This is a ready-to-use risk assessment that turns the classification step of AI governance for regulatory and CMC content into a documented, repeatable decision, rather than a one-time narrative judgment. It classifies each proposed AI use by where its output goes and who is accountable for it, and rules the direct-to-record pattern out explicitly for every use assessed. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through document control and approval. A filled specimen follows. Verify each cited regulation against the current source before you rely on it.
Document control header
| Field | Entry |
|---|---|
| Document title | AI Use Classification Risk Assessment for <<FILL: FUNCTION / PROGRAM>> |
| Document number | <<FILL: RA-ID>> |
| Version | <<FILL: version, e.g. 1.0>> |
| Effective date | <<FILL: effective date>> |
| Supersedes | <<FILL: prior version or "New">> |
| Document owner | <<FILL: role, e.g. Regulatory Affairs Lead>> |
| Linked AI system validation record(s) | <<FILL>> |
1. Purpose
This assessment classifies each proposed or in-use AI application within regulatory affairs and CMC content production into a governance tier, so the accuracy, traceability, and human-authorship controls applied to each use match what it actually does and where its output goes, per AI in regulatory affairs and CMC.
2. Scope
This assessment covers every AI-assisted activity in regulatory writing, submission assembly, regulatory intelligence, and labeling/change management for <<FILL: program / function>>. It does not cover AI models used for scientific or clinical data analysis feeding a regulatory decision directly, which fall under a separate credibility-assessment framework referenced in section 6.
3. Method
3.1 Classify each use by output destination and accountability
For each proposed or existing AI use, answer in one sentence: what does the AI output, what does it feed, and who is the named human who owns the result. Then assign the tier below.
| Tier | Pattern | Where output goes | Acceptable for filed content? |
|---|---|---|---|
| Internal intelligence | AI summarizes public or internal information for a human decision | Internal strategy, not filed | N/A, not filed |
| Assistive draft | AI drafts content a qualified human verifies and owns before use | Filed after human authoring and approval | Yes, with full controls |
| Consistency / conformance check | AI flags candidate issues a human adjudicates | Internal QC, human decides each flag | N/A, not filed directly |
| Direct-to-record | AI output enters a controlled record without human authoring | Would be filed unverified | Never acceptable |
3.2 For assistive-draft uses, confirm the supporting controls exist
| Control | Present? | Evidence |
|---|---|---|
| The AI system and version are pinned and version-controlled | <<FILL>> | <<FILL>> |
| The model is grounded via retrieval in named source documents, not general training | <<FILL>> | <<FILL>> |
| The draft requires inline source citation per claim | <<FILL>> | <<FILL>> |
| A named human author verifies and owns the content before filing | <<FILL>> | <<FILL>> |
| Records of AI involvement are retained in the controlled document system | <<FILL>> | <<FILL>> |
4. Use classification register
Complete one row per proposed or existing AI use.
| # | Use description (one sentence: output, feeds what, named owner) | Tier | Rationale | Controls confirmed (3.2, if assistive-draft) | Approved? |
|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
5. Acceptance criteria
- Every AI use in scope has a one-sentence classification statement and an assigned tier, with the reasoning recorded, not just the label.
- No use is classified or operated as direct-to-record; any use trending that way is stopped and reclassified.
- Every assistive-draft use has the section 3.2 controls confirmed present before it is approved to produce filed content.
- The register is reviewed whenever a new AI use is proposed and at the periodic cadence defined in the governing SOP.
6. References
FDA draft guidance, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products (January 2025, draft; narrower scope, models generating data for a regulatory decision). EU GMP draft Annex 22, Artificial Intelligence (draft; limits generative AI to non-critical uses with human oversight). Guiding Principles of Good AI Practice in Drug Development (FDA and EMA, 14 January 2026; non-binding principles, cite as framing only). ICH Q9(R1), Quality Risk Management. 21 CFR Part 11 / EU GMP Annex 11 (the human accountability and electronic signature framework filed content still runs through).
Confirm the current status (draft or final) of each AI-specific document before relying on it; several are actively moving.
7. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
8. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author (Regulatory Affairs) | <<FILL>> | ||
| IT / Data Science | <<FILL>> | ||
| Approver (QA) | <<FILL>> |
Filled specimen
| # | Use description | Tier | Rationale | Controls confirmed | Approved? |
|---|---|---|---|---|---|
| 1 | AI drafts a first-pass nonclinical written summary from provided study reports; the lead regulatory writer verifies every claim and owns the final section | Assistive draft | Output becomes filed CTD content; a named writer verifies against source before filing | All five controls in 3.2 confirmed present | Yes |
| 2 | AI summarizes competitor labels and public advisory-committee materials for internal strategy discussion | Internal intelligence | Output stays internal, informs strategy only, never filed | N/A | Yes |
| 3 | AI flags specification-value inconsistencies across dossier sections before eCTD compilation | Consistency check | Human adjudicates every flag; nothing is changed without review | N/A | Yes |
| 4 | Proposed: auto-populate a variation’s justification field directly from AI output with QA “spot-checking” a sample | Direct-to-record | Content would enter a controlled record without per-instance human authoring; spot-checking is not authoring | Not applicable, use rejected | No, rejected |
Use 4 is the point of the exercise: it looked like a productivity win, but classifying it plainly against the tier definitions showed it was direct-to-record wearing an assistive-draft costume, and it was rejected before it reached production rather than discovered during an audit.
Common inspection findings this risk assessment prevents
- “AI helps with regulatory writing” treated as one undifferentiated activity with no per-use classification.
- An assistive-draft use approved without confirming the grounding, citation, and authorship controls actually exist.
- A consistency-check tool’s flags applied automatically without human adjudication, quietly becoming direct-to-record.
- A non-binding AI principles document or a draft guidance cited as if it authorized a specific technical shortcut.
How to adapt this risk assessment
- List every current and proposed AI use in regulatory and CMC content production, not just the ones already in production.
- Force the one-sentence classification statement for each use before assigning a tier; a vague description usually hides a direct-to-record pattern.
- For every assistive-draft use, walk section 3.2 and require evidence, not an assertion, for each control.
- Reject and document any use that lands in the direct-to-record tier rather than trying to make it acceptable with a lighter review step.
- Re-run this assessment whenever a new AI use is proposed, and confirm the AI-specific reference documents’ status has not changed at each periodic review.