When the inspector asks for the deviation record, the answer is one question away.
Revised Schedule M has applied to every pharma unit in India since 1 January 2026, and state inspections are underway. A formulations or API manufacturer in the ₹100–800 crore band holds thousands of batch records, SOPs, deviation and CAPA files, and supplier documents, most of them scanned. This blueprint shows how a QA head finds any of them, with the signature, in under a minute, and how the documents the inspector will ask for are checked before the visit, not during it.
Who this is for
Modelled on representative organisation profiles. Test these parameters against your internal numbers.
Size band
Teams
Systems
Regulator
The three documents and two processes
The 3 documents and 2 processes you already have. No new content has to be created to begin.
The 3 Core Document Sets
SOPs and their revision history
Hundreds of SOPs; which version was in force on a given date is a search through a register
"Which SOP applied when this batch was made?" is the first inspector question
Deviation, OOS and CAPA records
Scanned forms; linked to batches by memory and a spreadsheet
Open CAPAs and repeat deviations are findings
Supplier documents (COAs, vendor qualification, quality agreements, change notifications)
Email attachments; a supplier's qualification status lives with one person
A COA that does not match the specification should stop a batch, not surface in an audit
The 2 Mission-Critical Processes
Pre-inspection document readiness
QA spends two to three weeks before each inspection assembling evidence
Nobody was hired for this
COA and supplier document checks
Every incoming material lot: COA received, checked against spec, filed; chased when missing
Done by hand, lot by lot
Days 1–90 in four stages
A phased, non-disruptive roadmap. Governed rules signed first, production live by week three, full autonomy by day 90.
- PHASE 01Days 1–15
Map and write the rules
With the QA head and the plant head, we list where SOPs, deviation records and supplier documents sit, who may read which, and what the inspection evidence list looks like for your licence type. Access, retention and approval rules are written as controlled documents and approved through your own change control. Nothing about your validated systems is touched.
Milestone: Signed rules & zero software footprint - PHASE 02Days 16–36
Open the door
Vectalk is deployed inside your site network or your cloud account on SOPs, deviation and CAPA records and supplier documents, read-only. Three weeks to production. From day 36 the QA head asks "List all deviations in the last 12 months on line 3 with a root cause of operator error, and their CAPA status" and gets the list, each with the record number and the signed page.
Milestone: Vectalk deployed in private boundary - PHASE 03Days 37–60
The first worker: inspection readiness
A Neo Agent runs your evidence checklist weekly: for every open CAPA, every SOP due for review, every batch with a deviation, it confirms the record exists, is signed and is closed or has a due date. Gaps go to the QA head on one screen each Monday. The agent reads and reports; it never writes to the QMS.
Milestone: First autonomous worker live with approvals - PHASE 04Days 61–90
The second worker: COA checks
For each incoming lot, the agent reads the supplier's COA, checks every parameter against your specification, confirms the supplier's qualification is current, and flags mismatches to QC before the material is released. QC approves the release; the agent only prepares the comparison. The audit log of both agents becomes part of your inspection evidence.
Milestone: Complete audit evidence & board report
The rules written first
The governance engine runs before the models. Rules are codified in software and signed off by responsible executives.
Access
ENFORCED RULEQA reads everything; production reads SOPs and its own batch records; purchase reads supplier documents but not deviation records; regulatory affairs reads all but cannot see HR data
Read-only
ENFORCED RULEThe AI never creates, edits or signs a GMP record; your QMS remains the system of record and its validation is untouched
Approvals
ENFORCED RULENo release, no CAPA closure and no supplier status change happens without the named approver signing in your own system
Retention
ENFORCED RULERecords keep their GMP retention period in your system; the AI stores no copy outside the deployment boundary
Residency
ENFORCED RULEDocuments, embeddings and answers stay on your site network or your cloud account in India
What the board sees at day 90
Modelled, with the inputs beside each number. Replace with your own.
- BOARD DELIVERABLE 01
Inspection prep from three weeks to three days.
Input4 QA staff, 15 working days, before each of two inspections a year; the weekly readiness check removes the assembly, leaving review.
- BOARD DELIVERABLE 02
No open CAPA found by an inspector first.
Input60–120 open CAPAs at any time; each checked weekly for owner, due date and evidence.
- BOARD DELIVERABLE 03
COA mismatches caught before release.
Input150 incoming lots a month; every parameter on every COA compared to spec; today the check depends on who is on shift.
- BOARD DELIVERABLE 04
"Which SOP version applied?" answered in under a minute.
Input400 SOPs with revision history loaded; the answer gives the version, effective date and the signed page.
- BOARD DELIVERABLE 05
An audit trail written in the inspector's language.
EMPIRICAL BENCHMARKEvery question, who asked, what they could see, what the agent checked and who approved.
Price band and what recurs
Transparent pricing with zero hidden seat taxes or foreign inference surcharges. Board-ready clarity.
Vectalk on SOPs, deviation and supplier records
Licence and usage, yearly
First Neo Agent (inspection readiness)
Per quarter
Second Neo Agent (COA checks)
Per quarter
One-time setup, document preparation, rule-writing under your change control
Does not recur
FAQ
Straightforward answers to the compliance, security, and IT architecture questions boardrooms ask.
No. It reads documents and data; it never writes a GMP record. Your QMS, LIMS and ERP remain the systems of record and their validation status is unchanged.
Every question and every agent check is logged with the user, the role, the documents retrieved and the answer given. The log is yours and lives inside your boundary.
OCR is part of the pilot. Pages that cannot be read reliably are listed as exceptions; the AI never guesses a batch number or a result.
The document readiness check is the same whichever inspector is coming; the evidence list is yours and can be set per market. Specific 21 CFR Part 11 obligations stay with your systems of record.
Nowhere. Documents, embeddings and answers stay on your site or your cloud account. No public AI service is involved.
Similar shape, different documents: see the NBFC blueprint
Compare how this governed 90-day pilot architecture applies across adjacent operational models.
AI your board can say yes to.
Bring the last inspection's document request list.