QAtrial includes an AI compliance co-pilot with six capabilities. This article explains what each capability does, how to configure a provider, what the user actually sees and does when interacting with AI features, and how AI governance works in a regulated quality context.
Inside QAtrial
Human reviews.
Human decides.
(Anthropic, OpenAI)
(Ollama, LM Studio)
The Six AI Capabilities
1. Test Case Generation
What it does: Given a requirement, the AI generates four to six test cases that verify the requirement’s acceptance criteria.
What you see: Click the test generation icon on any requirement row. A panel opens showing the requirement’s details at the top. Below, the AI generates proposed test cases, each with a title, description (including test steps and expected outcomes), and a pre-set link to the originating requirement.
What you do: Review each proposed test. Accept it as-is, edit it before accepting, or reject it. Accepted tests are created in the system with auto-generated IDs and proper links.
How it works: The AI receives the requirement text along with project context: country, vertical, applicable standards, and risk level. The prompt instructs the AI to generate tests that are specific, executable, and appropriate for the regulatory domain. A medical device requirement generates tests referencing IEC 62304 expectations. A pharmaceutical requirement generates tests aligned with GMP practices.
2. Risk Classification
What it does: Proposes a severity and likelihood rating for a requirement using the risk taxonomy appropriate to the project’s vertical.
What you see: Click the risk classification icon on a requirement row. A panel shows the AI’s proposed severity (1-5), likelihood (1-5), the resulting risk level, and a rationale explaining the classification.
What you do: Accept the classification to update the requirement’s risk metadata, modify the ratings if you disagree, or reject and classify manually.
How it works: The AI uses vertical-specific taxonomies. Medical device projects use ISO 14971 severity categories (negligible, marginal, critical, catastrophic) and likelihood categories. Pharmaceutical projects use ICH Q9. Software projects use GAMP 5 risk classifications. The prompt includes the taxonomy definitions so the AI applies the correct framework.
3. Gap Analysis
What it does: Compares your project’s requirements and tests against the applicable regulatory standards and identifies covered areas, partial coverage, and gaps.
What you see: In the Compliance dashboard, click Run Gap Analysis. After processing, a per-standard breakdown appears: total clauses analyzed, covered, partial, and missing. Each gap includes an AI-generated description of what is missing and a suggestion for how to address it. A Generate Requirement button next to each gap creates a pre-filled requirement.
What you do: Review the gaps. For each one, decide whether to generate a requirement, add the coverage to an existing requirement, or accept the gap as not applicable to your project.
4. CAPA Suggestions
What it does: When a test fails, the AI proposes root causes, corrective actions, and preventive actions based on the test context, the linked requirement, and the project’s regulatory domain.
What you see: In the CAPA dashboard, failed tests appear in a funnel view. Select a failed test to see AI-generated suggestions: potential root causes ranked by likelihood, proposed corrective actions, and proposed preventive actions.
What you do: Review the suggestions. If a formal CAPA is warranted, create a CAPA record incorporating the relevant suggestions. The CAPA record then follows its own lifecycle.
5. Executive Brief
What it does: Generates a one-page compliance summary suitable for C-level review or management meetings.
What you see: A formatted brief covering project status, compliance readiness, key risks, open CAPAs, and recommendations. Available in the Reports section.
What you do: Review the brief, edit if needed, and export as PDF.
6. Validation Summary Report (VSR)
What it does: Generates a seven-section audit-ready validation report including scope, approach, test results, deviations, and conclusions.
What you see: A structured report following a standard VSR format. The AI populates each section from project data and adds narrative context. Available in the Reports section with PDF export.
What you do: Review every section. Modify AI-generated narrative to match your organization’s documentation style. Export as PDF for inclusion in audit packages or regulatory submissions.
AI-Powered Contract Management: AI-Powered Contract Management:AI contract management, legal automation, contract lifecycle management, AI legal tech, … compliance monitoring, smart contracts.
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Configuring an AI Provider
Click the gear icon (Settings) in the header toolbar. The AI Provider Settings panel opens.
Five Presets
QAtrial offers five one-click presets that auto-fill provider configuration:
Anthropic: Uses Claude models via the Anthropic API. Requires an API key from console.anthropic.com. Default model: claude-sonnet-4-20250514. Temperature: 0.2. Best for regulatory precision and long-context requirements.
OpenAI: Uses GPT models via the OpenAI API. Requires an API key from platform.openai.com. Default model: gpt-4.1. Temperature: 0.2. Strong general-purpose option.
OpenRouter: Routes to multiple model providers through a single API. Requires an OpenRouter API key. Gives access to Claude, GPT, Gemini, Llama, DeepSeek, Qwen, and other models. Useful if you want to compare models or access models not available directly.
Ollama (Local): Runs models locally on your machine. No API key needed. Default model: llama3.1:8b. Temperature: 0.3. Requires Ollama installed separately (ollama.ai). Data never leaves your machine.
LM Studio (Local): Runs models locally via LM Studio. No API key needed. Temperature: 0.3. Requires LM Studio installed separately. Like Ollama, data stays local.
Model Selection
When you select a preset, the Model field becomes a dropdown showing available models for that provider. For Anthropic, you choose between Claude Sonnet, Opus, and Haiku. For OpenAI, you choose between GPT-4.1, GPT-4.1-mini, GPT-4o, and others. For Ollama, you choose between locally available models like Llama 3.1, Qwen 2.5, Mistral, and DeepSeek.
Smart Defaults
Cloud providers default to temperature 0.2 and max tokens 4096. Local providers default to temperature 0.3 and max tokens 2048. These defaults are tuned for regulatory quality content, where precision matters more than creativity.
