What is ALCOA data integrity and what does Contemporaneous actually require?
ALCOA stands for Attributable, Legible, Contemporaneous, Original, Accurate. Extended to ALCOA+ by FDA and MHRA, it is the minimum standard for all GxP-regulated records. The hardest criterion to satisfy is Contemporaneous: a record must prove it was created at the time the activity occurred, not reconstructed afterward. Most electronic record systems generate internal timestamps that are self-attesting — controlled by the same organisation that created the record. That is not independent proof.
FDA, MHRA, and EMA have cited ALCOA+ failures in hundreds of Warning Letters and inspection findings. In every case, the question is the same: can you prove this record was created when you say it was? immut provides the independent blockchain-anchored timestamp that makes the Contemporaneous criterion provable.
What does each ALCOA+ criterion require?
FDA guidance on data integrity (2018) and MHRA's GxP data integrity guide (2021) apply ALCOA+ to all computerised and paper records in regulated environments. Here is what each criterion demands:
Who performed the action and when. Record must identify the originator.
Permanent, readable for the record's lifetime.
Created at the time the activity occurs — not reconstructed later.
First-captured observation or certified true copy of it.
Truthful record of what actually occurred.
Extended criteria added by regulatory agencies.
Why can't existing LIMS or EBR systems prove Contemporaneity?
Internal system timestamps are self-attesting: generated and stored by the same system — controlled by the same organisation — that created the record. A LIMS administrator or IT team with appropriate access can alter system time, modify audit trail tables, or recreate records with backdated timestamps. FDA's 21 CFR Part 11.10(b) requires audit trails that independently record time. The word independently rules out systems where the generating organisation also controls the timestamp.
What is an independent, tamper-evident audit trail for ALCOA purposes?
An independent audit trail is one recorded by a system that the regulated organisation does not control and cannot alter. The XRP Ledger is a public, decentralised blockchain. No single entity — including immut — controls it. When immut anchors the SHA-256 hash of a record to the XRP Ledger, the timestamp is recorded by thousands of independent validator nodes simultaneously. The regulated organisation cannot retroactively alter the timestamp without changing the underlying record (which changes the hash, making the alteration immediately detectable).
How does immut prove the Contemporaneous criterion to an FDA or MHRA inspector?
Each immut certificate contains: (1) the SHA-256 hash of the original file, (2) the XRP Ledger transaction ID, (3) the ledger sequence number, (4) the UTC timestamp to the second. An inspector verifies the certificate by looking up the transaction ID on the public XRP Ledger. If the hash matches the file presented, and the timestamp predates the claimed event, the Contemporaneous criterion is satisfied. No trust in immut or the regulated organisation is required — the verification is mathematical and public.
Does immut replace our LIMS, EBR, or document management system?
No. immut sits underneath existing systems as the independent proof layer. Your LIMS or EBR manages and organises records. immut proves when those records existed. The two are complementary. immut adds the one property that electronic systems cannot self-certify: independent verification of creation time. It integrates with any file-based workflow — documents, reports, batch records, validation protocols — regardless of what system they originate in.
What has happened to organisations that failed ALCOA+ data integrity inspections?
FDA inspections found broken documentation trails: incomplete batch records, records that could not be authenticated. The agency's finding was not that products were unsafe — it was that records could not independently verify that GMP had been followed. The consent decree covered all 30+ manufacturing facilities. ALCOA+ failures resulted in $500M in penalties and import alerts.
Zydus Pharmaceuticals (2023), Sun Pharmaceutical (multiple years), and Bharat Serums (2022) faced similar enforcement actions — all rooted in audit trail integrity failures. See the full GxP enforcement case library.
How immut satisfies ALCOA+ in four steps
The SHA-256 hash of your batch record, validation protocol, or audit log is computed locally. The original file never leaves your infrastructure. No data is transmitted to immut.
The hash is recorded on the XRP Ledger with a cryptographic timestamp. The ledger is public and immutable — controlled by no single party. No administrator can alter the entry.
immut issues a certificate containing the hash, XRPL transaction ID, ledger sequence number, and UTC timestamp. This is your ALCOA+ contemporaneous proof.
An FDA or MHRA inspector verifies the certificate by looking up the transaction ID on the public blockchain. No contact with immut required. No chain of custody to dispute.
Related GxP evidence resources
Prove your first file in minutes.
Takes seconds. Works on any file type. No installation required.