Should You Trust AI in Regulatory Work? A Vendor-Neutral Checklist After DJ Fang's Pilot

When executive leadership asks whether generative artificial intelligence can compress global medical device dossier turnaround times, Regulatory Affairs (RA) and Quality Assurance (QA) leaders face a difficult governance decision. Off-the-shelf Large Language Models (LLMs), vendor submission copilots, and AI-enabled market-access platforms promise to automate multi-market technical documentation assembly. However, submitting unverified, hallucinated, or non-compliant content to health authorities carries severe legal, financial, and market-access risks.

A recent industry benchmark highlights both the potential and the boundary of AI in regulatory operations. In an August 2026 Q&A on ValiantCEO, DJ Fang, Chief Operating Officer of Pure Global, reported that their internal AI Builder tool (launched in late 2025) reduced document-assembly time across a 27-project pilot in Brazil by approximately 75%—compressing preparation from 25–30 business days down to 5–8 business days.

To evaluate such claims objectively, medical device manufacturers must apply strict fact discipline. The 75% time reduction is a vendor-reported, single-country, unaudited pilot statistic that applies exclusively to internal document assembly. It does not reflect regulator review timelines, market clearance speeds, or independent third-party validation.

This guide provides a vendor-neutral, gate-by-gate operational audit framework for RA, QA, and market-access teams. It establishes clear boundary lines between AI inside medical devices, AI generating clinical evidence, and AI assembling regulatory documentation. Furthermore, it outlines the exact Computerized System Validation (CSV), accountability, change control, and multi-market reliance sequencing required before any AI-generated submission reaches a health authority.

Direct Answer: How to Audit an AI Regulatory Workflow

Executive Summary & Operational Protocol
Any AI-assisted regulatory workflow must be governed as a GxP computerized system that produces draft content, never final regulatory decisions. Before authorizing an AI platform—whether a commercial product like Pure Global's AI Builder, an eSTAR/eCTD copilot, or an in-house LLM pipeline—manufacturers must clear three governance pillars:

1. Tool Validation & Provenance: Validate the AI platform under GAMP 5 (Second Edition) critical-thinking principles, 21 CFR Part 11 / EU GMP Annex 11 electronic record controls, and ISO 13485:2016 clause 4.1.6. Ensure every citation traces directly to verifiable primary regulatory sources (e.g., eCFR, EUR-Lex, NMPA decrees).
2. Controlled Content Governance: Maintain a validated master dossier (e.g., STED/eSTAR) as the single source of truth. Enforce automated gap analysis with named human closure owners, and wrap all model outputs in strict version control under QMS change management.
3. Accountability & Reliance Sequencing: Require non-delegable sign-off from a qualified regulatory professional. Recognize that local legal representatives (such as EU Authorized Representatives under EU MDR Articles 11–12) bear direct legal liability for registration defects. Finally, sequence market filings using official reliance pathways (e.g., Mexico COFEPRIS ~30-business-day equivalency or Malaysia MDA – China NMPA GHWP reliance) to convert internal assembly speed into actual market entry.

Conceptual Architecture: The Three Lanes of Regulatory AI

A common failure mode when evaluating AI tools is conflating software embedded within a medical device with software used to manage regulatory operations. Regulatory teams must maintain a strict three-lane classification map:

+-----------------------------------------------------------------------------------+
|                        REGULATORY AI CLASSIFICATION MAP                           |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  [LANE A: AI IN THE DEVICE]                                                       |
|  * Scope: SaMD, AI/ML diagnostic algorithms, adaptive clinical software            |
|  * Framework: CDRH AI/ML Lifecycle Guidance, GMLP, PCCP, EU AI Act (High-Risk)    |
|  * Focus: Clinical safety, algorithm drift, bias, analytical validation          |
|                                                                                   |
|  [LANE B: AI GENERATING DECISION-SUPPORTING DATA]                                 |
|  * Scope: AI generating synthetic clinical data, trial design, bio-simulations    |
|  * Framework: FDA Jan 2025 AI Credibility Draft Guidance (90 FR 1157)             |
|  * Focus: Model credibility, context of use (COU), 7-step risk assessment         |
|                                                                                   |
|  [LANE C: AI FOR DOCUMENT ASSEMBLY & REGULATORY OPERATIONS]                       |
|  * Scope: Dossier drafting, STED/eSTAR assembly, translation, gap checking        |
|  * Framework: GAMP 5 (2nd Ed), 21 CFR Part 11 / Annex 11, ISO 13485 cl. 4.1.6      |
|  * Focus: Source provenance, human sign-off, CSV, change control, legal liability|
|                                                                                   |
+-----------------------------------------------------------------------------------+

Lane A: Artificial Intelligence in the Medical Device (Software as a Medical Device)

Lane A encompasses Software as a Medical Device (SaMD) and AI/ML algorithms embedded within physical hardware (e.g., AI-driven image interpretation, ECG arrhythmia detection). This lane is governed strictly by FDA CDRH's AI-enabled medical device guidance, Good Machine Learning Practice (GMLP), Predetermined Change Control Plans (PCCP), and the EU AI Act's high-risk classification rules.

Lane B: AI Generating Decision-Supporting Clinical or Analytical Data

Lane B covers AI models used to generate data submitted to a health authority to prove safety, effectiveness, or performance—such as AI-driven statistical modeling or synthetic clinical trial arms. On January 6–7, 2025, the FDA issued a landmark draft guidance: Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products (Federal Register 90 FR 1157, Docket FDA-2024-D-4689; public comment period closed April 7, 2025).

This draft guidance establishes a rigorous 7-step risk-based credibility framework:

1. Define the regulatory question.
2. Define the Context of Use (COU).
3. Assess model risk.
4. Develop a credibility assessment plan.
5. Execute the plan.
6. Document results.
7. Assess overall adequacy.

Lane C: AI for Document Assembly and Operational Efficiency

Lane C covers generative software tools used by sponsors to draft, translate, format, gap-check, and re-purpose technical documentation across jurisdictions—including tools like Pure Global's AI Builder, custom RAG (Retrieval-Augmented Generation) pipelines, and eSTAR authoring assistants.

Critical Scope Boundary: The FDA's January 2025 draft guidance explicitly states that its credibility framework applies to AI models generating data that support a regulatory decision, while excluding operational efficiencies that do not directly alter patient safety or study reliability.

Because health authorities do not validate Lane C internal productivity tools on behalf of sponsors, the burden of governance falls entirely on the device manufacturer's Quality Management System (QMS). Understanding how generative AI in device regulatory operations fits into workflow automation is the starting point for building a defensible validation protocol.

The 8-Gate Vendor-Neutral AI Operational Audit Checklist

Before approving any AI-assisted workflow for regulatory submission assembly, QA and RA leadership should verify that the process passes each of the eight operational control gates below.

Gate 1: Source Provenance and Ground-Truth Document Verification

• Accountability Owner: RA Data Steward / Lead Author
• Operational Risk: Large Language Models inherently risk generating plausible-sounding but completely fabricated regulatory requirements, incorrect clause numbers, or outdated guidance dates.
• Audit Requirement: The AI platform must operate using strict Retrieval-Augmented Generation (RAG) restricted to verified primary repositories (such as eCFR, EUR-Lex, NMPA, PMDA, and official gazettes). When referencing external intelligence, platforms like pureglobal.ai provide access to regulatory databases across global markets. However, the internal workflow must verify that every generated citation points to an active, official legal text.
• Pass/Fail Test: Sample 20 random regulatory citations from the AI output. If any citation contains a hallucinated section number, non-existent guidance document, or outdated fee structure, the output fails Gate 1.

