Quality managers are increasingly being asked the same question by leadership: can we use AI for the document system? The pitch is usually attractive. Drafts written in minutes, procedures that update themselves when a process changes, search that finds the right work instruction without anyone remembering where it was filed.
I think the pitch is partly right and partly dangerous. ISO 9001:2015 does not care how a document gets written. It cares whether the right people have the right version at the point of use, and whether you can show that someone competent approved it. Automation can make that easier, and AI can make it quietly worse if nobody is watching.
This guide walks through what the standard actually requires, where automation and AI fit, what auditors will ask, and how to adopt these tools without creating a new nonconformity.
What does ISO 9001 actually require for document control?
The requirements sit in clause 7.5, "Documented information." The standard replaced the older vocabulary of "documents" and "records" with a single term, and the structure is short enough to hold in your head.
- Clause 7.5.1 (General) says the QMS must include documented information required by the standard and documented information the organization determines is necessary for effectiveness.
- Clause 7.5.2 (Creating and updating) requires appropriate identification and description (title, date, author, or reference number), an appropriate format and media, and review and approval for suitability and adequacy.
- Clause 7.5.3.1 requires that documented information be available and suitable for use where and when it is needed, and adequately protected from loss of confidentiality, improper use, or loss of integrity.
- Clause 7.5.3.2 lists the control activities: distribution, access, retrieval and use; storage and preservation, including preservation of legibility; control of changes, such as version control; and retention and disposition. It also requires that documented information of external origin, which the organization determines necessary for planning and operating the QMS, be identified and controlled.
Notice what is missing. ISO 9001:2015 does not require a documented procedure for document control. It does not require a particular software tool, and it says nothing about who or what drafts the content. The standard sets outcomes, and your system has to deliver them. That is the opening for automation, and it is also the reason an AI-generated document gets no special treatment in an audit. It is judged against the same clause 7.5.2 and 7.5.3 tests as a document typed by hand.
Where does automation already help with clause 7.5?
Before getting to AI, it is worth separating two things that often get lumped together. Rule-based automation does exactly what you configure it to do, every time. AI, particularly generative AI, produces output that varies and that you cannot fully predict. The risk profiles are very different.
Rule-based automation is mature, and for most small and mid-sized organizations it delivers more value than AI does. Typical uses map cleanly onto the clause 7.5.3.2 list:
- Version control. The system assigns revision numbers, supersedes the old version, and removes it from the point of use. This addresses one of the most frequently reported document-control findings, an obsolete form still in circulation.
- Approval workflows. A document cannot be published until the named approver signs off, and the system records who and when. That is direct evidence for the review-and-approval requirement in clause 7.5.2(c).
- Distribution and access. Role-based permissions decide who can view and who can edit. The note under clause 7.5.3.2 explicitly says access implies a decision about permission to view only, or permission and authority to view and change.
- Periodic review reminders. Automated notifications when a document reaches its review date, which supports suitability and adequacy over time.
- Retention and disposition. Rules that archive or purge records on a schedule you defined.
- Training acknowledgment. A revision triggers a read-and-understood task for affected staff, which links document control to the competence and awareness requirements in clauses 7.2 and 7.3.
If you are choosing where to start, start here. None of it needs a language model, and all of it produces audit evidence automatically.
What can AI add to document control?
AI tools are showing up in quality systems in a handful of practical ways. Some are low risk and some deserve real caution.
Drafting and rewriting
Generative AI can turn a process owner's rough notes or a recorded walkthrough into a first draft of a work instruction. It can also standardize formatting across a library written by ten different people over fifteen years. This saves real time. It is also where the biggest risk lives, because a fluent draft reads as correct whether or not it is.
Search and retrieval
Semantic search lets an operator type a plain-language question and get the relevant procedure back. This supports the availability requirement in clause 7.5.3.1, and it carries lower risk than drafting, provided the tool points to the controlled source document and does not paraphrase it. A summary that replaces the controlled document is an uncontrolled copy, and uncontrolled copies are the problem document control exists to prevent.
Gap and consistency checking
AI can compare your procedures against each other and flag contradictions, such as two documents that give different inspection frequencies for the same product. It can also compare a procedure against a standard's clause list. I find this one of the better uses, since a human still decides what to do with each flag.
Change impact analysis
When a process changes, a tool can suggest which documents reference the affected step. That helps you avoid the situation where the work instruction is updated and the three forms that depend on it are not.
Metadata and classification
Automatic tagging of document type, process owner, and related clause. This is useful for large legacy libraries, and low risk if a person reviews the tags.
How do manual, automated, and AI-assisted approaches compare?
