August 11, 2026

The Regulatory Challenge

Here’s the insight that took me a minute to actually appreciate, and I’ve been reading FDA guidance documents for longer than I care to admit. FDA’s framework doesn’t treat “AI” as one thing to validate. It treats every individual use of an AI model as its own question, with its own risk level, and its own proof requirement.

In January 2025, FDA published draft guidance that quietly rejects that whole idea. The document is titled Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products (docket FDA-2024-D-4689), and it’s still in draft as of this writing. But draft or not, the logic in it is already showing up in how FDA thinks about AI in inspections.

The FDA’s guidance has seven steps they use for AI inspections. They’re phrased as: 1) Define the Question of Interest, 2) Define the Context of Use, 3) Assess the AI Model Risk, 4) Develop a Plan to Establish AI Model Credibility, 5) Execute the Plan, 6) Document the Results and Discuss Deviations, and 7) Determine the Adequacy of the AI Model for the Context of Use.

These seven steps are not complicated on paper. However, step three is where it gets interesting, because that’s where FDA tells you how to grade an AI model instead of just asking you to promise it works.

What Surprised Us

Model risk, in FDA’s own framing, comes from two things combined: how much the model’s output actually drives the decision (its influence), and how bad things get if the decision is wrong (the consequence). FDA’s own example makes this concrete. One sponsor built a model to sort clinical trial patients into inpatient versus outpatient monitoring. That model was doing essentially all the deciding, high influence, and getting it wrong could genuinely hurt someone, high consequence. High risk, no argument. A different sponsor built a model to check vial fill volumes on the manufacturing line. Get that wrong and you’ve still got a real problem, so the consequence is still high. But that model wasn’t the only check catching that error; other measurements were watching the same thing. Lower influence pulled the overall risk down to medium. Same technology, wildly different scrutiny, because FDA isn’t grading the AI. It’s grading what happens if the AI is wrong.

It’s the same logic we already use with equipment calibration, if you think about it. A scale that’s a hair off weighing flavoring for a supplement batch is a shrug and a line in the deviation log. The same scale, the same hair-off reading, weighing an active ingredient, is a recall. Same scale. Same error. Completely different consequence. FDA is just asking you to run that math on your AI models instead of only your equipment.

We are adapting AI as a tool to improve our electronic software solutions and to improve our quality management systems, and I’ll be honest, the harder adjustment for us wasn’t the technology. It was training ourselves to ask what happens if this specific model is wrong, for this specific decision, before we got excited about what it could do.

What most companies get wrong isn’t ignorance of AI risk. It’s treating “we validated our AI” as a single sentence that covers every use of it. I’ve watched software vendors put “FDA-compliant AI” on a marketing page like it’s a checkbox, when the guidance underneath it is asking for a fresh credibility assessment plan for every distinct context of use. A model that flags an out-of-spec result for a human to review is not the same risk as a model that helps decide whether a batch ships. Calling both of them “validated AI” is exactly the kind of blanket answer this framework was written to end.

What It Means Today

Does a dietary supplement manufacturer working under 21 CFR Part 111 need to formally run FDA’s seven-step framework before adding AI to their quality system? Not literally; the guidance is written for drug and biological product submissions under Part 211. But the underlying question, grade the model by what it influences and what it costs you if it’s wrong, applies just as well to a supplement facility’s deviation process as it does to a biologics manufacturer’s release decision. Same question. Different paperwork.

At InstantGMP, we’ve built our approach around keeping AI features scoped narrowly on purpose: flagging anomalies for a person to review, drafting SOP language a qualified reviewer signs off on, not handing a model an unreviewed decision. That’s a deliberate choice to keep every context of use in a lower risk tier, because the credibility assessment burden should stay proportional to what’s actually at stake. As a global manufacturing platform serving pharmaceutical, dietary supplement, food and beverage, and other regulated manufacturers, we’d rather build AI that earns a low-risk rating than build AI that needs a heavy one and hope nobody asks.

Seven steps really boil down to one question you should already be asking about every piece of software touching your quality system: if this is wrong, who notices, and what does it cost us? FDA just wrote that question down and gave it a name. You need to answer it before an inspector does.