1What FDA’s warning letter found.
FDA inspected Purolea Cosmetics Lab in Livonia, Michigan, from 28 to 30 October 2025 and issued Warning Letter 320-26-58 on 2 April 2026. The firm told investigators it had used AI agents “to create drug product specifications, procedures, and master production or control records to be in compliance with FDA requirements.” FDA’s response: “If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP. Your failure to do so is a violation of 21 CFR 211.22(c).”¹
The letter also documents “overreliance on artificial intelligence”. The firm had distributed product without process validation, which 21 CFR 211.100 requires, and when told so replied that it was not aware of the requirement because the AI agent had never told it. If the firm resumes production and uses AI for work such as procedures and specifications, “any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative of your firm’s QU”.¹ The letter does not cite the use of AI itself. It cites the missing review.
2Who must approve a GMP document.
The rules for approving a document don’t change because AI drafted it.
| Document | US requirement | EU requirement |
|---|---|---|
| Procedures and specifications | The quality control unit approves or rejects all procedures or specifications affecting identity, strength, quality and purity.² | Documents containing instructions are approved, signed and dated by appropriate and authorised persons, with a defined effective date.³ |
| Production and process control procedures, and changes to them | Drafted, reviewed and approved by the appropriate organisational units, and reviewed and approved by the quality control unit.⁴ | Designed, prepared, reviewed and distributed with care, and in line with the relevant parts of the product specification file and marketing authorisation dossier.³ |
| Master production and control records | Prepared, dated and signed by one person, and independently checked, dated and signed by a second.⁵ | Manufacturing formulae and processing instructions are instructions like any other, so they are approved, signed and dated by authorised persons.³ |
Chapter 4 also expects SOPs to be written in an “imperative mandatory style”, and documents to be regularly reviewed and kept up to date.³ FDA accepts electronic signatures with appropriate controls in place of the handwritten signatures 211.186(a) specifies for master records.⁶
3What the EU drafts say about AI-made documents.
The revised Chapter 4 that the European Commission and PIC/S published for consultation in July 2025 addresses AI directly. Draft paragraph 4.24 reads: “The accountability for the integrity of documents, records or (raw) data produced or processed with artificial intelligence or any other automatic means (e.g. validation scripts) rests with the regulated user.” Paragraph 4.25 asks for support by any automatic means, artificial intelligence included, to be part of the pharmaceutical quality system “regardless of the service located on premise or as a hosted service”.⁷ The companion draft Annex 22 says generative AI and large language models should not be used in critical GMP applications, and that in non-critical ones qualified, trained people are responsible for the output.⁸ Both are drafts. On 6 November 2026 EudraLex Volume 4 still lists the January 2011 Chapter 4 and no Annex 22.⁹
EMA’s final reflection paper on AI says something similar about medicinal product information. AI used to draft, edit, translate or review those documents “should be used under close human supervision”, because generative language models “are prone to include plausible but erroneous or incomplete output”.¹⁰
4What to check in an AI draft.
The approval route is the same as for any SOP, but an AI draft fails in its own ways. Check:
- Requirements against the regulation itself. Purolea told FDA it had not known process validation was required because its AI agent never said so.¹
- The procedure against what the site actually does. Production procedures must be designed to assure identity, strength, quality and purity, and must be followed as written.⁴
- The content against the marketing authorisation and product specification file.³
- Every citation and reference. NIST’s Generative AI Profile warns that generated output can include confabulated citations that make wrong content look justified.¹¹
- Training for the people who will work to it. Each person must be trained in the written procedures that relate to their functions.¹²
5How it runs in Seal.
Neil can turn a procedure into a process: give it an SOP and it drafts a process configuration in Seal, with the steps, checks and approval gates mapped to the source procedure. Your team checks the intended use, resolves ambiguities, tests the configuration and releases it under change control.
