Device software has had a provenance vocabulary for two decades. IEC 62304 calls software you did not develop yourself, and whose development record you do not hold, SOUP — software of unknown provenance — and requires you to identify it, justify its use and manage its risk.
AI-written code is not SOUP, but the question rhymes
Code generated by a model inside your own repository is first-party software by every formal definition. You wrote the prompt, your engineer accepted the output, it went through your process. It is not a third-party library.
And yet the practical question an assessor asks about SOUP — where did this come from and what do you know about how it was produced? — lands on it just as hard. If the answer is “an engineer here typed it,” the file says one thing and reality says another.
Traceability is the actual obligation
What IEC 62304 and the design history file expect is a traceable line from requirement to design to implementation to verification. Each link has to be reconstructible by somebody who was not there.
AI assistance does not break that chain in principle. It breaks it in practice, because one link — the reasoning that produced a particular implementation — used to live in a person's head and could be recovered by asking them, and now lives in a terminal session that closed weeks ago.
What to record, concretely
The instruction. The prompt that produced the implementation, not a paraphrase written later.
The tool and the model. Named, or left empty when the tool does not expose it. Guessing a model version in a regulated record is worse than admitting you do not know.
The diff. Which lines actually landed, as distinct from what the model offered.
The human decision. Who accepted it, and where possible what they changed before accepting — the edits are the strongest available evidence that a review happened.
Do not overclaim in the technical file
Two failure modes are equally bad. One is silence: a technical file that does not mention AI assistance at all when it was used throughout. The other is an unsupported claim: asserting full attribution when coverage started three months into the project and two developer machines were never recording.
State the method, state the period it covers, and state what is unattributed. An assessor can work with a documented gap. They cannot work with a number that falls apart under a single question.