# GMP Batch Records and CAPA Data for AI: Retention, Ownership

> How long to keep batch records under FDA and EU GMP, who owns them at a contract manufacturer, and whether pharma batch data can be licensed to AI.

Canonical: https://origindatapartners.com/guides/license-gmp-batch-records-ai
By: Origin Data Partners
Status: Published
Published: 2026-11-13
Updated: 2026-11-14
Sources checked: 2026-11-12

## Quick answer

A drug manufacturer can in principle license de-identified batch, deviation and CAPA data for its own products, but we found no public sale or price for GMP manufacturing records. Today pharma shares data for AI mostly in-house or through federated networks where the data never leaves and members are paid in model access, not cash. FDA requires batch records to be kept at least one year after the batch expires; at a contract manufacturer, the product owner's rights decide what can be shared.

## Key points

- FDA: batch records are kept at least 1 year after the batch expiration date (21 CFR 211.180).
- EU GMP: one year after expiry or at least five years after QP certification, whichever is longer.
- Executed records with deviations, investigations and their outcomes are the useful part for AI.
- No public sale or price for batch record data was found; sharing today is in-house or federated.

## How long do you have to keep batch records?

Under FDA rules, records tied to a batch of drug product are kept at least one year after that batch's expiration date. EU GMP sets one year after expiry or at least five years after Qualified Person certification, whichever is longer. Many manufacturers therefore already hold years of executed batch records.

This page is general information, not legal advice: it states what each rule or contract says, with its source, and your counsel decides how it applies to your company.

| Rule | Record | Retention |
| --- | --- | --- |
| [21 CFR 211.180(a)](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.180) | Production, control and distribution records "specifically associated with a batch of a drug product" | At least 1 year after the batch expiration date; for certain OTC products without expiration dating, "3 years after distribution of the batch" |
| [21 CFR 211.180(c)](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.180) | All records required by part 211 | "Readily available for authorized inspection during the retention period at the establishment where the activities described in such records occurred" |
| [EU GMP Chapter 4, 4.11](https://health.ec.europa.eu/document/download/104b3eb8-81a7-4858-9419-cb06562adb66_en?filename=chapter4_01-2011_en.pdf) | Batch documentation | "One year after expiry of the batch to which it relates or at least five years after certification of the batch by the Qualified Person, whichever is the longer" |
| [EU GMP Chapter 4, 4.11](https://health.ec.europa.eu/document/download/104b3eb8-81a7-4858-9419-cb06562adb66_en?filename=chapter4_01-2011_en.pdf) | Investigational medicinal products | "At least five years after the completion or formal discontinuation of the last clinical trial in which the batch was used" |

Retention rules set a minimum. A licence to an AI developer is a separate decision, and the original records stay where the inspection rules require them.


## What a batch record, deviation report and CAPA record contain

A batch record documents how one batch was actually made; a deviation report records where the work departed from procedure; a CAPA records the investigation, the cause and the fix. Together they show a manufacturing decision and its result, which is what makes them interesting for AI.

| Record | What the rule requires | Typical system |
| --- | --- | --- |
| Executed batch record | Prepared "for each batch of drug product produced" with "complete information relating to the production and control of each batch", including the "persons performing and directly supervising or checking each significant step" ([21 CFR 211.188](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.188)) | Paper or MES electronic batch record |
| Deviation | "Any deviation from the written procedures shall be recorded and justified." ([21 CFR 211.100](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-F/section-211.100)) | eQMS |
| Investigation | Unexplained discrepancies or failures "shall be thoroughly investigated, whether or not the batch has already been distributed", and "A written record of the investigation shall be made and shall include the conclusions and followup." ([21 CFR 211.192](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.192)) | eQMS |
| CAPA | The corrective and preventive action that follows an investigation, with a check that it worked | eQMS |

Precision Federal, a consultant, lists electronic batch record contents as "Executed batch records, phase-level step confirmations, weigh-and-dispense, equipment and material genealogy" and puts volume at 2,000 to 6,000 "batches a year for solid oral dose" at one site ([Precision Federal](https://precisionfederal.com/insights/ai-for-pharmaceutical-manufacturing)).


