Where AI fits in quality assurance
Quality assurance in regulated industries is document-heavy: SOPs, batch and device history records, deviations, CAPA, audit reports, supplier files and validation packages. That makes it a natural target for AI, but also a sensitive one, because QA decisions affect patient safety and are inspected by regulators.
Useful uses of AI in quality assurance fall into three groups:
| Use | Examples | Risk level |
|---|---|---|
| Search and summarization | Finding the right SOP, summarizing a deviation report, drafting a CAPA summary | Lower, if a person reviews the output |
| Review and comparison | Checking a document against a regulation or template, comparing protocol and report, flagging missing evidence | Moderate; outputs inform human decisions |
| Automated decisions | Visual inspection that rejects units, models that release or disposition product | High; GMP-critical |
The regulatory question is less “can we use AI?” than “which of these categories is this use, and what assurance does it need?”
What regulators expect in 2026
EU GMP Annex 22 (draft)
The European Commission consulted in 2025 on a new Annex 22 on artificial intelligence, alongside a revised Annex 11. According to European Pharmaceutical Review, the draft:
- Covers static models (fixed parameters) used in critical GMP applications.
- Excludes dynamic, continuously learning models and generative AI and LLMs from GMP-critical decisions.
- Permits LLMs in non-critical tasks, such as summarizing deviation reports or searching SOPs, if a qualified person reviews the output and remains accountable.
- Requires documented intended use, acceptance criteria set before testing (performance at least as good as the process replaced), independent test data, explainability, confidence scoring and ongoing change control and drift monitoring.
Finalization was expected in 2026, but the text and timing could still change.
FDA: AI credibility for drug and biologic decisions
In January 2025 FDA issued draft guidance, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products. It proposes a risk-based credibility assessment of an AI model for a particular context of use where the model produces information about drug safety, effectiveness or quality. It remains a draft and is not for implementation.
FDA’s own use of AI
FDA itself launched an agency-wide generative AI tool, Elsa, in June 2025, to help with tasks such as summarizing adverse events, comparing labels and speeding protocol reviews, built in a secure GovCloud environment. Regulators reading submissions with AI is another reason sponsors’ quality documentation must be internally consistent.
Device software and validation
For medical device manufacturers, AI used in production or the quality management system is software subject to FDA’s Computer Software Assurance guidance (reissued in February 2026 for the QMSR): intended use, risk, assurance activities and a record.
A practical framework for AI in QA
- Classify each use as non-critical (assistive) or critical (decision-making) under GMP or QMS rules.
- Define intended use and limits in writing, including what the AI must not do.
- Keep a human accountable. Name the role that reviews outputs and signs decisions.
- Require traceability. Outputs should cite the source document and page so reviewers can verify them.
- Validate proportionately. Use CSA or GAMP 5 thinking for assistive tools; Annex 22-style testing for critical models.
- Control data. Know where documents go, who can access them and whether they train the model.
- Monitor and change-control models, prompts and configurations like any other GxP software.
Common weaknesses
- Teams using general chatbots on controlled documents without a documented intended use.
- AI outputs accepted without source citations, so reviewers cannot verify them.
- No distinction between assistive and decision-making uses in procedures.
- Validation that tests the vendor demo, not the company’s documents.
- Model or prompt changes made outside change control.
- Confidential data shared with tools whose data handling is unclear.
Checklist: AI-in-QA readiness
- Inventory of AI uses in quality processes, classified by criticality
- Intended use, limits and accountable reviewer documented for each
- Outputs traceable to source documents and pages
- Validation or assurance proportional to risk, with records
- Data handling, access and retention assessed
- Change control covers models, prompts and configuration
- Procedures aligned with draft Annex 22, Annex 11 and FDA guidance, with a plan to update when finalized
How AskDona helps
AskDona is built for the assistive, reviewable end of AI in quality assurance. It reads your SOPs, records and evidence packages against the requirements you choose and shows which requirement each document supports and where evidence is missing, citing the exact page so a qualified person can verify every finding. Run a sample AI-assisted evidence review with full citations on a recent audit package. AskDona shows the evidence; your quality team decides.
Editor’s note: Annex 22 details come from a European Pharmaceutical Review summary of the consultation draft, not the final text, which had not been confirmed as published when checked. The FDA AI guidance is a draft. Elsa details come from RAPS reporting. Vendor and tool comparisons are deliberately excluded.
FAQ
How is AI used in quality assurance? For searching and summarizing documents, reviewing evidence against requirements, trending deviations and, in some cases, automated inspection or decisions.
Can generative AI be used in GMP quality decisions? Under the draft EU Annex 22, generative AI and LLMs are excluded from GMP-critical decisions but may support non-critical tasks with qualified human review.
Does FDA have guidance on AI in quality? FDA’s January 2025 draft guidance proposes a credibility framework for AI producing information on drug safety, effectiveness or quality. Device QMS software falls under the CSA guidance.
Will AI replace QA professionals? Regulators expect a qualified person to remain accountable for decisions. AI can speed review, but responsibility stays with people.
What should an AI QA tool provide? Traceable outputs with source citations, clear intended use, data controls and records that support validation.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| European Pharmaceutical Review on Annex 22 | Trade publication | Annex 22 draft scope and requirements |
| European Commission consultation | Regulator | Annex 22 and Annex 11 consultation |
| FDA AI draft guidance page | Regulator | Credibility framework status |
| RAPS on FDA Elsa | Professional society news | FDA internal AI use |
| FDA CSA guidance (Feb 2026) | Regulator | Device QMS software assurance |