Why AI-drafted SOPs fail ISO audits, and how to use AI safely with a controlled template
Ishan MaharajBy Ishan Maharaj, Founder and Principal Consultant. Last reviewed 26 October 2026.
AI-drafted SOPs fail ISO audits because an auditor tests whether a procedure matches what people actually do and whether it is controlled, and a chat answer provides neither. ISO 9001 does not forbid AI drafting. It expects documented information to be identified, reviewed, approved and controlled (clause 7.5). Use AI to fill a controlled template with facts you supply, then have the process owner verify it against real practice before it is approved.
Why do AI-drafted SOPs fail audits?
A language model writes text that sounds right. The NIST Generative AI Profile calls the failure mode confabulation: systems that "generate and confidently present erroneous or false content in response to prompts" (NIST AI 600-1). In an SOP, that means steps that read well but describe a process you do not run. Auditors do not read for fluency. They pick a record, ask the person who made it how they did the job, and compare the answer with the procedure.
The second problem is control. A chat answer has no document number, owner, revision, approval or distribution list. Public descriptions of clause 7.5 list what documented information needs: identification (title, date, author, reference number), a suitable format, review and approval before use, and controls for access, change identification, revision status, retention and obsolete copies (iso9001help.co.uk). Pasting AI output into a Word file does not supply any of that.
Where does it go wrong?
| Failure | What the auditor sees | Control that prevents it |
|---|---|---|
| Generic or invented steps | Staff describe a different sequence from the SOP | The process owner walks the process and corrects the draft against observed practice |
| Made-up references | The SOP cites a form, record or clause that does not exist | Check every reference against the master document list |
| No document control | No number, revision, approver or effective date | Put the text into a controlled template with an identification block |
| No accountable approval | Nobody can say who reviewed it and when | A named person approves; a tool cannot |
| Conflicts with other documents | Different terms or responsibilities in two SOPs | One set of definitions and a cross-reference table across documents |
| Unrecorded AI use | No record of how the document was produced or checked | A line in the revision history: AI-assisted draft, reviewed by (name, date) |
| Confidential data in public tools | Customer or supplier details pasted into a chat | An AI acceptable use policy and an approved tool list |
How can you use AI safely?
- Start from a controlled template. The document number, headings, owner field, revision history and approval block already exist, so the AI fills a structure rather than inventing one.
- Give it facts, not a topic. Paste your walkthrough notes, the real form names and the real job titles. Ask it to organise them into the template headings.
- Restrict what it may write. Tell it not to add steps, records or references that are not in your notes, and to mark any gap as "TO CONFIRM".
- Verify against practice. The process owner reads each step with the people who do the work and removes anything they do not do.
- Check references. Every form, record and clause cited must match your master document list.
- Approve and issue under document control. A named person signs off, and the document is released with its revision and date.
- Record the AI use. A short note in the revision history is enough. The NIST profile suggests documenting how generative AI was used.
What does that look like in practice?
Example (fictional company). A 30-person distributor needs a goods-receipt SOP. The warehouse lead writes ten lines of notes: who receives, which form is signed, what happens to damaged cartons, where quarantined stock goes. She pastes the notes into the controlled SOP template and asks the AI to turn them into the template's sections without adding anything. The draft comes back with two points marked TO CONFIRM, both about who releases quarantined stock. She settles them with the warehouse team, checks that the form name matches the master document list, and the quality manager approves it as GRN-SOP-01 revision A. The revision history reads "AI-assisted draft from process notes, verified by warehouse lead, 14 November."
The AI saved the typing. The accountable people still supplied the facts, the verification and the approval, which is what an auditor looks for.
Where does a pre-built template set help?
A controlled template set gives the AI something to fill and gives the auditor something to trace. The ISO 9001:2026 Complete QMS Documentation Kit contains a 33-page quality manual, 20 procedures and 43 forms and registers, with a master document list. You adapt the text to your own process rather than generating a system from nothing. If you only need the manual, the ISO 9001:2026 Quality Manual Template has a document control block and revision history. A free master document list helps with reference checks. If your staff use AI tools, a written rule helps too: see the AI acceptable use policy template.
Templates do not make a system conform. Your certification body decides that. They give you a controlled starting point that you still have to adapt and verify.
Frequently asked questions
Does ISO 9001 prohibit AI-drafted documents?
No standard text we have seen prohibits it. The requirement is that documented information is identified, reviewed, approved and controlled, whoever or whatever drafted it.
Do I have to tell the auditor that AI was used?
We know of no requirement to disclose. Keeping a note in the revision history means you can answer honestly and quickly if asked.
Can AI approve a document?
No. Approval is a review by a person who is accountable for the content.
Does the AI tool itself need validating?
ISO 13485 clause 4.1.6 requires software used in the quality management system to be validated before initial use, in proportion to risk (Greenlight Guru summary). ISO 9001 has no equivalent clause. If you work under ISO 13485, decide whether your AI use falls within that scope.