## Why executed records with deviations and outcomes are useful for AI

A model that reviews batch records or drafts deviation investigations has to learn from real records, including the messy ones. Executed records with deviations, the investigation and the result after the fix are the closest thing to a labeled example, and they almost never leave the company that made them.

Enveda built a system to quality-check executed batch records and tested it on "four executed batch records from one clinical campaign (1,061 scanned, largely handwritten pages)", where "the human reviewers raised 11 distinct actionable issues" ([Enveda](https://enveda.com/cmc-document-processor/)). It notes that "one EBR can run from hundreds to thousands of scanned, handwritten pages".

Most of this work happens inside one company. Hanmi Pharmaceutical "will train AI on some 4,000 standard operating procedures at the Pyeongtaek site" ([Seoul Economic Daily](https://en.sedaily.com/business/2026/09/07/hanmi-pharmaceutical-trains-ai-on-4000-quality-documents)). For general quality records outside pharma, see [licensing manufacturing quality records](https://origindatapartners.com/guides/license-manufacturing-quality-records-ai).


## Who owns batch records at a contract manufacturer?

FDA rules decide who must make and keep the records; the supply or services agreement decides who owns and may use them. A contract manufacturer should treat batch records for a client's product as the client's confidential information, and license nothing about that product without the client's written agreement.

FDA's quality agreement guidance defines contract facilities as "parties that perform one or more manufacturing operations on behalf of an owner or owners", and says the owner's "quality unit is legally responsible for approving or rejecting drug products manufactured by the contract facility, including for final release" ([FDA guidance](https://www.fda.gov/media/86193/download)). It says the agreement should cover changes to "manufacturing records, specifications, laboratory records, validation documentation, investigation records, annual reports" and define each party's "roles in making and maintaining original documents or true copies in accordance with CGMP".

The guidance is about CGMP duties, not commercial ownership, and it states that "quality agreements cannot be used to delegate statutory or regulatory responsibilities to comply with CGMP". Data ownership and use rights sit in the master services or supply agreement, so read that first.


## Trade secret and regulatory exposure

Batch records describe how a product is made, so the risks are mostly about process know-how and inspection history.

- Client know-how. Federal trade secret law counts as misappropriation the disclosure of a secret acquired "under circumstances giving rise to a duty to maintain the secrecy of the trade secret or limit the use of the trade secret" ([18 U.S.C. 1839](https://www.law.cornell.edu/uscode/text/18/1839)). Process details a client gave a CMO under confidentiality are in that category.
- Your own process. Formulas, process parameters and yields for your own products may be trade secrets you choose to keep out, even when you own them.
- Inspection exposure. Deviation and investigation records are what inspectors read. Licensing a copy does not change your obligations, but your counsel should decide what leaves the building.
- People. Batch records name the operators and checkers of each step; replace names with roles or codes.


## How pharma shares manufacturing and R&D data for AI today

Plainly: most pharma data used for AI never leaves the company, and when companies pool data they usually use federated learning, where the model travels to each company's data and members are paid in model access rather than cash. We found no public example of a company selling or licensing GMP batch records for AI training.

| Arrangement | What happens to the data | Source |
| --- | --- | --- |
| Lilly TuneLab | Members "contribute data via a third-party hosted and operated federated learning infrastructure"; models include "more than 675,000 partner-contributed data points" | [CDD Vault](https://www.collaborativedrug.com/cdd-blog/lilly-tunelab-is-coming-to-cdd-vault-sharedlearning-better-informed-discovery); [CDD Vault](https://www.collaborativedrug.com/cdd-blog/webinar-lilly-tunelab-federated-learning-cdd-vault-) |
| Apheris ADMET network | Companies train models together "without sharing proprietary data" | [Apheris](https://www.apheris.com/resources/apheris-launches-admet-network) |
| Ginkgo and Apheris antibody consortium | Members use the models "while retaining ownership of the proprietary sequences and assay data they contribute" | [BioSpace](https://www.biospace.com/press-releases/ginkgo-datapoints-and-apheris-welcome-abbvie-argenx-lundbeck-and-takeda-as-founding-members-of-the-antibody-developability-consortium) |
| In-house training | Hanmi trains AI on its own SOPs; Enveda built its own batch record review | [Seoul Economic Daily](https://en.sedaily.com/business/2026/09/07/hanmi-pharmaceutical-trains-ai-on-4000-quality-documents); [Enveda](https://enveda.com/cmc-document-processor/) |

These networks cover discovery and assay data, not batch records. They show the model pharma prefers: keep the data, share the model. Experiment records are covered in [licensing R&D experiment records](https://origindatapartners.com/guides/license-rd-experiment-records-ai).