The table below compares the three approaches against the clause 7.5 requirements. It reflects my own judgment, not a ranking from the standard.
| Clause 7.5 requirement | Manual (folders, spreadsheets) | Rule-based automation (QMS/DMS software) | AI-assisted |
|---|---|---|---|
| 7.5.2(a) Identification and description | Depends on discipline; naming drifts | Enforced by templates and required fields | Can auto-tag, needs human check |
| 7.5.2(c) Review and approval | Signatures or emails, easy to lose | Workflow with timestamped approver record | Draft still needs a named human approver |
| 7.5.3.1 Availability at point of use | Often fails when files multiply | Single controlled repository | Strong for retrieval if it links to the controlled source |
| 7.5.3.1 Protection of integrity | Weak, open to silent edits | Permissions and audit trail | New risk: outputs can be wrong or altered; data may leave your control |
| 7.5.3.2 Version control | Error-prone | Strong and automatic | Not a substitute for version control |
| 7.5.3.2 Retention and disposition | Rarely done on schedule | Rule-driven | Little benefit, and some risk: an AI suggestion to archive or purge could dispose of records that must be kept. Disposition should follow your defined rules, with a person approving any exception |
| External origin documents (a separate paragraph following the lettered list in 7.5.3.2, not a lettered item) | Tracked by memory | Register with review alerts | Can monitor for changes, needs verification |
The pattern in the table is that AI does not replace the controls. It sits on top of them. An organization with weak rule-based document control that adds AI on top has not improved its system. It has added a faster way to create documents that nobody controls.
What are the risks of using AI in a controlled document system?
I would group the risks into five areas, and each one maps to something an auditor can test.
Accuracy and the approval trap
A person who reviews AI-generated text tends to skim it, because it sounds finished. Clause 7.5.2(c) requires review and approval "for suitability and adequacy," which means someone competent must actually check that the instruction reflects how the work is done. If the draft describes a step your process does not have, approving it makes you responsible for the error. For example, an AI-drafted receiving inspection instruction might add a 100% dimensional check that your process does not perform, or cite a sampling plan you do not use. It reads plausibly, but it is wrong. In my view the approver's name on the page is the whole control, so the approver has to be someone who knows the process well enough to catch a plausible mistake.
Confidentiality
Clause 7.5.3.1(b) requires protection from loss of confidentiality, improper use, or loss of integrity. Pasting a customer specification, a drawing note, or a proprietary process into a public AI tool can breach that requirement and often a customer contract as well. If you operate in regulated or export-controlled work, the question gets stricter. Our article on ITAR compliance with ISO 9001 or AS9100 covers how far the quality standard goes and where other obligations begin.
Integrity and traceability
If a tool rewrites a procedure, can you show what changed and who accepted the change? Without a version history that captures the before and after, you lose the control-of-changes evidence required by clause 7.5.3.2. Some AI features edit documents in place without leaving a clean revision trail, which is worth testing before you rely on it.
Vendor control
An AI service or a document platform with AI features is an externally provided service. Clause 8.4.1 requires you to determine and apply criteria for evaluating, selecting, and monitoring external providers, and clause 8.4.2 requires you to ensure that externally provided processes do not adversely affect your ability to deliver conforming products and services. Software that touches your controlled documents belongs on the approved-supplier list with a documented evaluation. Our guidance on outsourced process control explains why responsibility stays with you.
Regulated record requirements
If you also fall under 21 CFR Part 11 for electronic records and signatures, the bar is higher. Section 11.10(a) calls for validation of systems to ensure accuracy, reliability, and consistent intended performance, and section 11.10(e) calls for secure, computer-generated, time-stamped audit trails. An AI feature that alters regulated content has to sit inside that validated environment. ISO 9001 certification alone does not satisfy it.
What will an auditor ask about AI in my document system?
Certification bodies audit against the standard, and there is no ISO 9001 clause that mentions AI. That does not mean auditors ignore it. They will pull on the threads that already exist.
Expect questions like these:
- Show me how this procedure was created, reviewed, and approved (clause 7.5.2).
- Who approved it, and what makes them competent to judge its adequacy (clauses 7.2 and 7.5.2)?
- How do you know staff are using the current revision (clause 7.5.3.2)?
- How did you evaluate the AI tool or platform as an external provider (clause 8.4)?
- What information are you permitted to put into it, and how do you stop people from exceeding that (clause 7.5.3.1)?
- What does the tool do if it is wrong, and how would you find out (clause 6.1 on risks, clause 10.2 on nonconformity)?
The last question ties back to risk-based thinking. If you have not worked through that process yet, our practical guide to risk-based thinking is a good place to start before you write the AI risk assessment.
It also helps to know the audit failures that tend to appear regardless of tools. The most common ISO 9001 audit nonconformities include obsolete documents at the point of use and missing evidence of review, and AI can aggravate both when it multiplies the number of documents faster than anyone reviews them.
