Fixed fee · $5,000

For GMP, ISO 9001 and ISO 13485 sites

AI in the Quality System
Review

A fixed-fee review of where AI is already writing, checking or deciding inside your quality system, and whether the records it touches would survive an FDA inspection or an ISO audit. Findings ranked by inspection risk, with a control plan mapped to the regulations you already answer to.

"Keep it Simple. Keep it Real."

Book the Review 858-240-4353
$5,000
Fixed fee
2 weeks
Start to report
211 · 820 · 13485
Plus ISO 42001
Jared Clark, quality systems and validation consultant

Why Now

The question an investigator will ask is "who reviewed this?"

In April 2026 FDA issued a warning letter to a manufacturer citing inappropriate use of artificial intelligence under 21 CFR 211.22(c). The finding was ordinary in every way except one: specifications, procedures and master production records had been produced by an AI tool and released into use without review by the quality unit. Nothing in the regulations changed. The quality unit has always been responsible for approving those documents. What changed is that a machine can now produce a plausible one in seconds, and the review step that used to be unavoidable can be skipped without anyone noticing.

That is the pattern at the GMP, ISO 9001 and ISO 13485 sites we have looked at. Someone in QA drafts a deviation investigation with a chatbot. A supplier's software quietly adds an AI feature that proposes batch dispositions. A planner uses a copilot to rewrite a work instruction. Each one is reasonable on its own. None of them has a documented intended use, a review step, or a record that says a qualified person looked at the output before it became a controlled document. An inspector or an auditor will find them the same way we do: by asking people what tools they use and then asking to see the record.

The review exists to find those places before an inspection does, and to give you a control plan written in the language of the regulation you are inspected against. ISO 42001 is cross-referenced throughout, because the same findings are the raw material of an AI management system, but the plan stands on 21 CFR Parts 211, 111, 117 and 820, ISO 13485 and ISO 9001 on its own.

Scope

Six places AI is usually already inside the quality system

Documents and records

SOPs, specifications, master records, protocols and reports drafted or revised with AI. We trace a sample from draft to approval and check whether the review that clause 211.22(c) or ISO 13485 clause 4.2 requires actually happened, and by whom.

Investigations and CAPA

Deviation, OOS and complaint investigations written with AI assistance. The risk is not bad writing; it is root causes and conclusions that no one verified against the data.

QC and release decisions

AI features in LIMS, vision inspection, trending and disposition tools. Which decisions the system proposes, which it makes, and where a qualified person signs.

Validation status

Whether each AI tool touching GxP records has a documented intended use, a risk assessment and validation or computer software assurance evidence proportionate to that risk, in line with GAMP 5 and FDA's CSA thinking.

Data integrity and Part 11

Attributable, legible, contemporaneous, original and accurate still applies when the author is a model. We check audit trails, attribution of AI-generated content, and electronic signature use against 21 CFR Part 11.

Suppliers and training

What your supplier agreements say about AI running on your data, and whether the people using these tools have been trained on when the output needs a human before it becomes a record.

What You Get

A findings report and a control plan, in two weeks

The report lists every place we found AI touching the quality system, what it produced, and what review and validation evidence exists, ranked by how an inspector would weigh it. The control plan says what to do about each one: the review step to add, the intended-use statement to write, the validation to run or the procedure to change, with the regulation citation next to it and the ISO 42001 clause it also satisfies.

Where the honest answer is that a tool should not be used for a task until it is validated, we say that, and we say what validating it would take. Where a tool is fine and only the approval record is missing, we say that too. The point is proportion: the plan should cost less than the finding it prevents.

Deliverables

  • AI-in-the-QMS inventory: every tool, what it touches, who owns it
  • Findings ranked by inspection risk, with the record sample behind each
  • Control plan mapped to 21 CFR 211/111/117/820, ISO 13485, ISO 9001 and ISO 42001
  • A one-page AI use policy for the quality system you can adopt as written
  • A readout with your quality leadership, and a plain view on whether ISO 42001 is worth pursuing

Where It Fits

The first rung, not a substitute for ISO 42001

This is the natural starting point for a regulated manufacturer because it answers the question actually being asked. If a customer later asks for ISO 42001, or you decide the certificate is worth having, the inventory and the control plan become the first third of a gap assessment and nothing is done twice. If you never pursue the standard, you still have a quality system that can explain its AI to an inspector.

The fee is a fixed $5,000 for a single site, remote, confirmed in writing before we start. The background to the FDA finding and what it means for pharma, supplement, cosmetic and device manufacturers is in ISO 42001 for GMP manufacturers, and the record-keeping side in documented information and AI records.

Frequently asked questions

Did FDA really cite a company for using AI?

Yes. In April 2026 FDA issued a warning letter to Purolea citing inappropriate use of artificial intelligence under 21 CFR 211.22(c). The finding was that specifications, procedures and master production records had been written by AI and released without review by the quality unit. The problem was not the tool; it was the missing review and approval.

Is this the same as computer system validation for AI?

It includes it. Part of the review is whether each AI tool that touches GxP records has a documented intended use, a risk assessment and enough validation or software-assurance evidence to support that use. The rest of the review is about the records and decisions the tool produces, which validation alone does not cover.

Do we need ISO 42001 to act on the findings?

No. The control plan is written against the regulations you already answer to: 21 CFR Parts 211, 111, 117, 820 or ISO 13485 and ISO 9001. ISO 42001 clauses are cross-referenced so that if you later pursue certification, the work counts, but nothing in the plan depends on it.

How is this different from the ISO 42001 gap assessment?

The gap assessment measures your whole organization against the whole standard. This review looks only at AI inside the quality system, goes deeper on records and validation, and is priced and timed for a single site. It is the natural starting point for a regulated manufacturer; the findings feed straight into a gap assessment if you go on to one.

Find out what your AI has already signed

Book a free 30-minute call. Tell us which AI tools your quality, production and regulatory teams use, and we will tell you whether this review is the right first step and confirm the fixed fee in writing.

Book a Free Call Call 858-240-4353

Or email us at [email protected]