AI can tell you "what is a CAPA" — but it can't say a CAPA is adequate

I use generative AI every week to speed up routine quality work. It writes the first draft of a supplier non‑conformance report, it summarises a lengthy audit finding into a one‑page CAPA brief, and it normalises language across our change requests. Those uses are helpful, repeatable, and — crucially — reviewable.

Where organisations get into trouble is when they let the same models answer the fundamentally judgmental question: "Is this CAPA adequate?" That question is not a definitional lookup. Adequacy requires demonstrable evidence, contextual risk judgement, and traceable decisions — exactly the things regulators ask for.

What AI is good at: clear, repeatable, low‑judgement tasks

In practice, I rely on AI for explicit, constrained tasks. Examples that work:

• Drafting a plain‑English definition: "What is a CAPA", differences between containment and corrective action, or regulatory expectations under MDR/ISO standards.
• Formatting: turning free‑text incident notes into a standard CAPA template (owner, target date, proposed containment, proposed corrective action).
• Literature searches and summarisation: pulling together relevant standards language (ISO 13485, ISO 14971), notified‑body guidance, or recent MDCG documents into a digestible paragraph.
• Creating checklists: containment verification steps, test matrix suggestions, or documenting what evidence you should collect.
• Translating regulatory wording for engineers: "per MDR XXX, you need to demonstrate..." (I use it to draft emails that won’t lose the reviewers).

These tasks are high‑throughput and benefit from connected workflow: the draft goes into the eQMS, the CAPA owner reviews, and a training is triggered if procedures changed. Automated CAPAs and AI‑driven CAPA assistance are valuable here — as long as the human remains the accountable reviewer.

Where AI is dangerous: adequacy, root cause, and risk judgement

Judgemental work is where AI frequently misleads. Problems I’ve seen in audits or notified‑body interactions:

• Overconfident assertions. The model can state that the root cause is "supplier process drift" without the traceable investigation that supports it.
• Missing context. A CAPA for an implantable device requires a different risk appetite and verification plan than one for a packaging defect. AI often ignores those differences unless explicitly primed.
• False completeness. A CAPA plan generated by AI might list "retrain staff" and "update procedure", but omit verification metrics, acceptance criteria, or post‑implementation monitoring.
• Audit trail gaps. If AI drafts the CAPA and edits are not documented in the QMS, you lose reviewability and traceability — both red flags for auditors.

A notified body cares about demonstrable verification: evidence that the corrective action addressed the root cause and that effectiveness checks were performed. They will not accept a persuasive narrative alone.

Practical rules I follow (and require from my teams)

I built a short governance checklist that I now apply whenever AI touches a CAPA. It’s lean but effective:

• Purpose‑scope: AI may draft the initial CAPA text, but the designated CAPA owner remains accountable. The owner must sign off in the eQMS.
• Evidence first: Require the investigation evidence (test results, supplier corrective action, process data) to be uploaded before closing the CAPA.
• Acceptance criteria: Every corrective action must define objective acceptance criteria and a verification plan (who, what, when, how measured).
• Traceability: Link CAPA to associated change controls, risk assessments (ISO 14971), and affected Technical File/IFU sections in the QMS.
• Review logs: Record that AI was used, what prompts were given, and the human edits — preserve the chain of decisions for auditors.
• Escalation: If the CAPA impacts clinical claims, sterilisation, biocompatibility, or essential requirements under MDR, escalate to regulatory/clinical lead for review.

Those rules map neatly to ISO 13485 expectations for corrective action and the MDR requirement to maintain a robust quality management system. In practice this means the CAPA record shows the thought process, the evidence, and the verification results — not just a polished narrative.

How to integrate AI safely into your QMS workflows

A few tactical steps that helped our small medtech stay audit‑ready:

• Treat AI as a drafting tool not an approver. The CAPA owner must add the rationale and evidence in the record.
• Configure your eQMS so AI‑generated drafts are flagged and versioned. Reviewability matters; auditors will ask for the history.
• Use AI to generate a "risk impact checklist" that the CAPA owner completes. This forces consideration of clinical impact, patient safety, and regulatory obligations.
• Automate follow‑ups: training, supplier audits, or design changes that flow from a CAPA should trigger tasks and link back to the original CAPA (connected workflow).
• Validate where necessary: if AI‑generated tests or acceptance criteria are used to close a CAPA, ensure the test method is validated and recorded.

I've seen the time savings. I've also seen a CAPA closed too quickly because the narrative looked thorough. The time saved drafting must not create risk later when the evidence is thin.

Final thought

AI is an excellent assistant for definitions, drafting, and checklists. It’s not an assessor of adequacy. To be compliant and defensible you need documented evidence, clear acceptance criteria, and human accountability built into the workflow — the things auditors actually check.

How have you balanced speed gains from AI with the need for rigorous CAPA evidence in your QMS?