As of: 2026-10-16

In QA, work often begins long before a final assessment or decision: documents are classified, supplier documentation is reviewed, and previous deviations are researched. AI subsystems can perform or support such tasks within a controlled system. Applications that make a noticeable contribution to process performance while having a limited impact on quality, safety and data integrity are particularly promising.

Which tasks fit this description? For an initial selection, we examined 30 tasks from GMP and ISO 13485 environments.

Check the existing process first

Before improving a process with AI, establish which requirements apply and whether the actual workflow meets them. In the pharmaceutical environment, this means, in particular: Does the process comply with the applicable cGMP requirements? Are responsibilities, procedures, data flows, records and necessary checks clearly defined? Do the documented process and actual practice align?

We recommend this preliminary assessment as a sound basis for starting a project. It is grounded in the existing quality framework: EU GMP Chapter 1 describes a documented pharmaceutical quality system that is effectively implemented and monitored. For MedTech processes, the applicable QMS under ISO 13485, including the relevant regulatory requirements, should be considered accordingly. EU GMP Chapter 1, Principle and Section 1.4, ISO 13485

The following article explains which regulatory frameworks apply in a particular case and when validation is required: AI in GMP and MedTech Companies: Which Regulations Apply and When Is Validation Required?.

An independent assessment of the current state can help identify gaps before technical implementation. Gregory Sivo of Truex Consultancy describes such an approach for GMP audits and gap assessments. Relevant gaps should be resolved in the target process before the AI application enters routine use. It is then possible to assess whether simplified workflows, existing DMS/eQMS functionality or rule-based automation already meet the need.

Assess specific tasks within the QA process

Document control, training, audits, supplier management, deviations, CAPA, change control and quality data analysis offer different opportunities. Further interfaces exist with validation, manufacturing and release, and, in medical technology, with development and post-market surveillance.

The impact of AI can vary considerably within the same process. In deviation management, researching similar cases, drafting a report and assessing a cause differ substantially. The inputs, output, intended use of the output and possible consequences of an error or omission therefore need to be described.

Check frequency before overstating the potential

A large document repository does not necessarily imply a large annual workload. For filing classification, new or changed documents are what count. For case research, new research requests count; the number of historical deviations initially describes only the body of information available for searching. A one-off migration should be assessed separately.

Audit evidence requires particular attention. Numerous document requests during an audit can generate considerable work. However, this does not imply a high frequency throughout the year. The assessment should capture audit and inspection events, distinct evidence packages, actual search and review time, and the reuse of evidence that has already been prepared.

The methodology behind the matrix

The P index for process performance adds three component scores, each ranging from 0 to 4:

For the following matrix, we therefore use a conservative baseline scenario: an ongoing but limited need to process documents, supplier documentation and deviations, continuous manufacturing, and a small number of audit campaigns grouped into specific periods. This is a transparent working assumption for the selection, not a measured industry average. A site receiving numerous customer and inspection requests may arrive at a different assessment.

  • N – net workload reduction per case: work saved after accounting for the remaining processing, review, correction, human oversight and attributable routine maintenance.
  • V – recurring workload: how much of this work actually occurs within the period being assessed.
  • B – additional bottleneck benefit: whether handovers, waiting times or a process step that constrains performance can also be improved.

P ranges from 0 to 12. If there is no additional net workload reduction, we set P to 0. The index is a professional comparison aid; it cannot be converted into percentage savings.

The three component criteria carry equal weight. Different combinations of workload reduction per case, workload volume and bottleneck benefit can therefore produce the same P score. Actual case numbers and time savings must consequently also be established for the economic assessment.

The comparison also includes a suitable rule-based system. P reflects the additional benefit of AI over existing or reasonably implementable DMS/eQMS functionality, fixed rules, templates and workflows. If these already cover the task effectively, the additional contribution of AI to performance is correspondingly small. Time saved compared with a fully manual workflow alone therefore does not justify a high P score.

The QIS score adds the potential impact of an incorrect or missing output on product quality, data integrity and patient/user safety. Each dimension is rated from 1 to 5, giving a total from 3 to 15. Probability of occurrence and detectability are not included. Individual scores remain relevant even where the total is comparatively low.

The matrix supports initial selection. The subsequent application-specific risk assessment considers, in particular, the consequences of failure and probability of occurrence in accordance with ICH Q9(R1). The effectiveness of existing detection measures and the ability to intervene in time must also be assessed. A more comprehensive discussion of risk is provided in the following article: AI in the GMP environment: What the Annex 22 conference means for practice. ICH Q9(R1), Sections 4.3 and 5