How do I adopt AI without creating a nonconformity?
I would go in this order. It is slower than switching on a feature, but it is the sequence that holds up in an audit.
Step 1: Fix the foundation first
Confirm that your base controls work: a single controlled repository, version control, defined approvers, and a review schedule. If these are shaky, automation of the rule-based kind is the better investment right now.
Step 2: Write a short AI use rule
One page is enough. State which tools are approved, what categories of information may never be entered (customer confidential data, export-controlled data, personal data), and which activities are allowed, such as drafting versus approving. This is documented information under clause 7.5.1(b), determined by you as necessary for effectiveness, and it gives staff something concrete to follow.
Step 3: Keep the human approver non-negotiable
Your procedure should say that an AI-assisted draft goes through the same review and approval as any other. It helps to add a field to the revision record noting whether AI assisted the draft. The hypothesis is that the field prompts reviewers to read more carefully, so consider trying it and checking whether reviewer corrections change.
Step 4: Evaluate the vendor
Document the evaluation under clause 8.4. Ask where your data is stored, whether it is used to train the vendor's models, what the vendor's security commitments are, how outputs are logged, and what happens to your data if you leave. Keep the answers on file.
Step 5: Pilot on low-risk documents
Start with formatting cleanups, glossary standardization, or internal search. Hold back on drafting safety-critical or regulated procedures until you have seen how the tool behaves and how often reviewers catch errors.
Step 6: Measure and review
Track something you can count, such as the number of corrections reviewers make to AI-assisted drafts, or retrieval searches that returned the wrong document. Feed those results into management review under clause 9.3 and your internal audit program. If the numbers are bad, you have found out in your own house rather than in a customer's audit.
How does ISO/IEC 42001 relate to this?
ISO/IEC 42001:2023 is the international standard for AI management systems. It is a separate certifiable standard, and ISO 9001 does not require it. If AI is becoming a meaningful part of how you operate, it can provide a more complete structure for AI governance, including risk assessment and impact assessment, than a single page in your quality manual would.
For most organizations that simply want a faster way to maintain procedures, a short use rule and a vendor evaluation inside the existing QMS are enough. If you build or sell AI products, or your customers ask for evidence of AI governance, ISO/IEC 42001 and, depending on where you operate, the EU's Regulation (EU) 2024/1689 (the AI Act) enter the conversation. Those obligations come from the AI product or use case. They do not come from your document control process.
Will automation make my document library smaller?
This part gets less attention than it deserves. ISO 9001:2015 removed the explicit requirement for a documented quality manual and for documented procedures, and it gave organizations room to keep only what they need. That flexibility is why many certified companies still carry libraries that are far larger than the standard requires.
AI makes it very cheap to write more documents, and that is the wrong direction. Every document is something you must review, keep current, and train people on. My advice is to use these tools to find duplication, merge near-identical procedures, and retire what nobody uses. A practical method is a usage and duplication audit: export the document list with last-opened and last-revised dates, flag documents nobody has opened in the past year, use AI similarity checking to group near-identical documents, and have each process owner decide whether to keep, merge, or retire each one through your normal change control. Repeat it as part of the review in Step 6. A smaller library that people trust beats a large one that nobody opens. A process-focused approach helps here, and our piece on mapping and measuring processes shows how to decide what documentation a process actually needs.
What should the document control role look like in five years?
I do not think the role disappears. I think it shifts from filing and chasing signatures toward judgment: deciding what needs to be documented, confirming that the approver is competent, testing whether the tool is behaving, and keeping the audit trail honest. The clerical work will shrink, and the accountability will not.
Frequently asked questions
Does ISO 9001 allow AI-generated documents?
Yes. ISO 9001:2015 does not regulate how documented information is created. Clause 7.5.2 requires appropriate identification, format, and review and approval for suitability and adequacy, so an AI-generated document is acceptable if a competent person reviews and approves it and it is controlled under clause 7.5.3.
Do I need a documented procedure for document control?
No. ISO 9001:2015 does not require a documented procedure for controlling documented information. You must be able to demonstrate that the clause 7.5.3 controls are in place and effective. Many organizations still write a short procedure because it helps new staff and gives auditors a clear reference.
Will a certification body audit my use of AI?
Not as a standalone topic, since the standard has no AI clause. Auditors will examine the effects through existing requirements: document approval (7.5.2), control of changes (7.5.3.2), confidentiality (7.5.3.1), and external provider control (8.4).
One question is worth leaving with any team considering this: if a tool wrote your last ten procedures and nobody could tell, would your system still be able to prove that each one was right?
If you want help building an AI use rule or tightening your clause 7.5 controls before your next audit, reach out through Certify Consulting.
Last updated: 2026-10-30
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.