AI in quality management: ISO 9001 documents, audit preparation, complaints and 8D drafts

Where an own AI helps the quality department

AI in quality management helps most with the paperwork around the system: finding the released procedure that answers a question, collecting the evidence an auditor will ask for, sorting incoming complaints and drafting the texts of 8D reports and corrective actions. On an AI server in your own building, these jobs run on your released documents and your complaint data without either leaving the company. The QM system, with its document control and its records, stays the record; the AI reads from it and prepares drafts that people check and release.

This guide is for quality managers, heads of quality and managing directors at manufacturers of any industry. It explains each use in plain words, shows what stays with people, and puts the hardware in one section near the end, with what it needs in the building. Automotive suppliers with IATF 16949, PPAP and TISAX questions will find those in our guide to an AI server for automotive suppliers; our overview of AI servers for manufacturing companies covers visual inspection at the line and simulation. This page stays with ISO 9001 and the quality work every manufacturer shares.

A word on the method, because it decides what the AI can and cannot do. The assistant does not learn your documents. It searches a copy of them, which we call the index, picks the passages that fit the question and writes an answer that names the document and version it came from. This is called retrieval-augmented generation, or RAG, and our guide to RAG on company data explains why the search part decides most of the quality. For a quality department the consequence is simple: whatever is in the index can be quoted, so what goes into the index is a document-control decision.

ISO 9001:2026: the new edition in brief

ISO published ISO 9001:2026, Quality management systems, Requirements, on 16 September 2026, according to its catalogue page read on 25 October 2026. It is the sixth edition, has 36 pages and comes from the committee ISO/TC 176/SC 2; the catalogue lists ISO 9001:2015 and its 2024 amendment as withdrawn. ISO's summary names clearer requirements, the importance of quality culture and leadership, risks and opportunities treated separately, and closer alignment with other ISO management system standards. On the transition, ISO's page says: "Certified organizations will have to transition to the new version within the time frame set by their certification cycle", and refers them to their certification body. One certification body, LRQA, anticipates a transition period of three years.

For the AI question, the new edition changes little. A certification body's summary of the changes states that the standard keeps the ten clauses and their titles from 2015, adds a separate clause for opportunities next to the one on risks, gives top management the task of promoting a quality culture, and carries forward the climate change text of the 2024 amendment. The documents an auditor asks for remain of the same kinds: documented information, records of internal audits and management reviews, nonconformities and corrective actions. The guidance for auditors has a new edition too: ISO 19011:2026, Guidelines for auditing management systems, was published on 27 May 2026 and replaces the 2018 edition.

The transition is a good moment to start. Every procedure is read against the new edition anyway, and an assistant that finds every place where your documents mention risks and opportunities, management review inputs or customer complaints shortens that reading. Which change your procedures need remains the quality manager's call.

Document control first: only released versions go into the index

An assistant that quotes a withdrawn procedure creates a nonconformity of its own. The rule is therefore that the index is fed from the released documents only, and that it follows each release.

• Source. The index reads from the folder or document management system where the released versions of the QM manual, procedures and work instructions live, never from working drafts, personal folders or e-mail attachments.
• Release and withdrawal. When a document is released, its new version enters the index and the old one leaves it. Withdrawn documents disappear from answers the same day.
• Version in every answer. Each answer names the document, its number and its revision, so the reader can open the released original before acting on it.
• Access. The search applies the user's rights from the company directory: a production worker sees work instructions, not supplier audit reports or customer complaints.
• Standards. ISO's terms for its online platform exclude using ISO content to prompt or feed AI systems without a separate licence, as our guide to standards in a company AI explains. Put your own procedures into the index, and the text of ISO 9001 only if your licence allows it.

For many companies the first task is unglamorous: old versions sit next to new ones in shared folders. Our guide to preparing company documents for an AI assistant shows how to clean up the sources before the first index is built.

Audit preparation: from the audit plan to the evidence

Before an internal audit, a customer audit or the certification audit, the quality manager collects evidence process by process: the procedure, the records that show it is followed, training records, calibration certificates, the last management review, open corrective actions. The assistant shortens the search. Given the audit plan or a customer's audit questionnaire, it lists the questions per process, proposes for each the documents and records that answer it, and flags gaps it can see, such as a record whose review date has passed or a corrective action without a closing entry.

Our summary of typical uses; ISO 19011:2026 (published 27 May 2026) is ISO's guidance for auditing management systems.

Auditors judge; the assistant does not. It cannot tell whether a process is effective, only which documents claim that it is and whether the records are there. Questionnaires from customers on AI itself, such as which tools touch the customer's data and where they run, have their own guide: AI questions in customer audits and supplier questionnaires.

Complaint management: sorting, trends and similar cases

Customer complaints and internal deviations arrive as e-mails, PDFs, photos and exports from the quality software, often called CAQ (computer-aided quality), in several languages and with very different detail. The assistant reads each one and proposes a classification: product, part number, defect type, where it was found, severity. A person confirms or corrects it. Once the cases are classified the same way, trends show: the same defect on three product lines, a supplier whose parts appear in more and more complaints, a rise after a process change.

The second use is finding similar past cases. A new complaint about cracked housings brings up the 8D reports and deviations from earlier years that describe the same symptom, with their root causes and actions. That is often the most valuable answer for a young quality engineer, and it depends on old reports being in the index with their outcome.

