{"slug": "ai-drafted-the-impact-list-i-still-own-the-audit-answer", "title": "AI drafted the impact list. I still own the audit answer.", "summary": "A quality-management engineer at a medical-device manufacturer reports that an automated impact-analysis tool, drawing on PLM cross-references and device master records, drafted roughly 80% of the affected-document list for a Class IIa implant component change request in minutes — catching a heat-treat validation protocol, an incoming inspection procedure, a supplier quality agreement and two drawing callouts outdated for 18 months — but missed three impacts known only to experienced process engineers and the CAPA log. The engineer argues that under ISO 13485:2016, EU Annex 11 and 21 CFR Part 11, the audit trail must record what the AI produced and what the human reviewer added, removed or left unchanged, since accountability stays with the person who reviewed the reasoning.", "body_md": "Last month, a change request landed on my queue for a heat-treat subcontractor who had moved two of their furnace zones to a different EMS provider. Twelve components in scope. Four device families downstream. The change form asked one question at the top: which DHF documents does this touch?\n\nFor a Class IIa implant component, that question is not a checkbox. Get it wrong and the notified body's next surveillance audit will find orphaned drawings, outdated process validations, or a sterilization map that no longer reflects actual load patterns. Before our QA team in Germany closes the change, somebody has to think through the cascade.\n\nThat somebody is, and remains, a human.\n\nThe same change request fed into an automated impact analysis. It pulled cross-references from our PLM, matched the affected part numbers against the active device master records, and produced a draft list of impacted documents inside a couple of minutes. Compare that to the afternoon I would have spent pulling the same list by hand, cross-referencing supplier codes against DHF indices, and chasing confirmations from four process engineers.\n\nThe draft was 80% there. It caught the obvious items: the validation protocol for the heat-treat cycle, the incoming inspection procedure for the affected surface finish, the supplier quality agreement itself. It also flagged two drawing callouts that had been quietly outdated for eighteen months and were, frankly, due a refresh anyway.\n\nThe draft missed three things:\n\nNone of that lives in a part number. None of it sits in a cross-reference table. It lives in the heads of two process engineers who have been on the line for the better part of a decade, and in the CAPA log they are still working through.\n\nAI-assisted impact analysis will surface what your data structure can express. It will not — and probably should not — pretend to know the things only your team knows.\n\nUnder ISO 13485:2016's document control and change control requirements, changes have to be reviewed and approved prior to issue, with the impact considered and the rationale recorded. The phrasing is deliberate. \"Reviewed\" implies a human has interrogated the reasoning and signed off on it. \"Approved by\" names a person, not a system.\n\nEU Annex 11 and 21 CFR Part 11 both come into play when the impact analysis lives in an electronic QMS. The audit trail has to show who reviewed, when, and what they actually considered. A status of \"reviewed and approved\" with no record of what the reviewer looked at is not compliant. It is a checkbox.\n\nIf an AI drafted the impact list, the audit trail has to show what the AI produced, what the reviewer added, what they removed, and what they left alone. Otherwise the next auditor will ask, reasonably: how do you know this was a thoughtful review and not a click-through?\n\nHere is how I draw the line for my own team:\n\nThis is the line I keep coming back to: AI helps you surface impact; accountability lives with the human who reviewed the reasoning. The two statements are not in tension. The first is a productivity claim. The second is a regulatory claim. Mixing them up is where QMS leaders get themselves into trouble.\n\nIf you are evaluating AI assistance — automated CAPAs, AI-driven CAPA assistance, AI-guided impact mapping, whatever the marketing calls it — the question is not whether the model is clever. It is whether the reasoning is reviewable and the audit trail holds. Concretely:\n\nIf the answer to any of these is \"we will figure that out later,\" the system will fail an audit before it fails technically. Process automation is only as defensible as the records it leaves behind.\n\nIn your QMS, can your auditor trace a single change from \"AI suggested X\" all the way through \"the reviewer assessed X and concluded Y because Z\"? Or is the AI's contribution still a black box on the far side of someone's approval signature? I would be curious how others are handling the review-record problem in practice.", "url": "https://wpnews.pro/news/ai-drafted-the-impact-list-i-still-own-the-audit-answer", "canonical_source": "https://dev.to/rajiviyer112/ai-drafted-the-impact-list-i-still-own-the-audit-answer-1o4n", "published_at": "2026-10-19 04:02:53+00:00", "updated_at": "2026-10-19 04:19:02.576017+00:00", "lang": "en", "topics": ["ai-tools", "ai-products", "artificial-intelligence"], "entities": [], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-drafted-the-impact-list-i-still-own-the-audit-answer", "markdown": "https://wpnews.pro/news/ai-drafted-the-impact-list-i-still-own-the-audit-answer.md", "text": "https://wpnews.pro/news/ai-drafted-the-impact-list-i-still-own-the-audit-answer.txt", "jsonld": "https://wpnews.pro/news/ai-drafted-the-impact-list-i-still-own-the-audit-answer.jsonld"}}