Can AI write or change a quality record?

The requirement is about control, not about authorship. A quality management system requires documented information to be reviewed and approved for suitability and adequacy, to be identifiable, to carry version control, and to remain legible and retrievable. Section 7.5 of the standard sets this out, and none of it says a human must compose the text. What it does say is that somebody approved it, that the somebody is identifiable, and that changes are controlled — which means a generated draft is unremarkable and an unapproved generated record is a nonconformity.

The competence requirement is the second half and it is the one that decides the practical answer. Persons doing work affecting quality performance have to be competent on the basis of education, training or experience, and the organisation has to retain evidence of it. A system has no competence record and cannot acquire one. The approval therefore has to attach to a person who does, which is why the workable arrangement is generation plus named approval and never generation plus automatic release.

Aerospace and defence variants of the standard tighten this further rather than relaxing it, because they add explicit expectations about authority to approve, about the control of records supporting product conformity, and about traceability from the record back to the article. A shop working to those requirements has less room to experiment here, not more, and should assume any record touching product conformity carries an approval that a person owns.

Where these tools are genuinely valuable in a quality function is upstream and downstream of the controlled record. Drafting a work instruction from an engineer's notes, restating a procedure in the language the operators actually use, summarising a month of nonconformance reports to find the pattern nobody had time to look for, preparing a first draft of a corrective action investigation, or reading an inspection standard and telling you which clauses your procedure never addressed. All of that is preparation and analysis, and none of it is the record.

One class of use deserves an explicit no. Retrospectively generating or completing records — filling gaps in an inspection log, reconstructing a traceability chain, drafting a corrective action that describes an investigation nobody performed — is falsification whatever produced the text, and the ease with which these tools produce plausible records is precisely why the line needs stating. The characteristic risk is not that somebody sets out to falsify; it is that a record which should have said the data is missing gets written as though it were not.

Practically, the control worth adding is small: any document that a model contributed to should be identifiable as such in the system until it has been approved, and the approval step should require the approver to have opened it. Quality systems already have both mechanisms, because they were built for the same problem in its human form — a procedure copied from another site and released without anybody reading it is the failure this is a faster version of.