What FDA's AI Warning Letter Tells Us About GMP Accountability

The FDA’s April 2026 warning letter to Purolea Cosmetics Lab provides a concrete enforcement example involving artificial intelligence (AI) in current good manufacturing practice (CGMP) documentation.¹ During the inspection, the firm told the FDA investigators that it had used AI agents to create drug product specifications, procedures, and master production or control records to help comply with the FDA requirements. The FDA’s concern was direct: firms using AI to assist document creation must review the resulting documents for accuracy and compliance with CGMP before use. The FDA cited the failure to do so as a violation of 21 Code of Federal Regulations (CFR) 211.22(c). The letter also describes a process-validation gap under 21 CFR 211.100 after the firm stated that the AI agent had not identified the requirement. AI-assisted drafting can support documentation work only when the resulting document is subject to quality-system controls. That requires controlled source material, qualified review, quality unit approval, version history, and retained evidence that the final record was checked before use.^1–3

Why Did This Warning Letter Matter?

The Purolea letter is notable because FDA explicitly addressed AI in the body of a CGMP warning letter and linked its use to established quality-system responsibilities. The firm had used AI agents to create specifications, procedures, and master production or control records. These are controlled documents that can shape manufacturing, testing, batch documentation, and product disposition.¹

The FDA did not need an AI-specific rule to make this finding. The letter states that, when AI is used to assist document creation, the firm must review the resulting documents to confirm their accuracy and compliance with CGMP. The FDA cited the failure to do so under 21 CFR 211.22(c), which assigns the quality control unit responsibility for approving or rejecting procedures or specifications that affect identity, strength, quality, and purity.^1,2

The letter also describes a process-validation failure. The FDA investigators found that process validation had not been conducted before distribution of drug products, as required under 21 CFR 211.100. The firm stated that its AI agent had not identified the requirement. That explanation does not shift accountability: software can assist a task, but it cannot substitute for the firm’s responsibility for ensuring that required GMP activities are performed.^1,3

Where Does the Quality Unit’s Responsibility Begin?

The Quality Unit is not merely a final reviewer. Under 21 CFR 211.22, it has authority over components, in-process materials, packaging, labeling, drug products, and production records. It is also responsible for approving or rejecting procedures or specifications that affect the identity, strength, quality, and purity of the drug product. The unit’s responsibilities and procedures must be in writing and followed.²

That matters for AI-assisted drafting because the relevant risk is not the tool used to prepare the first draft. The risk is that a procedure or specification enters use without a controlled basis, documented review, or a quality unit decision. The Purolea finding applies an established framework to a new drafting route: a GMP document still requires defined sources, qualified review, and quality unit approval before use.^1,2

Section 211.100 adds the same point from another direction. Written procedures for production and process control must be designed to assure identity, strength, quality, and purity. They must be drafted, reviewed, and approved by appropriate organizational units and reviewed and approved by the quality control unit. They must also be followed during production, and deviations must be recorded and justified.³

What Makes AI-Assisted GMP Documentation Fragile?

The central issue is not simply that AI-generated text can be wrong, a risk common to any draft. AI output can appear complete while obscuring missing source checks, unsupported assumptions, or weak linkage to the firm’s approved process. Those gaps create a documentation risk before they become technical risks.

A specification generated from the wrong source can look polished. A procedure can describe a generic manufacturing step that does not match the site’s equipment, validated parameters, sampling plan, or cleaning controls. A master production or control record can omit a required verification step and still read fluently. In a GMP setting, fluency has no evidentiary value unless the record can be traced back to approved sources and accountable review.^1,4,5

This is why the Purolea letter is better understood as a quality-system signal than as a general warning against AI. The firm needed a process that made each AI-assisted document reviewable: what source material was used, who checked the output, what changes were made, who approved the final document, and where the supporting evidence was retained.^1,4,5

How Should AI-Assisted Drafting Be Controlled?

A workable control model does not require every prompt to be treated as a regulated system event. It should, however, distinguish informal drafting from AI use that creates or revises a GMP-controlled record. When AI is used to prepare or revise a specification, procedure, batch record, validation document, investigation response, or other controlled record, the output should enter a defined review path.

The first step is to define intended use. Teams should know which tasks are permitted, which are prohibited, and which require prior Quality Unit approval. The second step is to assemble a source package before drafting. AI should not be used to establish the factual or procedural basis for a GMP document. The approved procedure, product specification, validation report, batch record template, change control, regulatory commitment, or supplier document should be identified before the output is reviewed.

The third step is technical review. A subject-matter expert should check the output against the approved source package and the process used at the site. The fourth step is Quality Unit approval. The final document should follow the same document-control route that would apply if the draft had been prepared without AI. The fifth step is retention. The firm should be able to produce the final approved record, the key source material, the review evidence, and the approval history.^1–5 Table 1 summarizes these controls and the evidence a firm should retain to make the process inspectable.

