AI in Regulatory Affairs: From Faster Answers to Better Decisions

AI Is Changing Regulatory Affairs

Artificial intelligence has already entered medical device regulatory work, through approved enterprise systems and informal use of general-purpose tools. The attraction is understandable. Regulatory Affairs teams manage growing volumes of legislation, guidance, standards, technical documentation and post-market information across several jurisdictions. A tool that can search, summarise and compare this material in seconds appears to offer an immediate productivity gain. 

Yet regulatory work is not simply a text-production exercise. Its outputs inform product classification, evidence strategies, submissions, market access and patient safety decisions. A plausible answer is not necessarily a defensible one. The test is whether an AI-supported conclusion is relevant to the specific product, grounded in authoritative sources, reviewable by a qualified professional and documented well enough to withstand later scrutiny. 

This distinction is becoming more important as regulators develop more detailed expectations for AI-enabled medical devices. Recent FDA guidance and IMDRF principles emphasise lifecycle management, risk, data quality, transparency and human factors. In Europe, guidance on the interplay between the MDR, IVDR and AI Act illustrates how several regulatory frameworks can apply to the same technology. These documents primarily address AI within medical products, not internal regulatory tools. Even so, the underlying principles offer a useful benchmark for responsible adoption. 

How to Use AI in Regulatory Affairs Workflows

The weakest starting question is often, “Where can we use AI?” It encourages organisations to begin with the technology and search for a task. A stronger approach begins with a defined workflow: monitoring a changing requirement, assessing a documentation gap, comparing market pathways or preparing a first draft for expert review. 

The team can then identify the problem, inputs required, acceptable output, accountable reviewer and consequences of an error. Low-risk administrative support should not be governed like analysis that influences a submission or safety-related decision. This risk-based framing helps organisations apply controls proportionately instead of treating every use of AI as either harmless or unacceptable. 

Organisations should also recognise that AI adoption is rarely a simple technology deployment. Individual employees may achieve immediate productivity gains, but broader organisational benefits depend on how workflows, responsibilities and decision-making processes evolve. As routine research, drafting and information retrieval become more automated, teams may need to redefine roles, strengthen cross-functional collaboration and focus human expertise on judgement, strategy and oversight. The challenge is therefore not only introducing a new tool, but adapting the operating model around it. 

Why Context Matters in AI for Regulatory Affairs

Regulatory questions rarely have universally correct answers. Relevance can depend on intended purpose, claims, classification, medical device characteristics, target population, market, lifecycle stage and the applicable requirement version. The same regulatory change may require immediate action for one product, a documented assessment for another and no action for a third. 

AI systems used in this environment need more than access to information. They need a structured way to connect that information to the product and decision at hand. When the system lacks essential context, it should expose the uncertainty or request further information rather than filling the gaps. Fluency must never be mistaken for completeness.

Traceability Must Be Operational

A citation is useful only if a reviewer can follow it to the relevant source and verify that the interpretation is current and accurate. Regulatory teams should be able to see which regulation, guidance document or standard informed an output, which version was used, and how the cited passage supports the conclusion. 

This has practical implications. Source hierarchies should prioritise authoritative material; superseded documents need to be identified; and generated outputs should distinguish between a direct requirement, an interpretation and a recommendation. Where evidence conflicts or remains ambiguous, the system should make that visible. Traceability is not a cosmetic reference list added after generation. It is part of the reasoning process and review trail. 

Protecting Confidential Data When Using AI

Regulatory Affairs work often involves confidential product information, unpublished evidence, quality records and commercially sensitive plans. Before introducing an AI system, organisations should understand where prompts and documents are processed, whether submitted data may be retained or reused, who can access it, and what contractual and technical safeguards apply. The convenience of a public tool does not remove obligations around confidentiality, data protection, cybersecurity and supplier oversight. 

Clear usage rules are therefore essential. Teams need to know which information may be entered, which use cases require an approved environment and which activities are prohibited. These controls should be supported by training and system design, not left to individual caution. An organisation cannot assess output reliability while ignoring the governance of the information used to create it. 

Why Human Oversight Remains Essential for AI in Regulatory

The phrase “human in the loop” can become an empty reassurance unless the organisation defines what the human is expected to do. A named reviewer needs the competence, time and authority to challenge the output. Review criteria should cover source validity, product context, assumptions, omissions and the regulatory significance of the conclusion. 

Effective adoption requires more than assigning a reviewer. As AI assumes a greater share of information retrieval, comparison and drafting, organisations may need to rethink how regulatory expertise is deployed. Human effort can shift away from routine information processing and toward interpretation, risk assessment, strategy, stakeholder engagement and governance. 

Human review is especially important when an answer affects regulatory strategy, formal documentation, market access or communication with an authority. AI can accelerate research and synthesis, but accountability cannot be delegated to a model. The professional signing off the work must understand how the conclusion was reached and remain able to disagree with it.

How to Govern AI Throughout Its Lifecycle

AI adoption is not complete when a tool passes an initial pilot. Models, source collections, regulations and organisational processes all change. Teams need ongoing controls for access, confidentiality, versioning, performance monitoring and incident handling. They should test the system against representative use cases before deployment and repeat that evaluation when material components change. 

The evaluation should look beyond speed. Useful measures include whether the system retrieves the correct authoritative sources, identifies missing context, distinguishes requirements from recommendations and produces outputs experts can verify efficiently. Organisations should also record when AI has contributed to a regulated workflow and retain the evidence needed to explain its role later. 

A controlled pilot can begin with a narrow set of tasks and expected outcomes agreed by experienced regulatory professionals. Errors and near misses should be recorded, categorised and used to improve the workflow. This creates evidence for deciding whether the tool is ready to expand into higher-impact activities, rather than allowing enthusiasm after a few good demonstrations to substitute for evaluation.

A Decision Layer, Rather Than an Answer Machine

Used carefully, AI can reduce repetitive searching, help compare complex material and give experts more time for interpretation and strategy. Used carelessly, it can produce confident text that obscures missing context and weakens the decision trail. 

Through our work building QARAlink, I have become convinced that the most valuable regulatory AI will not be the system that generates the largest number of answers. It will be the system that helps teams ask better questions, recognise uncertainty, connect requirements to specific products and preserve the evidence behind each decision. In MedTech, speed is valuable only when it travels with clarity, traceability and the informed judgement of accountable professionals. 

References

• U.S. Food and Drug Administration, Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations, Draft Guidance, January 2025.
• U.S. Food and Drug Administration, Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions, Guidance.
• Medical Device Coordination Group, MDCG 2025-6: FAQ on the interplay between the Medical Devices Regulation, the In Vitro Diagnostic Medical Devices Regulation and the Artificial Intelligence Act, June 2025.
• International Medical Device Regulators Forum, Good Machine Learning Practice for Medical Device Development: Guiding Principles, IMDRF/AIML WG/N88 FINAL:2025, January 2025.

Disclaimer. The views and opinions expressed in this article are solely those of the author and do not necessarily reflect the official policy or position of Test Labs Limited. The content provided is for informational purposes only and is not intended to constitute legal or professional advice. Test Labs assumes no responsibility for any errors or omissions in the content of this article, nor for any actions taken in reliance thereon.