As AI tools continue to be used in regulated environments, Quality professionals must understand how to appropriately validate and control them within a Quality Management System (QMS). AI can support efficiency, analysis, and better decision-making, but its use must align with applicable regulatory requirements, ISO 13485, and other quality-system expectations.

The level of validation or assurance should be appropriate to the tool’s intended use and risk. The objective is to establish documented confidence that technology used in regulated processes performs consistently, accurately, and as intended.

Step 1: Define the Intended Use

Validation begins with a clearly defined intended use. The organization should document what the AI tool is expected to do, which processes it supports, who will use it, what information it receives and produces, and whether its output may influence regulated decisions or records.

A precise intended-use statement establishes the foundation for determining risk, requirements, testing, controls, and acceptance criteria.

Step 2: Assess Risk and Regulatory Impact

The organization should assess the potential consequences of incorrect, incomplete, misleading, or inconsistent AI output. Risk considerations may include impacts on product quality, patient safety, data integrity, compliance, and regulated decision-making.

Higher-risk uses require stronger controls and more rigorous evidence. An AI tool used only to assist with low-risk administrative formatting presents a different risk profile than one used to support CAPA, investigations, complaint analysis, validation decisions, or product-related quality determinations.

Step 3: Establish Requirements and Acceptance Criteria

Once intended use and risk are understood, the organization should define measurable requirements and acceptance criteria. These criteria should describe the expected performance of the AI-enabled process and the conditions under which the tool may be used.

Requirements may address accuracy, consistency, repeatability, data handling, access controls, traceability, human review, error handling, and escalation when output cannot be verified.

Step 4: Test Performance Under Realistic Conditions

Testing should demonstrate that the AI-enabled process performs adequately under expected conditions. Testing should not rely only on ideal inputs.

A robust test strategy should consider:

·         Representative real-world data and normal-use scenarios.

·         Ambiguous, incomplete, or conflicting inputs.

·         Edge cases and unusual conditions.

·         Known failure modes and incorrect assumptions.

·         Consistency of outputs where consistency is required.

·         The ability of users to identify and appropriately handle unreliable output.

Because generative AI may produce variable responses, validation strategies should focus on controlling the intended process and demonstrating that risks are acceptably managed rather than assuming every response will always be identical.

Step 5: Maintain Human Oversight

AI output should not automatically be treated as authoritative simply because it appears complete or confident. Where AI-generated information influences regulated records or decisions, appropriate review by qualified personnel should remain part of the controlled process.

Validation should confirm that required human-review controls are effective, that reviewers understand their responsibilities, and that AI does not bypass established approval or decision-making authority.

Step 6: Document Validation and Control the System

Validation evidence should be documented and retained according to the organization’s QMS requirements. Documentation should establish the intended use, risk assessment, applicable requirements, testing performed, acceptance criteria, results, identified limitations, controls, approvals, and ongoing monitoring expectations.

Changes to the AI tool, its configuration, underlying model, integrations, data sources, or intended use should be evaluated to determine whether additional assessment or revalidation is necessary.

Step 7: Monitor Performance Throughout the Lifecycle

Validation is not necessarily a one-time activity. AI-enabled tools and services may change over time through model updates, configuration changes, new data sources, vendor changes, or modifications to connected systems.

Organizations should establish lifecycle monitoring appropriate to risk. This may include periodic performance reviews, deviation and error trending, user feedback, change assessment, audit activities, and reevaluation of whether existing controls remain effective.

A Practical Risk-Based Validation Framework

A practical approach can be summarized as a controlled lifecycle:

1. Define the intended use.
2. Assess risk and regulatory impact.
3. Establish requirements and acceptance criteria.
4. Test the AI-enabled process under realistic conditions.
5. Implement appropriate human and technical controls.
6. Document results and obtain required approvals.
7. Monitor performance and manage changes throughout the lifecycle.

This approach keeps validation focused on intended use, evidence, risk, and control rather than treating every AI application as requiring the same level of rigor.

Conclusion: Validate the Use, Control the Risk

AI can provide meaningful value within a QMS, but regulated organizations need documented confidence that AI-enabled processes are fit for their intended use and appropriately controlled.

Effective validation combines clear intended use, risk assessment, objective testing, human oversight, documented evidence, change control, and ongoing monitoring. When these elements are applied proportionately to risk, organizations can use AI more effectively while maintaining the integrity and accountability expected of a compliant Quality Management System.

References

FDA. General Principles of Software Validation; Final Guidance for Industry and FDA Staff (2002).

FDA. Quality Management System Regulation (QMSR) – Frequently Asked Questions (2026).

ISO 13485 – Medical devices — Quality management systems — Requirements for regulatory purposes.

FDA guidance and applicable quality-system requirements for software assurance, validation, and risk-based controls.