Where Do Part 11 and Data Integrity Fit?

Part 11 should be handled carefully. The FDA’s scope guidance says Part 11 applies when records required by predicate rules are maintained in electronic format in place of paper, or when electronic records are relied on to perform regulated activities. A firm should therefore document whether the AI workspace, the document-management system, or the approval workflow is part of the electronic record relied upon for GMP activity.⁶

That does not mean that every AI draft becomes a Part 11 record. If the regulated record is a controlled final procedure in the document-management system, the Part 11 assessment may focus on that system and its approval workflow. If the AI workspace stores source material, review history, or approvals on which the firm relies to defend the record, the compliance analysis changes. The firm should document that decision prospectively, rather than first addressing it during an inspection.⁶

Data integrity has a narrower but useful role here. The FDA’s data integrity guidance expects data to be reliable and accurate and allows risk-based strategies to prevent and detect data-integrity lapses. For AI-assisted GMP documentation, that means the firm should be able to reconstruct how the final record was created, checked, approved, and retained. It also means avoiding uncontrolled copy-paste routes that leave no review trail.⁵

How Should Firms Apply Risk-Based Review?

A risk-based approach is appropriate, but it cannot be used to bypass CGMP requirements. The International Council for Harmonisation’s Q9(R1) states that the level of effort, formality, and documentation should be commensurate with the level of risk. It also makes clear that quality risk management does not replace the obligation to comply with regulatory requirements. This distinction is useful when defining AI controls.⁷

A draft internal training outline may need a lighter review than a master production record. A revised product specification, process-control procedure, validation protocol, or batch-record instruction should receive a much higher level of scrutiny. The review burden should follow the possible effect on product quality, patient risk, regulatory commitments, and batch disposition.^2,3,7

The FDA’s January 2025 draft guidance on AI for regulatory decision-making is not a GMP documentation guidance and is not for implementation. Its context-of-use and credibility framework is nevertheless useful. Within a quality system, the same logic supports a practical question: What decision does this AI output support, how could it affect quality, and what evidence is needed before the output is relied upon?⁸

What Should Manufacturers Do Now?

The immediate work is to identify where AI is already being used to draft or revise GMP content. Firms should classify those uses by risk, assign an accountable owner, and determine which outputs must follow a defined source-review-approval path. The review should involve product and process experts, not only document-control staff.^1–5,7

Quality units should also define the evidence that will be retained. The retained record does not necessarily need to preserve every informal prompt used during early drafting. The firm should define, through a risk-based procedure, the inputs and review artifacts needed to defend the final GMP decision: approved source documents, key reviewer checks, changes made before approval, Quality Unit clearance, effective date, and version history.^1–7

Supplier and contractor arrangements require the same discipline. FDA reminded Purolea that a firm remains responsible for the quality of its drugs regardless of agreements with contractors. If a contractor, consultant, or software vendor supports AI-assisted GMP documentation, the firm still needs enough control to defend the final record and the process that produced it.^1,4

The Key Takeaway

The Purolea warning letter does not establish a separate AI regulatory framework. It applies existing CGMP accountability to AI-assisted drafting. In practice, AI may help prepare GMP content, but the firm must establish and retain the controls needed before that content is used in manufacturing or quality operations.

For quality and CMC leaders, the practical response is to integrate AI-assisted drafting into existing document-control and quality-system processes. Define permitted uses, control source material, verify the output, approve the final record, and retain evidence of the review.

References

1. FDA. Purolea Cosmetics Lab, Warning Letter 320-26-58, MARCS-CMS 722591. April 2, 2026. Accessed May 26, 2026. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/purolea-cosmetics-lab-722591-04022026

2. 21 CFR 211.22. Responsibilities of Quality Control Unit. Accessed May 26, 2026. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-B/section-211.22

3. 21 CFR 211.100. Written Procedures; Deviations. Accessed May 26, 2026. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-F/section-211.100

4. FDA. Quality Systems Approach to Pharmaceutical CGMP Regulations. Guidance for Industry. September 2006. Accessed May 26, 2026. https://www.fda.gov/media/71023/download

5. FDA. Data Integrity and Compliance With Drug CGMP: Questions and Answers. Guidance for Industry. December 2018. Accessed May 26, 2026. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers

6. FDA. Part 11, Electronic Records, Electronic Signatures: Scope and Application. Guidance for Industry. August 2003. Accessed May 26, 2026. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application

7. ICH. Q9(R1) Quality Risk Management. Final version. Adopted January 18, 2023. Accessed May 26, 2026. https://database.ich.org/sites/default/files/ICH_Q9%28R1%29_Guideline_Step4_2022_1219.pdf

8. FDA. Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products. Draft Guidance for Industry and Other Interested Parties. January 2025. Accessed May 26, 2026. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological

About the Authors

Gourav Pandey is Pharmaceutical Science Quality Lead, Takeda. Svyatoslav Borshchenko is CEO & Co-founder, GxPilot.