Do You Need to Validate ChatGPT in Your Quality System?

 

Since ChatGPT entered our lives, it has already been changing the way we write, analyze and think about regulation. But when the question "Do we need to validate ChatGPT?" comes up, my answer is this: we are asking the wrong question.

As a quality and regulatory consultant for medical devices, I come across this question more and more, especially from organizations that are starting to bring AI-based tools into their day-to-day work.

ChatGPT is not a computer program, so don't treat it like one

Generative models such as ChatGPT are not deterministic tools. They don't work on the logic that input A will always give output B. They are probabilistic, variable and context-dependent, and above all, they cannot be validated in the classic sense.

Instead of trying to push them into a regulatory framework that doesn't suit them, it is time we asked: what does control mean in the context of tools like these?

Four smart steps for bringing ChatGPT into a regulatory framework

If you use LLM-based tools in quality and regulatory processes, here is what matters (not out of fear of the audit, but out of professional responsibility):

  1. Define the use clearly: what exactly does the tool do? Does it draft protocols, summarize documents or analyze complaints? A vague use means a vague risk.

  2. Assess the risk according to the context: the same tool can be completely safe in one process and very risky in another. It depends on the type of decisions, the impact on safety and how far you rely on it.

  3. Build human control into the process: no output from ChatGPT goes straight into the file. But not every "human review" is enough. You need an organized process, with review logic, documentation and accountability.

  4. Document the professional reasoning: record not only what you decided, but why you decided it. The regulator wants to understand  the rationale.

This is about professional control

The fact that we use AI doesn't mean we give up control. Quite the opposite. It requires us to think about how we apply the principles of traceability, accountability and critical thinking even when we use a tool that wasn't built to fit the usual "box."

So no, there is no need to validate ChatGPT in the traditional sense.
But you do need to build a process, understand the risks and manage them.

Beyond the practical implementation, there are also legal and ethical considerations that must be taken into account.

Legal and ethical considerations

  • Has the tool received sensitive or identifiable information? Using such information in ChatGPT may violate the GDPR or local privacy laws.

  • Who is legally responsible for the output ChatGPT produced? You are, not the tool. It is important to make sure the content doesn't include incorrect or biased material.

  • Consider writing a procedure that defines what may and may not be entered into ChatGPT, especially with regard to personal information or sensitive regulatory information.

ChatGPT in the quality management system

  • Which processes does the tool fit into? Is it document writing, investigation and corrective action, customer complaints, or risk assessment?

  • Do existing procedures need to be updated? For example, you might add a reference to AI in the section on configuration management or document review.

  • If ChatGPT supports product development, it is important to include this in the Design and Development File as well, and to explain the context.

  • It is also worth checking whether clause 4.1.6 of ISO 13485 (validation of software used in the quality management system) is relevant to your specific situation.

Decision table for using AI tools

Use case

Allowed / Conditional / Prohibited

Required conditions

Internal draft of a document

Allowed

Mandatory human review

Wording a final regulatory document

Conditional

Only pre-approved texts may be used + double review

Initial analysis of customer complaints

Conditional

Double quality control

Use of identifiable data

Prohibited

Violates privacy regulations

Risk assessment format for using GPT

  • Process name: ____________

  • Purpose: __________________

  • Does the tool support regulatory decision-making? Yes/No

  • Potential risks: _______________

  • Controls in place: _____________________

  • Review owner: _______________________

Frequently asked questions (FAQ)

  1. Can we use ChatGPT to write an IFU? - Only as supporting material, not as a final output.

  2. How do we explain to an auditor that we used an AI tool? - Through documentation of the considerations, the risk assessment and the controls.

  3. Do we need to update the design file? - If ChatGPT was used as part of the development process, then yes, with concise documentation.

  4. How can we ensure traceability when ChatGPT doesn't keep a history of answers or versions? - It is important to keep logs of the prompt settings, the main outputs and the conclusions.

  5. Is it better to use an open model such as ChatGPT or an in-house (on-prem) tool? - Each approach has advantages and disadvantages. Closed systems increase control and privacy, but sometimes limit the quality of the answers.

Examples:

Example 1: Initial drafting of a CAPA

The quality team used ChatGPT to create an initial draft of a corrective action plan following a customer complaint. The tool helped create a clear skeleton quickly. After that, a human review was carried out, which included corrections to terminology, updates to the assumptions and the addition of internal data. 

The main risk identified: wording that was too general and needed sharpening. 

The control: a double review (approval by two people).

Example 2: Summarizing a clinical study for a regulatory meeting

The regulatory team used ChatGPT to summarize a 120-page clinical study report into a 3-page document. The advantage was a significant saving of time. 

The risk: omission of critical data. 

The control: a manual comparison by a professional editor against the full report, marking any sections that had been left out.

Example 3: Classifying user complaints

User complaints arrive in a variety of formats and languages. ChatGPT was used as an aid for initial classification by risk analysis categories.

The risk: a wrong classification that could lead to a significant case not being handled. 

The solution: adding a review step by the quality department and building a parallel database to compare automatic and manual classification.

Example 4: Translating quality training and making it accessible

A company used ChatGPT to translate professional training for employees in different countries. The translation improved local understanding, but required cultural adjustments and specific regulatory terms. 

The control:  approval by a local representative and a check against the relevant regulations.

Example 5: Identifying gaps in regulatory documentation

The regulatory team uploaded a series of technical documentation files to ChatGPT and asked it to check consistency between the different documents. The tool managed to find mismatches in dates and file names. 

The risk: overreliance on the automated result. 

The control: a double check by a quality reviewer using a defined checklist.

Example 6: Preparing answers to regulatory questions (Q-Sub, Notified Body)

ChatGPT was used as the basis for a draft answer to questions received from the FDA. The advantage was fast, focused wording. 

The risk: general wording that is not backed by data or regulatory citations. 

The control: adding references to internal documents + approval by a qualified member of the regulatory team.

In summary

Generative tools are here to stay. But they require a new standard of regulatory thinking from us. 

Would you like to look at how to do this right in your company? Talk to me.