A CMC writer is building the quality risk management dossier for a CMC change: a new single-use bioreactor and a revised cell-culture media supplier for a commercial monoclonal antibody. She pastes the change description, the affected process steps, and a list of quality attributes into the enterprise large language model and asks for a failure mode and effects analysis (FMEA) to support the ICH Q9(R1) risk-assessment narrative for the OPQ submission. Eighteen seconds later a complete FMEA table appears: failure modes, severity scores, occurrence scores, detectability scores, risk priority numbers, and a clean narrative concluding that the change is low-risk after mitigation. It looks like a rigorous risk assessment. It also scored the severity of a potential glycosylation shift as a moderate three on a ten-point scale, with no reference to whether the existing control strategy actually detects or controls that shift, and the occurrence and detectability scores are equally untethered from the real process controls. That detachment is the entire problem. An FMEA that scores severity, occurrence, and detectability without grounding them in the actual control strategy is not a risk assessment; it is a table of plausible numbers, and the OPQ assessor reads risk tables for exactly this kind of detachment. This lesson is about producing Q9(R1) risk documentation with AI that is grounded rather than decorative.

What ICH Q9(R1) Actually Requires

ICH Q9 established quality risk management as a systematic process for the assessment, control, communication, and review of risks to product quality across the lifecycle, and the R1 revision, which reached step 4 in January 2023, sharpened several points that bear directly on how AI-generated risk documents go wrong. The R1 revision added explicit attention to the formality of risk management (how much rigor a given decision warrants), to risk-based decision-making, and, most relevant here, to the problem of subjectivity in risk assessments. The revision is candid that risk scoring is vulnerable to subjectivity and inconsistency, and it asks that risk assessments be conducted with methods and inputs that make the scoring defensible rather than arbitrary. That single emphasis is the lens through which an AI-generated FMEA must be judged, because an ungrounded AI score is subjectivity at industrial scale: a number with the appearance of analysis and none of the substance.

The Q9(R1) toolkit includes several formal methods, and the lesson uses the most common ones. FMEA decomposes a process into failure modes and scores each on severity, occurrence, and detectability, combining them into a risk priority number (RPN) that ranks where risk-reduction effort should go. HACCP (Hazard Analysis and Critical Control Points) identifies hazards and the critical control points that manage them, and is often applied where a process has identifiable control points with measurable limits. Risk ranking and filtering sorts and prioritizes risks against defined factors. Each method produces an artifact, and each artifact is only as meaningful as the grounding of its inputs. A formal method applied to ungrounded inputs produces a formally structured wrong answer, which is more dangerous than an obviously informal one because the structure lends it false authority.

The deliverable this lesson targets is the Q9(R1)-aligned risk-assessment narrative for an OPQ submission, with its supporting FMEA, HACCP, or risk-ranking attachments, filed to support a CMC change. The narrative explains the risk question, the method chosen and why, the inputs, the scoring, the conclusions, and the resulting risk-control decisions. The named author owns the gap between a risk table that looks analytical and a risk assessment whose scores are anchored in the actual process and its controls.

The Failure Mode: Severity Scored Without the Control Strategy

The signature failure of an AI-generated FMEA, and the one this lesson is built around, is scoring severity, occurrence, and detectability without grounding them in the actual control strategy. Each of the three scores has a specific dependence on real, product-specific information, and the model has access to none of it from a generic prompt. Severity is the consequence of the failure mode if it occurs, and it depends on what the failure mode would do to the patient and the product, which is a function of the attribute's criticality and the clinical consequence, not a number the model can know for this product. Occurrence is how likely the failure mode is, which depends on the actual process, its history, and the new equipment or material being introduced. Detectability is the inverse of how well the existing controls would catch the failure mode before it reached the patient, which is entirely a property of the control strategy, the in-process controls, the release tests, the monitoring.

When the model fills these scores from a generic prompt, it produces plausible mid-range numbers, because mid-range numbers are the statistically safe completion in the absence of grounding. A severity of three, an occurrence of two, a detectability of three, an RPN that lands comfortably below an action threshold. Every number is defensible-looking and none is anchored. The detectability score is the most revealing: a low detectability score (meaning the failure is easily caught) is a claim about the control strategy, and if the model assigned it without reference to whether the control strategy actually detects that failure mode, the score is fabricated in the same sense a hazard ratio is fabricated. A risk assessment that concludes low risk on the strength of detectability scores that do not correspond to real controls is the precise thing an OPQ assessor is trained to find, because the conclusion rests on a claim about controls that the assessment never actually checked.

