, drafts a query for each question, tests each query against known answers, and routes later questions to the right assistant. A person decides at two points, and each point leaves a record.

The phrase "no-code AI builder" covers several kinds of product. Some build chat helpers that answer from documents. Some automate workflows. The kind this guide covers answers questions from structured data, usually a warehouse or a reporting database, by writing a database query in SQL. The industry calls the core trick text-to-SQL: turn a question in words into a query in code. The builder wraps that trick in the steps a careful analyst would take anyway.

Why a database question needs a query someone can read

A chat answer that draws on documents can quote its source. An answer from a database is a calculation: sums, joins, filters, a currency rate. The only way to know whether it is right is to read the calculation or to compare its result with a figure you already trust. A builder that hides the query asks the reader to trust it blind.

A builder that shows the query, and runs the same query against signed-off figures before release, gives a reviewer something to check. This is the difference that matters for a regulated company, and Part C turns it into questions for any vendor.

What a no-code builder leaves to qualified people

Software can draft fast and test fast. It cannot decide what the answer is for, which records belong in it, whether a test set is fair, or whether a use is critical to product quality. Those are judgments, and every text in this guide gives them to a qualified person.

Draft Annex 22 says that where a large language model is used in a non-critical GMP application, "personnel with adequate qualification and training should always be responsible for ensuring that the outputs from such models are suitable for the intended use".7 FDA, in a 2026 warning letter to a drug manufacturer that used AI to write its procedures, put it more bluntly: "If you use AI as an aid in document creation, you must review the AI generated documents".10

Where CSA, Annex 11, draft Annex 22, Part 11 and the AI Act stand on November 3, 2026

In shortFDA's Computer Software Assurance guidance is final, dated February 3, 2026, and written for device makers. EU GMP Annex 11 is still the 2011 text. The revised Annex 11 and the new Annex 22 on AI are drafts; inspectors aim to hand final text to the Commission in the fourth quarter of 2026, with no adoption date. The EU AI Act's high-risk dates moved to December 2027 and August 2028.

GAMP 5 (second edition, July 2022) has an appendix on AI and machine learning, and ISPE published a separate GAMP guide on AI in July 2025.24,25 Both are paid industry guides with no legal force; we read their contents pages. The European Medicines Agency's (EMA) reflection paper on AI in the medicinal product lifecycle, adopted in September 2024, places responsibility for algorithms, models and data on the sponsor, applicant, marketing authorization holder or manufacturer using them.26

What FDA's February 2026 CSA guidance says about AI tools, analytics and spreadsheets, and whom it covers

In shortFDA's guidance reaches software a medical device maker uses in production or its quality management system, and it names AI tools, data analytics tools and automated workflows among them. It sorts each function by whether its failure could foreseeably compromise safety. Its own examples show that "it is only reporting" may still be high process risk when the report feeds quality trending.

The guidance's full title is "Computer Software Assurance for Production and Quality Management System Software". It was issued on February 3, 2026, replacing the version of September 24, 2025, one day after FDA's device quality rule took effect.3,11 Its scope sentence is short: "computers or automated data processing systems used as part of production or the quality management system for medical devices".3 It does not cover software that is itself a device, and by its terms it does not reach drug manufacturing or clinical systems.

CDER, FDA's drug center, lists in its 2026 guidance agenda a planned supplement on assurance for AI-based systems in drug manufacturing and clinical investigations; an agenda does not bind CDER, and nothing had been issued by November 3, 2026.27

The sentence that brings an AI builder into scope

FDA's framework "can be applied, but is not limited, to automation tools (e.g., BOTS or automatic workflows), data analytic tools, artificial intelligence/machine learning tools, and cloud computing when used as part of production or the quality management system".3 So a device maker cannot set a no-code AI assistant aside as an office tool if its answers feed quality data. The first question is the intended use, function by function.

Three of FDA's own examples, read for a business-built assistant

Reasonably foreseeable failures: FDA's test for the rare wrong answer

FDA asks manufacturers to consider "which failures are reasonably foreseeable (as opposed to likely)".3 A wrong join is not likely on any given day. It is foreseeable over the life of an assistant that hundreds of people question.

