SAP B1 + medical devices
AI on SAP Business One for Medical Device Manufacturers: Traceability and Records Retrieval Without Touching the Validated State
Short answer
AI for SAP Business One in a medical device company is a read-only retrieval layer over lot, serial, supplier, production and shipment records. It helps quality, regulatory and operations staff find device history, UDI data and supplier status in plain English, runs on-prem, and does not write to records or replace validated quality system processes.
- ERP
- SAP Business One
- Industries
- Medical Devices, Life Sciences
- Written for
- Quality Manager
Small and mid-sized medical device makers often run Business One for finance, inventory and production while keeping the quality system in separate tools: an eQMS, document control platform or, still common, binders and spreadsheets. That split is workable but leaves a recurring problem. When a complaint, audit finding or field action arrives, the answer needs data from the ERP and the quality system together.
Business One provides batch and serial management, production orders, purchase orders, goods receipts and deliveries, all of which hold fragments of the device history record. It does not provide native design history, CAPA, complaint handling or electronic signatures in the regulated sense. Many companies add UDFs for UDI data, device class and supplier approval status to close part of the gap.
The regulatory environment is tightening on records. FDA's Quality Management System Regulation, which replaces the old Quality System Regulation and incorporates ISO 13485:2016, took effect in February 2026. EU MDR (2017/745) requires UDI and traceability throughout the supply chain. Whatever the regime, the ability to trace a device to its components and customers quickly is part of expected control.
This page explains where AI is appropriate in this setting. The short answer is retrieval and summarization on read-only data, kept outside the validated core, with a human responsible for every decision. We describe the architecture, the use cases that fit, and the boundaries.
What usually gets in the way
The problems we hear most from quality manager teams running SAP Business One.
Device history is scattered across systems
Component lots are in Business One, inspection records in the eQMS or paper, sterilization certificates in files, and shipping records in delivery documents. Assembling a device history for a complaint takes hours.
UDI and device identifiers are weakly structured
UDI-DI, UDI-PI components and GUDID or EUDAMED registration status are often held in UDFs or spreadsheets. Checking completeness across SKUs is manual.
Supplier approval status is not enforced where buyers work
Approved supplier lists live in the QMS, while purchasing happens in Business One. A buyer may not see that a supplier certificate lapsed or an audit is overdue.
Field action scoping is stressful
When a component or process issue emerges, determining which finished serials and customers are affected under time pressure invites mistakes if the genealogy is hard to read.
Audit preparation drains quality time
Inspectors ask for traceability examples, supplier files and training evidence. Quality staff gather these by hand for each audit.
Where AI earns its place in SAP Business One
Each use case names the ERP objects it reads or writes, so your ERP team can judge the integration effort before anyone commits budget.
Device history retrieval by serial or lot
From a serial or lot, produce a structured summary of production order, component lots, supplier receipts, and delivery records, with links to quality records stored in connected systems.
Touches: OSRN, OBTN, OIBT, OWOR, WOR1, OPDN, ODLN, OCRD
Outcome: Faster complaint investigation preparation. The DHR itself remains the controlled record, and the AI output is a convenience summary.
Field action scoping
Given a component lot or supplier, list affected finished lots or serials, current location (stock or customer), and shipment dates.
Touches: OITL/ITL1, OBTN, OSRN, ODLN, OINV, OCRD
Outcome: A defensible first scoping list in minutes, handed to quality and regulatory for verification and decision.
UDI completeness check
Scan item master and UDFs for finished devices lacking UDI-DI, device class or issuing agency data, and list gaps by product family.
Touches: OITM, UDFs for UDI fields, OBTN expiry and manufacturing dates
Outcome: A cleanup list produced in minutes instead of a manual SKU review.
Supplier status watch
Flags open purchase orders to suppliers whose certificate, audit or approval date has lapsed in the connected supplier record.
Touches: OPOR, OCRD, UDFs for approval status, supplier file index
Outcome: Fewer purchases from suppliers that have fallen out of approved status.
Audit evidence assembly
Natural-language requests such as show three traceability examples for class II devices shipped last year produce a package of cross-referenced records.
Touches: OWOR, OBTN, ODLN, document store
Outcome: Audit preparation time reduced; quality reviews and selects the final evidence.