Complaints written in other languages can be summarised in your working language; check a sample of each language your customers use during the pilot before relying on it. Photos and scanned forms need a model that reads images, which is one reason we choose a vision-language model for the document card in the table below.

We supply AI servers built to order and set up the models and the document search under our Private AI/ML service; send us a short description of your complaint process and your document sources, and our team proposes a configuration.

8D reports, CAPA and FMEA: drafts for the team

The 8D report structures problem solving in complaint handling. The training description of TÜV Rheinland's academy names its contents: describing and assessing the problem, immediate containment, finding root causes, introducing lasting corrective measures, passing the knowledge on within the company and monitoring the measures, with root-cause methods such as 5 Why and Ishikawa. The AI can help in each step with text: a clear problem description from the customer's e-mail and the inspection data, a list of similar past cases, a first Ishikawa sketch of possible causes for the team to discuss, the wording of actions and the summary for the customer.

The root cause itself is found by the team at the part, the machine and the data. A language model proposes plausible causes, and plausible is not the same as proven. The rule we recommend is that every cause in the report has evidence attached by a person, and that the AI's drafts are marked as drafts until the team signs.

For corrective and preventive actions (CAPA), the assistant drafts the action text, the effectiveness check and the due date from the template, and reminds the owner when a check is due. For FMEA, it can compare documents that should agree: the same failure mode rated differently in two FMEAs of similar products, an action named in the FMEA but missing in the control plan, or a complaint whose failure mode does not appear in the FMEA at all. It does not rate risks. The ratings follow the method your customers require, and automotive rules are in our automotive supplier guide.

Data that should stay in the company

Quality data is more sensitive than it looks. Complaints name the customer's contact person, the customer's part numbers and often include the customer's drawing. Supplier audit reports describe another company's weaknesses. 8D reports describe your own failures. Names of people are personal data under the GDPR, and drawings and part data are usually covered by the customer's NDA.

On an own server, the answer to "where is this processed" is your server room or an EU data centre you name, and the query log is under your retention setting. Our guides to local AI and the GDPR and to trade secrets, NDAs and AI tools explain what own hosting changes; your data protection officer and legal counsel confirm what your contracts require. Staff who use the assistant should also get a short introduction: Article 4 of the AI Act asks providers and deployers to take measures to support the AI literacy of their staff, as our guide to AI literacy training describes.

The AI server for a quality department

Quality work is a modest load for an AI. A few quality engineers ask questions, a handful of complaints arrive per day, and audit preparation comes in waves. A model of moderate size does this well, so the sensible plan is one company AI server that carries the quality assistant next to the assistants for engineering, sales and the office.

Users-per-card rule (0.9 × driver-visible memory, less 3 GiB per card and less the weights): Qwen3.8-27B FP8 weights 30,866,866,928 bytes = 28.75 GiB (Hugging Face file list, read 25 October 2026) with FP8 cache, 1.14 GiB per 32K conversation; gpt-oss-120b about 65 GB = 60.8 GiB (Hugging Face file list, re-read 25 October 2026) with 16-bit cache, 0.5625 GiB per 16K conversation; power by our estimate (cards, processors and 15 per cent for the rest), confirmed by a measurement on the delivered system.

A conversation here is one request being answered at the same moment; far more staff can use the assistant, because most of them are reading or typing at any given time. A token is a piece of a word, and 32K tokens hold a long procedure plus the question and answer. Qwen3.8-27B is described on its model card as a vision-language model that understands images and documents, released under Apache 2.0; gpt-oss-120b, also Apache 2.0, has 117 billion parameters, of which 5.1 billion are active per token.

The entry server has two NVIDIA RTX PRO 6000 Blackwell Server Edition cards, two AMD EPYC processors, 384 GB of DDR5 ECC memory and two NVMe drives. It runs from one ordinary 230 V 16 A feed in a server room with cooling for about 1.8 kW. Without a server room, our Private AI/ML service runs the same platform on dedicated hardware in a Tier-3 data centre in Lithuania, inside the EU. A company without an IT department finds the division of tasks in our guide to an AI server without an IT department, and the first tasks to give such a server in first AI use cases in a manufacturing SME.

Notes for the IT team

• Connectors. The index is built from the document management system or file share that holds released versions; a release event or a nightly comparison updates it. Keep the document number and revision as metadata so that answers can cite them.
• Access filter. Map the roles held in the company directory to document classes (work instructions, procedures, audit reports, complaints) and filter every search by the user's roles.
• Exports from the CAQ system. Complaints and actions come as exports or through the system's interface; store the AI's proposed classification in a separate field so that the confirmed value stays the record.
• Logs. Keep the query log under a retention period agreed with the data protection officer; it shows in an audit who asked what and which documents were cited.
• Evaluation. Before go-live, collect fifty to a hundred real questions with the expected document, and repeat the test after each model or index change, as our guide to LLM evaluation before model upgrades describes.

What we supply

You can buy this system from us: our team sizes the configuration to your workload and budget and replies within one business day. We build AI servers to order with two, four or eight cards, assembled and tested before delivery, delivered anywhere in the EU on one EU contract and invoice, with manufacturer warranty on every component handled through us; quantities and lead time are confirmed in writing with the quote. Our Private AI/ML service, with our engineering partner Vixen.UNO, sets up the models, the search on your released documents, access control and the query log. Tell us which quality tasks you want to start with, and we propose how to set them up on one server.

FAQ