FDA calls a function high process risk when its failure "may result in a quality problem that foreseeably compromises safety", and gives examples such as functions that "measure, inspect, analyze and/or determine acceptability of product or process with limited or no additional human awareness or review".3 The phrase "with limited or no additional human awareness or review" is the design question for any assistant: is a person checking its answer before it counts?

What FDA wants in the record

For each function FDA recommends a record of the intended use, the result of the risk analysis, the testing done, the issues found, a conclusion on acceptability, who performed the testing and when, and review and approval where appropriate.3 It prefers "digital records, such as system logs, audit trails, and other data generated and maintained by the software, as opposed to paper documentation, screenshots".3 A builder that keeps its own test runs, confirmations and versions can supply most of that record. Whether the record is enough is still your call.

EU GMP Annex 11 and draft Annex 22 on AI: what they ask of a builder that drafts with a large language model

In shortAnnex 11, in force since 2011, asks for risk-based validation, controlled changes and access, audit trails and periodic evaluation of any computerized system used in GMP work. Draft Annex 22 covers AI models, and keeps generative AI and large language models out of critical GMP uses, those with direct impact on patient safety, product quality or data integrity. In non-critical uses a qualified person answers for each output. Both drafts may change.

Annex 11 applies "to all forms of computerised systems used as part of a GMP regulated activities".1 Its principle is short: "The application should be validated; IT infrastructure should be qualified." Where a system replaces a manual operation, "there should be no resultant decrease in product quality, process control or quality assurance".1

Clause 1 ties the extent of validation to "a justified and documented risk assessment". Clause 10 says changes, "including system configurations should only be made in a controlled manner in accordance with a defined procedure". Clause 12 asks for access restricted to authorized people, and clause 11 for periodic evaluation.1

A business-built assistant used in GMP work falls under every one of these clauses, whoever built it.

The draft revision of Annex 11 adds two lines a builder will feel

The consultation draft, which closed on October 7, 2025, says it "should be clear what functionality, if any, is modified or added by configuration of a system", and that the chosen configuration "should be documented in a controlled configuration specification" (section 6.6).2,12 A plain-language rule such as "leave out voided invoices" is configuration in that sense. Section 11.10 sets two principles for access: segregation of duties, "users who are involved in GMP activities do not have administrative privileges", and least privilege.2 It is a draft and has no force yet.

Draft Annex 22, section 1, quoted

Three consequences follow for a builder whose first drafts come from a large language model.

1. The critical or non-critical call comes before anything else, and draft Annex 22 defines non-critical by impact: no "direct impact on patient safety, product quality or data integrity".7
2. In a non-critical use the qualified person, the human in the loop, is a requirement, and where testing has been reduced because a person reviews the output, draft sections 3.3 and 10.5 ask that the operator's responsibility be written into the intended use and that records be kept of that review.7
3. The draft puts a tested model and its system under change control and configuration control before use (section 10).7

The draft may move, and the record says how far

EMA's report on a workshop held June 30, 2026 says consultation comments "indicated support for allowing manufacturers to use Large Language Models and generative AI systems in GMP applications, whether critical or non-critical", that the drafting group "has therefore discussed" widening the scope under a documented, risk-based control strategy, and that "concerns remain".8 Its closing words are cautious: "there may be viable pathways".8 The same report records the view, from discussion, that "Human-in-the-loop is one possible control, not a default requirement for all AI uses".8

No revised text had been published by November 3, 2026, and EMA's inspectors' work plan sets the fourth quarter of 2026 as the target for giving the Commission final text of Annex 11 and Annex 22, with no adoption date.13 Plan for the draft as written, and design your evidence so it can change.

Who may build, who confirms and who administers a business-built assistant

In shortNone of the texts in this guide forbids a business user from building an assistant. In our reading, they govern access and duties: changes only by authorized people, administrators independent of the record's content, users without administrative rights, and training for anyone who develops or uses the system. A sound procedure names who may build for which uses, requires a second person to confirm regulated uses, and keeps administration with someone else.

