AI in medical devices · Expert · 13 min lesson
Practical AI use cases in document control, audits and regulatory intelligence with review controls
ISO 13485:2016 clauses 4.2.4, 4.2.5, 5.6, 6.2, 8.2.4 and 8.5.2, EU MDR Article 10, 21 CFR Part 11, NIST AI 600-1
What you will learn
- Choose AI use cases in document control, internal audit and regulatory intelligence by consequence, and match each to a review control.
- Apply source-grounded drafting, citation checking, seeded-error tests and second-person review so AI output never replaces a competent decision.
- Measure how well the review works, keep the records, and answer what an auditor asks about AI-assisted quality work.
Key takeaways
- Classify AI uses by consequence (levels A, B and C) and strengthen the review as the consequence rises.
- Core review controls: ground in controlled sources, check every citation against the primary text, second-person review, label drafts, sample outputs.
- Document control: the owner approves under clause 4.2.4 and the document history records AI assistance; the tool never signs.
- Audits: AI proposes checklists, the auditor sees the evidence, concludes and grades (clause 8.2.4).
- Regulatory intelligence: act only on primary documents, record source, date and status, and sample the dismissed items; measure the review with seeded-error tests.
Free practice question
Brindle's analyst receives an AI summary of a new guidance document. It quotes a document number and an effective date. The analyst wants to update the labelling procedure the same day.
What should the analyst do first?
Update the procedure now and verify later in the next audit.
Not quite. Changing a controlled document on unverified content conflicts with the review and approval expected by clause 4.2.4.
Ask the assistant to confirm its own summary.
Not quite. A model confirming its own output is not independent verification under clause 4.2.4 review.
Forward the summary to the notified body for confirmation.
Not quite. The notified body is not the source of the requirement; the manufacturer must verify under MDR Article 10.
Open the official publication, confirm the number, date and status, record the source, and only then start the change.
Correct. The primary document is the authority, and clause 4.2.4 review before issue depends on verified content.
Key terms
- level A/B/C use: A classification of AI use by consequence of an unnoticed error, from low (A) to decisions that drive action (C), used to set the review control.
- grounding: Supplying controlled source text to the tool and asking it to point to the passages relied on, instead of answering from memory.
- seeded-error test: A trial in which known errors are planted in sample documents to count how many the tool or reviewer catches.
- escape rate: The number of errors found after approval per hundred outputs, used to judge whether the review control works.
- horizon scanning: The planned monitoring of defined sources for new or changed regulatory requirements that may affect the devices.
- primary source: The official text of a regulation or guidance, as opposed to a summary or commentary.
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- Regulation (EU) 2017/745 (MDR), Official Journal, Article 10 general obligations of manufacturers
- 21 CFR Part 11, Electronic Records; Electronic Signatures
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (July 2024)
- FDA, Computer Software Assurance for Production and Quality System Software, final guidance (September 2025)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.