Internal change approvals

What a change approval needs

Your own procedure sets the requirements. Most change records cover:

• A description of the change and the reason for it.
• What it affects: drawings, procedures, specifications, training, suppliers, customers.
• A risk or impact assessment by the right disciplines.
• Whether an external approval, permit or licence condition is affected. If so, see permit and licence applications.
• Reviewers and approvers, with their decisions and dates.
• Implementation and close-out: documents updated, people trained, change verified.

Where an AI worker helps

1. Draft the request. From a short description in Teams, the AI drafts a change request in your Word template.
2. Find what is affected. It searches SharePoint and OneDrive for drawings, procedures and work instructions that mention the item being changed, and lists them.
3. Check against the procedure. It compares the request with your change procedure and flags missing fields, a missing discipline review or an absent risk assessment.
4. Route and chase. It sends the request to the reviewers your procedure names, reminds them in Teams and records who has responded.
5. Close out. After approval, it builds a task list in Planner for document updates and training, and tracks it to completion.

It asks before anything important goes out, and in Word each change it makes to a document is approved by you.

US life sciences: 21 CFR Part 11 audit trails

In the United States, FDA-regulated businesses that keep electronic records must meet 21 CFR Part 11. Section 11.10(e) requires the use of "secure, computer-generated, time-stamped audit trails" and says "record changes shall not obscure previously recorded information".

The principle is useful even outside Part 11: never overwrite an approved record. Keep each version, and add new entries instead of editing old ones. See approval evidence packs.

What stays with a person

• Approval. The approvers named in your procedure decide. The AI never marks a change as approved on anyone's behalf.
• Engineering and safety judgement. Risk assessments and technical reviews are done by competent people.
• Whether a regulator must be told. If a change affects an external approval, the responsible person decides what to notify, with advice where needed.
• Electronic signatures. Signatures go in the system of record, by the person signing.

Before you start

Approval files hold drawings, site details, personal information about neighbours and staff, and sometimes commercially sensitive designs. Before you point any AI tool at them, check your own obligations:

• Privacy and data location. The Everything runs against your own Microsoft 365 tenant, but its AI processing uses Microsoft Azure OpenAI and OpenAI, and its privacy policy says those providers may process information outside your country. If a contract, a client or a regulator restricts where your data goes, settle that first.
• Record keeping. Some approvals, conditions and industries carry their own rules on what you must keep and for how long. The AI helps you keep the record; it does not decide what the law requires you to keep.
• Certifications. The Everything does not claim SOC 2, ISO 27001 or any other certification. If your procurement or quality system requires one, it is not a fit for that requirement.
• Your quality system. Check whether your quality or safety management system allows AI-drafted content in controlled records, and how it must be reviewed.

Your data is not used to train AI models, and if you cancel, your files stay where they always were, in your Microsoft account.

Questions people ask