The texts are specific about duties and silent about job titles. Part 211 says changes to master production and control records or other records must be "instituted only by authorized personnel".6 FDA's data integrity questions and answers add that "the system administrator role, including any rights to alter files and settings, should be assigned to personnel independent from those responsible for the record content".4 Guidance for inspectors from PIC/S, the scheme through which GMP inspectorates cooperate, says administrator rights "should not be given to normal users on the system (i.e. segregation of duties)".28

Part 11 asks for "authority checks to ensure that only authorized individuals can use the system, electronically sign a record" and for a determination that people "who develop, maintain, or use" such systems "have the education, training, and experience to perform their assigned tasks".18

Under the EU AI Act as amended, providers and deployers "shall take measures to support the development of AI literacy" of their staff.14

Builder, second confirmer, data owner, quality, administrator: who does what

One person building, testing and confirming is the gap auditors find first

The tools make it easy for one person to do everything: describe, draft, choose the test answers and confirm. For business reporting that may be fine. For a use that touches a GMP record it breaks the logic of every text above, because the same mind that made an error is asked to find it. Annex 11 already asks, for critical data entered by hand, for "an additional check on the accuracy of the data", which "may be done by a second operator or by validated electronic means".1 In our reading, a test set can serve as that kind of check only if someone other than the builder agreed it.

Sorting assistant uses by GxP impact: freight cost, document status, review data, batch status

In shortThe same builder can answer a question about freight spend and a question about which procedure version is effective. The second feeds a GMP decision; the first does not. A short triage at intake, on two questions, sorts most uses: how much a quality decision rests on the answer, and how hard a wrong answer would be to notice.

Every text in section 3 sizes the work to the risk. Annex 11 bases the extent of validation on "a justified and documented risk assessment".1 ICH Q9(R1) says formality "is not a binary concept" and "can be considered a continuum".20 FDA's 2018 questions and answers say the extent of validation "should be commensurate with the risk posed by the automated system", and that when one system does both CGMP work (FDA's term, current good manufacturing practice) and other work, "the potential for non-CGMP functions to affect CGMP operations should be assessed".4 An assistant builder is exactly that kind of shared system.

Five triage questions that place an assistant's use

1. Will the answer be copied into a GMP record, a batch decision, a periodic review or a regulatory document? If yes, the use is GMP-relevant, and Annex 11, Part 211 or the device rule applies to it.
2. Could a wrong answer have a direct impact on product quality or data integrity? If yes, draft Annex 22 would call it critical, and keeps large language models out of it.7
3. Does a person check the answer against another source before it counts? FDA's high-risk examples turn on work done "with limited or no additional human awareness or review".3
4. Does the answer read personal data? Then privacy rules and your data protection officer join the triage.
5. Who owns the data, and who signs the reports used to test it? No owner, no build.

The answers go on the request, and the request goes in the inventory. Annex 11 clause 4.3 asks for "an up to date listing of all relevant systems and their GMP functionality (inventory)".1 An assistant answering GMP questions belongs on it, with its intended use and its owner.

Why plain-language data answers go wrong, worked through on one freight figure

In shortTurning a question into a correct query is hard on real company data. Published tests show accuracy falling from over 90% on simple teaching databases to about one in five tasks on enterprise data work. Most wrong answers come from a few causes: joins that repeat rows, records that should be left out, the wrong period or currency. A test set of questions with signed-off answers catches them before release.

The Spider 2.0 authors built their test from real enterprise workflows, with large schemas and several steps per task.9 A 2023 study on an enterprise database found a large language model answered 16% of questions correctly when given the tables alone, and 54% when given a map of what the tables mean; its three authors worked at a company that sells such maps, which a reader should weigh.29 Both studies are older than the models on sale in November 2026, and both say the same thing: on company data, the meaning of the tables matters more than the cleverness of the model.

The worked example: $2,412,300 against $2,291,800

In the fictional example at the top of this page, the September freight report, closed at month-end and signed by the finance data steward, gives total freight spend of $2,291,800: $918,400 to Kestrand Freight, $702,100 to Aerolis Express and $671,300 to Brevalin Logistics. The first draft query returns $2,412,300. The gap is $120,500. It comes from 118 Kestrand Freight invoices that were voided and re-billed in September; the query counted both the void and the re-bill, about $1,021 each on average.

The same error moves the expedited share. Air and courier spend is $412,600 in both cases, but divided by the inflated total it comes to 17.1% against the report's 18.0%.

A reader would not have caught it: $2.41 million looks as plausible as $2.29 million. A test caught it, because someone had a signed figure to compare against. That is the whole case for test sets.

