FDA just gave the industry a very clear signal about AI in a cGMP environment.

In an April 2, 2026 Warning Letter to Purolea Cosmetics Lab, FDA included a section on “Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing.” The core issue wasn’t that the firm used AI, it was that the firm relied on AI-generated quality content without qualified, documented human review and approval.

The citation at the center: 21 CFR 211.22(c)

FDA tied the issue to 21 CFR 211.22(c), which states the Quality Control Unit (QU) must approve or reject procedures/specifications that impact identity, strength, quality, and purity.

In this case, FDA wrote that if a firm uses AI as an aid in document creation, it must review the AI-generated documents to ensure they’re accurate and cGMP-compliant, and failing to do so is a violation of 211.22(c).

That’s the headline: AI doesn’t get to “own” compliance. The QU does.

What happened

FDA documented that the firm used AI to generate content intended to satisfy FDA requirements (e.g., specifications/procedures/records) and did not verify the outputs through proper oversight. FDA also described broader cGMP gaps and “overreliance on artificial intelligence,” including an example where the firm indicated it didn’t perform process validation because the AI “never told” them it was required.

This is why the letter matters: it connects AI use directly to a cGMP fundamentals failure, which is quality unit oversight and scientifically sound decision-making.

What this signals for everyone using AI in GxP

1) AI is a tool inside your quality system, not a substitute for it

If AI drafts a procedure, summary, specification, deviation narrative, investigation, or risk assessment, that output is still your controlled record. Your system must treat it as such.

2) Validation now extends to AI-assisted content workflows

Not every AI use case needs the same rigor, but risk-based assurance does. If AI influences GxP decisions or controlled documentation, you need defined expectations: intended use, limitations, controls, and how you verify performance over time.

3) “Human-in-the-loop” has to be real, documented, and defensible

A checkbox approval or “rubber stamp” won’t survive scrutiny. FDA is reminding industry that the QU must actually exercise judgment consistent with 211.22(c).

A practical AI governance checklist (what to implement now)

If your organization is already using AI, or planning to soon, start with these guardrails:

1. Define allowed use cases (and prohibited ones)
   Example: AI may draft non-final text, summarize non-GxP sources, or support brainstorming; AI may not be the sole author/approver of specifications, master records, or final GMP procedures without defined verification and approval controls.
2. Update SOPs to reflect AI-assisted workflows
   Include: required review steps, what reviewers must verify, and how the organization documents that verification.
3. Require traceability
   Maintain records of: what tool was used, version/model (where relevant), inputs, outputs, reviewer, approval rationale, and any edits made before finalization.
4. Train reviewers on “how to review AI”
   Reviewers need specific training: hallucination risk, missing requirements, false confidence, and what “adequate review” means for different document types.
5. Apply change control and periodic performance checks
   AI tools and prompts evolve. Treat significant changes like any other system change: evaluate impact, re-qualify where needed, and document it.

Bottom line

FDA isn’t telling the industry to stop innovating. FDA is reminding everyone that accountability stays with the Quality Unit and the company. And the requirement behind that message is not new: it’s anchored in 211.22(c).

If you’re adopting AI in a GxP environment, the win isn’t “using AI.” The win is building AI-assisted workflows that are controlled, validated (as appropriate), and inspection-defensible, with the QU’s role unmistakable in both practice and documentation.

If you want an extra set of hands, QSN can help you stand up a right-sized AI governance approach (use-case policy, SOP updates, reviewer training, documentation controls, and audit readiness). Contact us here.