## What a drug manufacturer could license, and how to prepare

The realistic candidate is de-identified process and deviation data for products you own: deviation categories, investigation reasoning, root causes, CAPAs and whether the problem came back. No public sale or price exists for this data, so any deal would be a first of its kind and would need to be scoped carefully.

- List products by owner. Separate your own products from client products made under contract; client products stay out unless the client agrees in writing.
- Pick closed, verified CAPAs with linked deviations and investigations, over several years.
- Decide what is a trade secret: formulas, critical process parameters and supplier identities may be removed or generalized.
- Replace operator, reviewer and supplier names with codes. The [de-identification guide](https://origindatapartners.com/guides/de-identify-company-data-before-licensing) covers the method.
- Keep originals in place. Prepare a copy; the retention and inspection duties stay with the original records.
- Read your supply and quality agreements for confidentiality and data-use clauses before anyone exports a file.


## Next step

Start by counting closed deviations and CAPAs for one product you own outright. If the history is linked and the rights are clean, there is something to discuss. Read [what a data licensing agreement should include](https://origindatapartners.com/guides/data-licensing-agreement) before any term sheet.

Does your company hold records like these? [See what your data is worth](https://origindatapartners.com/check-fit).

Origin Data Partners works with companies that own data and helps get it bought. We are independent of the services on this page, and a buyer may pay us when a deal closes ([how Origin is paid](https://origindatapartners.com/referral-disclosure)). [See what your data is worth](https://origindatapartners.com/check-fit).


## Questions and answers

### How long does FDA require drug manufacturers to keep executed batch records?

At least one year after the expiration date of the batch, under 21 CFR 211.180(a). For certain OTC products without expiration dating, three years after distribution of the batch. Records must stay readily available for inspection at the site where the work happened during the retention period.

### How long must batch documentation be kept under EU GMP?

EU GMP Chapter 4 requires batch documentation to be kept one year after expiry of the batch or at least five years after certification by the Qualified Person, whichever is longer. For investigational medicinal products, at least five years after the last clinical trial using the batch ends.

### Can a contract manufacturer license batch records for products it makes for clients?

Not without the client's written agreement. FDA guidance makes the product owner's quality unit responsible for release, and the supply or services agreement decides who owns the data. Process details a client shared in confidence can be trade secrets under federal law. Start with products you own outright.

### Has any pharma company sold GMP batch records or deviation data to an AI company?

We found no public example or price as of November 2026. Pharma data for AI is mostly used in-house, as Hanmi and Enveda do, or pooled through federated networks such as Lilly TuneLab and Apheris, where the data never leaves and members are paid in model access, not cash.

### Why are deviation and CAPA records useful for training AI in pharma quality?

They pair a real problem with the investigation, the cause, the fix and whether it worked. FDA requires discrepancies to be thoroughly investigated with written conclusions and follow-up, so the records hold the reasoning a model would need to learn to draft or review investigations.

### What is in an executed batch record?

A record of how one batch was actually made: a checked copy of the master record, dates, materials, equipment, in-process results, yields, the people who performed and checked each significant step, and any investigation. One executed record can run to hundreds or thousands of scanned pages.

### Can a biotech license manufacturing data without exposing trade secrets?

Partly. Formulas, critical process parameters and supplier names can be removed or generalized while deviation categories, investigation reasoning, root causes and CAPA outcomes stay. Whether what remains is still useful, and still safe to share, is a decision for your quality, legal and technical leads together.

