ISO automation is software that carries out the clerical steps that follow a human ISO 9001 decision: numbering the revision, updating the registers, notifying the distribution list, calculating the retention date. Nobody retypes any of it. What ISO automation does not do is decide whether a document is correct, adequate or ready to release. That decision stays with a person, every time.
Vendor pitches blur this line constantly, which is why many QMRs are rightly suspicious of "AI for ISO". So let's be exact about where the line sits. The line is the whole point.
The judgment layer and the clerical layer
Every document-control cycle has two kinds of work running at once.
The judgment layer is where a qualified person reads a proposed change and decides: is it technically correct, does it match what happens on the floor, does it conflict with another controlled document, is it ready for the next stage. This is the work clause 7.5 exists to protect. No competent QMR wants to hand it to a script, and no script deserves it.
The clerical layer is everything that happens after that judgment. Once the reviewer has said "correct" and the approver has said "release", someone still has to:
- Assign the next revision number
- Set the effective date
- Write a line into the amendment record
- Update the master document list
- Log the change in the change register
- Work out who needs a copy, and where
- Calculate the retention and disposal date
- File the superseded version correctly
None of that needs quality judgment. It needs accuracy and consistency, which is what software is good at and what a person doing it by hand for the hundredth time is not.
ISO automation does the second layer only, triggered by the outcome of the first.
Three levels, and only one of them is compliant
"Automation" gets used for three very different things. Separating them settles most arguments about ISO automation before they start.
| Level | What happens | Who decides |
|---|---|---|
| Manual | The DCC retypes every field into every register after approval | A person decides and a person executes |
| Automation (what we build) | The system writes the register entries, dates and distribution updates after a recorded human approval | A person decides, the system executes |
| "AI does your ISO" (what we do not build) | Software evaluates document content and approves or rejects it | Software decides. Not compliant |
The middle row is the only one that saves real hours and stays inside ISO 9001's requirement for competent human review. The bottom row is what gets vendors and their clients into trouble at audit: a system that silently makes adequacy judgments leaves no accountable person behind the decision trail.
If a vendor cannot draw this line for you in the first conversation, treat that as the answer.
What it looks like running
The clearest description is our reference build for a Thai manufacturer, ISO 9001:2015 certified across two sites. Their document control ran the way most factories' does: paper change-request forms routed for physical signatures, then a document controller retyping the outcome into several Google Sheets registers.
We did not change how they decide. We automated what happens after. The system covers the full lifecycle (new document, revision, cancellation, controlled copy, uncontrolled copy) and preserves the four human decision gates exactly as their SOPs define them: a reviewer marks the paper form, an approver checks content adequacy, and a combined final gate completes master sign-off, external and support documents included.
Only after that final sign-off does the system act. It writes the eight fields the document controller used to retype: revision number, effective date, amendment-record entry, the master-list row across a ten-department distribution matrix, the change-register entry, the year-keyed request number, the page count, and the calculated retention and disposal date. Each of the eight writes is logged individually to an activity log. The workflow is idempotency-keyed, so replaying the same approved event never duplicates a register entry.
Lifecycle state is mirrored by real Google Drive folders across a nine-step lifecycle. Moving a document between folders is still a human act; the automation reacts to the move, it never initiates it.
The build runs on n8n with Google Sheets as the register and master-list backend, and its logic came from the manufacturer's own written SOPs rather than a template. It passed 19 of 19 acceptance criteria, and all 51 unrelated workflows on the same automation tenant were verified unchanged afterwards. The five original source documents were also verified unchanged: same file IDs, names, formats and modification times.
One detail shows what "from their own SOPs" means in practice. The build surfaced a latent bug in the paper process: forms mixed Buddhist and Gregorian calendar years. The system standardised every date on dd/mm/yyyy, something the paper process had never forced anyone to reconcile.
What ISO automation is not
The negative space defines the category as much as the positive one, so here it is plainly.
It does not read a document and judge whether the content is adequate. It does not decide a change is minor enough to skip a review step. It does not auto-approve anything, under any threshold. It does not replace the reviewer or approver named in your SOP. And it is not a QMS platform you configure and populate yourself; that is a different category with a different set of trade-offs.
What it removes is the retyping, the transcription errors, the register drift, and the hours a document controller spends acting as copy-and-paste between a paper form and half a dozen spreadsheets, after every decision has already been made by the people whose job it is to make them.
FAQ
Does ISO automation replace the document controller?
No. It removes the repeat data entry, the same eight fields into the same registers every revision, so the document controller's time goes to document quality and SOP upkeep instead of transcription.
Can automation approve a document change on its own?
No. A system that approves content is outside ISO 9001's requirement for competent human review of adequacy. Automation should only run after a human decision has been recorded.
Does this replace our QMS software?
Not necessarily. It can sit beside a QMS or replace a spreadsheet-based register, depending on how your document control runs today. See how ISO automation compares to QMS software.
What platform is it built on?
The reference build uses n8n as the automation engine and Google Sheets as the register and master-list backend, because that matched what the manufacturer already ran. The platform is chosen to fit what you have, not the other way round.
Will an auditor accept an automated register?
An activity log that records every automated write, tied to a separately documented human approval, is a stronger audit trail than a hand-maintained spreadsheet. It removes the possibility of a register entry that does not match what was approved.
If you would rather see this mapped against your own document-control process than read about someone else's, book a free consultation with 1% EVO. Bring your current SOP; we open a running system and walk your workflow through it, live.