Gate 2: Controlled Master Dossier Single Source of Truth

• Accountability Owner: Document Control Lead
• Operational Risk: As AI makes multi-country dossier adaptation effortless, organizations risk creating fragmented, inconsistent product claims across different regional filings.
• Audit Requirement: Establish a validated master dossier—such as an IMDRF STED baseline or FDA eSTAR structure—as the canonical single source of truth. Regional variations (e.g., adapting an FDA 510(k) summary into a Brazilian ANVISA RDC 751/2022 technical dossier) must maintain exact equivalence in intended use, indications for use, device description, and risk management findings.
• Pass/Fail Test: Perform an automated delta audit between the regional draft and the master dossier. Any deviation in technical specifications or clinical claims that cannot be traced to a specific local regulatory requirement fails Gate 2.

Gate 3: Validated Gap Analysis & Defect Closure Ownership

• Accountability Owner: Principal Regulatory Affairs Manager
• Operational Risk: Relying on automated AI checklists to confirm submission completeness can cause teams to overlook missing test reports or invalid biocompatibility data.
• Audit Requirement: AI-assisted gap analysis tools must produce a structured deficiency matrix that categorizes gaps into structural missing documents (e.g., missing ISO 10993-1 summary), technical non-conformances, and administrative omissions. Crucially, the software must assign every identified gap to a named human subject matter expert for resolution.
• Pass/Fail Test: The AI gap-analysis report must include explicit human closure sign-offs for 100% of flagged missing elements before dossier finalization.

Gate 4: Computerized System Validation (CSV) under GxP & QMS Standards

• Accountability Owner: Computer System Validation (CSV) Manager / QA Lead
• Operational Risk: Deploying unvalidated commercial software or unmanaged cloud LLMs to generate regulatory records violates core quality system regulations.
• Audit Requirement: The AI authoring environment must undergo CSV in accordance with:
  • ISPE GAMP 5 (Second Edition, 2022): Applying critical thinking to software risk categorization and supplier assessment.
  • 21 CFR Part 11 & EU GMP Annex 11: Verifying electronic signature controls, user role permissions, and immutable audit trails that record who generated, modified, or approved every document section. Reviewing 21 CFR Part 11 electronic record and audit trail requirements ensures the system meets federal compliance standards.
  • ISO 13485:2016 Clause 4.1.6: Validating software applications used in the quality management system prior to initial use.
• Pass/Fail Test: A completed Validation Summary Report (VSR) containing documented User Requirements Specifications (URS), functional testing, and security controls must be signed off by QA.

+-----------------------------------------------------------------------------------+
|                  AI REGULATORY TOOL VALIDATION ARCHITECTURE                       |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|   [ISO 13485:2016 cl 4.1.6]       [ISPE GAMP 5 (2nd Ed)]      [21 CFR PART 11 / ANNEX 11]|
|   QMS Software Validation          Critical Thinking CSV       Electronic Records / Trails |
|              \                               |                              /     |
|               \                              |                             /      |
|                +-----------------------------+----------------------------+       |
|                                              |                                    |
|                                              v                                    |
|                      +-----------------------------------------------+            |
|                      |  VALIDATED AI AUTHORING WORKFLOW ENVIRONMENT  |            |
|                      |  - Role-Based Access Controls                 |            |
|                      |  - Encrypted RAG Data Pipeline                |            |
|                      |  - Immutable System Audit Logs                |            |
|                      +-----------------------------------------------+            |
|                                              |                                    |
|                                              v                                    |
|                      +-----------------------------------------------+            |
|                      |   HUMAN-IN-THE-LOOP QUALITY REVIEWS & SIGNOFF |            |
|                      +-----------------------------------------------+            |
|                                                                                   |
+-----------------------------------------------------------------------------------+

Gate 5: Qualified Human-in-the-Loop Sign-Off

• Accountability Owner: Head of Regulatory Affairs / Authorizing Officer
• Operational Risk: Treating AI outputs as final submissions creates immediate regulatory exposure.
• Audit Requirement: Implement a strict non-delegable human sign-off policy. An AI platform is legally and operationally categorized as a drafting assistant. The final submission cover letter, technical summary, and legal declarations must be authored or explicitly reviewed and approved by a credentialed regulatory professional (e.g., RAC holder or senior RA manager).
• Pass/Fail Test: Every submitted file must contain a signed internal review routing sheet confirming human verification of technical accuracy, data integrity, and regulatory strategy.

