Quality systems run on text: procedures, work instructions, audit reports, complaints, nonconformity reports and meeting minutes. Language models are good at exactly this kind of material. They can draft, summarize, compare and classify it in seconds. For a quality team that is usually short of time, that is a real opportunity.
It also raises a fair question from auditors and customers: if an AI tool wrote part of your procedure or sorted your complaints, how do you know the result is right? This article sets out where AI tools help, where they do not, and the controls that keep their use consistent with ISO 9001.
What the standard says about AI
Nothing specific. ISO 9001:2026 remains technology-neutral; according to certification bodies' summaries, it adds no requirement about artificial intelligence. That cuts both ways. You are free to use AI tools, and the existing requirements apply to whatever they produce. A procedure drafted by a model must still be reviewed and approved. An analysis produced by a model is still your analysis, and you are accountable for decisions based on it.
Two related standards are worth knowing. ISO 19011, the auditing guideline, was revised in 2026, and published summaries say it now addresses digital audit tools and AI-supported procedures, with attention to confidentiality and information security. ISO/IEC 42001:2023 is a separate management system standard for organizations that develop or use AI systems. It is not required for ISO 9001, but it shares the same clause structure and is a useful reference if AI becomes central to your operations.
Four uses that pay off
1. Document control
Models are useful for turning a rough process description into a clear draft, simplifying wording for the people who use the instruction, comparing two versions and listing what changed, and checking a set of documents for contradictions and broken cross-references. They are also good at mapping a procedure against the clauses of the standard to show where a requirement is not addressed.
The control is the one clause 7.5 already requires: review and approval for suitability and adequacy by an authorized person before release. The reviewer should be someone who knows the process, and should check the draft against how the work is really done.
2. Audit preparation
Given a procedure and the relevant clause, a model can propose audit questions, suggest what records to sample, and summarize previous audit reports and open actions for the area. After the audit it can help turn notes into a clearly worded finding. This saves preparation time, which is often what limits the depth of internal audits.
The control: the auditor stays responsible for the plan, the evidence and the conclusion. A model has not seen the shop floor. It must never be the source of audit evidence.
3. Nonconformity and complaint trends
Most organizations record nonconformities and complaints as free text and rarely analyze them, because reading and coding hundreds of entries is tedious. A model can assign each entry to a category such as product, defect type, process step or likely cause, group similar entries and draft a summary. That turns a pile of reports into a Pareto chart for management review.
The control: check a sample. Have a person code 30 to 50 entries independently and compare. If agreement is poor, tighten the category definitions and repeat. Keep the categories stable from period to period, or trends will reflect the tool and not the process.
4. Training and answers from your own documents
An assistant that answers employees' questions from your approved procedures, with a link to the source paragraph, makes the quality system easier to use than a folder of files. This is retrieval-augmented generation; our journal paper on its design and failure modes explains how it works and where it goes wrong.
The control: the assistant must draw only on current, approved documents, show its sources, and say when it does not know. Test it with questions whose answers you know before releasing it.
Where to be careful
| Risk | What it looks like | Control |
|---|---|---|
| Confident errors | A plausible clause reference, tolerance or step that is wrong | Human review against the source; never release unreviewed output |
| Confidentiality | Customer drawings or personal data pasted into a public tool | Approved tools only; rules on what may be entered; contract terms on data use |
| Uncontrolled change | The vendor updates the model and results shift | Record the tool and version; re-check after updates |
| Loss of ownership | Procedures nobody in the company has really read | Named process owner approves every document |
| Decisions on product | A model decides whether product is released | Treat as a process requiring validation, with defined criteria and monitoring |
The last row deserves emphasis. Using a model to help write a procedure is low risk, because a person reviews the result. Using a model to accept or reject product is a different matter. It becomes part of the production and release process and needs the validation, monitoring and records you would apply to any automated inspection.
Controls that keep an auditor comfortable
- A short policy on AI use in the quality system: which tools are approved, for what tasks, and what may not be entered.
- Risk assessment of each use, recorded in your risk register (clause 6.1).
- Supplier control of the AI provider, as for any external provider whose service affects your system (clause 8.4).
- Competence: train users in what the tools can and cannot do (clause 7.2).
- Human approval of every controlled document and record (clause 7.5).
- A record that AI assistance was used, where it matters, so that results can be traced.
How to start
Choose one low-risk use, such as a monthly summary of complaints or drafts of revised work instructions. Define how a person will check the output. Run it for two or three months and measure the time saved and the errors caught at review. Then decide whether to extend it. This is the plan-do-check-act cycle applied to the tool, and it produces the evidence an auditor will want to see.
Chmltech works at this junction of quality systems and AI. If you would like help choosing a first use or setting up the controls, see our AI services or book a strategy call.
Sources
- DQS: ISO 9001:2026, key changes, timeline and transition checklist
- Quality Austria: ISO 19011:2026, new impulses for auditing management systems
- ISO: ISO/IEC 42001:2023, AI management systems
More in this series
- ISO 9001:2026: what changed from 2015
- Your ISO 9001:2026 transition plan
- ISO 9001 for small and mid-sized businesses
- Internal audits that find real problems
- Risk-based thinking in practice
- Integrating ISO 9001, ISO 14001 and ISO 45001
- Management review that leadership finds useful
- Document and revision control