Expiry and sterile-barrier shelf-life watch
Highlights lots of finished goods or components nearing expiry, with open orders and warehouse location.
Touches: OBTN.ExpDate, OBTQ, OITW, ORDR
Outcome: Better stock rotation and fewer expired units.
Procedure and work instruction Q&A
Retrieval over controlled SOPs and work instructions answers how-do-I questions with citations to the effective revision.
Touches: Document control export, item and process metadata
Outcome: Faster access to current procedures; it never presents superseded revisions as current when metadata is correct.
Reference architecture
The AI layer is deliberately placed outside the validated state: it reads from Business One and quality documents, never writes, and its outputs are working aids. Every answer cites source records so users can verify in the controlled system.
- 1
Read-only data access
Dedicated read-only login limited to curated views for batch, serial, production, purchasing and delivery data; Service Layer for authorized document lookup.
- 2
Document retrieval
Index of effective SOPs, supplier files and certificates exported from document control with revision and status metadata.
- 3
Semantic layer
Maps terms such as DHR, UDI-DI, lot, device family and approved supplier to tables, UDFs and documents.
- 4
Model serving
Open-weight model run locally through vLLM or Ollama, with no external calls and logging of prompts and outputs.
- 5
Governance
Role-based access, retention of query logs, citation requirements, and a no-write policy enforced at the database permission level.
Integration notes for your ERP team
- Use a database login restricted to SELECT on views; enforce no-write at the permission level, not just in prompts.
- Make sure finished devices are serial or batch managed, and that component issues on production orders record tracked lots.
- Store UDI-DI and device class in structured UDFs; free text in item descriptions makes completeness checks unreliable.
- Export effective SOPs and supplier files from the QMS with status and revision metadata; do not index drafts as effective.
- Treat patient-related complaint content as restricted data and exclude or mask it unless the use case requires it.
- Keep the Business One transaction log (OITL) as the basis for genealogy rather than derived summary tables.
Deployment options
On-prem server
Device makers with design and complaint data sensitivity
Everything runs inside your network and under your IT security controls.
Private cloud tenancy
Companies with hosted ERP and QMS
Dedicated environment with private networking and encryption using your keys.
Segmented network zone
Sites with cleanroom or manufacturing network segregation
The AI zone has controlled one-way read access to ERP replicas and document exports.
Compliance and data control
How the architecture supports your obligations. Certification and accountability stay with your organisation; the design keeps the evidence straightforward.
FDA 21 CFR Part 820 (QMSR) and ISO 13485:2016
AI is a retrieval aid outside the quality system's controlled processes. Your procedures define whether and how such tools may be used; assess software under your own validation or assurance approach.
21 CFR Part 11 (electronic records and signatures)
The AI layer neither creates nor signs regulated records. It reads existing records and does not substitute for audit trails in the source systems.
EU MDR 2017/745 and UDI requirements
Helps find and check UDI data on file; registration and labeling decisions remain with regulatory affairs.
FDA guidance on Computer Software Assurance
A risk-based assurance rationale for non-product, read-only tools can be documented; we provide architecture and test evidence to support your assessment.
HIPAA where complaint data includes patient information
Keep patient-identifiable data out of the index or restrict by role; on-prem processing avoids third-party disclosure.
How an engagement runs
Phase 1 . 2 weeks
Risk and data assessment
- -Intended-use statement for the tool
- -Data and record source map
- -Software assurance rationale draft
- -Role and access plan
Phase 2 . 4-5 weeks
Traceability pilot
- -Device history summary workflow
- -Field action scoping workflow
- -Test cases against real historical lots
Phase 3 . 3-4 weeks
Supplier and UDI extensions
- -UDI completeness checker
- -Supplier status watch
- -SOP retrieval with revision control
Phase 4 . 2 weeks
Handover
- -Runbook
- -Change control entry for the tool
- -Periodic accuracy review plan
Questions to ask any vendor, including us
A short list that separates real SAP Business One AI work from a chatbot demo.
- Is the connection read-only at the database permission level?
- How do you support our software assurance or validation rationale?
- Does the tool create or modify any regulated records?
- How are superseded SOP revisions excluded?
- How is patient-related information handled?
- Can every answer be traced to source records?
- What is the change control process when the model or index is updated?
- Does anything leave our network?
Frequently asked questions
Can AI be used with SAP Business One in a regulated medical device company?
