Artificial intelligence (AI) is increasingly being integrated into FDA regulated industries, where it is used to process large volumes of data, create documents, generate reports, analyze results, enhance search functions and support decision-making.
The FDA defines AI as the science and engineering of creating intelligent machines capable of performing tasks that typically require human intelligence. Even the agency is taking advantage of AI, as it recently announced that it launched upgraded internal AI capabilities as part of a broader modernization initiative, introducing Elsa 4.0 and a new unified data platform, HALO. The agency said it integrated more than 40 systems into HALO, which will allow reviewers to analyze regulatory data more efficiently, thereby enhancing scientific review, compliance and enforcement.
However, how FDA-regulated companies implement and utilize this technology comes with significant responsibilities and potential compliance challenges and risks. The April 2, 2026 warning letter (WL 320-26-58) issued to Purolea Cosmetics Lab1 offers one of the first GMP-related AI observations issued to industry. The FDA noted an “overreliance on artificial intelligence” finding that the company had used AI agents to generate drug product specifications, procedures and manufacturing records — without adequately reviewing the outputs for accuracy or cGMP compliance. Most strikingly, when investigators found the firm had skipped process validation entirely, the company responded that its AI agent had never flagged it as a requirement.
The FDA was clear in its takeaway: Any output from an AI agent must be "reviewed and cleared by an authorized human representative" of the quality unit.
This case illustrates that AI used in cGMP environments must meet applicable regulatory requirements, including 21 CFR Part 11 if generating electronic records, and may require validation to demonstrate consistent accuracy and reliability. The broader regulatory framework surrounding AI remains in development, and companies would be wise to stay ahead of it.
It is important for regulated companies to understand that probably the most critical concept with the appropriate use of AI is data integrity. Regardless of how easy it is to use or how comprehensive and professional the output appears to be, AI outputs are only as reliable as the data used to generate them. Principles such as ALCOA (Attributable, Legible, Contemporaneous, Original and Accurate) continue to apply and must be maintained throughout the data lifecycle. Inconsistent, incomplete or poorly managed input data can lead to unreliable outputs, which may ultimately compromise product quality, regulatory compliance and lead to the implementation of significantly insufficient quality systems.
AI is increasingly finding its way into how companies implement and manage their quality management systems (QMS). It can be used to analyze data, identify trends and support quality-related decisions. However, even as AI capabilities expand, human oversight remains essential. As demonstrated by the FDA warning letter, AI should function as a decision-support tool rather than a fully autonomous decision-maker. Organizations must ensure that appropriate governance structures are in place, including clear documentation, life cycle management and risk-based oversight. In addition, AI-enabled systems should be audit-ready, with sufficient transparency to allow regulators and other stakeholders to understand how data was generated, reviewed and ultimately how decisions are made.
It is clear from the FDA’s statements that the agency acknowledges companies may be using AI to create and generate GMP-related documents, such as specifications, SOPs and even master production records. However those documents must still go through a thorough review and approval process by the appropriate quality unit personnel prior to implementation. This is a requirement, per § 211.22(c) “Responsibilities of quality control unit,” which states that “The quality control unit shall have the responsibility for approving or rejecting all procedures or specifications impacting on the identity, strength, quality and purity of the drug product.”
Without this human review and approval, AI-created documents are not compliant with GMPs. The Purolea Cosmetics incident also makes it apparent that AI does not have the ability to assess all of the specific GMP requirements and produce fully compliant draft documents. Therefore, without appropriately trained and qualified quality personnel, there is a likelihood that companies will implement non-compliant and incomplete quality systems and documentation.
Though AI can certainly be used as a tool to assist in the development of GMP documents, it cannot and should not be used to replace the knowledge and expertise of experienced QA personnel. The GMP documents created by AI are likely only a reflection of what the AI tool references from the CFR. It appears that the documents reviewed by the FDA were a very generic interpretation of the regulations, and do not and cannot reflect the specific roles, responsibilities and processes within a manufacturing site or include ‘how’ things are actually done by each individual company. The apparent risk is that the AI-generated information is only a very high-level summarization of the regulations and does not include all the detailed requirements needed for compliance, such as process validation.
Additional uses of AI within QMS environments are also emerging, particularly in areas involving data analysis and risk management. Examples include analyzing quality data to identify trends and drive preventive actions, assessing supplier risk based on predefined criteria, and supporting supplier audit preparation by reviewing historical performance data. These applications demonstrate how AI can enhance efficiency and decision-making while remaining aligned with regulatory expectations when properly controlled.
Though the warning letter was written to a drug manufacturer, the FDA’s expectations apply to all FDA-regulated industries. This warning letter puts industry on notice that the FDA understands how AI is being used in quality system development — and has the tools to verify that documents, regardless of how they were created, are being properly reviewed and approved by quality unit personnel. Therefore, it is imperative that companies adopting AI in their quality systems engage internal audit teams or external consultants to evaluate data integrity, audit trail transparency, and QMS controls — ensuring full FDA compliance and inspection readiness."
In summary, while AI offers significant advantages in data processing and analytical capability, its use in regulated industries must be carefully governed. Organizations must balance innovation with compliance by ensuring robust data integrity practices, appropriate validation and ongoing human oversight. By doing so, they can effectively leverage AI to improve quality systems and operational outcomes while maintaining regulatory confidence.
References
1) U.S. Food and Drug Administration. (2026, April 2). Purolea Cosmetics Lab 722591 (Warning Letter WL 320-26-58).