Any ERPIndustry

Medical devices + QMSR + AI

AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485

Short answer

AI for a medical device ERP lets quality, regulatory and operations staff ask plain-English questions across lots, device history records, complaints, CAPA and supplier records, with each answer grounded in live data and the query shown. It runs on infrastructure you control, so design and production records stay inside your quality system boundary, and any record it drafts needs a person's approval.

ERP: Any ERP, SAP S/4HANA, Infor SyteLine, Oracle NetSuite, Microsoft Dynamics 365
Industries: Medical Devices, Life Sciences
Written for: VP Quality and Regulatory

Discuss your Any ERP environment See use cases

Since the FDA's Quality Management System Regulation took effect in February 2026, 21 CFR Part 820 incorporates ISO 13485:2016 by reference. For many device makers the practical change is less about new paperwork and more about proving that records connect: that a complaint ties to a lot, the lot ties to a device history record, the record ties to a supplier receipt, and a CAPA closes the loop with objective evidence.

That chain usually spans several systems. The ERP holds lots, serial numbers, routings, purchase receipts and nonconformance dispositions. A separate eQMS may hold CAPA and complaints. A PLM holds the device master record. Inspectors and auditors ask for the thread across all of them, and the person who can pull it is often one senior quality engineer with a stack of saved reports.

A private AI layer does not replace the eQMS or the validated ERP. It reads from them, answers cross-record questions in seconds, and drafts the boring parts: a trend summary for management review, a first-pass complaint investigation worksheet, a list of lots affected by a supplier change. A human reviews and signs, exactly as before.

This page covers where AI fits in a regulated device ERP, what stays out of scope on purpose, and how to run it without creating a new unvalidated system that an auditor will question. It describes how the architecture helps you meet your own obligations; it is not a claim of any certification by Netray.

What usually gets in the way

The problems we hear most from vp quality and regulatory teams running Any ERP.

Traceability questions span systems

A field complaint on a serial number needs the lot, the components, the supplier lots, the DHR and any open nonconformances. In most plants that is three or four screens in two or three systems, assembled by hand.

DHR review is slow and repetitive

Reviewing a device history record before release means checking routing completion, inspection results, label reconciliation and deviations. Most records are clean, but every one gets the same manual pass.

Complaint trending is a spreadsheet exercise

Complaint codes are inconsistent across years and sites, so trend analysis for management review means exporting, cleaning and pivoting before anyone can discuss the result.

Supplier change control is easy to miss

When a critical supplier changes a process or material, finding every affected part, BOM, lot and open order depends on whoever remembers the where-used logic.

Audit prep consumes quality staff

Preparing for an FDA inspection or an ISO 13485 surveillance audit means pre-pulling sample records for likely requests, which pulls engineers away from open CAPAs for weeks.

Where AI earns its place in Any ERP

Each use case names the ERP objects it reads or writes, so your ERP team can judge the integration effort before anyone commits budget.

Lot and serial traceability in one question

A quality engineer asks which finished serial numbers contain a specific component lot, and where they shipped, and gets a grounded list with the query visible.

Touches: Lot master, serial master, work order material issues, goods receipts, sales shipments

Outcome: Forward and backward trace for a lot moves from a multi-screen exercise to a question answered in under a minute, subject to data quality.

DHR completeness pre-check

Before release, the agent checks each DHR for missing routing sign-offs, out-of-tolerance inspections without a disposition, and label quantity mismatches, then flags exceptions for the reviewer.

Touches: Production orders, routing operations, inspection results, nonconformance records, label reconciliation

Outcome: Reviewers focus on flagged records instead of reading every clean one, shortening release time for routine lots.

Complaint investigation first draft

Given a complaint, the agent compiles related lots, prior similar complaints, supplier receipts and open deviations into a draft investigation worksheet for the investigator to complete.

Touches: Sales orders, shipment records, lot history, complaint log, NCR records

Outcome: Investigators start from a populated worksheet instead of a blank form, and spend their time on root cause.

UDI and labeling data checks

The assistant compares UDI-DI and production identifiers held in the ERP against what was labeled and shipped, and flags mismatches for review before submission to a database such as GUDID.

Touches: Item master UDI attributes, lot and expiry data, label print logs, shipment lines

Outcome: Catches attribute mismatches earlier, before they surface as a regulatory data correction.

Supplier quality and change impact

When a supplier notifies a change, the agent lists every affected part, BOM, open purchase order and finished lot, and drafts the change assessment inputs.