Yes, if it is scoped sensibly. A read-only retrieval and summarization layer outside the controlled quality processes is a lower-risk use than anything that creates records. You should still document intended use, assess risk under your own procedures, and keep humans responsible for decisions.
Does it replace our eQMS or DHR?
No. The device history record, CAPA, complaints and design controls stay in your controlled systems. The AI layer helps people find and summarize information across them faster, always citing sources so users can verify in the system of record.
What about 21 CFR Part 11?
The AI layer neither creates nor approves regulated electronic records, and it does not carry electronic signatures. Part 11 obligations remain with the source systems that hold those records. If you later add write-back, that would need a separate and much stricter validation approach.
How does it help with UDI?
It can scan your item master and UDFs for finished devices missing UDI-DI, issuing agency or device class data and list gaps by product family. It can also locate documents related to GUDID or EUDAMED submissions. It does not submit data or decide labeling content.
Can it support field actions and recalls?
It can speed up the first scoping step by listing finished lots or serials that used a given component lot, with shipment destinations. Quality and regulatory must verify the list and make the decisions. Gaps in lot recording on production orders will show up as unresolved branches.
Does Business One have a medical device edition?
SAP offers industry solutions and partners provide add-ons for regulated manufacturing, but base Business One is a general ERP. Whether it meets your needs depends on your classification and quality system. AI does not change that; it works with the data you capture.
What infrastructure is needed?
One GPU server with 24 to 48 GB memory usually suffices for a small quality and operations team plus a document index. We size against user count and document volume, and keep the environment segmented under your IT security policies.
Related guides
AI for SAP Business One, Without Sending Your Books to a Public API
Add AI to SAP Business One without sending customer data or financials to a public API. Service Layer and DI API integration, sized for an SMB budget.
SAP QM + on-prem AIAI for SAP Quality Management: Notifications, 8D, and CAPA Without the Manual Drafting
AI grounded on SAP QM data that triages notifications, drafts 8D and CAPA reports, and summarizes inspection trends, deployed on-prem for full traceability.
RAG + SQL + permissionsA Private LLM Grounded on Your ERP Data
How a private LLM answers questions on your ERP data: RAG plus text-to-SQL, role-based permissions inherited from the ERP, and where each fits.
Agents + approval gatesAI Agents for ERP, Running On-Prem
A practical guide to on-prem AI agents for ERP: what they can safely automate, where human approval belongs, and how to design the guardrails.
SAP AI Buyer GuideSAP AI Consulting for On-Prem and Private Deployments
What to demand from an SAP AI consulting partner when data must stay on-prem or private: OData/BAPI mechanics, Joule vs. private LLM, and buyer questions.
SAP S/4HANA + private AIAI for SAP S/4HANA, Running On-Prem or in Your Private Cloud
Run AI on SAP S/4HANA without sending ERP data to a public API. On-prem and private-cloud architecture, CDS views, OData, and honest deployment trade-offs.
Plan it with numbers
On-Prem LLM Total Cost of Ownership Calculator
Model the full multi-year cost of running LLMs on your own hardware, including GPU capex, power, cooling, support contracts, and operations staffing.
Free ToolRAG Infrastructure Sizing Calculator
Estimate vector storage, node RAM, generation GPUs, and monthly infrastructure cost for a retrieval-augmented generation deployment over your document corpus.
Free ToolGPU Sizing Calculator for LLM Inference
Work out how many GPUs you need to serve a given open-weight model to your user base, based on memory footprint and token throughput.
GuideA Data Governance Framework for Private AI
A practical data governance framework for private AI: classification, access controls, retention, and audit patterns that satisfy CMMC 2.0 and ITAR.
GuideSecurity Hardening for On-Prem AI Stacks
Security hardening for on-prem AI stacks: container isolation, model supply chain, prompt injection defenses, and audit logging for defense contractors.
GuideEnterprise RAG Architecture: The Full 2026 Blueprint
A practitioner's blueprint for enterprise RAG in 2026: ingestion, chunking, embedding, retrieval, rerank, generation, and the eval loop that keeps it honest.
Talk it through with an engineer who knows SAP Business One
Bring one real question your team cannot answer from the ERP today. We will map the data path, the model, and where it runs, and tell you honestly if AI is the wrong tool for it.