AI Is Already Inside Your QMS — But Is It Under Control?
Artificial Intelligence may already be part of your Quality Management System, even if your organization has never formally implemented an AI tool.
Regulatory Affairs professionals may use ChatGPT to research requirements. Quality teams may use AI to help draft procedures or summarize meetings. Engineers may ask AI to brainstorm potential failure modes. Post-Market Surveillance teams may experiment with AI to analyze complaints.
This creates an important challenge:
AI may already be inside your QMS—even though your QMS doesn’t know it. Markdown collé
The answer isn’t necessarily to ban AI.
The answer is to understand where it is being used and introduce controls proportionate to the risk.
The Shadow AI Problem
Employees don’t always wait for management to formally implement AI.
When a tool can turn a three-hour activity into a thirty-minute task, people naturally become interested.
The Quality challenge isn’t simply that AI is being used. The problem is that the organization may not know:
what activities AI supports, what information employees provide to it, how outputs are verified, and how heavily people rely on those outputs.
This is what the episode describes as Shadow AI. Markdown collé
Not Every AI Use Has the Same Risk
Asking AI to improve the wording of an email isn’t equivalent to asking it to determine whether complaint data indicates a safety signal.
The key question is:
What happens if the AI is wrong?
An error in a rewritten email may have limited consequences. An incorrect conclusion about complaint reportability or patient safety could have significantly different consequences.
AI governance should therefore be based on intended use and risk, rather than treating every AI application identically. Markdown collé
Green, Amber, Red: A Practical AI Framework
The episode introduces a simple traffic-light approach.
🟢 Green — Assist
AI improves productivity without materially driving a regulated decision.
Examples include improving English, formatting documents, brainstorming, summarizing meeting notes or helping structure a presentation.
Normal human review, together with appropriate confidentiality and information-security controls, may be sufficient for these lower-risk applications.
🟠 Amber — Verify
AI begins influencing regulated work.
Examples include helping draft an SOP, suggesting potential FMEA failure modes, summarizing complaints, researching regulatory requirements or suggesting possible CAPA root causes.
The principle here is simple:
AI can propose. A qualified person must verify.
AI can help locate information, but it shouldn’t automatically become the regulatory evidence supporting a decision.
🔴 Red — Assess Before Deployment
Here, AI makes or materially drives a critical decision.
Examples could include automatically determining complaint reportability, accepting suppliers, closing CAPAs, deciding risk acceptability or generating clinical conclusions without independent qualified evaluation.
These uses call for formal assessment before the organization relies on the system. Markdown collé
Human Review Is Not Automatically Verification
“We have a human reviewing everything” sounds reassuring.
But what does review actually mean?
Generative AI can produce incorrect information that looks professional and convincing. Reading an AI-generated regulatory assessment and thinking “looks good” isn’t necessarily meaningful verification.
The episode proposes another important principle:
Trust the source, not the sentence.
Regulatory requirements should be checked against the regulation. Complaint-analysis results should be checked against the underlying data and methodology. Technical suggestions should be evaluated by qualified personnel. Markdown collé
Five Steps for Bringing AI Under Control
Rather than immediately writing an AI SOP, the episode recommends starting with discovery.
First, inventory where AI is already being used.
Then classify each use according to what could happen if the output is wrong.
Next, control the input, particularly where patient information, complaints, confidential drawings, clinical data, intellectual property or supplier information may be involved.
After that, define how the output will be verified.
Finally, maintain human accountability.
As the episode puts it:
“AI can perform work. It cannot inherit your regulatory accountability.” Markdown collé
What About AI Validation?
Instead of starting with:
“Do we need to validate ChatGPT?”
Start by asking:
What exactly are we using it for?
Then:
What happens if it gives us the wrong answer?
And finally:
What level of assurance do we need for that intended use?
The framework presented in the episode is:
Intended Use → Risk → Control → Evidence. Markdown collé
AI Literacy Matters Too
AI governance isn’t only about procedures and technical controls.
People need to understand what AI does well, where it can fail, how errors and hallucinations can occur, how information should be verified, what data they are allowed to enter, and when AI should not be relied upon.
That’s a much more practical form of AI literacy than simply asking employees to click through another annual training presentation. Markdown collé
AI Isn’t the Enemy of Quality
The message of the episode isn’t to avoid AI.
Quite the opposite.
AI could create significant opportunities for Quality and Regulatory teams—from supporting complaint analysis and regulatory intelligence to identifying recurring CAPA themes, simplifying procedures, creating training exercises, checking Technical Documentation for inconsistencies, and brainstorming potential hazards for qualified professionals to assess. Markdown collé
The role of Quality shouldn’t be to stand in front of innovation and say:
“No, because compliance.”
It should be to enable innovation with appropriate controls.
Final Takeaway
Instead of asking your team:
“Are you using ChatGPT?”
Ask:
“Show me where AI is helping you do your job today.”
Then build the inventory and ask what happens if the AI gets each task wrong.
Green: Assist.
Amber: Verify.
Red: Assess before deployment.
Control the inputs. Verify the outputs. Keep humans accountable.
Because banning AI may not stop its use, while ignoring it means losing visibility.
Who is Monir El Azzouzi?
Monir El Azzouzi is the founder and CEO of Easy Medical Device a Consulting firm that is supporting Medical Device manufacturers for any Quality and Regulatory affairs activities all over the world. Monir can help you to create your Quality Management System, Technical Documentation or he can also take care of your Clinical Evaluation, Clinical Investigation through his team or partners. Easy Medical Device can also become your Authorized Representative and Independent Importer Service provider for EU, UK and Switzerland.
Monir has around 16 years of experience within the Medical Device industry working for small businesses and also big corporate companies. He has now supported around 100 clients to remain compliant on the market. His passion to the Medical Device filed pushed him to create educative contents like, blog, podcast, YouTube videos, LinkedIn Lives where he invites guests who are sharing educative information to his audience. Visit easymedicaldevice.com to know more. If you need help implementing QMSR or preparing your teams for FDA inspections, contact: info@easymedicaldevice.com
If you are located outside the EU/UK/Switzerland and need an Authorized Representative (and possibly an Importer), we can support you as well.
Social Media to follow
- Monir El Azzouzi Linkedin: https://linkedin.com/in/melazzouzi
- Twitter: https://twitter.com/elazzouzim
- Pinterest: https://www.pinterest.com/easymedicaldevice
- Instagram: https://www.instagram.com/easymedicaldevice
