Medical Devices
- What applies
- In the EU, the MDR places the technical documentation and the control of suppliers with the manufacturer; in the US, 21 CFR Part 820 (QMSR) applies with ISO 13485:2016.
How does your QM system review AI-enabled RA/QM services before their output enters the technical documentation?
RA/QM work for medical device and IVD manufacturers can be delivered with AI support in individual work steps. Whether that happens in your project, which documents such a step may use and who signs off each output is agreed with you beforehand.
Overview
How does a QA head assess an AI-supported service provider?
AI-supported RA/QM work for medical devices and IVD · MDR and IVDR Art. 10 · AI Act Art. 4
Last updated: November 1, 2026
Against rules that already exist. The manufacturer's QM system and the control of its suppliers apply whether or not a work step uses AI, and the AI Act adds an obligation on AI literacy for providers and deployers of AI systems.
- The service provider belongs in the manufacturer's supplier procedure. The MDR and the IVDR require the QM system to address resource management, including the selection and control of suppliers and sub-contractors (Art. 10(9)(d) MDR, Art. 10(8)(d) IVDR). The manufacturer draws up and keeps the technical documentation up to date (Art. 10(4) of both regulations; under the MDR for devices other than custom-made devices).
- AI tools in the manufacturer's own QM system are a validation question, not part of this service. Under the FDA guidance on computer software assurance, software used as part of production or the QM system is validated for its intended use (ISO 13485:2016 clauses 4.1.6, 7.5.6 and 7.6, through 21 CFR Part 820), and the guidance lists artificial intelligence and machine learning tools among the uses of its risk-based framework.
- AI literacy is an obligation of the deployer itself. A deployer is anyone using an AI system under its authority, except in the course of a personal non-professional activity (Art. 3(4) AI Act). Art. 4 addresses providers and deployers alike: both take measures on the AI literacy of their staff and of other persons operating or using AI systems on their behalf.
- The FDA draft on AI for regulatory decision-making and the draft EU GMP Annex 22 concern medicinal products. The FDA draft of January 2025 covers drugs and biological products and excludes AI used for operational efficiencies, such as drafting a regulatory submission, where it does not affect patient safety, drug quality or the reliability of nonclinical or clinical study results. Annex 22 covers AI models in critical applications in the manufacture of medicinal products and active substances.
Industries
What this means in your industry
IVD
- What applies
- In the EU, the IVDR does the same for IVD manufacturers; in the US, the same QMSR applies.
Services
How we support you
Use agreement per project
Fixed with you before the project starts: which work step runs with AI support and which does not, which of your documents may be used for it, who signs off each output and how the sign-off is documented. Deliverable: a written agreement you can keep with your supplier records.
How we work together
What it comes down to
AI-enabled RA/QM services, as used on this page, means regulatory affairs and quality work for medical device and IVD manufacturers in which individual work steps use AI, such as research, comparison, review or the analysis of post-market data. Who signs off each output is agreed in the project, and the technical documentation remains the manufacturer's responsibility.
| Rule | Applies to | Status | What it means for AI-supported RA/QM work |
|---|---|---|---|
| MDR and IVDR, Art. 10 | medical device and IVD manufacturers in the EU | law in force | technical documentation with the manufacturer, suppliers in the QM system |
| AI Act, Art. 4 | providers and deployers of AI systems | applies since February 2, 2025; current wording since July 27, 2026 | measures on the AI literacy of staff |
| FDA, Computer Software Assurance | software in production and the QM system of device manufacturers | guidance of February 3, 2026, nonbinding | the manufacturer's own tools, outside this service |
| FDA, AI for regulatory decision-making | drugs and biological products | draft of January 2025 | delimitation only |
| EU GMP Annex 22 | AI in critical applications in the manufacture of medicinal products | draft, consultation until October 7, 2025 | delimitation only |
When a service provider uses AI, the allocation of responsibility stays the same. A QA head therefore checks the same things as with any other supplier, plus one question: which step used AI, and who signed off the output? The answer belongs in the supplier file before the work starts, not after the first delivery.
In the project, that question is answered before work starts, in a written use agreement. It lists the work steps that use AI, the documents released for them and the subject-matter expert who reviews the outputs. It also sets how sources are recorded and whether rejected flags stay in the log.
For the service provider, Art. 4 AI Act has applied since February 2, 2025. Until July 26, 2026, it required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy. Since July 27, 2026, Regulation (EU) 2026/1744 has required measures that support its development, without any specific level to be guaranteed.
This page does not cover AI in your products and GxP processes, which is the subject of EU AI Act, the digitalization of your own processes, described on Digitalization in Life Sciences, or the validation of your own systems, including AI tools in your QM system. For the technical documentation itself, see Technical Documentation & UDI.
Our approach
Our approach
Step
Result
01
Scoping
A use agreement listing the work steps, the documents used and the sign-off for each output.
02
Documents
The documents you release for the agreed steps, with status and version.
03
Work
Research, comparison, review or analysis, with sources in the primary text or the record as set in the use agreement.
04
Expert sign-off
Outputs reviewed by a subject-matter expert as agreed, signed off or rejected, with name and date.
