Question 1

Which regulatory frameworks does LabComplyx support?

Accepted Answer

LabComplyx supports documentation aligned with CLIA (42 CFR Part 493), CAP accreditation checklists, ISO 15189:2022, ISO 17025, ISO 13485, FDA QMSR (21 CFR 820, effective February 2026), 21 CFR Part 11, 21 CFR Part 211, ICH Q7, ICH Q10, ICH E6(R3), ALCOA+, FDA CSA (2022), GAMP 5, MDSAP, EU MDR, EU AI Act, EPA SW-846, and NELAC/TNI. Each framework is maintained as a controlled reference library with clause-level entries.

Question 2

How do I know the regulatory guidance is correct?

Accepted Answer

Every requirement in our regulatory library is a controlled record with a document number, version, effective date, and a link to the official government or standards-body source. Requirements carry status flags — current, superseded, or under review — so outdated guidance is never silently served. Citations generated during drafting are automatically verified against this library before they appear in a document.

Question 3

Can I trace every recommendation back to its source regulation?

Accepted Answer

Yes. Traceability is architectural, not cosmetic. AI-assisted drafts record the specific regulatory clauses retrieved and cited during generation, and each finding can carry pre-written, auditor-ready citation language for the exact clause (e.g., ISO 13485 §7.5.1 or its QMSR equivalent). You can walk from a recommendation, to the clause, to the official source text.

Question 4

What happens when regulations change?

Accepted Answer

The regulatory library is version-controlled: when a regulation is updated, the prior version is marked superseded rather than deleted, preserving the historical record your past documents cited. For example, our library carries explicit crosswalk mappings between legacy 21 CFR 820, the new FDA QMSR, and ISO 13485 — so documents drafted under either regime remain traceable through the transition.

Question 5

Do you maintain crosswalks between standards like CLIA, CAP, ISO 15189, and FDA QMSR?

Accepted Answer

Yes. Requirements are stored with cross-reference mappings to equivalent clauses in other standards, including QMSR-to-ISO 13485 mappings and MDSAP authority tags (FDA, Health Canada, ANVISA, TGA, PMDA). This lets a lab operating under multiple frameworks satisfy overlapping requirements once instead of duplicating work per standard.

Question 6

Does the AI invent regulatory answers?

Accepted Answer

No. Drafting uses retrieval-augmented generation (RAG): the system first retrieves the relevant verified regulatory text from our controlled library, then drafts against that text and is required to cite the specific clauses used. An automated citation-verification step checks that cited clauses actually exist in the library, and a human reviewer must approve every document before it enters the quality record.

Question 7

What is a CLIA gap audit and does my lab need one?

Accepted Answer

A CLIA gap audit is a structured review of your lab's compliance posture against 42 CFR Part 493 requirements — covering personnel competency documentation, QC policies, proficiency testing, and procedure manuals. If your lab is due for a CLIA inspection or has received deficiency citations, a gap audit gives you a clear remediation roadmap before the inspector arrives. LabComplyx offers a free initial gap audit.

Question 8

How was your AI validated?

Accepted Answer

Every production prompt lives in a governed prompt library where it is risk-classified (GxP-critical, GxP-assistive, or non-GxP) using a documented decision tree, tested against scripted test cases and adversarial challenge tests, and formally approved by QA and a Model Council chair before activation. Each prompt records its version, changelog, validation date, and the specific AI model version it was validated against — the same document-control discipline you apply to SOPs.

Question 9

How do you prevent hallucinations?

Accepted Answer

Three layers. First, deterministic retrieval: drafts are grounded in verified regulatory text retrieved from our controlled library, not the model's memory. Second, automated citation verification confirms every cited clause exists in the source library. Third, a mandatory human sign-off gate — no AI output enters a quality record without a qualified reviewer's approval, and that approval is captured as an electronic signature.

Question 10

Is every AI output reviewed by a human?

Accepted Answer

Yes, and it is enforced by the system rather than by policy alone. Every AI generation event creates a runtime trace with a compliance gate status of 'pending human verification.' The gate only moves to 'verified' when a named reviewer signs off, recording who verified it and when. AI assists; humans approve — always.

Question 11

What happens if the AI is wrong?