When an SOP changes, Neil can work through the change. It reads the previous and proposed revisions, the current process configuration and the linked training and change-control records, then drafts a source-mapped change summary and proposed process updates. The process and quality owners assess the impact, training and verification needed. In Word, Neil changes the file only once you accept its edits.
References
- 1Warning Letter 320-26-58 to Purolea Cosmetics Lab, MARCS-CMS 722591, FDA Center for Drug Evaluation and Research, 2 April 2026. https:/
/ www. fda. gov/ inspections- compliance- enforcement- and- criminal- investigations/ warning- letters/ purolea- cosmetics- lab- 722591- 04022026 (read 6 November 2026) - 221 CFR 211.22, Responsibilities of quality control unit, eCFR, current to 4 November 2026. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- B/ section- 211. 22 (read 6 November 2026) - 3EudraLex Volume 4, Part I, Chapter 4: Documentation, sections 4.2 to 4.5, European Commission, in operation since 30 June 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ chapter4_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 421 CFR 211.100, Written procedures; deviations, eCFR, current to 4 November 2026. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- F/ section- 211. 100 (read 6 November 2026) - 521 CFR 211.186, Master production and control records, eCFR, current to 4 November 2026. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- J/ section- 211. 186 (read 6 November 2026) - 6Data Integrity and Compliance With Drug CGMP: Questions and Answers, guidance for industry, question 11, FDA, December 2018. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 7Chapter 4: Documentation, draft for consultation, paragraphs 4.24 and 4.25, European Commission and PIC/S, July 2025. https:/
/ health. ec. europa. eu/ document/ download/ fa336a6e- 753b- 46fc- b53b- 9178bacd8878_ en?filename=mp_ vol4_ chap4_ consultation_ guideline_ en. pdf (read 6 November 2026) - 8Annex 22: Artificial Intelligence, draft for consultation, section 1, European Commission and PIC/S, July 2025. https:/
/ picscheme. org/ docview/ 9715 (read 6 November 2026) - 9EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026) - 10Reflection paper on the use of Artificial Intelligence (AI) in the medicinal product lifecycle, EMA/
CHMP/ CVMP/ 83833/ 2023, European Medicines Agency, adopted 9 September 2024. https:/ / www. ema. europa. eu/ en/ documents/ scientific- guideline/ reflection- paper- use- artificial- intelligence- ai- medicinal- product- lifecycle_ en. pdf (read 6 November 2026) - 11NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, sections 2.2 and 2.7, National Institute of Standards and Technology, July 2024. https:/
/ nvlpubs. nist. gov/ nistpubs/ ai/ NIST. AI. 600- 1. pdf (read 6 November 2026) - 1221 CFR 211.25, Personnel qualifications, eCFR, current to 4 November 2026. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- B/ section- 211. 25 (read 6 November 2026)
AQuestions and answers
Does an AI-drafted SOP need a different approval route?
No. It goes through the same route as any procedure: drafted, reviewed and approved by the appropriate units and the quality unit in the US, and approved, signed and dated by authorised people in the EU. What changes is what the reviewer looks for, such as invented references and missing requirements.
Can AI write a master batch record?
It can draft one, but a master production and control record must be prepared, dated and signed by one person and independently checked, dated and signed by a second. FDA accepts electronic signatures with appropriate controls for both. Purolea’s AI-created master records were among the documents in FDA’s citation.
Will inspectors ask whether AI drafted our documents?
They may. An HPRA inspector said in May 2026 that inspectors may ask at the opening meeting whether AI is used in any GMP system or process. FDA learned of Purolea’s use because the firm told its investigators.
Can AI compare two revisions of an SOP?
Yes, as an aid to the change review. The change still has to be drafted, reviewed and approved by the appropriate units and the quality unit, and the people it affects need training in the revised procedure.
Is the revised EU Chapter 4 in force?
No. The revision that names artificial intelligence was published for consultation in July 2025. The Chapter 4 in force is the January 2011 version, in operation since 30 June 2011.
