--- title: Using AI to Automate Regulatory Documentation: Opportunities and Limits description: AI can automate parts of regulatory documentation work. Here is what it does well, what it does poorly, and where the human stays in the loop. authors: Tibor Zechmeister, Felix Lenhard category: AI, ML & Algorithmic Devices primary_keyword: AI automate regulatory documentation canonical_url: https://zechmeister-solutions.com/en/blog/ai-automate-regulatory-documentation source: zechmeister-solutions.com license: All rights reserved. Content may be cited with attribution and a link to the canonical URL. --- # Using AI to Automate Regulatory Documentation: Opportunities and Limits *By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.* > **AI can automate the grinding layer of MDR documentation work — first drafts, gap analysis, cross-reference checks, template population, change tracking — and it can save a meaningful share of the hours a small regulatory team spends on repetitive writing. What it cannot do is carry the manufacturer's responsibility under MDR Article 10. The signature at the bottom of every document is human. The audit trail has to show a human made the decision. The right operating model is AI as first draft, expert as final adjudicator, with a mandatory review step that does not get skipped once the tool looks reliable. This post walks through what AI does well in regulatory documentation, where it accelerates startups, where it fails, and how to build the human-in-the-loop discipline that keeps the time savings real.** **By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.** --- ## TL;DR - AI is useful for regulatory documentation in a narrow band: first drafts, template population, gap analysis, cross-document consistency checks, and change tracking across versions. - The MDR obligations under Article 10 do not transfer to the tool. The manufacturer remains fully responsible for every document that leaves the QMS, and the QMS under EN ISO 13485:2016+A11:2021 must describe how any software used in the process is qualified and controlled. - The common failure mode is not bad AI output. It is humans reviewing AI output less carefully after the tool looks reliable, and missing the one draft that needed a real edit. - The audit trail has to show who wrote what, who reviewed, who approved, and when. An AI-generated section with no review evidence is a finding waiting to happen. - The Subtract to Ship test still applies: AI removes time from work that is required, not work that is required. --- ## The grinding layer of documentation A small MedTech team spends an uncomfortable share of its regulatory hours writing and re-writing documents that are not creative. Technical file sections that repeat the same structure across devices. Risk management files that need to be re-aligned every time a design input changes. Post-market surveillance reports that follow the same skeleton every cycle. Clinical evaluation updates that re-state well-established context before getting to the new evidence. Deviation narratives that copy a standard opening and then describe a specific event. None of that work is optional. All of it is structured. And most of it is the kind of writing a large language model does reasonably well when the inputs are clean and the reviewer is attentive. This is the opening AI creates for a small regulatory team. Not a shortcut around the obligations — the obligations do not move — but a way to spend fewer hours on the structured parts of the writing so more hours are available for the parts that actually need judgement. Tibor has watched two kinds of people burn out in small regulatory teams: the qualified ones who quit because the work does not match their training, and the less-qualified ones who cannot keep up with the volume under MDR. AI does not fix either problem on its own. It changes the arithmetic enough to make a two-person regulatory function viable where a three- or four-person one would otherwise be needed. ## What AI does well in regulatory documentation The band where current AI tools are reliable for documentation work is narrower than the marketing suggests, but it is real. **Template population from structured inputs.** Given a clean set of inputs — design inputs, risk controls, verification test results, labelling content — a model can populate a technical documentation template faithfully. It pastes the right content into the right section, keeps the cross-references consistent, and flags fields where the input is missing. This alone removes hours per document. **First drafts.** A model can produce the first draft of a PMS report, a CER update, a deviation narrative, a change control justification, or a design review summary from the structured inputs behind it. The draft is never the finished document. It is the starting point that replaces a blank page, and for a tired regulatory writer a starting point is worth a surprising amount. **Gap analysis across documents.** Checking whether the risk controls named in the risk file are mirrored in the instructions for use, whether the harmonised standards cited in the technical file match the latest OJEU listing, whether the PMS plan and PMS report describe the same data sources — these cross-document consistency checks are the kind of work humans do badly because the files are long and the discipline is tedious. A model does them reasonably well. **Change tracking across versions.