Accepted Answer

Reviewer corrections are captured in a structured feedback system — what was rejected, why, and the preferred correction. That feedback feeds a monitored improvement loop, and significant issues are logged in a formal AI incident register with investigation and corrective action, the same way you'd handle any quality event. Rejected outputs never reach the quality record because the human gate sits in front of it.

Question 12

How is prompt quality controlled over time?

Accepted Answer

Prompts are versioned records with semantic version numbers, changelogs, approval status, and performance scores derived from reviewer feedback. Changes require re-validation and re-approval before release. Regression strategy is risk-based: GxP-critical prompts require full scripted regression; lower-risk prompts use golden-prompt sets or sampling-based monitoring.

Question 13

What happens when the underlying AI model changes?

Accepted Answer

Model versions are tracked in a formal model version register recording provider, version, deployment date, configuration baseline, and affected features. Major upgrades require regression tests to pass and Model Council approval before deployment. We also run ongoing drift and bias monitoring so silent provider-side changes are detected rather than discovered by your reviewers.

Question 14

Can we turn AI off?

Accepted Answer

Yes. AI assistance is optional per workflow. You can run governed workflows in manual mode — using the structured intake, review gates, e-signatures, and audit trail as a controlled documentation platform without any generative drafting.

Question 15

What AI governance evidence can you show an inspector?

Accepted Answer

Every generation event produces an immutable runtime trace: model version, prompt ID and version, SHA-256 hashes of the input and output, regulatory citations used, duration, and the human verification record — each trace itself hash-sealed for tamper evidence. These traces can be bundled into an exportable evidence package alongside EU AI Act-style technical documentation, giving you audit-ready proof of controlled AI operation.

Question 16

Can this help us pass inspections? How?

Accepted Answer

LabComplyx is built so evidence is captured as work happens, not assembled before an inspection. Every document carries its own audit trail — drafts, revisions, reviews, approvals — and findings flow through a tracked lifecycle: finding → owner → due date → evidence → verification → closure. When an inspector arrives, you export the record instead of reconstructing it.

Question 17

Who changed this record, and when?

Accepted Answer

Every action on a controlled document is logged with the performer's identity, role, timestamp, and action details. Audit trails are append-only and hash-chained, so entries cannot be silently edited or removed. Version history preserves each prior state of a document alongside who changed it and why.

Question 18

Can records be deleted or altered?

Accepted Answer

Quality records follow ALCOA+ principles: audit log entries are immutable and hash-chained, document versions are preserved rather than overwritten, and superseded regulatory references are retained with their status flagged. Role-based permissions restrict destructive operations to administrators, and even administrative actions are themselves logged.

Question 19

Do you support electronic signatures?

Accepted Answer

Yes. Signature events capture signer identity, the meaning of the signature (e.g., authorship, review, approval), and a computer-generated timestamp, consistent with 21 CFR Part 11 requirements. Signature gates are enforced at workflow checkpoints — a document cannot advance past a review step without one.

Question 20

Can inspectors see everything? Can I export reports?

Accepted Answer

Yes. You can export watermarked draft PDFs, final GxP-formatted documents, full audit trail exports, and complete auditor evidence packages that bundle the document, its version history, signatures, and AI runtime traces. Nothing about the record depends on an inspector having a login.

Question 21

How are deficiencies and CAPAs tracked?

Accepted Answer

CAPAs move through a managed lifecycle with owners, due dates, priority, linked evidence, and verification of effectiveness before closure. Deviations can be linked to the CAPAs they triggered, findings are graded for severity using GHTF-style nonconformity grading, and dashboards surface overdue actions and recurring findings so trends are visible to leadership.

Question 22

Who is LabComplyx designed for?

Accepted Answer

Small to mid-sized regulated labs — clinical/diagnostic (CLIA, CAP, ISO 15189), environmental testing (ISO 17025, NELAC/TNI), cannabis/hemp, and pharma/biotech GxP teams — that need audit-ready documentation discipline without enterprise QMS overhead. Typical users are QA leads, lab directors, and compliance managers at labs of roughly 5–100 staff.

Question 23

Why wouldn't we just keep using spreadsheets or SharePoint?

