AI Can Recommend. Who Owns the Quality Decision?

AI tools are arriving in Quality and Regulatory work faster than the governance around them. They can summarise a complaint population, draft an SOP, propose a root cause or compare evidence against a requirement in seconds. The question that matters in a regulated organisation is not whether the output is impressive. It is who stands behind the decision that follows it — and whether they can show why.

What the frameworks say

The EU AI Act requires high-risk AI systems to be designed for effective human oversight (Article 14), and requires deployers of those systems to assign that oversight to natural persons with the necessary competence, training and authority, as well as the necessary support (Article 26(2)).^[1] Not every AI tool used inside a quality system is a high-risk system under the Act, and these articles should not be assumed to apply automatically. They are, however, the clearest statement of where regulators expect accountability to sit: with a named, competent person who has the authority to overrule the system.

NIST's AI Risk Management Framework treats accountability, transparency and human oversight as part of governing AI risk,^[2] and its Generative AI Profile names confabulation — confidently stated but false or erroneous content — as a specific risk of generative systems.^[3] ISO/IEC 42001 gives organisations a management-system structure for AI.^[4]

Medical-device Quality already has its own rules. ISO 13485:2016 requires software used in the quality management system to be validated for its intended use (4.1.6) and responsibilities and authorities to be defined (5.5.1).^[6] FDA's February 2026 guidance on Computer Software Assurance describes a risk-based way to establish confidence in production and quality-system software.^[5] None of these documents endorses or prohibits generative AI for Quality decisions; together they make clear that the organisation, not the tool, owns the outcome.

Our interpretation: what makes an AI-assisted decision defensible

• Traceability — the recommendation points to the specific records, document versions and requirements it relied on.
• Source authority — a regulation, a guidance document, a standard and a company procedure are labelled as different things, never blended.
• Visible gaps — what the evidence does not show is stated, not filled with something plausible.
• Visible contradictions — evidence that does not fit the leading conclusion is shown, not smoothed away.
• Labelled status — a recommendation, a draft or a suggestion never looks like an approved record.
• Named accountability — the decision is recorded against a qualified person, with the time and the rationale.

Confidence is a property of the output. Accountability is a property of the organisation.

Questions to ask before relying on an AI recommendation

• Can I see exactly which evidence this is based on — and open it?
• Does it tell me what it could not establish?
• Is anything here presented as a requirement that is actually guidance, a standard or a suggestion?
• If I disagree, can I record that, and is the disagreement kept with the record?
• Whose name will be on this decision, and would they sign it without the AI's output in front of them?

Where QMSROOT fits

This section describes QMSROOT, not a regulatory requirement. RootAí brings evidence-grounded intelligence to supported Quality workflows: it works from current sources and the records supplied, labels each source for its authority, keeps unresolved points unresolved and does not approve, close or sign anything. Dispositions are recorded against a named person and time. RootAí advises. Quality decides. Evidence shows why.