Five causes behind most wrong figures, and the test that catches each

Spreadsheets already show what untested business-built logic does

A no-code assistant is the spreadsheet's successor in one way: logic built by the person who knows the business, outside the engineering process. Panko's review of audit studies found errors in 94% of 85 operational spreadsheets, and an average cell error rate of 3.9% across 14 laboratory studies.30 The studies are old and the tools are new. The lesson holds: careful people still make errors at a steady rate, and only testing against known answers finds them.

What a fair test set looks like

• Answers someone else signed. Month-end reports, closed reviews, figures that went to management. The builder should not write the expected answers.
• At least three questions per query, chosen to hit the causes above: a total, a share, a second period.
• A tolerance stated before the run. A figure "matches" within a stated margin for rounding, decided in advance.
• Kept apart from the build. Draft Annex 22 asks, for models in critical uses, that test data not be used in development and that its use be recorded (section 6).7 The draft does not cover large language models; the idea of a test set the builder cannot tune to is still sound.
• Re-run on a schedule and after every change, because data moves.

Change control for a business-built assistant: model versions, shared rules, tables and test sets

In shortAn assistant changes in more ways than ordinary software. Its query can change, and so can a rule shared with other assistants, a table upstream, the test set, the prompt and the AI model itself. Annex 11 clause 10, ICH Q10 and draft Annex 22 section 10 all ask that each change be evaluated and controlled. The practical question is which changes trigger which re-test, decided in advance.

Annex 11 clause 10: "Any changes to a computerised system including system configurations should only be made in a controlled manner in accordance with a defined procedure."1 ICH Q10 asks that quality risk management "be utilised to evaluate proposed changes", with "the level of effort and formality of the evaluation" commensurate with the risk, and that the system "provide a high degree of assurance there are no unintended consequences of the change".21

ICH E6(R3) says for trial systems: "Subsequent changes to the system should be validated based on risk".5 Draft Annex 22 asks that "any change to the model itself, the system, or the process in which it is used" be documented and evaluated "to determine if the model needs to be retested", and that "any decision not to conduct such retest should be fully justified".7

The AI model underneath is a supplier change

Most builders rely on a large language model run by someone else. When that supplier ships a new version, the next draft query for the same question may differ. Annex 11 says the regulated user remains responsible when relying on suppliers, and that formal agreements should state the third party's responsibilities (clause 3).1 Ask the vendor how you learn of a model change, whether you can hold the version, and whether existing confirmed queries change when it does. A builder that stores each confirmed query as text and re-runs that text is easier to control than one that regenerates the query at every question.

Going live straight away versus your release procedure

Some builders put an assistant live the moment it is confirmed, with no deployment step. For business reporting that is the attraction. For a GMP-relevant use, your change procedure decides when it is released and who approves, and the software's "live" button is one step inside that procedure. Configure the tool so that GMP-relevant assistants wait for the approval your procedure names.

Periodic review and drift

Annex 11 clause 11 asks that systems "be periodically evaluated to confirm that they remain in a valid state".1 The draft revision says the frequency should be "established and justified based on the risk".2 No text sets a fixed interval. For an assistant, a nightly re-run of every test, with a re-check whenever a result moves by more than a set margin, supplies evidence between formal reviews. The review itself still needs a person and a record.

The records a regulated assistant must leave: who built, tested, confirmed and changed what, and when

In shortPart 11, Annex 11 and FDA's CSA guidance agree on the record's core: who did what and when, kept so it cannot be quietly altered, and readable by an inspector. For an assistant that means the build conversation, every query version, every test run, every confirmation with a name and time, and every change. In FDA's fiscal 2025 drug inspection data, by our count, controls over who may change records are the most cited computer finding.

Part 11 asks for "secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records", and says record changes "shall not obscure previously recorded information".18 Annex 11 clause 12.4 asks systems to "record the identity of operators entering, changing, confirming or deleting data including date and time", and clause 14 that electronic signatures be "permanently linked to their respective record" with the time and date applied.1

The data integrity guidance of MHRA, the UK medicines regulator, lists the ALCOA principles, attributable, legible, contemporaneous, original and accurate, and the "+" for complete, consistent, enduring and available.31

What the record holds for one assistant

Who may change records: the computer finding FDA cited most often in drug plants in fiscal 2025, by our count

FDA publishes the observations its investigators record on Form 483 each fiscal year. For drug inspections we summed the rows citing 21 CFR 211.68(b), the paragraph on computer and related systems.32 Fiscal 2020 and 2021 were the pandemic years; FDA's files give counts and no reasons. FDA notes that the files are not a complete listing of every observation.32 Our count covers only those rows: a computer problem cited under another section, such as laboratory records, is not in it. We re-read the fiscal 2021 and 2025 rows, and they match.

