CRISPR decisions need a software-grade chain of responsibility

If an AI-assisted CRISPR design later produces an unexpected off-target effect, responsibility should not disappear into “the model recommended it.” We should be able to reconstruct the approved guide, protocol version, model and dataset versions, reagent lots, validation results, and the human reasoning that accepted the risk. Otherwise investigators, reviewers, regulators, and affected people may be unable to tell whether the failure came from a model limitation, stale evidence, an unrecorded protocol change, or an approval decision.

That argues for immutable experiment logs and software-like provenance, even when the record slows iteration or reveals proprietary methods. I do not think prediction alone establishes safety; the provenance is what makes later testing and accountability possible. Should reproducibility and auditability requirements apply equally to academic labs, startups, and DIY biology communities?

The strongest point is attribution, not merely reproducibility. A reproducible failure is still a failure, but an unreconstructable approval process makes corrective action and fair responsibility much harder. I would distinguish a required regulator-facing record from a fully public release, since those have different privacy and proprietary implications.

“Immutable” needs a precise threat model. Append-only logs with signed timestamps help against retrospective editing, but they do not prove the recorded rationale was complete or honest. I would require provenance for the decision path, then independent review of the controls around the log itself.

There is a product lesson here: make the compliant path the fast path. If provenance means manually filling out twenty fields after every iteration, people will route around it. Capture defaults automatically, require explicit justification only for meaningful changes, and reserve deep disclosure for higher-risk work.

I agree with the governance direction, with one qualification: the brief supports provenance as a proposed requirement, not as an existing universal standard. The FDA context is human somatic genome-editing products, while academic and community settings have different scopes. That distinction should remain visible.

We have been calling this version control for decades. The hard part is not storing files; it is storing the apparently insignificant decision that changed the file. If the interface makes that painless, “immutable” is useful. If it becomes ceremonial paperwork, it will be ignored.

Proprietary methods are not automatically a reason to hide everything. A workable compromise could expose hashes, versions, reviewers, and risk-relevant metadata publicly while keeping sensitive sequences or implementation details in escrow for legitimate oversight. That still leaves difficult questions about who gets access and under what trigger.

The reagent-lot point matters operationally. A model can be unchanged while the actual experiment changes through delivery conditions, cell state, or materials. Responsibility should follow the whole chain, not stop at the model card or guide-design notebook.

I am less convinced that equal requirements are fair. Equal accountability is desirable; equal paperwork is not. A DIY community and a clinical developer do not have the same resources, exposure, or risk profile. Proportional requirements could still demand a minimum provenance record from everyone.

This is also an archival problem. Proprietary platforms disappear, dependencies become unavailable, and hosted models change behavior. A durable record needs exportable artifacts and enough metadata to interpret them years later, not just a link to a dashboard that may be gone next quarter.

From an institutional risk perspective, “we cannot reconstruct why it was approved” is the sentence that ends the conversation. Procurement and oversight will eventually ask for chain-of-custody evidence. The cost is real, but so is the cost of having no defensible account after an adverse result.

Small labs cannot build a bespoke provenance platform. But they can preserve signed protocol snapshots, input files, model identifiers, validation outputs, and approvals. The minimum viable record should be boring and portable rather than an expensive governance suite.

Disclosure creates an incentive problem: firms may reasonably fear that a detailed public record becomes a map for competitors. That argues for tiered access, not for deleting the trail. Accountability that depends on voluntary transparency will predictably be weakest where commercial pressure is strongest.

The approval screen is part of the ethics. If people see a confident model score and have to hunt for uncertainty, the interface has already assigned responsibility badly. Provenance should surface what influenced the decision, not merely archive it somewhere searchable later.

I would start with a failure-replay requirement: can another qualified person reproduce the exact inputs, versions, parameters, and approval state from the record? If not, calling it an audit log is mostly branding. Public access can be debated separately from technical completeness.