** When a document has been revised many times, identifying what actually changed between versions and summarising it in change-control language is a structured task. Models do it faster than a human and, with a review step, at comparable accuracy. **Rewriting for clarity without changing meaning.** A draft written in dense engineer-prose can be reworked by a model into the cleaner structure a Notified Body reviewer expects, provided the reviewer afterwards confirms the meaning has not drifted. **Terminology consistency.** Ensuring the same term is used the same way across a file — "intended purpose" versus "intended use," "device" versus "product," a specific trade name versus a generic descriptor — is the kind of janitorial work that quietly matters in a Notified Body review. Models handle it well. Felix's summary from the interviews applies here too. AI maintains documentation, flags discrepancies, runs questionnaires, increases speed, maintains quality, reduces costs. The biggest single waste in MDR consulting work is repetitive structured documentation — and that waste is exactly what these tools remove. ## Where it accelerates startups The acceleration is concentrated in the places where the work is both structured and high-volume. For a startup building toward first CE marking, that usually means: - **Technical file assembly.** Populating Annex II sections from the underlying engineering and clinical evidence. - **First-cycle PMS reports and PSURs.** The first time a company writes one of these, the structure is unfamiliar and the temptation to over-write is strong. A model produces a structurally-correct draft that the reviewer then corrects on content. - **Standards gap analyses.** Comparing a technical file's list of applied standards against the current OJEU list and flagging any that need updating. - **Consistency sweeps before a Notified Body submission.** A full-file sweep for cross-reference and terminology consistency, done by a model, catches issues a human reviewer usually misses on the first pass. - **CAPA and deviation narratives.** The structure is repetitive; the content is specific. Models do the structural half well. The realistic productivity gain from these uses is not a ten-times improvement. Honest numbers in the tools Tibor has worked with look more like a thirty to sixty percent reduction in the hours spent on the drafting layer of the document, provided the review step is done properly. Where the tool is used without proper review, the apparent gains are larger but the risk is much larger too. That trade is never worth it. ## Where AI fails The places AI fails in regulatory documentation are the places where the document is not just text but a record of a decision. **Decisions with the manufacturer's name on them.** Classification calls, conformity assessment route selection, clinical evidence strategy, risk-benefit conclusions. A model can draft the text around these decisions. The decision itself is a human one, and the document exists to record the human reasoning. An AI-drafted conclusion to a risk-benefit analysis, signed by a human who did not re-do the reasoning, is a document that looks fine and fails an audit. **Facts the model does not know.** Models do not know the contents of the engineering file unless those contents are in the prompt. A draft that confidently describes a verification test that was never run is not a productivity gain — it is a contamination event in the technical documentation. Every fact in an AI-drafted section has to be verifiable against the underlying evidence, and when the underlying evidence is not fed into the prompt, the draft has to be treated as suspect until checked. **Up-to-date regulatory detail.** Models lag the regulation. Transitional provisions, MDCG document revisions, new harmonised standards — the model may have an older picture. Any regulatory citation that a model produces has to be verified against the current text by a human who knows where to look. **Judgement about what to leave out.** Good regulatory writing is as much about what is not in the document as what is. Models tend to add — more context, more caveats, more qualifications. A file that has been bloated by AI-generated over-explanation is harder for a Notified Body to review, not easier. Subtraction is still a human discipline. **Defending a document in an audit.** When a Notified Body auditor asks why a specific sentence is in the file, the answer cannot be "the model wrote it." The answer has to be a reasoned explanation from the human who approved the document. If the human cannot give that explanation, the document was never really reviewed. ## The human-in-the-loop discipline The single most important operating rule for AI in regulatory documentation is the one Tibor repeats to every team: AI as first draft, expert as final adjudicator, never the reverse. This is not a slogan. It is the only configuration where the time savings are real and the risk is contained. In practice the discipline has five parts: 1. **Named adjudicator.