This is a ready-to-use form for the citation discipline an AI risk assessment needs: with several overlapping documents in play at once, binding regulation, final but general guidance, draft guidance, and non-binding principles, it is easy to cite one as if it carries the weight of another. This form makes the assessor record, claim by claim, exactly what kind of document is being cited and for what. Attach it to the risk assessment record. Replace every <<FILL: ...>> placeholder. A filled specimen follows.
Form control
| Field | Entry |
|---|---|
| System / model name | <<FILL>> |
| Risk assessment reference | <<FILL>> |
| Completed by | <<FILL>> |
| Date | <<FILL>> |
Citation map
For each claim in the risk assessment that rests on an external document, record it here rather than folding it into narrative text where its status (binding, final, draft, principle) can get lost.
| Claim in the assessment | Document cited | Status (binding / final guidance / draft / non-binding principle) | Why this document, not another |
|---|---|---|---|
<<FILL: e.g. "the risk-sizing method used">> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. "the GAMP category assigned">> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. "the assurance-effort level for validation">> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. "the evidence depth for the credibility argument">> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. "the data representativeness and monitoring expectations">> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. "whether the system is a high-risk AI system under horizontal EU law">> | <<FILL>> | <<FILL>> | <<FILL>> |
Status definitions, applied consistently
| Status | Meaning | How it may be cited |
|---|---|---|
| Binding | A statute, regulation, or final guidance in force that applies directly (for example 21 CFR Part 11, EU GMP Annex 11, a final FDA guidance) | As a requirement the assessment must satisfy |
| Final, general | Final guidance that governs the underlying computerized system but does not address AI specifically (for example FDA’s Computer Software Assurance guidance) | As the assurance-effort principle, with an explicit note that it does not resolve AI-specific questions |
| Draft | Published for comment, not yet final (for example an FDA AI draft guidance, EU GMP Annex 22 in draft) | As the direction the field is heading, explicitly marked “draft, not binding,” never as a satisfied requirement |
| Non-binding principle | A joint statement of principles, not a technical standard (for example the Good Machine Learning Practice principles, the FDA/EMA Guiding Principles of Good AI Practice) | As framing language or supporting rationale, never as the sole basis for a specific technical acceptance criterion |
Acceptance criteria
- Every external document the assessment relies on for a specific claim appears in the citation map, with its status recorded.
- No draft or non-binding document is cited in the assessment’s conclusions as if it were a binding requirement.
- Where two documents address the same topic differently (for example FDA’s draft credibility framework and GAMP 5’s category approach), the map states which one governs this assessment and why.
- The map is reviewed and updated at each periodic re-look of the risk assessment, since draft guidance can finalize and non-binding principles can be superseded by binding rules.
Sign-off
| Role | Name | Signature | Date |
|---|---|---|---|
| Preparer | <<FILL>> | ||
| Quality Assurance | <<FILL>> |
References
ICH Q9(R1), Quality Risk Management. ISPE GAMP 5, 2nd edition. FDA Computer Software Assurance for Production and Quality Management System Software (current version issued 3 February 2026). FDA draft guidance, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products (January 2025, draft). Good Machine Learning Practice guiding principles (FDA, Health Canada, MHRA, October 2021; IMDRF final, January 2025). EU GMP Annex 22, Artificial Intelligence (draft). Guiding Principles of Good AI Practice in Drug Development (FDA and EMA, 14 January 2026). EU AI Act, Regulation (EU) 2024/1689, as amended.
Confirm the current status (draft or final) of every document above before relying on this map; several are actively moving.
Filled specimen
A completed citation map for an example complaint-classification model risk assessment.
| Claim in the assessment | Document cited | Status | Why this document |
|---|---|---|---|
| The risk-sizing method used | ICH Q9(R1) | Binding, adopted expectation | The site’s quality system requires Q9(R1) as the risk-management method for every GxP system |
| The GAMP category assigned (Category 5 for the trained classifier) | GAMP 5, 2nd edition | Industry standard | Explains why a configured platform still yields a Category 5 artifact once a custom model is trained on it |
| The assurance-effort level for validation | FDA Computer Software Assurance guidance | Final, general | Scales validation effort to product-quality risk; noted explicitly that it does not address AI failure modes directly |
| The recall-focused evidence requirement on the safety category | FDA draft guidance, AI for regulatory decision-making (Jan 2025) | Draft | Its credibility-assessment logic, evidence sized to the model’s role, is used as reasoning, marked as drawn from a draft in the assessment text |
| The training-data representativeness expectation | Good Machine Learning Practice principles | Non-binding principle | Used as supporting rationale for the data integrity section, not as the sole basis for the acceptance threshold |
| Whether the system is a high-risk AI system under EU law | EU AI Act, Regulation (EU) 2024/1689 | Binding EU law, phased | Site has EU manufacturing; classification determined separately from the GxP risk class per the article’s guidance |
This specimen shows the discipline the form enforces: the draft FDA guidance and the non-binding GMLP principles both appear in the assessment, and both are useful, but neither is cited as if it settled a question only a binding document or the site’s own risk-management method can settle.
Common inspection findings this form prevents
- A risk assessment that cites a draft guidance’s specific numeric threshold as if it were an adopted requirement.
- Non-binding principles used as the sole justification for a technical acceptance criterion, with no independent risk-based rationale behind it.
- Confusion between GxP-domain guidance (FDA CSA, ICH Q9) and horizontal AI law (the EU AI Act), treating a GxP risk class as if it also answered the separate legal question of AI-system classification.
- A citation list at the end of an assessment with no record of what each document was actually used to justify, so a reviewer cannot tell if a cited draft is load-bearing or decorative.
How to adapt this form
- Set the system name and risk assessment reference in the control block.
- Fill the citation map with the actual claims your assessment makes, adding rows as needed; a complex model may need ten or more.
- Update the status of each document at every periodic review; a document that was draft when the assessment was written may finalize before the next review.
- Attach the completed map to the risk assessment as supporting documentation, referenced from the assessment’s regulatory basis section.