Reprosia

How it works

From a regulatory principle to a record you can show.

What the FDA and EMA principles ask for, where the records get used, and the open-source tools behind them, on one page.

The ten principlesWhere the records get usedThe open-source tooling

The ten principles, and how far Reprosia gets you.

In January 2026 the FDA and EMA published ten joint guiding principles for AI across the drug lifecycle. They are non-binding. This table turns them into things you could show a reviewer.

PrincipleWhat to be able to showWhat Reprosia gives you todaySupport
Human-centric by designWho reviewed, accepted, edited or rejected each AI output.regulog keeps a user-attributed log. Capturing review decisions on AI outputs is in development.Partial
Risk-based approachValidation effort that scales with the tool's context of use and risk.No software feature. Consulting can support the risk assessment.Guidance only
Adherence to standardsAI work sits inside existing GxP controls, audit trails included.regulog is designed around 21 CFR Part 11 and EU Annex 11. You decide which AI records are in scope and document it.Supported
Clear context of useThe task, scope and limits of each AI tool, written down.No software feature. Consulting and templates only.Guidance only
Multidisciplinary expertiseStatisticians, QA, IT and regulatory staff working together.Training and workshops.Guidance only
Data governance and documentationData sources, handling and lineage, tied to each run.lineager traces rows and exclusions from source to analysis dataset.Supported
Model design and developmentTraceable development, versioned releases and frozen environments.reproducr captures sessions and locks dependencies. It covers the R environment, not model training.Partial
Risk-based performance assessmentPredefined metrics and acceptance criteria, with error monitoring.reproducr flags drift when results change. Model-specific performance metrics are not covered.Partial
Lifecycle managementPlanned updates, re-validation and ongoing monitoring.Drift detection and replay help. The change-control process is yours.Partial
Clear, essential informationDocumentation of intended use, capabilities and limits.lineager generates structured provenance reports. AI-specific documentation templates are in development.Partial

Reading the table. Supported means an existing package produces the record. Partial means it covers part of the need, or the AI-specific part is still being built. Guidance only means help comes from consulting, not software.

Principle names and the evidence column paraphrase a third-party summary of the January 2026 principles, not the agencies' own text. Read the official documents before you cite wording, and decide with your QA group which AI records fall under 21 CFR Part 11.

Where the records get used.

Situations where a statistician, QA lead or regulatory reviewer needs evidence, and what produces it.

Reviewing AI-drafted analysis code

In development

Who
Statistical programmers and QC reviewers.
The problem
A draft from an assistant is merged with no record of the prompt, the model or who approved it.
Evidence produced
A log entry chain holding the prompt, output, reviewer decision and data hash.

Tracing populations through an analysis

On CRAN

Who
Study statisticians.
The problem
The sample size changes between datasets and nobody can say exactly which rows were dropped, or why.
Evidence produced
A lineager provenance report listing every exclusion and its reason.

Qualifying an R environment

On CRAN

Who
QA and IT validation teams.
The problem
You need evidence that a package is installed and behaves as specified.
Evidence produced
IQ/OQ/PQ scripts and results for regulog, with each operational test traced to a 21 CFR Part 11 or EU Annex 11 clause.

Showing that SAS and R agree

Consulting

Who
Teams moving programmes from SAS to R.
The problem
Reviewers want proof that migrated outputs match the originals.
Evidence produced
Side-by-side comparison documentation and a migration audit trail.

The open-source tooling.

Reprosia does not replace your analysis environment or your validation process. It adds the records they need to stand up to review, including when an AI assistant was involved.

Where it sits.

The packages are ordinary R packages, so they fit wherever you already run R.

Your R environment

  • Analysis scripts and packages
  • RStudio or Posit Workbench
  • Git and CI
  • The AI assistant you choose

Evidence layer

  • regulog records actions in a tamper-evident log
  • lineager traces rows and exclusions
  • reproducr locks and checks the environment

What QA and reviewers receive

  • Audit log extracts that can be verified
  • Provenance reports
  • Qualification scripts and results
  • Reproducibility checks and drift reports

Audited AI assist In development

The next layer captures the AI step itself. The design below is a sketch of the intended workflow, not released software.

  1. Scope the task

    Write down the context of use: what the assistant may do and what it may not.

  2. Capture the draft

    Log the prompt, the model and its version, and the output it returned.

  3. Record the review

    A named reviewer accepts, edits or rejects the output. The decision joins the same chain.

  4. Fix the data

    Hash the input datasets and exclusions so the run points at an exact data version.

  5. Replay

    Re-run in the locked environment and compare outputs to the logged result.

Design sketch. Function names are illustrative and the API is not final.

# Not released. Illustrates the intended shape.
session <- ai_session(
  task  = "Derive change from baseline for ADLB",
  data  = adlb,
  log   = regulog_path
)
draft  <- ai_draft(session, model = my_model)
review <- ai_review(draft, reviewer = "jsmith",
                    decision = "accept")
ai_replay(session)  # locked environment, recorded seed

You choose the model. Reprosia does not ship one.

Try the simulation

What it is not.

Stating the limits plainly is part of the product.

Not a validated system out of the box
Your own computer system validation still applies. regulog ships qualification scripts to support it, and the results belong to your installation.
Not a compliance certificate
The software is designed around 21 CFR Part 11 and EU Annex 11. Whether a deployment is compliant depends on how it is configured, governed and validated.
Not submission assembly
Reprosia does not build eCTD packages or generate Define-XML. lineager produces provenance reports that can support a Reviewer's Guide.
Not an AI model
It records and verifies what happened around a model you select. It does not judge whether the model is right.

Four questions an auditor will ask.

Four questions come up whenever an auditor looks at AI-assisted analysis. Each one maps to something that exists today or something being built.

  • What did the AI touch?

    regulog writes each action to a hash-chained, user-attributed log, so a missing or altered entry shows up on verification. Capturing prompts and model output in that same log is in development.

    regulog on CRAN
    AI capture in development

  • Which data was it run on?

    lineager traces rows from source to analysis dataset, records every exclusion with its reason, and writes a provenance report styled after the CDISC Reviewer's Guide.

    lineager on CRAN

  • Who reviewed it, and what did they decide?

    Most AI workflows keep no record of who accepted, edited or rejected an output. This is the first thing Reprosia is adding on top of regulog.

    In development

  • Can someone re-run it and get the same result?

    reproducr captures the session, locks dependencies, certifies scripts and flags drift when results change.

    reproducr on CRAN

Want this mapped onto your own workflow?

A short review can show which of these records you already keep and which you do not.

Talk to Reprosia