The largest row, 87 of the 110, is the finding that "appropriate controls are not exercised over computers or related systems" so that changes are made only by authorized people.32 A business-built assistant that lets its builder change a shared rule, a query or a test answer without a second person is a new way to earn that observation. In the UK, MHRA's newest published GMP deficiency data, for 2019, held 240 references to Annex 11 among 5,292, counted from its spreadsheet.33

Business-built AI is spreading faster than the controls around it

In shortSurveys in 2025 and 2026 show most companies experimenting with AI, a growing share of validation teams trying AI for their own work, and unsanctioned AI use rising sharply in data breaches. No public figure counts no-code assistants in life sciences. The direction is clear: people will build, and the choice is whether they build inside a controlled tool or outside one.

IBM's 2026 study of 602 breaches across 17 industries, between March 2025 and February 2026, found incidents involving unsanctioned employee AI use more than doubled to 43%. We read a law firm's summary and not IBM's full report.35 The figures are about all industries and about security. They point at the same risk a quality team worries about: AI built or used where nobody controls access or keeps a record.

The 2026 validation survey also found 78% of respondents confident AI will be standard practice in validation by 2030.34 No public figure gives the share of life sciences companies that allow business users to build AI assistants, the hours such builds take, or the error rate of their answers. Section 18 lists what you can measure in a week instead.

How a regulated company answers a new data question today: the request queue, the spreadsheet and the controlled builder

In shortA new data question usually travels from the person who knows the data to a team that knows the tools, and back, several times. In the fictional example the median wait is 31 days, most of it in a queue. Teams that cannot wait build spreadsheets outside any inventory. A third way, a controlled self-service builder, keeps the business person building and the quality controls in place.

Analyst, data engineer, data steward, quality: who handles a new data question

The 31-day median and its split are the fictional company's own estimate; no public figure measures this wait in life sciences.

Three ways companies handle new data questions

Many companies set up a small group, sometimes called a center of excellence, that trains builders, keeps the procedure and reviews regulated builds. Whatever the name, the group owns three decisions: who may build, what is reviewed, and how changes are controlled.

October 6, 10:31 to 10:45 am: a freight cost agent described, tested, fixed, confirmed and live in 14 minutes

In shortLena Ortiz, a supply chain analyst at a medical device manufacturer, describes what people ask her. The Agent Builder proposes six tables and writes down her rules. It takes nine test questions from three signed reports and drafts three skills. Seven tests pass and two fail on one cause, which she fixes in one sentence. She confirms each skill by name, and the agent joins the assistant's routing.

1

10:31 am: the conversation on the left, an empty agent on the right

The Build screen opens on a blank agent: purpose, data, rules, skills and a test board, each empty. Lena types what people keep asking her: what we spend, with which carrier, per unit on each lane, and how much goes on expedited freight. Below the canvas are agents built here before, with their build times, among them Warehouse capacity in 11 minutes and Supplier delivery in 17.

2

10:33 am: eight tables found, six highlighted

The Agent Builder searches the supply chain warehouse catalog, read-only, and finds eight tables that look related. It highlights six: freight_invoices with 1.1 million rows, shipment_lines with 96.3 million, carriers, sites, customer_accounts and fx_month_end. Then it asks two questions a careful engineer would ask: how do they join, and which figures do you already trust?

3

10:36 am: join keys checked, four rules, nine test questions

Lena names the join keys, says expedited means air or courier, and points to the September freight report and the Q3 lane cost review. The builder checks all five join keys against the warehouse and writes down four rules in her words, including one it adds itself: shipment lines are summed per shipment first, so spend is never counted once per line. That is the fan-out error from Part A, section 8, caught before any test runs. It takes nine test questions from three signed reports: the September and August freight reports, signed by Omar Haddad at month-end close, and the Q3 lane review, signed by Sam Patel.

