AI and QMS documentation: what needs validation before you use it

Companies that are digitizing their quality management system often come to me with the same question: "We use AI to write procedures, manage changes and review documents. Do we need to validate it?" The more complex answer is that it depends, and a lot depends on how you define "using AI".

Two completely different categories

Before we talk about requirements, we need to distinguish between two completely different categories:

  • Category A, AI as a writing and editing tool: A person uses AI to draft, edit or improve a document (with ChatGPT, Claude or Copilot, for example). The person is the authority. They read, verify and approve the output, and the final document goes through all the usual approval processes.

  • Category B, AI as a functional component of a quality process: An AI system performs an automated action within the quality management system, such as classifying documents, detecting deviations, generating reports or analyzing CAPA data. Here the AI itself is part of the regulated process.

The validation requirements for these two categories are completely different.

Category A: AI as a writing tool

When a person uses AI as a tool for drafting and editing, the AI is not part of the quality process. It is a tool the person uses as part of their own work, just as they use Word, Grammarly or any other writing assistant.

What ISO 13485:2016 says: Clause 4.1.6 requires the organization to define its processes, specifically the "processes needed for the quality management system". The document creation process must be defined. However, the tool used for writing is not necessarily part of the regulated process itself.

What is required: A proper document control process under clause 4.2.4, which includes review and approval before distribution, controlled versions and identification of changes. All of these apply to the final document, regardless of how it was created.

Practical recommendation: It is worth stating in your document writing procedure that AI tools may be used for drafting, and emphasizing that every document is reviewed and approved by an authorized person. That is enough. There is no need for formal validation of the AI tool itself.

Category B: AI as a functional component of the QMS

Here the situation is entirely different. If an AI system performs an action that affects product quality, product safety or regulatory compliance, it requires Computer Software Assurance (CSA) under the FDA approach, and computer software validation under ISO 13485.

ISO 13485:2016 clause 4.1.6: "The organization shall document procedures for the validation of the application of computer software used in the quality management system. Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application."

This is a clear and explicit requirement. Software that is used in the quality management system and meets the definition of an "application of computer software" must be validated.

The FDA's newer approach, known as Computer Software Assurance (CSA) and described in a 2025 guidance, emphasizes a risk-based approach instead of heavy validation documentation.

What CSA changed in the FDA approach

In 2025 the FDA published the guidance document "Computer Software Assurance for Production and Quality System Software".

This document presents a substantial shift in approach: instead of formal validation for every piece of software, the FDA proposes a risk-based approach.

The central question under CSA is this: what level of risk does the software represent?

Software used for critical manufacturing operations, for classifying nonconformances, for approving product release or for managing CAPA sits at a higher risk level. Software used for drafting, reviewing or organizing information sits at a lower risk level.

Under CSA, the documentation and the level of validation are scaled to the risk.

For low-risk software, a lighter level of assurance is enough: a basic functional test that shows the software does what it is intended to do, with minimal documentation of that test.

For high-risk software, fuller documentation is required.

Putting it into practice: questions to ask before using AI in the quality management system

  • Question 1: Does the AI perform an action that directly affects product safety or compliance? If it does, a validation or assurance process is required. If it does not, a clear usage policy is enough.

  • Question 2: Does a person review the AI output before a decision is made? Keeping a human in the loop lowers the risk level and the validation requirements.

  • Question 3: Does the AI change over time (is it adaptive)? An AI system that learns and changes requires a monitoring and change control process.

  • Question 4: Does the AI system's supplier provide adequate documentation? Under ISO 13485 clause 7.4 (purchasing), the supplier of critical software is a supplier that must be managed. If they do not provide enough documentation, that becomes part of your risk management.

What your procedures should say

If an organization decides to use AI in its quality management system, these are the points that need to be defined:

  • Scope of use: In which processes may AI be used, and what is out of scope?

  • Human oversight: Who reviews and approves each AI output before a decision is made?

  • Documentation: How is the use of AI documented in critical quality processes?

  • Change control: What happens when the AI system changes (a new version, or a change in parameters)?

  • Supplier management: Who is the supplier, are they approved, what is the SLA, and what happens if the service stops?

The EU MDR and AI in the quality management system: another angle

Under MDR Article 10(9), the manufacturer must maintain a quality management system that covers all aspects of the product life cycle. The MDR has no specific reference to AI in running the quality management system, but notified bodies expect the organization to be able to explain and document how each process in the quality management system is performed, controlled and governed.

Use of AI that is neither documented nor governed raises a legitimate question during an audit.

In closing: validation is not a magic word

Not every use of AI requires formal validation. Every use of AI does require some thought, though: what the risk level is, what the effect on safety and quality is, and what the oversight process looks like.

An organization that decides to use AI in its quality management system, does so with a clear understanding of the boundaries and defines suitable procedures will be in a much better position than an organization that uses AI without thinking about the subject at all.

Validation is a means, not a goal.

The goal is the safe and controlled use of tools that serve the system rather than harm it.