Why You Shouldn't Trust AI to Write Regulatory Documentation Without Review
This is an opinion piece, and I will say it directly up front: AI is an excellent tool for supporting the writing of regulatory documentation.
It does not replace professional judgment, and if you use it without review, it can cause real harm. Not theoretical harm, but harm that reaches the inspection, the regulator and the patient.
Here is why, with specific examples.
The first problem: regulatory hallucinations
Large language models produce text that sounds right. That is their strength, and it is also their biggest risk in a regulatory context.
I have seen AI cite clauses that do not exist in ISO 13485. I have seen it phrase an "FDA requirement" that does not appear in any CFR. I have seen a description of MDCG guidance that pointed to the wrong content. In all of these cases, the text sounded convincing and professional, and it was written in proper regulatory language. Anyone who did not check it against the source would not have spotted the error.
This is not a trait that fully improves over time. Even the most advanced models can produce incorrect information about regulations that have been updated, about specific clauses, and about transition requirements.
The rule: every regulatory citation that AI writes must be checked against the source. No exceptions.
The second problem: generic text that sounds specific
AI is excellent at producing text that sounds specific but is generic.
"The organization shall perform a risk assessment according to ISO 14971 to identify potential risks and take appropriate mitigation measures." That sentence is correct. But it says nothing about the specific organization, the specific product or the specific risks.
Regulatory documentation written with AI and without real organizational context produces documents that pass a superficial review but collapse in a thorough audit.
An experienced auditor asks: "Show me how you apply the risk management process to your product."
If the answer comes from a generic document, it will not hold up.
The third problem: errors in classification and requirements under specific regulations
This is the most dangerous problem, and to a large extent also the hardest to spot. When you ask AI to describe specific regulatory requirements, the output is usually mostly accurate.
The problem is not in what is blatantly wrong, but in the small details: an exception presented as a blanket requirement, a requirement that applies to one category attributed to another, or two documents written in similar language but with different requirements presented as if they were the same.
The main difficulty is that these errors do not look like errors. They look like proper regulatory text, written in professional language, with clause numbers and document names. Someone who does not know the regulation in depth will not spot them. That is why the risk is not only technical but also managerial. An organization that relies on AI to write regulatory documentation without an independent review by a professional may end up with documents that pass internal review successfully but do not hold water in front of an experienced auditor or a notified body.
The fourth problem: versions and updates
Regulations and standards get updated. AI is trained on data up to a known date and does not know about updates published after it.
In the past year we have seen the QMSR (a substantial update to 21 CFR Part 820), changes to the MDR transitional provisions, new MDCG guidance documents and several FDA guidance updates.
An AI asked about the QMSR may answer based on the old 21 CFR Part 820, because that is what it "knows" better.
The differences between them are not negligible.
So what is the right thing to do?
I am not saying don't use AI. I use it every day.
These are the boundaries I work by:
What AI may write without verified review: document structure, clear wording, language editing, alternative phrasings for text I wrote, and a first-draft translation.
What AI must not write without a full check against sources: any section that claims to cite a regulatory requirement, any gap analysis, any statement of compliance, any description of a conformity assessment process, and any regulatory submission.
The iron rule: if the document is going to a regulator, a notified body or an FDA inspection, or is going to be part of the technical documentation, every regulatory claim is checked against the source.
AI helps us, but it is not an authority.
In closing: professional responsibility cannot be delegated
In the end, the signature on regulatory documentation is yours, not the AI's. Regulators, auditors and courts will not accept "the AI wrote it" as an explanation for an error.
AI is another tool in the toolbox, like Excel, like quality management software, like any database that supports the work.
No tool replaces professional judgment.
And in our field, professional judgment is not only efficient. It is essential.