** Every document produced with AI assistance has a named human who is responsible for the final content. That human is the one who signs, and the one who can explain the document in an audit. 2. **Full review, not skim.** The adjudicator reads the whole document against the underlying evidence. A skim after a confident draft is not a review. If the time pressure makes a full review impossible, the tool is being used to move too fast and the scope has to shrink. 3. **Mandatory spot-check rate.** Even on high-volume documentation workflows, a fixed percentage of outputs is re-drafted from scratch by a human who has not seen the AI draft. This catches drift before it compounds. 4. **Override logging.** Every change the reviewer makes to the AI draft is logged with a reason. Over time the log shows where the tool is systematically weak and where the reviewer is drifting toward rubber-stamping. 5. **Rotation.** The same reviewer does not supervise the same AI-assisted workflow for months on end. Fresh eyes re-establish critical distance and break the complacency pattern. The complacency pattern is the one to watch. The tool gets ten drafts right in a row and the reviewer stops really reading. The eleventh draft is the one that matters. This is the same failure mode that shows up in vigilance triage and every other AI-assisted regulatory workflow, and the countermeasures are the same. ## Audit trail expectations Under MDR Article 10 the manufacturer is responsible for the technical documentation, the QMS, the post-market surveillance system, and everything that flows from them. Under EN ISO 13485:2016+A11:2021 the QMS has to describe how documents are created, reviewed, approved, and controlled — including how any software used in the process is qualified. For AI-assisted documentation that means the audit trail needs to show: - **Who created the draft.** The AI tool is named as the drafting aid, the human operator who ran it is named, and the inputs used are identifiable. - **Who reviewed the draft.** A named human, with the review date and the scope of the review. - **What changed between draft and final.** A version history or change log that shows the human edits on top of the AI draft. - **Who approved the final.** The named approver, with their role and the date. - **How the tool is qualified.** A record in the QMS of the tool's intended use, its validation, and its limits. An AI-generated section that appears in the technical file with no review evidence behind it is a finding in any real audit. The auditor will ask how the content was produced and who checked it, and the answer has to exist in the QMS. ## Common mistakes - **Treating the draft as the document.** The AI output is the starting point, never the finished version. Any process that skips the review step is not using AI well — it is using AI instead of doing the work. - **Leaving the tool unqualified in the QMS.** Using a tool that is not described anywhere in the QMS creates an invisible dependency and a documentation gap. Describe it, control it, and keep the description up to date. - **Feeding sensitive data into tools without checking where it goes.** Regulatory documentation often contains patient data, proprietary engineering content, or clinical evidence. The data-handling posture of the tool has to be understood before it is used. - **Confusing speed for quality.** A document produced in an hour that would have taken a day is not automatically a better document. If the review step has been compressed to match the drafting speed, the quality has dropped. - **Assuming the tool knows the regulation.** Models are not authoritative on MDR text. Every regulatory citation they produce has to be verified against the current consolidated text by a human. - **Hiding the tool from the Notified Body.** Being open about how documentation is produced is the right posture. Notified Bodies are increasingly aware of AI tooling in QMS processes, and a transparent description of the tool's role is far stronger than pretending the documents were written by a human who did not use a model. ## The Subtract to Ship angle Subtract to Ship says every activity in the regulatory plan must trace to a specific MDR article, annex, or harmonised standard, and everything else is waste. AI in documentation does not change that test. The activities that survive are still the required ones. What changes is how much time each one costs. The honest framing is that AI subtracts hours from work that is required. It does not subtract the work itself, and it does not create permission to skip anything. A document that was previously written by hand and is now drafted by a model and reviewed by a human is the same document for MDR purposes. The obligation is met by the human, not by the tool. Where AI crosses into subtraction-for-the-wrong-reasons is when a team starts cutting the review step because the drafts look fine. That is not subtraction. That is cutting compliance, and the framework does not allow it. The test remains the same: every activity that survives must trace to an article or annex, and every activity that has to happen still has to happen with a human responsible for it. Used correctly, AI in regulatory documentation fits the framework cleanly. It lets a small team ship a fully-required file with fewer burned hours on the structured writing, which is exactly the kind of efficiency the framework is built to find. ## Reality Check — Where do you stand? 