AI Approval Boundaries in Quality Systems: A Governance Gap Auditors Are Catching

A quality systems professional working in a Class II medical device company has raised concerns about the lack of explicit, written boundaries defining what AI tools are and are not permitted to approve within electronic Quality Management Systems (eQMS). Regulatory frameworks such as ISO 13485:2016, EU MDR Article 2(46), and FDA guidance on AI/ML software all emphasize human oversight and accountability, but none prescribe a specific list of AI-prohibited tasks, leaving companies to define those limits themselves. The author distinguishes between three types of governance boundaries: platform-enforced, SOP-enforced, and implied — noting that only the first offers a fully defensible audit posture. A real-world near-miss was cited where an eQMS auto-closed low-risk CAPAs after 90 days of inactivity, resulting in a corrective action being marked complete without a formal root cause review or human sign-off. The piece calls on eQMS vendors and quality teams to proactively document AI-prohibited approval actions before an audit — rather than after — exposes the gap.