International IT Regulations and Compliance: Quality Standards in the Pharmaceutical and Regulated Industries
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Purpose-Scoped Routing
QAtrial supports configuring multiple AI providers and routing different tasks to different models. This is called purpose-scoped routing.
Why would you want this? Different AI tasks have different characteristics:
- Test generation benefits from models with strong instruction following and domain knowledge. A larger model produces more thorough test cases.
- Risk classification needs precision and consistent taxonomy application. A model tuned for analytical tasks works well.
- Executive briefs need clear writing. A model good at summarization is appropriate.
- Gap analysis requires deep understanding of regulatory standards. The most capable model available is the right choice.
You might route gap analysis to Claude Opus (maximum capability) while routing test generation to Claude Sonnet (good capability, lower cost) and executive briefs to a local Llama model (no data leaves your network).
AI-Powered Software Testing: Practical Techniques for Quality Assurance with Generative AI
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Human-in-the-Loop Principle
Every AI feature in QAtrial follows the same pattern: AI proposes, human reviews, human decides.
The AI never creates records autonomously. It never changes statuses. It never approves anything. Every AI output appears as a proposal in a review panel, and a human must explicitly accept, modify, or reject it.
This is not just good UX design. In regulated industries, accountability for quality decisions must rest with identified individuals. The CAPA suggestion did not write itself into the quality system. A named person reviewed it, modified it, and accepted it on a specific date. The audit trail records who made the decision, not just that a decision was made.
The Modern AI Agent with Claude AI: A Practical Guide to Building Autonomous Workflows for Real-World Use
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Confidence Scoring
AI-generated outputs include provenance metadata:
- Model: Which model generated the output (e.g., claude-sonnet-4-20250514)
- Parameters: Temperature, max tokens, and other settings used
- Tokens: Input and output token counts
- Timestamp: When the generation occurred
- Reviewer: Who reviewed and accepted the output
Re-run history tracks all AI generations for a given entity. If you generate tests for the same requirement multiple times (perhaps after editing the requirement or switching to a different model), all versions are preserved and can be compared.
This provenance chain is important for regulated environments. If an auditor asks how a test case was developed, the answer is documented: generated by model X with parameters Y, reviewed by person Z on date W.
Privacy and Data Sovereignty
Data privacy is a real concern when using AI in regulated industries. Pharmaceutical formulations, medical device designs, and clinical trial data may be subject to confidentiality agreements, trade secret protection, or data protection regulations.
QAtrial addresses this with the local model options:
Ollama runs open-source models (Llama, Mistral, Qwen, DeepSeek) entirely on your machine. No data is sent to any external service. The AI processing happens in your local environment. For organizations that cannot send quality data to cloud APIs, this is the enabling feature.
LM Studio provides the same local execution model with a different interface.
When using cloud providers (Anthropic, OpenAI, OpenRouter), data is sent to those providers’ APIs. You should review each provider’s data retention and usage policies. Anthropic and OpenAI both offer terms where API data is not used for model training, but your organization’s compliance team should verify this independently.
Temperature Settings and GxP Relevance
Temperature controls the randomness of AI outputs. Lower temperature produces more deterministic, consistent results. Higher temperature produces more varied, creative results.
QAtrial defaults to temperature 0.2 for cloud providers and 0.3 for local providers. These are low settings, chosen deliberately for GxP contexts where:
- Consistency matters: If you generate tests for the same requirement twice, the results should be similar. High temperature would produce wildly different outputs each time.
- Precision matters: Regulatory classification and gap analysis need accurate, specific outputs, not creative interpretations.
- Reproducibility matters: Regulated environments value the ability to explain why a particular output was produced.
Local providers use a slightly higher temperature (0.3) because smaller models sometimes need more sampling diversity to produce coherent outputs. This is a practical accommodation, not a quality trade-off.
You can adjust temperature in the provider settings if the defaults do not suit your needs.
The ISO 13485 Dual-Mode Assessment
The ISO 13485 gap assessment demonstrates how QAtrial balances AI and non-AI approaches:
Keyword mode works without any AI provider. It matches requirement text against curated keyword lists for each of the 27 ISO 13485:2016 clauses. Two or more keyword matches means “covered.” One match means “partial.” Zero means “gap.” This mode is deterministic, reproducible, and always available.
AI mode sends requirements to the configured LLM for semantic analysis against clause intent. It understands that a requirement about “maintaining records of personnel qualifications” addresses clause 6.2 (Human Resources) even if it does not contain the specific keywords. AI mode is more accurate but requires a provider and produces probabilistic results.
Both modes display results in the same interface: readiness score, section-by-section accordion, per-clause status with matched requirements. You can switch between modes with toggle buttons. For maximum confidence, run both modes and compare: keyword mode as a baseline, AI mode for deeper insight.
Practical Advice
Start with a local model if you are evaluating QAtrial. Install Ollama, pull llama3.1:8b, and configure QAtrial to use it. You will see all AI features working without sending data anywhere or spending money on API credits.
Use the best model for gap analysis. Gap analysis benefits most from model capability. If you have access to Claude Opus or GPT-4.1, route gap analysis there. The quality difference compared to smaller models is significant for this task.
Do not skip the review step. AI outputs are drafts. In six months, no one will remember whether a test case was AI-generated or hand-written. What matters is that a qualified person reviewed and approved it. Treat AI output with the same review rigor you would apply to a junior engineer’s first draft.
Document your AI configuration. For audit readiness, note which models you use, what temperature settings are configured, and what your review process is. QAtrial’s provenance tracking handles the per-record documentation, but your quality system should describe the overall approach to AI-assisted quality work.
AI in QAtrial is a productivity tool, not an autonomy tool. It makes quality engineers faster and more thorough. It does not replace their judgment, their accountability, or their signatures.
