Document control: versions, review dates and sign-off

What document control covers

Whatever system you use, document control usually comes down to six things:

1. A register of controlled documents, with owner, version and next review date.
2. Versions, so you can tell what changed, when and why.
3. Review dates, so documents are checked on a cycle and after relevant changes or incidents.
4. Approval by someone with authority, recorded.
5. Distribution, so the current version is where people look and old versions are withdrawn.
6. Read-and-acknowledge, where people affected by a change confirm they have read it.

Document control is also something auditors commonly look at under management system standards such as ISO 9001, ISO 14001 and ISO 45001. This page describes the practice in general terms only, not the wording of any clause.

Versions and review dates

SharePoint and OneDrive already keep file version history. What they do not do on their own is tell the owner that a procedure is due for review, or notice that a procedure still refers to a piece of plant you sold last year. That is where an AI worker helps:

• It watches the review dates in your document register and reminds owners ahead of time, then follows up.
• When a review is due, it can read the document and list things worth checking, such as references to roles, equipment or forms that no longer match your other records.
• It drafts the revision in Word for the owner to accept or reject change by change. The Everything's Word add-in drafts and edits in your document, with each change approved.
• It updates the register with the new version, date and a short summary of what changed, once the document is approved.

Incidents and audit findings are common triggers for an unscheduled review. Linking those to the document register means a corrective action from an incident or an audit does not stall.

Approvals and sign-off

The AI can send a draft to the approver, with the change summary and the reason for the change, and chase until it is approved or sent back. It records who approved what and when in your register. It does not approve anything itself.

Some regulated industries set specific rules for electronic records and signatures. In the United States, FDA-regulated businesses are subject to 21 CFR Part 11, which in §11.10(e) requires "secure, computer-generated, time-stamped audit trails" and says "record changes shall not obscure previously recorded information". If rules like these apply to you, your validated document system remains the place approvals are recorded; an AI assistant can support the process but is not that system.

Read-and-acknowledge

When a procedure changes, the people who use it need to know. The routine is simple and tedious, which makes it a good fit for an AI worker:

• Work out who is affected, from a distribution list you maintain.
• Send each person the new version with a plain summary of what changed.
• Record each acknowledgement, for example in a SharePoint List, and follow up with anyone who has not replied.
• Give the document owner a list of who is outstanding.

Acknowledging a document is not the same as being competent in it. Where a change needs training, record it in your training records.

What stays with a person

• Content. What a procedure says, and whether it is safe and lawful, is decided by people with the knowledge and authority.
• Approval and release. A named approver signs off each version.
• Withdrawing old versions. The AI can list where an old version still appears; removing it from use is a decision for the owner.
• Follow-up on non-acknowledgement. What happens to someone who has not read a safety-critical change is a supervisor's call.

Before you start

The Everything runs inside your Microsoft 365 tenant with tightly scoped permissions, but your data does leave the tenant for AI processing. Its privacy policy names Microsoft (Azure OpenAI) and OpenAI as AI providers and says providers may process information outside your country. The public site does not claim any certification such as SOC 2 or ISO 27001, and it does not name a hosting country.

Check any record-keeping rules that apply to your controlled documents, including how long old versions must be kept. Decide which document libraries the AI may read and edit, and keep your document register as the single source of truth.

Questions people ask