Gate 6: Local Legal Representative & Authorized Representative Accountability

• Accountability Owner: Global Legal Counsel / Global Regulatory Operations Director
• Operational Risk: Foreign manufacturers often forget that their local legal representative bears direct regulatory liability for registration accuracy in overseas jurisdictions.
• Audit Requirement: Under major global regulatory regimes, local representatives—such as an EU Authorized Representative (EC REP) under EU MDR 2017/745 Articles 11–12, a UK Responsible Person (UKRP), or a Brazilian Registration Holder (BRH)—are legally co-liable for product compliance and dossier truthfulness. Reviewing EU authorized representative (EC REP) legal liability underscores the importance of obtaining local sign-off. Local representatives must be granted audit visibility into any AI-assembled dossier bearing their name before it is filed with the competent authority.
• Pass/Fail Test: Written confirmation from the local authorized representative or in-country licensee approving the final translation and local submission package.

Gate 7: Artifact Version Control & Submission Change Control

• Accountability Owner: QMS Manager / Configuration Control Lead
• Operational Risk: Inability to reconstruct how an AI tool generated specific submission text during a subsequent QMS audit or regulatory inquiry.
• Audit Requirement: Maintain full traceability across the AI generation lifecycle. The system must archive:
  1. The exact prompt template and system instructions used.
  2. The specific version of the underlying LLM or RAG model.
  3. The raw, unedited AI output.
  4. The redlined human edits.
  5. The final approved document version tied to a formal Change Order (CO) under QMS change procedures. Aligning this workflow with established standards for change control for adaptive AI systems ensures seamless integration with quality processes.
• Pass/Fail Test: An auditor must be able to select any section of a submitted dossier and inspect the complete audit trail showing initial AI generation, human revision, and final QA sign-off.

Gate 8: Multi-Market Reliance Pathway Sequencing

• Accountability Owner: Global Market Access Director
• Operational Risk: Accelerating internal document drafting without optimizing market filing sequences creates bottlenecked regulatory queues and wasted review fees.
• Audit Requirement: The strategic value of AI document assembly lies in its ability to simultaneously prepare reference dossiers that unlock global regulatory reliance pathways. Rather than filing dossiers independently across 20 countries, manufacturers should sequence filings to leverage reference-authority approvals:
  • Mexico COFEPRIS Equivalency Pathway: Under the updated decree published in the Diario Oficial de la Federación (DOF July 18, 2025, effective September 1, 2025), medical devices cleared by the US FDA, Health Canada, or Japan PMDA qualify for an abbreviated equivalency review targeting ~30 business days. Reviewing the Mexico COFEPRIS equivalency registration pathway details how reference clearances reduce overall approval timelines.
  • Malaysia MDA – China NMPA Bilateral Reliance Pilot: Effective July 30, 2025, under the Global Harmonization Working Party (GHWP) framework, Malaysia's Medical Device Authority (MDA) and China's NMPA initiated a reciprocal reliance pilot (Phase 1: July 30–Sept 30, 2025, scoped to in vitro diagnostic devices; Phase 2: July–Sept 2026), allowing qualified reference approvals to streamline technical evaluations.
  • IMDRF Reliance Principles: Leveraging reference dossiers across IMDRF member jurisdictions accelerates entry into secondary markets. Incorporating IMDRF global regulatory reliance principles into your strategic roadmap ensures optimal positioning across target regions.
• Pass/Fail Test: The market-access launch plan must map every AI-assembled dossier directly to a primary reference approval (e.g., FDA 510(k) or EU CE Mark) to maximize reliance recognition.

