Can AI Agents Be Used in a Validated ERP System?
By Thomas Brünger, Managing Partner
Yes — AI agents can be used in a validated ERP system, but only under governance. The question is not whether to use agents, but under what controls. An agent that acts on a validated system — posting documents, applying configuration, reconciling data — is making changes to a validated system, and that carries the full weight of the controls that implies.
What "under governance" means
An AI agent in a regulated ERP environment needs defined authority boundaries (what it may and may not do), human-in-the-loop approval for GxP-relevant actions, a complete and attributable audit trail of every action and its rationale, and change control over the agent's own configuration and model. These are not new principles — they are the existing expectations for computerised systems (EU GMP Annex 11) and AI (Annex 22) applied to an agent.
The practical line
Agents that suggest are low-risk; agents that act on validated data are not. The controls scale with the risk of the action, and the governance has to be designed before the agent is deployed — not retrofitted. See AI in regulated manufacturing (Annex 22) for the regulatory backdrop and compliant AI agents for Business Central for how the controls apply in practice.
Frequently asked questions
- What controls does an AI agent in a validated ERP need?
- Defined authority boundaries, human-in-the-loop for GxP-relevant actions, a complete audit trail of what the agent did and why, and change control over the agent's configuration and model — the same scrutiny as any change to a validated system.
- Does EU GMP Annex 22 apply to AI agents in ERP?
- Annex 22 addresses AI in GMP. An agent that acts on a validated ERP system is making changes to a validated system, so both Annex 11 (computerised systems) and Annex 22 (AI) considerations apply.