Human effort is accounted for only once: in N. With Human in the Loop, an output is reviewed before it is used; with Human on the Loop, the workflow is monitored and intervention occurs when needed. Whether sampling or exception handling is sufficient must be justified by a documented risk assessment and appropriate performance evidence. Failure modes, error rates and the effectiveness of monitoring must be tracked during operation. For HITL applications with a reduced scope of model testing, the draft Annex 22 notes that review of every output may be necessary, depending on criticality and the scope of testing. Draft Annex 22, Section 10.5 Required human decisions and approvals remain part of the workflow. Whether this allocation of responsibilities is viable must be demonstrated for the specific application; Annex 11 requires a risk-based approach and validation of the application. EU GMP Annex 11, Principle and Section 1

The 2025 draft Annex 22 advises against using GenAI and LLMs in critical GMP applications and provides for qualified humans to retain responsibility for the suitability of results in non-critical applications. However, the EMA workshop report, published on 2 October 2026, discusses risk-based uses and HITL as one possible form of human oversight. This discussion replaces neither applicable requirements nor a final Annex 22. Draft Annex 22, Section 1, EMA workshop report, particularly pp. 7–8 and 14

Our QIS dimensions address the same protected interests. However, the scoring scale and its boundaries are our own selection model and do not determine a regulatory criticality classification.

Four areas for prioritisation

The chart shows 30 possible QA tasks. We use P ≥ 6 as the working threshold for a higher contribution to performance and QIS ≤ 8 for a comparatively lower impact.

Prioritisation of 30 QA tasks by process performance (P) and quality, integrity and safety impact (QIS).

The Best candidates are in the top left. In the top right, the potential contribution to performance is also high, but the QIS impact is greater: High AI maturity required signifies greater demands on subject-matter responsibility, data quality, validation, monitoring and change control, as well as competence and experience in working with AI applications. Organisational maturity alone does not demonstrate that an application is suitable.

In the bottom left, Why even bother? asks whether an AI project is economically worthwhile given its limited additional benefit. No-go area in the bottom right means: defer these applications for the initial adoption phase. The label is a prioritisation judgement, not a regulatory prohibition. The boundaries between the areas are internal selection conventions.

Below, we take a closer look at three specific operational applications from the preferred selection area.

1. Metadata and filing classification: P 7 / QIS 6

An AI subsystem reads new or changed documents and assigns them to a limited scheme for document type, subject or filing location. Unclear cases are referred for further processing. In this scenario, the system does not independently change access rights, retention periods or approval status.

The workload reduction comes from recurring classification tasks as documents are received. The baseline scenario counts the ongoing inflow of new documents; one-off projects involving legacy documents are assessed separately. Existing DMS classification remains the benchmark.

The QIS score remains limited because the function is restricted to classification. Incorrect filing can nevertheless impair findability; the integrity impact is rated I=3. Extending the function to determine binding applicability or document status requires a new assessment.

2. Extracting information from supplier documentation: P 7 / QIS 8

The system transfers defined information from certificates, questionnaires and inspection or test reports into a structured overview. Each item is linked to its source. Missing information, inconsistencies and uncertain extractions are made visible. The supplier qualification decision remains a separate step.

The potential depends on new suppliers, renewals and changes. A certificate reused without changes does not count as a new extraction each time it is used. The baseline scenario assumes an ongoing but limited need.

The potential impact on quality and integrity is higher than for filing classification alone. With a QIS score of 8, the task therefore sits at the boundary of the preferred selection area. For the pilot project, the relevant measure is the time required to produce an overview suitable for professional use, including corrections. This assessment does not cover automatic supplier approval.

3. Researching similar deviations: P 7 / QIS 8

A search function identifies comparable closed cases and shows source locations and relevant characteristics for comparison. It supports the current investigation. Previous causes or CAPA measures are not adopted automatically.

Here, AI must demonstrate its value compared with the existing DMS/eQMS search. A benefit may arise where events are described differently or similarities are difficult to find. Semantic search alone does not establish an additional benefit.

Only investigations that actually involve research count towards the workload. A large case repository increases the basis for comparison, but does not automatically increase annual workload reduction. In the pilot, search time and useful results are just as important as missed counterexamples: a one-sided initial selection can influence the investigation. This explains the QIS score of 8.

Demonstrate the benefit in your own process

Before a pilot, case numbers and processing times should be recorded over a representative work cycle. For seasonal tasks, this includes peak periods. The measure is the workload reduction achieved up to an accepted result, including oversight and rework. Implementation, validation and subsequent changes must also be included in the economic assessment. Changes to model versions, prompt templates or output schemas must also be assessed for their impact through change control. This assessment must establish which tests and evidence of fitness for intended use are required before continued use. New inputs within the approved intended use must be distinguished from changes to the system configuration. EU GMP Annex 11, Sections 10 and 11

Figure 5 in the following article illustrates these two levels of change: AI in the GMP environment: What the Annex 22 conference means for practice.

A lower QIS score does not justify a blanket exemption from GMP or QMS requirements. For QMS software, ISO 13485, Clause 4.1.6, must also be considered. ISO 13485:2016

QMVP helps assess the existing process, intended use and quality impact, and use this assessment to define a bounded AI use case that can be verified.

Sources