The danger, as with the comparability failure mode, is that the ungrounded FMEA does not look wrong. It is formally complete, it follows the FMEA structure, it produces RPNs and a conclusion, and the numbers are individually plausible. The deficiency is in the grounding, in whether each score traces to a real property of the product and its controls, and grounding is invisible to a reader who checks the arithmetic rather than the inputs. The control is to refuse to let the model assign scores and instead to ground each score in the named source: severity in the criticality assessment and clinical consequence, occurrence in the process history and the specifics of the change, detectability in the actual control strategy.

Grounding the Three Scores in Named Sources

The discipline that fixes the failure mode is to treat each FMEA score as a claim that must trace to a specific source, exactly as a comparability acceptance criterion must trace to the historical data. Severity is grounded in the product's criticality assessment: the established CQAs, their links to safety and efficacy, and the clinical consequence of a deviation. If glycosylation is a high-criticality attribute because it governs effector function and clearance, the severity of a glycosylation-shift failure mode is high, and the score must reflect that established criticality rather than a generic mid-range guess. The criticality assessment is the source, and the AI can draft the severity rationale only after the writer has supplied which attributes are critical and why.

Occurrence is grounded in the process knowledge and the change. The introduction of a new single-use bioreactor and a new media supplier changes the occurrence profile of media-related and bioreactor-related failure modes, and the occurrence score must reflect what is known about the new components and the relevant process history, including any prior deviations or known sensitivities. The model does not know the process history or the qualification status of the new components, so it cannot ground occurrence on its own; the writer supplies the process knowledge and the change specifics, and the model drafts the occurrence rationale against them.

Detectability is the score most tightly bound to the control strategy and the one most often fabricated. A detectability score answers: if this failure mode occurred, would the existing controls catch it before it reached the patient? Answering it requires knowing what the in-process controls, release tests, and monitoring actually measure and whether they are sensitive to this particular failure mode. A glycosylation shift is detectable only if the control strategy includes a glycan analysis with adequate sensitivity, and if it does not, the detectability is poor and the score must reflect that gap. The writer grounds detectability in the actual control strategy, attribute by attribute, and the model drafts the detectability rationale only against that grounding. When all three scores are grounded this way, the RPN means something, because it is built from real properties; when they are not, the RPN is arithmetic on fiction.

Where AI Genuinely Helps the Risk Assessment

The grounding discipline does not argue against using AI for Q9(R1) work; it argues for using it in the roles where it adds value without fabricating the substance. The model is genuinely useful for failure-mode enumeration: asked to list the ways a new bioreactor and media supplier could perturb a cell-culture process, it generates a broad, well-structured candidate set, because the failure modes of bioprocessing are well represented in its training data. That candidate list is a real aid to completeness, helping the writer ensure the FMEA does not miss a failure mode the team had not considered, and missing a relevant failure mode is itself a common deficiency that a broad enumeration helps prevent.

The model is also useful for structuring the narrative and the attachments. A Q9(R1) risk-assessment narrative has a conventional shape, the risk question, the method selection rationale, the inputs, the scoring approach, the conclusions, the risk-control actions, and the model drafts that structure cleanly and consistently, which saves real time and improves readability. It can also draft the rationale prose for each score once the writer has supplied the grounded values and the basis, turning the writer's grounded judgment into clear, consistent narrative far faster than typing it. The division of labor is the same throughout this chapter: the model is excellent at enumeration and prose and structure, and unreliable at the grounded judgment that the substance depends on.

The line to hold is that the model may propose the failure modes and draft the narrative, but it may not assign the scores, because the scores are the substance and the scores require grounding the model does not have. A workflow where the model enumerates failure modes, the writer grounds and assigns each score against named sources, and the model then drafts the rationale and the narrative around those grounded scores captures the model's value without inheriting its fabrication risk. The reverse workflow, where the model assigns the scores and the writer reviews the prose, inherits exactly the failure mode this lesson exists to prevent.

The Named Artifact: The Q9(R1) Narrative in the OPQ Submission

The artifact this lesson produces is the ICH Q9(R1)-aligned risk-assessment narrative and its supporting FMEA, HACCP, or risk-ranking attachments, filed to support a CMC change in a submission read by an assessor at the FDA Office of Pharmaceutical Quality. Naming the artifact fixes the reader and the stakes. The OPQ assessor reads the risk assessment not as a formality but as the sponsor's argument for why the change is acceptable, and the assessor is specifically attentive to whether the risk scoring is grounded or decorative, because Q9(R1) itself flags subjectivity as the central weakness of risk assessments. An assessment whose scores do not trace to the control strategy and the criticality assessment is the textbook example of the subjectivity the revision warns against.