Touches: Approved supplier list, item-supplier links, BOM where-used, purchase orders, receiving inspection

Outcome: Change impact assessment starts from a complete list rather than from memory.

Management review trend packs

The agent summarizes nonconformance, scrap, complaint and CAPA aging data for a period, with the underlying queries attached so the quality lead can check them.

Touches: NCR, scrap transactions, CAPA links, complaint codes, cost of poor quality accounts

Outcome: Replaces days of data assembly with a reviewable draft, leaving judgment to the quality team.

Procedure and work instruction search

Operators and engineers ask questions of controlled SOPs and work instructions, with answers citing the document number and revision currently effective.

Touches: Document control references, routing notes, work instruction attachments

Outcome: Faster, cited answers, with the controlled document remaining the source of truth.

Reference architecture

The AI layer sits beside your validated ERP and eQMS as a read-only consumer, using their existing APIs and role models. It is a decision-support tool; it does not become a record of truth, and nothing it drafts is released without a person acting in the system of record.

1
Read-only connectors
Dedicated service accounts with read access to ERP lots, production, inventory and purchasing, plus optional connectors to the eQMS and document control, honoring existing roles.
2
Regulated-term semantic layer
Maps terms such as DHR, DMR, NCR, CAPA, MRB, UDI and complaint code to your actual tables and fields, including site-specific customizations.
3
Private model serving
Open-weight models served with vLLM or Ollama on your GPUs or in your private cloud, so device, supplier and patient-adjacent data never reach a public API.
4
Retrieval and drafting agents
Grounded retrieval over records and controlled documents; agents draft worksheets and summaries but writes go through an approval queue with a named human approver.
5
Audit and change control
Every question, query, answer and prompt version is logged, and model or prompt changes go through your own change control process.

Integration notes for your ERP team

Read lots, serials and genealogy from the ERP using its supported APIs or reporting views rather than direct writes to production tables.
Use a read replica or reporting database for heavy trace queries so release-critical transactions are not slowed.
Connect the eQMS through its REST API for CAPA, complaint and audit records where one exists; otherwise index scheduled exports.
Index controlled documents with revision and effectivity metadata so answers cite the current revision only.
Treat UDI and labeling checks as comparison reports; corrections are made by the data owner in the source system.
Keep prompts, retrieval configs and model versions under your own change control with version tags in every log entry.
Exclude patient identifiers from the index by default and mask complaint free text where policy requires.

Deployment options

On-prem next to the ERP

Device makers with strict supplier or customer data restrictions, or sites with limited cloud connectivity.

Model, retrieval index and connectors run on customer hardware inside the validated network zone with no outbound path.

Private or sovereign cloud

Companies already running ERP and eQMS in a controlled cloud tenant.

Dedicated tenant under your own cloud agreement and your own key management, isolated from shared AI services.

Hybrid across sites

Groups with plants in several jurisdictions and different ERPs.

Per-site retrieval stays local while a central governance layer holds logs and prompt versions.

Compliance and data control

How the architecture supports your obligations. Certification and accountability stay with your organisation; the design keeps the evidence straightforward.

FDA 21 CFR Part 820 (QMSR) and ISO 13485:2016

AI is positioned as decision support outside the record of truth. Your quality manual decides whether it falls under software validation for quality system use, and the architecture gives you the logs and controls to support that assessment.

21 CFR Part 11 where electronic records or signatures apply

The layer does not create signed records. Approvals happen in your validated ERP or eQMS with its existing audit trail and signature controls.

EU MDR and IVDR

Traceability and post-market data stay in your environment, which supports your own vigilance and technical documentation processes.

HIPAA and GDPR for complaint data

Complaint narratives can contain personal data. Local deployment avoids third-party AI processors and simplifies your data transfer analysis.

Where Netray fits

ERPray

Grounded questions and dashboards over lots, production, purchasing and nonconformance data, with the query shown and ERP roles respected.

DataRay

Useful when complaint logs, eQMS exports and SOP libraries live outside the ERP and need to be searched together on-prem.

Custom build

Bespoke agents for DHR pre-checks or complaint worksheets when your workflows and regulatory approach are specific.

