The AI Didn't Know About Process Validation.

What QA doesn't know...

Five weeks after FDA's first warning letter citing AI overreliance, the implications are still being underestimated — particularly outside pharma.

On April 2, the FDA issued the first warning letter in the agency's history with a dedicated section titled Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing. The recipient was Purolea Cosmetics Lab, a Livonia, Michigan contract manufacturer that produces homeopathic OTC drug products. The letter cites multiple cGMP violations, but the AI section is the one that will be quoted in regulatory training decks for the next decade.

Most of the LinkedIn coverage of Purolea has focused on two themes: AI is here, and you need governance. Both are true. Neither captures what the letter actually says about how Quality Units will be evaluated going forward — particularly inside organizations that have been telling themselves Purolea is a pharma-only problem.

It is not.

What the warning letter actually says

The factual record, in summary. FDA inspected Purolea's facility from October 28 to 30, 2025. During the inspection, company personnel told the investigators that they had used AI agents to generate drug product specifications, procedures, and master production and control records — with the stated intention of helping the company comply with FDA requirements.

Two findings followed.

The first was that the AI-generated documents had not been independently reviewed by a qualified person before use. FDA cited 21 CFR 211.22(c), which makes the Quality Unit responsible for approving or rejecting all such documents. The agency wrote, in plain language, that a firm using AI in document creation "must review the AI generated documents to ensure they were accurate." Failure to do so is itself the violation.

The second finding is the one that will keep regulatory affairs leaders awake. The investigators noted that Purolea had not performed process validation prior to distributing drug products, as required under 21 CFR 211.100. When asked why, the firm's representative reportedly told the investigators that they were not aware process validation was a legal requirement — because the AI agent had not informed them it was required.

That sentence is now the most-quoted line in pharmaceutical regulatory commentary in 2026. It deserves to be.

The lesson nobody is drawing

The standard reading of Purolea is that the company was uniquely negligent. That reading is comforting and incomplete. Purolea's situation differs from the median small-to-mid-size manufacturer — pharmaceutical, biologic, or device — only by degree.

Across the regulated industries, quality professionals are quietly using AI to draft deviations, CAPA closures, supplier audit reports, design history file narratives, validation protocols, and 510(k) sections. Most of this AI use is not formally sanctioned at the corporate level. It is happening because individual quality engineers have discovered that ChatGPT or Claude or Copilot can produce a defensible-looking first draft in five minutes instead of three hours.

That activity is not a violation by itself. The Purolea letter is explicit on this point: AI-assisted document creation is permitted. What is not permitted is AI output entering the quality system without competent human review.

The structural problem — and it is a structural problem, not a moral one — is that most Quality Units do not yet have the AI literacy to detect what AI gets wrong. AI tools confidently invent regulatory citations. They produce SOPs in correct cGMP format that omit critical steps. They cite ISO clauses that do not exist. The competent reviewer required by 211.22(c) — and by ISO 13485 §4.1.6 for device firms operating under the QMSR — must now also be a reviewer who can recognize hallucinated regulatory content. That is a new competency. Most QUs do not have it. Most have not yet acknowledged that they need it.

Why this is not a pharma-only problem

Three reasons device firms should treat Purolea as their warning letter, even though it was issued under 21 CFR Parts 210 and 211.

First, the QMSR's incorporation of ISO 13485 brings §4.1.6 into device regulation. That clause requires manufacturers to validate the application of computer software used in the quality management system, proportional to the risk associated with its use. AI tools used to draft design history file narratives, supplier audit reports, or design verification protocols sit squarely inside §4.1.6's scope. The QMSR did not introduce a Purolea-specific citation, but the underlying requirement is structurally identical.

Second, Compliance Program 7382.850 elevates Outsourcing and Purchasing to one of six QMS Areas. If your contract manufacturer or testing lab is using AI in cGMP operations and you have not asked, you have not exercised supplier oversight. Sponsors who outsource to CDMOs need to update quality agreements to require disclosure of AI tool use, audit rights specific to AI-assisted activities, and documented human review of AI outputs.

Third, FDA and EMA jointly released the Guiding Principles of Good AI Practice for Drug Development on January 14, 2026. Purolea's inspection was in late October 2025 — before G-AI-P existed. The warning letter was issued in April 2026 — after. Any AI use in cGMP or QMS operations going forward is happening with regulatory expectations already on the public record. The "we did not know" defense is no longer available to anyone.

What to do this quarter

Four actions, in priority order.

First, conduct an AI inventory. 

Find out — actually find out, not assume — what AI tools are being used in your quality, regulatory, and manufacturing operations. Include the unsanctioned tools your team is running on personal accounts. The ones you do not know about are the ones that will surface in your next inspection.

Second, update your AI governance framework to define competent review. 

It is not enough to require human review of AI output. The reviewer must be qualified to detect AI failure modes — hallucinated citations, structurally correct but operationally incomplete documents, fabricated cross-references. This is a training problem, not a procedure problem.

Third, update quality agreements with contract manufacturers and testing labs. 

Add disclosure requirements for AI tool use, audit rights specific to AI-assisted activities, and documented human review obligations. This is now an expected element of supplier oversight under CP 7382.850 and CP 7356.002 alike.

Fourth, validate AI tools used in QMS workflows.

Under ISO 13485 §4.1.6 for device firms, or under data integrity principles and Part 11 expectations for pharma. Document intended use, performance qualifications, and the competence of the personnel reviewing outputs. The Purolea letter is the floor, not the ceiling.

Closing

The most quotable line in the Purolea warning letter is the one about the process validation requirement the AI never flagged. The most important line is not. The most important line is FDA's plain statement that AI-assisted document creation does not reduce the Quality Unit's obligation to review and approve.

That obligation has not changed. What has changed is the technology that quality units are now responsible for evaluating — and the literacy required to do so competently. Firms that treat that literacy as optional are sitting on the next Purolea letter.

If you are not sure how AI is actually being used inside your quality operations — or whether your QU has the literacy to review what it produces — find out before the warning letter writes itself.

Sources for the reader who wants to verify: FDA Warning Letter to Purolea Cosmetics Lab, 722591 (WL 320-26-58), April 2, 2026; 21 CFR 211.22 and 21 CFR 211.100; ISO 13485:2016 §4.1.6; FDA-EMA Guiding Principles of Good AI Practice for Drug Development (G-AI-P), January 14, 2026; FDA Compliance Program 7382.850, "Inspection of Medical Device Manufacturers," issued January 30, 2026.