The consequence of an ungrounded risk assessment is more than an information request. It can undermine the risk-control decisions that the assessment is supposed to justify: if the detectability scores are not grounded, the conclusion that the change is low-risk after mitigation is not supported, and the mitigations the sponsor proposes may not match the real risks. The assessor may require the assessment to be redone with grounded inputs, may question whether the control strategy is adequate to detect the change's potential effects, and may extend the concern to the sponsor's broader quality risk management maturity. An ungrounded FMEA does not just fail on its own terms; it casts doubt on whether the sponsor's risk management is real.

This is why the AI-assisted Q9(R1) narrative must be reconciled to the same named sources that ground every other artifact in this chapter: the criticality assessment for severity, the process knowledge and change specifics for occurrence, and the control strategy for detectability. A risk assessment whose every score traces to one of those sources is defensible, because each number is a claim the assessor can follow to its basis. A risk assessment whose scores are the model's plausible mid-range guesses is the failure mode wearing the costume of rigor, and the formal FMEA structure makes the costume more convincing, not less.

Building the Defensible Q9(R1) Workflow

The defensible AI-assisted Q9(R1) workflow follows directly from the grounding requirement and the division of labor. Before drafting, the writer loads the named sources that the scores must trace to: the criticality assessment that establishes severity, the process knowledge and the change-and-qualification details that establish occurrence, and the control strategy that establishes detectability. The writer also fixes the scoring scales and the action thresholds in advance, because Q9(R1) asks that the method and its criteria be defined rather than improvised, and a scale defined after the scores are seen is itself a source of subjectivity.

The drafting then proceeds with the model in its bounded roles. The model enumerates candidate failure modes, and the writer reviews the list for completeness and relevance, adding any the team knows and removing any not applicable. The writer then grounds and assigns each score, severity from the criticality assessment, occurrence from the process knowledge and change, detectability from the control strategy, recording the basis for each. The model then drafts the rationale prose for each score and the surrounding narrative, and the writer verifies that the drafted rationale faithfully represents the grounded basis rather than substituting a plausible-sounding justification. Any score whose basis cannot be traced to a named source is treated as ungrounded and is reworked, exactly as an uncheckable acceptance criterion is treated as wrong.

Around this sits the GxP audit trail, read by the OPQ assessor and defensible under 21 CFR Part 11. The record captures the model and version, the system prompt with ICH Q9(R1) pinned, the criticality assessment and control strategy and process sources loaded with their versions, the predefined scoring scales and thresholds, the grounded basis for each severity, occurrence, and detectability score, the resulting RPNs and risk-control decisions, and the named CMC writer and quality reviewer who signed. The discipline is the one that runs through the entire program, sharpened for risk scoring: the model can enumerate the failure modes and draft the narrative, but the scores are the substance, the scores require grounding the model does not have, and the named author owns the grounding. A Q9(R1) assessment whose every score traces to the criticality assessment and the control strategy is a real risk assessment; the alternative is a formally structured table of plausible numbers, and Q9(R1) was revised in part to make exactly that table indefensible.

Key Takeaways

• ICH Q9(R1), which reached step 4 in January 2023, sharpened the warning about subjectivity in risk assessments. An ungrounded AI score is subjectivity at industrial scale, a number with the appearance of analysis and none of the substance, and a formal FMEA structure makes it more convincing, not less.
• The signature failure mode is scoring severity, occurrence, and detectability without grounding them in the actual control strategy. The model fills plausible mid-range numbers because that is the safe completion absent grounding, and a detectability score assigned without reference to whether the controls actually detect the failure mode is fabricated like a hazard ratio.
• Each score must trace to a named source. Severity to the criticality assessment and clinical consequence, occurrence to the process knowledge and the change specifics, detectability to the actual control strategy; when all three are grounded the RPN means something, and when they are not the RPN is arithmetic on fiction.
• AI helps with enumeration, structure, and prose, not with the scores. The model proposes failure modes and drafts the narrative, which aids completeness and saves time, but it may not assign the scores; the reverse workflow, where the model scores and the writer reviews the prose, inherits the exact failure mode.
• The named artifact is the Q9(R1) risk-assessment narrative for an OPQ submission, reconciled to the criticality assessment and the control strategy. An ungrounded FMEA does not just fail on its own terms; it casts doubt on whether the sponsor's risk management is real, so every score must be a claim the assessor can follow to its basis under a captured, signed audit trail.