4

10:38 am: three skills drafted, nine tests run, two fail

One click drafts three skills, each a question with the query that answers it: freight spend by carrier, freight cost per unit by lane, and expedited freight spend. The Skill Tester runs all nine tests live and read-only. Seven pass. September spend comes out at $2,412,300 against $2,291,800 in the report, and the expedited share at 17.1% against 18.0%. The Skill Tester finds one cause for both: 118 voided Kestrand Freight invoices that were re-billed in September and counted twice. A failing test blocks Confirm on its skill.

5

The query behind the failing skill, with no line for invoice status

"Show query" opens the query the first skill ran. A reviewer who reads SQL can see that it filters by invoice month and currency but has no line for invoice status. A reviewer who does not read SQL still has the test row above it, which is the point of testing against known answers.

6

10:42 am: one sentence, every test re-run, nine of nine

Lena types: "Yes, leave out voided invoices (status VOID). They were re-billed." The builder adds the rule to all three skills and re-runs every test, the passing ones too. Nine of nine pass: September is $2,291,800 and the expedited share 18.0%, matching the report. The Skill Tester never changes an expected figure and never marks a failing test as passed.

7

10:42 to 10:43 am: each skill confirmed, with a name and a time

Lena reads each skill with its tests and confirms all three. Each card now reads "Confirmed by Lena Ortiz" with the time. Her confirmation is recorded in the audit trail: which skill, how many tests passed, who, and when.

8

10:45 am: version 1.0 saved and routed

Go live saves version 1.0: instructions, five rules, three verified skills and nine tests. The agent joins the supply chain assistant's routing. Three probe questions route as expected: Kestrand Freight spend (match 0.94) and air freight share (0.91) go to Freight cost, and the least on-time carrier (0.89) stays with Shipments & carriers. The sample treats this as business reporting, so there is no separate release step; section 9 of Part A explains why a GMP use would wait for one.

9

10:46 am: the first live question

Lena asks the way her colleagues will: what did a unit cost to move from Leiden to Madrid in September? The assistant routes it to Freight cost at a match of 0.95. The answer: $0.84 per unit, $351,900 of freight across 418,900 units on 1,912 shipments, split by carrier, with a note that courier is about 10% of units and 24% of the lane's spend. Below the answer: the skill that produced it, who confirmed it, and "See the query".

10

"See the query": the void rule highlighted in the calculation that ran

One click opens the exact query that ran, read-only, with the lines that produced the cited number highlighted, including the new rule that leaves out voided invoices. Below it, the result for each lane and the skill's three test questions with their sources. Customer contact columns are hidden from every answer.

Four agents draft, test, route and watch; the analyst and the data steward sign

In shortThe Agent Builder interviews and drafts. The Skill Tester runs every test and explains failures. The supply chain assistant routes questions. The Skill watcher re-runs tests every night. None of them can confirm a skill: a named person does, and skills on cost or price tables need the finance data steward too. Who confirms, how strict the tests are and what the agents may read are settings, recorded when they change.

The sample's sign-off settings, and what a GMP procedure might choose instead

Every build step, test run, confirmation, rule change and go-live is written to an audit trail with who and when, and every version is kept with the conversation behind it. The audit trail sits in an administrator area this guide does not show.

After go-live: twelve agents, their tests every night, a result that moved and a paused agent waiting for its co-signer

In shortThe work goes on after the first build. The Agents screen shows every agent's owner, status, verified skills and accuracy. A skill whose nightly result moves is flagged for its owner to re-check. A new version waits until someone publishes it. An agent whose finance skills lack the steward's signature stays paused.

How the sample's 30 live skills were verified

The dashboard in the sample shows how skills reached the agents over the last 90 days: 71% confirmed as drafted, 24% fixed by the analyst and then confirmed, 5% set aside. A quarter of skills needing a fix is the reason tests exist. The figures are the sample's.

A plain-language request and a signed report in; a tested, versioned agent and its record out

In shortThe analyst brings knowledge and a report she trusts. The warehouse stays read-only and stays where it is. What comes out is a live agent, verified skills with their queries and tests, versions and an audit trail. The design targets are labeled as targets, and the one customer result is quoted as the solution page states it.