How an engagement runs

Phase 1 . 3-4 weeks

Discovery

-Map of ERP, eQMS and document control data relevant to traceability
-Intended-use statement and risk assessment for the AI layer
-Ranked use cases by quality team effort saved
-Deployment and validation approach agreed with quality

Phase 2 . 6-10 weeks

Pilot

-Read-only connectors against a non-production copy
-Traceability and DHR pre-check use cases live for a pilot group
-Accuracy review against known trace results
-Logging reviewed by quality assurance

Phase 3 . 4-8 weeks

Production

-Production cutover with service accounts and role mapping
-Procedures and training records updated through change control
-Runbook for adding use cases
-Handoff to internal IT and quality owners

Phase 4 . Ongoing

Scale

-Additional sites and ERPs
-Complaint and CAPA drafting with approval queues
-Periodic accuracy and drift review
-Model refresh through change control

Questions to ask any vendor, including us

A short list that separates real Any ERP AI work from a chatbot demo.

Is the AI layer read-only, and which service accounts and roles does it use in the ERP and eQMS?
How do we assess whether this falls under our software validation procedure, and what evidence will you provide?
Where does the model run and can we verify no complaint or supplier data leaves our network?
How are model, prompt and retrieval changes placed under our change control?
Can every answer show the underlying query and source records so an investigator can verify it?
How does the system handle document revisions so it never cites a superseded procedure?
What happens to personal data in complaint narratives?
What do we keep if we stop the engagement?

Frequently asked questions

Does AI in our ERP require software validation under QMSR?

That depends on your intended use and risk assessment under your own quality system. A read-only assistant that helps people find records is usually lower risk than one that makes release decisions. Document the intended use, test accuracy against known answers, and let your quality unit decide the validation scope.

Can the AI release a lot or close a CAPA?

It should not. It can flag exceptions, assemble evidence and draft text, but releases, dispositions and closures remain human decisions recorded in the validated system with its audit trail and signatures.

Will this work with our eQMS as well as the ERP?

Usually yes. Most eQMS platforms expose a REST API or scheduled exports. The connector layer reads CAPA, complaint and audit records alongside ERP data so trace questions can cross both systems.

How is this different from the vendor's built-in AI features?

Vendor AI is tuned to its own product and often runs in the vendor cloud. A private layer can span your ERP, eQMS and document control together and run entirely inside your boundary. If your ERP vendor's feature already answers your questions, use it.

Can it help with an FDA inspection?

It can speed record retrieval and trace assembly, which helps the team respond to requests. It does not replace your quality system or your people, and what you hand an investigator must still be verified from the source records.

What about complaint data containing personal information?

Run the model locally, exclude identifiers from the index by default, and mask free text where policy requires. Local deployment removes the third-party AI processor from your data protection analysis.

How accurate are the answers?

Accuracy depends on data quality and the semantic mapping. Pilots test answers against known results before wider use, and every answer shows its query so users can check. Messy lot genealogy will limit results until the data is fixed.

Related guides

Faster paperwork, same standard

AI for NCR, CAPA, and 8D Drafting in AS9100 and ISO 9001 Quality Systems

AI drafts NCR, CAPA, and 8D reports from ERP quality data for engineer review, cutting drafting time under AS9100 and ISO 9001 without changing sign-off.

RAG + SQL + permissions

A Private LLM Grounded on Your ERP Data

How a private LLM answers questions on your ERP data: RAG plus text-to-SQL, role-based permissions inherited from the ERP, and where each fits.

Ask your ERP anything

Natural Language Query for ERP Data: Ask SAP, Infor, or Oracle a Question in Plain English

See how natural language query over SAP, Infor, Oracle, and NetSuite data works: grounded text-to-SQL, role-based permissions, and a visible audit trail.

Agents + approval gates

AI Agents for ERP, Running On-Prem

A practical guide to on-prem AI agents for ERP: what they can safely automate, where human approval belongs, and how to design the guardrails.

SAP QM + on-prem AI

AI for SAP Quality Management: Notifications, 8D, and CAPA Without the Manual Drafting

AI grounded on SAP QM data that triages notifications, drafts 8D and CAPA reports, and summarizes inspection trends, deployed on-prem for full traceability.

ERP AI readiness

Is Your ERP Ready for AI? A Readiness Assessment Checklist

Is your ERP actually ready for AI? A practical checklist covering master data quality, access and permissions, GPU sizing, and governance before you fund a pilot.

Plan it with numbers

Free Tool

Talk it through with an engineer who knows Any ERP

Bring one real question your team cannot answer from the ERP today. We will map the data path, the model, and where it runs, and tell you honestly if AI is the wrong tool for it.

Start the conversation See ERPray

All AI for ERP guides