ALCOA for AI

Pharma already has the rulebook for this. It is called ALCOA, and it has governed data integrity in regulated manufacturing for thirty years. Attributable, legible, contemporaneous, original, accurate. Later extended with complete, consistent, enduring, available. Five letters, then nine, that decide whether a record can be trusted years after the fact.

Almost nobody has thought to point it at AI. So let me.

Attributable. Every output traces to a named owner and a specific system. Not the AI produced this, but this model, this version, run by this process, accountable to this person. An output nobody owns is anonymous, and anonymous is the exact opposite of attributable.

Legible. The record of what happened is readable by a human, not buried in a log no one can parse. If working out what the system did needs a forensic engineer and a clear week, it is not legible. The trail has to be plain enough that an inspector, or your own successor, can follow it without you in the room.

Contemporaneous. The record is made at the time the work is done, not written up afterwards from memory. This is the principle AI breaks most casually, because logging gets treated as optional and added later, if at all. A record created after the fact is not contemporaneous. It is a reconstruction, and a reconstruction proves nothing.

Original. You keep the actual inputs and outputs, not a tidied summary. The original prompt, the original retrieved context, the original response. A paraphrase of what the model saw is not the thing the model saw, and the difference is exactly where the problems hide.

Accurate. The record reflects what actually happened, including the failures and the human overrides. A log that shows only the clean runs is not accurate. It is marketing with timestamps.

And the rest. Complete, so nothing is quietly dropped. Consistent, so the same standard is applied every time and not just when someone is watching. Enduring, so it survives longer than the project and the platform. Available, so it can be produced when asked, not locked inside a system you decommissioned last year.

None of this is new. Pharma wrote these rules in recalls and consent decrees, long before anyone trained a model. The task in front of you is not to invent a standard for AI evidence. The standard already exists, fully formed, sitting in a quality manual down the hall. The task is to admit it applies, and that deploying AI earned no one an exemption from it.