Accepted Answer

Spreadsheets and generic document stores hold files; they don't govern work. They have no enforced review gates, no clause-level regulatory traceability, no immutable audit trail, no signature meaning, and no way to prove to an inspector that a record wasn't edited after the fact. LabComplyx's value is the governed workflow layer — every step captures its own evidence as it happens.

Question 24

Does LabComplyx replace our LIMS, LIS, or QMS?

Accepted Answer

No. LabComplyx is a governed documentation and QA-support layer that works alongside your existing systems — QBench, CloudLIMS, Labguru, Benchling, Veeva, MasterControl, SharePoint, and others — with integration points for syncing records both ways. It strengthens documentation workflows without forcing a rip-and-replace project.

Question 25

Can we start small?

Accepted Answer

Yes. The Starter plan covers a single governed workflow area (e.g., CAPA & deviations), and you can expand to more workflow areas as value is proven. Read-only inspector and auditor seats are unlimited on every plan, so visibility never costs extra.

Question 26

How long before we see value?

Accepted Answer

The first governed document cycle typically completes in the first week. AI-assisted drafting is designed to meaningfully cut the manual writing time on CAPAs and deviations, though actual time savings vary by lab and document complexity — every draft still goes through full human review before it's approved. Measurable metrics (cycle time, overdue actions, readiness score) are visible on dashboards from day one so you can track your own results rather than relying on a general estimate.

Question 27

Who uses it day-to-day — do technicians need training?

Accepted Answer

Workflows are role-based: technicians submit structured intakes, QA reviews and signs at gates, and leadership watches dashboards. Each role sees only the steps relevant to them, and guided intake forms mean most staff are productive after a short orientation rather than formal training courses.

Question 28

How is our data protected?

Accepted Answer

Data is encrypted in transit (TLS) and at rest on managed cloud infrastructure. Access is controlled through authenticated sessions with role-based permissions enforced at the database row level — each client can only read and write their own records, and administrative operations require the admin role.

Question 29

Is our data used to train AI models?

Accepted Answer

No. Your documents and quality records are not used to train foundation models. AI calls are processed per-request; the 'learning' our system does is limited to your own reviewers' structured feedback improving prompts for your own drafts — governed, versioned, and visible to you.

Question 30

How do permissions and least privilege work?

Accepted Answer

Row-level security rules are defined per entity: clients see only records tied to their own account, reviewers act only within their assigned documents, and admin-only data (prompt library, model registers, governance logs) is inaccessible to standard users. Public endpoints are rate-limited and validated independently of user permissions.

Question 31

Are you SOC 2 or ISO 27001 certified?

Accepted Answer

We state this plainly rather than implying otherwise: LabComplyx does not currently hold SOC 2 or ISO 27001 certification. Our security posture rests on the controls above — encryption, row-level access enforcement, hash-chained audit logging, and webhook signature verification — and we're happy to walk your IT team through the architecture in detail during evaluation.

Question 32

How long does implementation take?

Accepted Answer

Most labs are running their first governed workflow within days, not months. Onboarding follows a structured engagement: a free compliance review, workflow-area selection, template alignment to your existing SOP formats, and a first supervised document cycle. There is no server installation or IT project — it's a hosted platform.

Question 33

What does pricing look like?

Accepted Answer

Plans are per-lab monthly subscriptions tiered by governed workflow areas and active seats — Starter (1 workflow area), Professional (3 areas), and Lab (all 5 areas) — each with a monthly allowance of reviewed document cycles. Read-only inspector/auditor seats are unlimited and free on all plans. Fractional QA support engagements are available separately. Full details are on the Pricing page.

Question 34

How do we measure success?

Accepted Answer

Dashboards track the metrics QA leadership actually reports on: document cycle time, average CAPA closure time, percentage of overdue actions, inspection readiness score, and repeat-finding trends over time. Monthly compliance summaries and quarterly evidence packages are generated automatically so progress is documented, not anecdotal.

Question 35

What support is included?

Accepted Answer

All plans include onboarding assistance, an in-app assistant, and email support. Document-cycle plans include human QA consultant review as part of the workflow itself — support isn't a separate desk, it's built into how documents move through the system.

Can you trust this system with your lab's compliance program?

Regulatory Confidence

Validation & AI Governance

Audit Readiness & Data Integrity

Business Fit & Workflow

Security & Data Protection

Implementation & Value

Still have a question we didn't answer?