What you are learning
Identify everything that can influence the AI-assisted outcome. A model is one component. A different document parser can drop a table; a retrieval filter can select an obsolete procedure; a reviewer can accept an unsupported answer; an integration can save it to the wrong record.
From source to review outcome
Computerized system validation (CSV) and computer software assurance (CSA) both need an assessment grounded in actual intended use and applicable obligations. The examples here use Quality procedures to connect risk and evidence; they do not establish one global regulatory approach.
Worked example
Worked example — fictional
A protocol-review assistant receives a draft protocol and approved requirements. A parser extracts text. Retrieval selects relevant requirements. A prompt asks the model to find mismatches. The application displays findings and sources. A reviewer accepts, rejects, or edits each finding. The approved review outcome is stored in the quality workflow.
If the parser omits the acceptance-criteria table, the model may never see the information needed to identify a mismatch. Improving the prompt cannot reliably compensate for missing input.
How to document the workflow
List each component, its version or configuration identifier where available, its owner, its input and output, and its failure behavior. Identify external services and what the organization can and cannot control. Show where the authoritative source and final decision reside.
Completed scope wording: “Evaluation covers document extraction, selected-source retrieval, generated candidate findings, source display, reviewer disposition, and retention of the approved review outcome. It does not establish suitability for autonomous approval.”
Exercise
The model does not change, but a new parser is introduced. Is reassessment unnecessary?
Show suggested answer
No. The parser changes the information presented to the model. Assess extraction of relevant formats, tables, footnotes, and identifiers, then examine the downstream tasks affected by those changes.
Expected records
A system description showing components, source versions, interfaces, owners, reviewer decisions and prohibited actions. Adapt record names and detail to the applicable procedures; these are practitioner examples, not a universal mandatory document list.
Relevant regulations and guidance
Regulations set requirements within their scope; guidance offers recommendations or explains applicable expectations; standards depend on adoption or incorporation. Voluntary frameworks do not establish compliance. The lesson's controls, test designs and example records are practitioner suggestions unless explicitly identified otherwise.
Voluntary framework · National Institute of Standards and Technology · NIST AI 100-1 · January 2023
Scope: United States · Cross-sector AI governance and risk management, including generative AI.
Relevance to this lesson: Supports considering the complete AI system and its context, rather than a model score alone.
Publication status: Final / published. Source checked 21 September 2026.
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Source details and applicabilityGuidance · U.S. Food and Drug Administration · February 2026
Scope: United States · Medical-device manufacturers assuring software used in production or their quality management system.
Relevance to this lesson: For device-production or QMS software in scope, consider risk-based assurance of the automation actually used.
Publication status: Final / published. Source checked 21 September 2026.
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Source details and applicability