Warehouse, signed reports, item master, exchange rates: what the agents read

Design targets, the sample build, and one customer result

Targets are design goals, measured in the live solution on your data. One customer result, in the solution page's words: "Delivered at a global medtech manufacturer: business users create and wire live data agents in minutes through plain-English conversation." The company, people and figures in the sample build are fictional and are not that customer's.

What to set and decide before the same builder answers a GMP question

In shortThe freight build shows the mechanics. A GMP-relevant use, such as which version of a procedure is effective, or how many lots sit on quality hold, needs more around the same mechanics: a triage on record, two people confirming, a release step under your change procedure, a re-test rule for shared rules and model changes, and your own assessment of the supplier and of your use.

Botminds holds a SOC 2 Type II audit and manages information security to ISO 27001. Those are statements about the supplier's controls. They do not validate your use, and no software can be certified for GxP, Part 11 or Annex 11. The product's version history, audit trail, roles and test records are controls that support your compliance; your people decide and sign.

A month in the queue and a confident wrong figure: the two costs to weigh before you let people build

In shortTwo costs pull against each other. The queue costs weeks on every new question, while people decide on old figures. The shortcut, an untested AI answer or a private spreadsheet, costs a wrong number nobody catches, and in a regulated company a finding when it reaches a record. Nobody publishes either cost for life sciences, so the numbers that matter are the ones you can find in a week.

The market is moving faster than the evidence. Gartner published an Emerging Market Quadrant for No-Code Agent Builders, for startup vendors, on June 11, 2026; we read its title and date in a listed vendor's announcement, not the paid report.37 In McKinsey's 2025 survey of 1,993 participants across industries, 62% said their organizations were at least experimenting with AI agents and 23% were scaling them somewhere in the enterprise; we read a news report of the survey, not McKinsey's own report.38 Neither figure is specific to life sciences.

The split is the fictional company's estimate. For a GMP-relevant use, add your review and release time to the right-hand column: confirmation by a second person and quality approval take what your procedure takes.

Where the cost of new data questions hides at your company, and how to find it in a week

An inspection question, an analyst who quits, a decision on old figures: costs a calculator leaves out

Your return from a governed agent builder: engineering hours back, review time paid, fewer wrong figures

In shortPut in your own numbers. The return comes from engineering and analyst hours on new questions, less the review time a governed build still needs, plus whatever wrong figures you stop. The calculator counts review time on purpose, and takes away what the software would cost you. Every default is a placeholder.

Engineering time, review time, wrong figures, the wait: where a governed builder pays

A calculator for new data questions, review hours and corrections at your company

Is your company ready to let business and quality teams build AI agents? Score eight questions

In shortEight questions, 0 to 2 each. Your score suggests whether to write the procedure first, pilot on one business-reporting use, or plan a rollout that includes GMP-relevant uses. Nothing you choose leaves this page.

From an unwritten builder role to a rollout with GMP uses: what each band means

Questions for any no-code AI agent builder vendor: tests, sign-off, model changes, records and claims

In shortAsk every vendor the same questions, us included. The answers show whether the tool tests against figures you already trust, whether a second person can be required, what happens when the AI model underneath changes, what record it keeps, and whether the vendor claims a certification no software can have.

A ten-week pilot of a governed agent builder: one reporting use, one GMP-relevant use, five numbers

In shortStart with your procedure and a baseline. Build one business-reporting agent first, where a wrong answer costs little. Then one GMP-relevant use with a second confirmer and release under change control. Have someone who was not involved read the record. Decide on the numbers below.

1. Weeks 0 to 2. Write the builder role, the triage and the re-test rules. Measure the wait on your last 20 requests.
2. Weeks 2 to 4. Assess the vendor as a supplier. Set up read-only access. Agree test sets with two report owners.
3. Weeks 4 to 6. One business-reporting agent, built by an analyst. Count failed tests, causes and minutes.
4. Weeks 6 to 9. One GMP-relevant use, such as effective document versions, with two confirmers and a release under your change procedure.
5. Weeks 9 to 10. An auditor who was not involved reads the record. Decide, and write down why.

Failed tests caught, time to a confirmed answer, record questions answered: scoring the pilot

No-code AI agent builders in pharma and medtech: CSA, Annex 22, citizen developers and validation

In shortShort answers to what quality, validation and data teams search for, each complete on its own. Rules and statuses are as of November 2026.