Most quality teams are not short of records. They are short of time to find the right record, show how it links to the others, and spot the gap before an auditor does.
AI can help with that search-and-link work. It should not decide whether you conform. This guide shows how to use AI in audit preparation while keeping accountability where regulators expect it: with people.
What Has Changed for US Device Makers
For medical device manufacturers, the FDA's Quality Management System Regulation became effective on February 2, 2026. It amends 21 CFR Part 820 and incorporates ISO 13485:2016 by reference.
That alignment makes clause-based preparation more consistent across FDA inspections and ISO audits. It also raises the value of clean cross-references between procedures, records and corrective actions.
Where AI Helps and Where It Should Not
| Task | AI role | Human role |
|---|---|---|
| Finding records across systems | Search and retrieve with citations | Confirm the right version |
| Linking SOPs to training and CAPAs | Propose links | Approve the traceability map |
| Spotting missing signatures or overdue items | Flag candidates | Verify and fix |
| Drafting a response to an auditor request | First draft with sources | Edit, approve and present |
| Judging conformity | None | Quality unit decides |
The rule of thumb: AI may suggest, sort and draft. A named person approves anything an auditor will see.
Step 1: Define the Audit Scope
Start from the audit plan or the last report. List the processes, sites and product lines in scope.
● Last audit findings and their CAPA status
● Processes changed since the last audit
● New products, suppliers or software systems
● Any AI tools now used inside quality processes
The last item matters. ISO's committee for quality standards has published auditing guidance on QMS processes that use AI. Auditors may ask how those tools are controlled.
Step 2: Index Records Read-Only
Connect the AI tool to your quality systems with read-only access first. Index SOPs, work instructions, training records, deviations, CAPAs, complaints and supplier files.
● Keep the index tied to document IDs and versions
● Exclude drafts and obsolete versions, or label them clearly
● Log every query, so you can show what the tool accessed
Read-only access limits risk while the team learns how the tool behaves.
Step 3: Build the Traceability Map
Auditors often follow a thread. They start at a complaint, ask for the investigation, then the CAPA, then the procedure change, then the training on it.
Ask the AI to propose those links for each open and recently closed CAPA. Then have the CAPA owner confirm or correct every link.
➤ Complaint → investigation → CAPA → effectiveness check
➤ Procedure revision → training assignment → completion record
➤ Supplier issue → supplier corrective action → requalification
Step 4: Run a Gap Sweep
Use the index to look for common weak points. Treat every result as a lead to verify, not a finding.
● CAPAs past due, or closed without an effectiveness check
● Training not completed before an effective date
● Signatures missing on approved documents
● Deviations without a linked root cause
● Procedures overdue for periodic review
Assign each confirmed gap an owner and date. Keep the sweep output as evidence that you looked.
Step 5: Run Mock Auditor Requests
Write ten realistic requests and time how long the team takes to answer each, with and without AI search.
● "Show me the last three CAPAs related to labeling."
● "Who approved the current revision of the complaint handling SOP?"
● "Show training records for operators on line 2 for this procedure."
● "How did you verify the effectiveness of CAPA 2026-014?"
For each answer, check that the cited record is the correct version. A fast wrong answer is worse than a slow right one.
Step 6: Assemble the Audit Package
Group records by audit area. Include a short index page per area listing document IDs, versions and owners.
Let the AI draft summaries of each area. The process owner then edits and signs off. Keep drafts and final versions separately so the review is visible.
Step 7: Prepare People, Not Only Records
Auditors interview staff. Brief process owners on how they will answer and where to find records.
● Who presents each area
● How to request a record from the back room
● What to say if a record cannot be found right away
● How AI tools are used and controlled in their process
Controls to Put Around the AI Tool
If AI becomes part of your quality process, treat it like any other tool that affects quality records.
● Documented intended use and limits
● Validation proportionate to risk, with records
● Access control and query logging
● Change control when the model, prompts or connected systems change
● Training for users on checking output
The NIST AI Risk Management Framework offers useful vocabulary for documenting these controls. Our post on AI agent audit trails explains what to log.
A Two-Week Readiness Plan
| Days | Activity | Output |
|---|---|---|
| 1–2 | Confirm scope, connect read-only | Scope list, index |
| 3–5 | Build and confirm traceability map | Approved map |
| 6–7 | Gap sweep and owner assignment | Gap log |
| 8–10 | Mock requests, fix slow answers | Timed request log |
| 11–12 | Assemble package, owner sign-off | Audit package |
| 13–14 | Staff briefings, final check | Briefing notes |
Example: a contract manufacturer runs this plan before a customer audit. The gap sweep flags 14 possible issues. Owners confirm five, including two training records completed after a procedure's effective date. Both are corrected and documented before the audit.
Keep the Gains After the Audit
Audit preparation is easier the second time if the work continues. Keep the index current, refresh the traceability map monthly, and rerun the gap sweep quarterly.
● Add new CAPAs to the map when they open, not before the next audit
● Track how long mock requests take over time
● Feed audit findings back into the gap sweep checklist
Readiness then becomes a routine, not a scramble.
Our Own Product
Disclosure: LuMay offers AI QMS Compliance Agents. The product page describes audit package assembly, traceability mapping and CAPA intelligence for Veeva Vault, MasterControl and ETQ. Evaluate it against the controls above. Bespoke integrations are handled through our AI engineering services.
Next Step
Pick your last audit report and run Steps 1 to 3 against it this month. If you want help connecting AI to your quality systems safely, contact the LuMay QMS team.
References
● FDA, Quality Management System Regulation: https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr
● eCFR, 21 CFR Part 820: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820
● ISO/TC 176, Auditing a QMS that uses AI systems: https://committee.iso.org/files/live/sites/tc176/files/2026%20APG%20Papers/Auditing%20a%20QMS%20using%20AI.pdf
● NIST AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