05
Handover
Outputs and log in a format you can bring under your own document control.
Common pitfalls
Where projects commonly fail
An AI output is accepted because it sounds plausible.
A source the tool names is only verified once someone has read it in the primary text, so sign-off belongs to each individual output, not to the package at the end.
The service provider is missing from the supplier list because it only contributes.
Supplier control under the MDR and the IVDR makes no exception for contributors.
The use agreement is signed once and never revisited.
When a project adds a work step or new documents, the agreement no longer describes the work that is actually done.
Regulatory Affairs
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
The manufacturer is responsible for the technical documentation: it draws it up and keeps it up to date (Art. 10(4) MDR and IVDR; under the MDR for devices other than custom-made devices). Its QM system addresses the selection and control of suppliers and sub-contractors (Art. 10(9)(d) MDR, Art. 10(8)(d) IVDR). Whether a service provider uses AI does not change this allocation.
Anyone using an AI system under its authority in a professional activity is a deployer (Art. 3(4)), and Art. 4 requires providers and deployers to take measures on the AI literacy of their staff. Art. 4 has applied since February 2, 2025, in its current wording since July 27, 2026. It sits in Chapter I, which in our reading makes it independent of the risk class; whether a system is high-risk is governed by Art. 6.
No. The draft applies to computerized systems used in the manufacture of medicinal products and active substances, where AI models are used in critical applications. The consultation closed on October 7, 2025, and Annex 22 was not yet listed in EudraLex Volume 4 on November 1, 2026. Generative AI and large language models are outside its scope and should not be used in critical GMP applications.
No. The draft of January 2025 covers AI that produces information or data for regulatory decisions on the safety, effectiveness or quality of drugs, and it excludes drafting a submission as long as patient safety, drug quality and study results are not affected. Its recommendations may also be relevant across all medical products, including devices used with drugs; for devices, the FDA refers to its device-specific guidance.
Sources
- Regulation (EU) 2017/745 (MDR): Art. 10(4) and Art. 10(9)(d) (consolidated version CELEX 02017R0745-20260719)
- Regulation (EU) 2017/746 (IVDR): Art. 10(4) and Art. 10(8)(d) (consolidated version CELEX 02017R0746-20250110)
- Regulation (EU) 2024/1689 (AI Act): Art. 3(3) and (4), Art. 4 in the original wording (CELEX 32024R1689) and as replaced by Regulation (EU) 2026/1744 (CELEX 32026R1744), Art. 6, Art. 113 (consolidated version CELEX 02024R1689-20260727)
- 21 CFR Part 820 (QMSR), § 820.7: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820
- FDA, Computer Software Assurance for Production and Quality Management System Software, February 3, 2026 (supersedes the version of September 24, 2025, 90 FR 45945): https://www.fda.gov/media/188844/download
- FDA, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products, draft, 90 FR 1157 (January 7, 2025), section II and footnote 6: https://www.fda.gov/media/184830/download
- European Commission, EudraLex Volume 4, draft Annex 22 Artificial Intelligence, consultation from July 7 to October 7, 2025, section 1: https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Projects from this industry
What we have worked on in this industry
Latest insights
All insights →Regulations & standards considered
- EU 2017/745 (MDR), Article 10(4) (technical documentation) and Article 10(9), point (d) (selection and control of suppliers and sub-contractors)
- EU 2017/746 (IVDR), Article 10(4) (technical documentation) and Article 10(8), point (d) (selection and control of suppliers and sub-contractors)
- Regulation (EU) 2024/1689 (AI Act), Article 3, points (3) and (4) (provider, deployer), Article 4 (AI literacy), applicable since February 2, 2025, replaced by Regulation (EU) 2026/1744 with effect from July 27, 2026, Article 6 (classification as high-risk)
- 21 CFR Part 820 (Quality Management System Regulation, QMSR), effective since February 2, 2026; § 820.7 incorporates ISO 13485:2016 by reference
- ISO 13485:2016, clauses 4.1.6, 7.5.6 and 7.6, on which the FDA guidance on computer software assurance bases software validation
- FDA, Computer Software Assurance for Production and Quality Management System Software, guidance of February 3, 2026 (nonbinding)
- FDA, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products, draft of January 2025 (drugs and biological products)
- EU GMP Annex 22 (Artificial Intelligence), draft, consultation from July 7 to October 7, 2025 (manufacture of medicinal products and active substances only)
Related topics
Technical Documentation & UDI →
The technical documentation itself, to which AI-supported research and review contribute
Technical Writing →
Technical documentation, IFU and reports, written and owned by technical authors
EU AI Act →
AI in the manufacturer's products and GxP processes: classification under Art. 6 and obligations for high-risk AI
Digitalization in Life Sciences →
Digitalization of GMP processes at the manufacturer, from LIMS and eQMS to paperless production
Computer System Validation (CSV) →
Validation of GxP systems under GAMP 5, EU GMP Annex 11 and 21 CFR Part 11
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +39 02 8904 1000
contact@theentourage.it
- Reply usually within one working day
- 4 locations: DE · CH · IT · US
- 100% life sciences