+-----------------------------------------------------------------------------------+
|               MULTI-MARKET RELIANCE SEQUENCING STRATEGY                           |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  [PHASE 1: MASTER DOSSIER & PRIMARY APPROVAL]                                     |
|  * AI Platform compiles Master STED / eSTAR Dossier                              |
|  * File primary submission with US FDA or EU Notified Body                        |
|  * Obtain Reference Clearance / CE Mark                                           |
|                                                                                   |
|                                     |                                             |
|                                     v                                             |
|                                                                                   |
|  [PHASE 2: AI-ASSISTED RELIANCE ADAPTATION]                                       |
|  * AI adapts Master Dossier into regional submission templates                    |
|  * Embed Primary Reference Approval Certificates                                  |
|                                                                                   |
|                 +-------------------+-------------------+                         |
|                 |                                       |                         |
|                 v                                       v                         |
|                                                                                   |
|  [MEXICO COFEPRIS RELIANCE]               [MALAYSIA MDA - CHINA NMPA PILOT]       |
|  * Abbreviated Equivalency Pathway        * GHWP Bilateral Reliance Framework     |
|  * DOF decree (Effective Sep 1, 2025)     * Reciprocal Pilot (Effective Jul 2025)  |
|  * Target: ~30-Business-Day Review        * Streamlined Technical Evaluation      |
|                                                                                   |
+-----------------------------------------------------------------------------------+

Separating Internal Document Assembly from Regulator Review

When communicating with executive stakeholders, RA leaders must distinguish between internal document preparation and health authority review. The table below illustrates why internal productivity gains do not translate linearly into faster regulatory approvals.

Understanding these distinctions helps sponsors evaluate software solutions appropriately. When evaluating regulatory intelligence and submission software, organizations should focus on how vendors address data security, validation support, and source traceability.

Vendor Audit Questionnaire: What to Ask AI Software Providers

When conducting vendor due diligence on regulatory AI platforms, procurement and QA teams should require written responses to the following eight questions:

1. Data Security & Model Isolation: Are our proprietary submission documents used to train your public base models? (Require contractual commitment that customer data is strictly isolated within dedicated, non-training instances.)
2. Source Grounding & RAG Architecture: How does your platform prevent hallucinated regulatory citations? Can you demonstrate real-time link verification to official legal gazettes?
3. Computerized System Validation (CSV) Support: Do you supply a pre-packaged Validation Acceleration Kit—including URS, Traceability Matrix, and IQ/OQ/PQ execution scripts compliant with GAMP 5 (2nd Edition)?
4. Audit Trail Compliance: Does the platform maintain immutable system audit logs compliant with 21 CFR Part 11 and EU GMP Annex 11, recording every prompt, generated output, and user edit?
5. Master Dossier Inheritance: How does your system manage version changes in a master dossier when re-purposing content across 15+ regional technical files?
6. Local Representative Access: Can external local legal representatives (e.g., EU Authorized Representatives) be granted restricted, read-only audit access to review local submission drafts prior to filing?
7. Performance Benchmark Verification: Are published speed or time-saving metrics (e.g., 75% draft time reductions) based on independent audited studies, or are they self-reported vendor pilot statistics?
8. Vendor Financial & Operational Stability: What is your long-term product roadmap, data export policy, and escrow commitment if platform support is discontinued?

Frequently Asked Questions

Does FDA's January 2025 AI credibility framework apply to AI that drafts my 510(k)?

No. The FDA's January 2025 draft guidance (Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products, 90 FR 1157) explicitly scopes its 7-step credibility framework to AI models that produce clinical, analytical, or safety data supporting a regulatory decision. It explicitly excludes operational efficiency tools used for document assembly or formatting. Document-drafting AI is instead governed by sponsor QMS software validation (ISO 13485:2016 clause 4.1.6, GAMP 5 2nd Edition) and electronic record rules (21 CFR Part 11).

