Management told everyone to start using AI. Your engineers are drafting protocols with Copilot. Someone in RA is summarizing complaint files with ChatGPT. A vendor switched on an AI feature in your eQMS last month and didn’t tell you. None of it is in a procedure — and QMSR has been in force since February.
You have two bad options and one good one. Option 1, block AI, and watch it move out of sight only to rise again like a zombie. Option 3, allow it, and have nothing to show the investigator who asks how AI-generated content got into a quality record. Or Option 4, acknowledge, qualify, and control it.
This toolkit is the third option.
What’s in it
| File | What it does |
|---|---|
| START HERE | Deployment guide and 30-day plan, including the four ways this normally goes wrong |
| SOP-AI-001 | The governing procedure — four tiers, three blocking conditions, ten revalidation triggers, and a nine-item catalogue of AI failure modes to test for |
| TOOL-AI-001 | Interactive triage tool. Describe a use case, get a risk tier, the reasoning, the required assurance activities and the records to produce |
| FORM-AI-001 | Qualification record — intake through approval to periodic review |
| FORM-AI-002 | Validation plan and report for Tier 2 and Tier 3, with a 12-script test library |
| REG-AI-001 | AI use register — inventory, dashboard, monitoring log and change log, with live formulas |
| REF-AI-001 | Regulatory crosswalk across 23 requirements, with a column for your own evidence |
| GUIDE-AI-001 | Two-page employee guide — green, amber and red, in plain language |
Why it isn’t another template pack
It tells you when not to validate. Most of what your people want to do is low risk and needs a documented decision, not a validation protocol. The tiering sorts those in minutes using FDA’s own computer software assurance logic — is the tool used directly in the QMS or supporting it, and could a failure foreseeably compromise safety — so you approve the majority in an afternoon and spend real effort only where the risk actually is.
It handles the thing conventional software validation doesn’t: AI tools change under you. Validate once and you’ve documented a state that ended when the vendor pushed an update. Every approved use case here carries defined revalidation triggers and a retained challenge set, so you can tell when your validated state expired.
Every tier assignment traces to a named condition — not to a score. You can defend the decision clause by clause in front of an auditor, because the reasoning is the output, not just the answer.
What it’s built on
FDA’s Computer Software Assurance for Production and Quality Management System Software (final guidance, 3 February 2026), QMSR (effective 2 February 2026), ISO 13485:2016 clause 4.1.6, ISO/IEC 42001:2023 Annex A, ISO/IEC 22989, ISO/IEC 23894, ISO 14971 and 21 CFR Part 11. Clause references throughout, so you can check the reasoning rather than take it on trust.
Written by a certified lead auditor for ISO 13485 and ISO/IEC 42001.
What you get
- Editable Word and Excel files — adapt and rebrand them inside your own quality system
- The triage tool as a single HTML file that runs offline in any browser. Nothing you type into it leaves the file
- Updates through January 2028, re-downloadable from your order history at any time
- Licensed for use within one organisation, including its subsidiaries
These are templates, not compliance. They become your documents when a competent person has reviewed them against your processes, your products and your regulatory position, and approved them under your own document control. Nothing here is legal or regulatory advice.