1. For every AI-assisted document in your QMS, can you name the human who reviewed it and point to the review evidence? 2. Is the AI tool you use described in the QMS, with an intended use, a validation record, and a defined scope? 3. If a Notified Body auditor asked how a specific section of your technical file was produced, could you answer without hesitating? 4. Do you have a mandatory spot-check rate for AI-drafted documents, and is it actually being done? 5. Have you caught an AI-drafted document with a factual error that the reviewer initially missed? What did you change in the process afterwards? 6. Is the speed of your documentation workflow driven by the drafting step or the review step? If it is the drafting step, is the review keeping up honestly? 7. Can every activity in your documentation plan be traced to a specific MDR article, annex, or harmonised standard? ## Frequently Asked Questions **Can I use AI to write my technical file under the MDR?** You can use AI to draft sections of the technical file, and many small teams already do. The obligation under MDR Article 10 does not change. The manufacturer is still responsible for the content, and the QMS has to describe how documents are created, reviewed, and approved — including the role of any software used in the process. The tool is a drafting aid, not an author. **Does the Notified Body need to know that I use AI in my documentation process?** Transparency is the right posture. Notified Bodies are increasingly aware of AI tools in QMS workflows, and describing the tool's role in your QMS is stronger than hiding it. How the tool is qualified, what it does and does not do, and how outputs are reviewed should all be recorded in the QMS under EN ISO 13485:2016+A11:2021. **How much time can I realistically save with AI in documentation?** Honest numbers on the drafting layer of structured documents — technical file sections, PMS reports, gap analyses, consistency checks — look like a thirty to sixty percent reduction in the hours spent drafting, provided the review step is done properly. The savings shrink as the content becomes more judgement-heavy. Pilot the tool on your specific documents before promising any number to your board. **What is the biggest mistake teams make when automating documentation?** Compressing the review step to match the drafting speed. The AI draft is not the document. The document is the draft plus the human review, the edits, and the approval. When the team starts skipping the review because the drafts look fine, the apparent productivity gain becomes a hidden risk. **Can AI replace a regulatory writer?** No, and the framing is wrong. AI changes what a regulatory writer does. Less time on the structured drafting layer, more time on the judgement layer — clinical reasoning, risk-benefit analysis, defending decisions to a Notified Body. A small team with good AI tooling and a disciplined review process can do the work of a larger team without them. A small team that uses AI to skip review is taking on risk it cannot see. ## Related reading - [The Subtract to Ship Framework for MDR Compliance](/blog/subtract-to-ship-framework-mdr) — the methodology this post sits inside. - [How Flinn.ai and AI Tools Are Transforming Regulatory Work for Startups](/blog/flinn-ai-tools-transforming-regulatory) — the broader category view of AI in regulatory operations. - [AI in Post-Market Surveillance: Signal Detection](/blog/ai-post-market-surveillance-signal-detection) — the PMS side of the same question. - [AI in Post-Market Surveillance: Complaint Analysis](/blog/ai-post-market-surveillance-complaint-analysis) — deeper dive on the complaint-analysis workflow. - [The AI Advantage in Regulatory Affairs for Startups](/blog/ai-advantage-regulatory-affairs-startups) — the strategic case for small teams. - [AI Document Drafting for QMS Procedures](/blog/ai-document-drafting-qms-procedures) — the QMS-documentation companion post. - [What Is a Quality Management System for Medical Devices?](/blog/what-is-quality-management-system-medical-devices) — the QMS frame any tool has to fit into. - [How to Write an SOP That People Actually Follow](/blog/how-to-write-an-sop-people-follow) — the writing discipline AI supports, not replaces. - [Document Control Under ISO 13485 and the MDR](/blog/document-control-iso-13485-mdr) — the control layer any AI-drafted document has to live inside. ## Sources 1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 10 (general obligations of manufacturers). Official Journal L 117, 5.5.2017, consolidated text. 2. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes. --- *This post is part of the AI, Machine Learning & Algorithmic Devices series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. AI in regulatory documentation is a productivity layer, not a responsibility transfer — the obligation under the Regulation still lives with the human whose name is on the document.* --- *This post is part of the [AI, ML & Algorithmic Devices](https://zechmeister-solutions.com/en/blog/category/ai-ml-devices) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*