Can our authorized representative or local responsible person be liable for an AI-generated dossier error?

Yes. Under major regional regulations—such as EU MDR 2017/745 Articles 11–12 for EU Authorized Representatives (EC REPs) or UKRP rules in the United Kingdom—the local legal representative whose name appears on the device registration shares legal liability for product compliance and technical file accuracy. If an AI platform introduces incorrect technical data or omitted risk analysis into a regional filing, the local representative can face direct regulatory enforcement. Consequently, local representatives must review and approve AI-assembled filings.

Is the Pure Global AI Builder 75% / 25–30 to 5–8 day result something we can expect too?

The 75% reduction (from 25–30 to 5–8 business days) reported by Pure Global for its AI Builder tool in a 27-project Brazil pilot is a self-reported, single-vendor, unaudited pilot statistic. It applies strictly to internal document assembly time within a specific pilot setting. It should not be generalized as a universal benchmark, nor does it guarantee faster health authority review or approval. Your organization's actual time savings will depend on master dossier maturity, data availability, CSV qualification, and internal review efficiency.

What is the minimum human sign-off before an AI-drafted regulatory submission goes to a health authority?

The absolute minimum requirement is a documented, non-delegable review by a qualified regulatory professional (e.g., RAC credentialed or senior RA manager). This review must verify 100% of technical claims, regulatory citations, device descriptions, and risk management conclusions against original test reports and master design history files (DHF). AI-generated outputs must never be transmitted to a health authority without explicit human sign-off and formal QMS change control approval.

Conclusion & Action Plan for RA/QA Leaders

Generative AI offers significant potential for streamlining medical device regulatory operations, but it demands rigorous quality governance. To adopt AI safely without exposing your organization to compliance failures:

1. Establish your classification map: Separate Lane A (AI in the device) and Lane B (AI generating clinical data) from Lane C (AI document assembly).
2. Execute the 8-Gate Audit: Require every AI-assisted workflow to pass all eight control gates—from source provenance and GAMP 5 CSV to human sign-off and local representative authorization.
3. Audit your vendors: Demand full transparency, CSV support packages, and clear data isolation guarantees from AI software vendors.
4. Sequence multi-market reliance: Pair internal document assembly speed with official reliance pathways (such as Mexico COFEPRIS or GHWP bilateral reliance) to achieve real-world market access acceleration.

By maintaining strict fact discipline and robust QMS oversight, regulatory leaders can harness AI productivity gains while protecting patient safety and corporate integrity.

Primary & Official Sources

• U.S. Food and Drug Administration (FDA): Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products (Draft Guidance, Jan 6–7, 2025; Federal Register 90 FR 1157, Docket FDA-2024-D-4689).
• International Society for Pharmaceutical Engineering (ISPE): GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems (Second Edition, July 2022).
• International Organization for Standardization (ISO): ISO 13485:2016 Medical devices — Quality management systems — Requirements for regulatory purposes (Clause 4.1.6 Software Validation).
• U.S. Code of Federal Regulations: 21 CFR Part 11 - Electronic Records; Electronic Signatures (eCFR).
• European Commission: EU GMP Annex 11: Computerised Systems & EU Medical Device Regulation (MDR) 2017/745 (Articles 11–12 Authorized Representative).
• Diario Oficial de la Federación (Mexico): COFEPRIS Medical Device Abbreviated Equivalency Agreement (Published July 18, 2025; Effective September 1, 2025; DOF).
• Medical Device Authority (MDA) Malaysia & NMPA China: Malaysia–China Bilateral Medical Device Regulatory Reliance Programme under GHWP Framework (Effective July 30, 2025).
• ValiantCEO Interview Source: Transforming Healthcare Compliance with AI: A Q&A with DJ Fang, COO of Pure Global (Published August 1, 2026; ValiantCEO Interview).