---
title: "AI Agents & Precedent: Three Gates Before Reusing a Decision"
url: "https://atlan.com/context-and-chaos/issue/ai-agents-precedent-three-gates-before-reusing-a-decision/"
description: "Why an agent that agrees with past regulatory decisions can still be wrong, and three gates a decision must pass before guiding the next."
keywords: "AI Agents, Context Engineering, Enterprise AI, Regulatory Affairs"
---

A Context & Chaos guest take by Geethapriya Setty, MS, MBA, RAC-Devices, a manager of global regulatory affairs at a global medical device company, working on regulatory policy, strategy, and AI governance for high-risk devices. She writes in a personal capacity. Published November 12, 2026. Her argument: an AI agent that agrees with past regulatory decisions can still be wrong, so a past decision has to pass three gates before an agent reuses it, and each gate needs a person.

## The opening

- Finding the right regulation is rarely the hard part of regulatory work. The hard part is judging what that regulation, your own procedures, and everything you have told the regulator before allow you to conclude about a specific situation.
- Change assessment decides what a change to an already cleared or approved product means to each regulator. Each assessment ends in a disposition: no regulatory action beyond an internal record (a letter to file for 510(k) devices), a notification, or a new submission.
- She built a prototype AI agent to test whether that work can be learned from past cases. It matched her answers 75 to 80 percent of the time. "What that number can't show is whether those answers were right."

## What I built

- A personal experiment, not a system her company uses. It isn't validated, nothing in it is proprietary, and it was limited to FDA and the US market.
- Everything the agent works from is made up: about 25 mock change assessments with invented products and procedures, plus public FDA guidance, in a knowledge base. She did not retrain the model; she walked it through each case and corrected it.
- It is decision support, not an autonomous agent: it drafts a recommendation for a person to review and never makes or files a determination itself.
- On a second batch of 25 unseen mock assessments, its disposition matched hers about 75 to 80 percent of the time, after a lot of correction. It did well where guidance is explicit and struggled where the answer needed judgment beyond what was written down.
- Where it looked most useful was triage: a rough early read for requesters outside regulatory, before a request reaches regulatory.
- The harder question: what if the past decision the agent agreed with was itself the wrong call? A change listed in an annual report to FDA can be overturned months later. An agent that learned from the case as first decided has no way to know unless someone updates the record.

## Three gates between a decision and reusable context

- Dan McCreary has argued that the unit worth modeling is the trace behind a decision, including the conversation that authorized it. In change assessment, the authorizing conversation is almost never kept.
- Gate one: Can this precedent apply here? Someone has to decide whether the new case is truly like the old one or only looks like it.
- Gate two: Can the reasoning be inspected? A written rationale can be a tidy reconstruction instead of a record of what happened.
- Gate three: Can the system use the new context? For regulated use, a system has to be validated, and adding new material to what it relies on is a change that needs review. This only applies to GxP use.
- Diagram: "Three gates between a past decision and reusable context."

## Gate one: what can this precedent establish?

- Ten similar assessments show what was decided ten times. They don't authorize an eleventh.
- Sources carry different weight: law and regulation is binding; FDA guidance is treated as the agency's current position; company procedures sit below both; the company's own dealings with the regulator on a product settle the question for that product. Past assessments inform, but do not authorize.
- Diagram: "Past assessments inform, but do not authorize."
- A like-for-like supplier change on a 510(k)-cleared device: precedent speaks for itself. The same change on a PMA device could mean a 30-day notice or an annual report entry, so the agent must know the pathway first.
- A change to an AI-enabled device's intended use or performance claims: the agent pulls guidance and similar cases, but a person writes and owns the argument.
- A question the regulator has already settled for the company's own product: precedent doesn't count.
- Precedent is a record of what people decided before. It is not a source of authority. When the agent prepares a recommendation for a person to review, precedent can be shown freely; the restriction protects the moment of decision.

## Gate two: can the reasoning be made inspectable?

- A quality record holds the disposition, the rationale, and the weighing that produced it. The weighing is the part that most often goes missing.
- A rationale written after the decision tends to read as clean and confident and leaves out the disagreement in the room and the reason a senior reviewer gave in a conversation nobody wrote down. An AI agent that retrieves the memo inherits the same gap.

## Gate three: can the system use the new context?

- A system is in GxP use when its output feeds a regulated decision. Then it has to be validated and kept that way through change control, which covers new content as much as new software.
- Adding a past case or a revised guidance document to the agent's knowledge base is a change to the system, the same kind of change as editing a formula in a validated spreadsheet.
- Controlled context lag is the gap between the moment the organization learns something and the moment its system is allowed to use it. Context drift is context changing without the evaluation process noticing. Lag runs the other way: everyone has noticed, and the system isn't yet allowed to reflect it.
- Diagram: "Drift: nobody noticed. Lag: everyone noticed, and the system can't use it yet."
- FDA's Predetermined Change Control Plans let a manufacturer agree in advance which changes a device may make and how each will be validated. They do not cover AI used inside a company's own processes; for that software, FDA's framework is Computer Software Assurance. As far as she knows, no equivalent exists yet for AI-enabled GxP processes in manufacturing or the quality system.

## What a team building this would need

- Tag every source with its authority level: law, guidance, SOP, our own correspondence with the regulator, or past assessment.
- Record when a past decision was superseded or overturned, with the date it took effect.
- Capture the reviewer's reasoning when the decision is made, not afterward.
- Keep "retrieve and show" separate from "decide," so precedent can inform a person but never decide alone.
- Put the knowledge base under change control, with versioned releases.
- The third is the one she has not solved.

## Is the juice worth the squeeze?

- A small, stretched regulatory team has more to gain from triage than a large one, but most regulatory teams aren't IT organizations, and maintaining and validating a tool like this in-house is where the idea can fall apart.
- The clearest gain is filtering regulatory intelligence feeds: fifteen items arrive, five apply. An AI agent could save time there, at low risk, because nothing is being determined.
- What she would never hand it is the determination itself, made without a person reviewing it. "Right now, an AI agent is an intern, not a licensed professional."
- The part she still can't solve is the review conversation. Until the reasoning behind an override is captured somewhere the next assessment can find it, review will keep improving decisions that the agent can't learn from.

Geethapriya Setty writes in a personal capacity. The agent described is a personal prototype built on mock data and does not represent any system deployed by her employer.

## Next steps

- To get new writing on context engineering, subscribe to Context & Chaos: [Context & Chaos newsletter](https://atlan.com/context-and-chaos/)
- To see Atlan working on your own data stack, book a demo: [Book a demo with Atlan](https://atlan.com/forms/talk-to-sales-contact/)