### What is a master batch record?

It is the approved template for making a drug product, which 21 CFR 211.186 calls the master production and control record. One is needed for each drug product and each batch size, "prepared, dated, and signed (full signature, handwritten) by one person and independently checked, dated, and signed by a second person". It lists the components and quantities, theoretical yield limits, packaging and labeling, and complete manufacturing and control instructions. Each executed batch record includes "An accurate reproduction of the appropriate master production or control record, checked for accuracy" (21 CFR 211.188).

### Can batch records be kept in an electronic batch record system?

Yes. 21 CFR 211.68 allows computers and related systems in drug manufacturing, provided changes to master records are made "only by authorized personnel", inputs and outputs are checked and a backup is kept. Part 11 covers electronic records kept "under any records requirements set forth in agency regulations" (21 CFR 11.1), which includes these; see the [Part 11 checklist](https://origindatapartners.com/guides/21-cfr-part-11-checklist).

## Sources

- [21 CFR 211.180: records and reports, general requirements](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.180)
- [21 CFR 211.188: batch production and control records](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.188)
- [21 CFR 211.192: production record review](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.192)
- [21 CFR 211.100: written procedures; deviations](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-F/section-211.100)
- [EudraLex Volume 4, Chapter 4: Documentation (EU GMP)](https://health.ec.europa.eu/document/download/104b3eb8-81a7-4858-9419-cb06562adb66_en?filename=chapter4_01-2011_en.pdf)
- [FDA: Contract Manufacturing Arrangements for Drugs: Quality Agreements (guidance)](https://www.fda.gov/media/86193/download)
- [Enveda: CDP, quality review of executed pharmaceutical batch records](https://enveda.com/cmc-document-processor/)
- [Precision Federal: AI for pharmaceutical manufacturing](https://precisionfederal.com/insights/ai-for-pharmaceutical-manufacturing)
- [Seoul Economic Daily: Hanmi Pharmaceutical trains AI on 4,000 quality documents](https://en.sedaily.com/business/2026/09/07/hanmi-pharmaceutical-trains-ai-on-4000-quality-documents)
- [CDD Vault: Lilly TuneLab is coming to CDD Vault](https://www.collaborativedrug.com/cdd-blog/lilly-tunelab-is-coming-to-cdd-vault-sharedlearning-better-informed-discovery)
- [CDD Vault: Lilly TuneLab federated learning webinar](https://www.collaborativedrug.com/cdd-blog/webinar-lilly-tunelab-federated-learning-cdd-vault-)
- [Apheris: ADMET network launch](https://www.apheris.com/resources/apheris-launches-admet-network)
- [BioSpace: Ginkgo Datapoints and Apheris antibody developability consortium](https://www.biospace.com/press-releases/ginkgo-datapoints-and-apheris-welcome-abbvie-argenx-lundbeck-and-takeda-as-founding-members-of-the-antibody-developability-consortium)
- [18 U.S.C. 1839: trade secret definitions](https://www.law.cornell.edu/uscode/text/18/1839)
- [21 CFR 211.186: master production and control records](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.186)
- [21 CFR 211.68: automatic, mechanical and electronic equipment](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-D/section-211.68)
- [eCFR: 21 CFR Part 11, current text](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11)

## Related reading

- [License Manufacturing Quality Records to AI Companies](https://origindatapartners.com/guides/license-manufacturing-quality-records-ai)
- [Licensing R&D lab notebooks and experiment records to AI](https://origindatapartners.com/guides/license-rd-experiment-records-ai)
- [/who-we-help/manufacturers](https://origindatapartners.com/who-we-help/manufacturers)
- [How to de-identify company data before licensing it](https://origindatapartners.com/guides/de-identify-company-data-before-licensing)
- [Data licensing agreement: what to include](https://origindatapartners.com/guides/data-licensing-agreement)
- [What is proprietary data? Meaning, examples and value to AI](https://origindatapartners.com/guides/what-is-proprietary-data)
- [Non-Conformance Report (NCR): Template and Examples](https://origindatapartners.com/guides/non-conformance-report-template)
- [8D Report: Example, Template and 8D Problem Solving](https://origindatapartners.com/guides/8d-report-example)