1The letter and the inspection behind it.
FDA’s Center for Drug Evaluation and Research issued warning letter 320-26-58 on 2 April 2026 to Purolea Cosmetics Lab in Livonia, Michigan, after inspecting the site from 28 to 30 October 2025. The firm made homeopathic drug products. FDA found the drugs adulterated, both because they were prepared, packed or held under insanitary conditions and because the firm’s methods, facilities or controls did not conform to CGMP. It also found two products to be unapproved new drugs, and judged the firm’s response to the Form FDA 483 inadequate for lack of supporting documentation.¹
| What FDA cited | Regulation |
|---|---|
| Batches released without testing for objectionable microorganisms | 21 CFR 211.165(b) |
| Components not tested for identity and purity, and supplier certificates relied on without establishing their reliability | 21 CFR 211.84(d)(1), (d)(2) and (d)(6) |
| Quality unit did not oversee operations: procedures not established or followed, batch records not reviewed before release, production and process controls not adequate | 21 CFR 211.22(a) and (d); 21 CFR 211.100(a) |
| AI-generated documents not reviewed | 21 CFR 211.22(c) |
| No process validation before distribution | 21 CFR 211.100 |
The AI finding sat among ordinary CGMP failures. The letter gave it its own heading, “Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing”.¹
2What the letter said about AI.
During the inspection the firm told investigators it used AI agents to help it comply with FDA regulations, and specifically to create drug product specifications, procedures and master production or control records. FDA’s response was direct: “If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP. Your failure to do so is a violation of 21 CFR 211.22(c).”¹
FDA also recorded “overreliance on artificial intelligence”. Investigators found the firm had not validated its process before distributing drug products, as 21 CFR 211.100 requires, and told the firm so. The firm replied that it was not aware of the legal requirement because, in FDA’s words, the AI agent it used “never told you it was required”.¹
The firm had stopped making drugs. FDA wrote that if it resumes and uses AI to help with CGMP activities, “such as development of procedures and specifications, any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative of your firm’s QU”. Given the nature of the violations, FDA also said the firm should engage a qualified CGMP consultant to audit its whole operation.¹
3The rules behind it.
The letter created no new AI rule. It applied the existing CGMP regulations to a new kind of tool.
| Regulation | What it requires | How the AI use fell short |
|---|---|---|
| 21 CFR 211.22(c) | The quality control unit approves or rejects all procedures and specifications affecting identity, strength, quality and purity² | AI-drafted specifications and procedures were used without that review¹ |
| 21 CFR 211.22(d) | The quality unit’s responsibilities and procedures are in writing and followed² | Procedures were not established or followed¹ |
| 21 CFR 211.100 | Written production and process control procedures, drafted, reviewed and approved by the appropriate units and the quality control unit, and followed³ | Process validation was missing, and the firm relied on the AI agent to tell it what was required¹ |
| 21 CFR 211.34 | Consultants have the education, training and experience to advise on what they are retained for⁴ | FDA asked for a consultant qualified under this section¹ |
4What it means for companies that use AI.
The letter does not ban AI. It anticipates that the firm may use AI to help with CGMP activities and sets the condition: an authorised human representative of the quality unit reviews and clears the output.¹ Three practical points follow from its text.
First, review means checking that the content is accurate and compliant, not only that a document exists. Second, the AI tool is not a source of regulatory knowledge: the firm stays responsible for knowing what CGMP requires, whatever the tool did or did not say. Third, the approval belongs to the quality unit, which 211.22(c) makes responsible for approving or rejecting procedures and specifications however they were drafted.¹²
European inspectors say much the same. HPRA told the May 2026 QP Forum that the company and the personnel responsible for a GMP activity using AI are responsible for the decisions made on its outputs, that verification through a human in the loop or other guardrails is key, and that inspectors may ask at the opening meeting whether AI is used in any GMP system or process.⁵ For the EU draft rules, see whether AI can be used in GMP.
5How it runs in Seal.
Neil, Seal’s AI agent, drafts and proposes; it signs, approves and releases nothing. Each finding links to the record, version and field behind it, and Neil says what the records don’t show. When Neil turns a procedure into a process, it proposes a change; the change’s tests run, QA signs, and the next run follows the released version.
The validation and AI assurance guide sets out the evidence to keep for an AI-assisted decision: the request and requester, the source records and versions, the output, any proposed actions and the reviewer’s decision. It advises keeping the original output rather than relying on a later rerun, so what supported the decision at the time is preserved.
References
- 1Warning Letter 320-26-58, Purolea Cosmetics Lab, MARCS-CMS 722591, FDA Center for Drug Evaluation and Research, 2 April 2026. https:/
/ www. fda. gov/ inspections- compliance- enforcement- and- criminal- investigations/ warning- letters/ purolea- cosmetics- lab- 722591- 04022026 (read 6 November 2026) - 221 CFR 211.22, Responsibilities of quality control unit, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 22 (read 6 November 2026) - 321 CFR 211.100, Written procedures; deviations, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 100 (read 6 November 2026) - 421 CFR 211.34, Consultants, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 34 (read 6 November 2026) - 5Question and Answers, Richard O’Sullivan, GMP Inspector, HPRA, QP Forum, Trinity College Dublin, 12 May 2026. https:/
/ www. tcd. ie/ media/ tcd/ pharmacy/ images/ qp- forums/ qp- forum- 2026/ presentations/ 9. 3- HPRA- QA. pdf (read 6 November 2026)
AQuestions and answers
Does the letter ban AI in drug manufacturing?
No. It describes the conditions for using AI: if AI helps create CGMP documents such as procedures and specifications, the firm must review them for accuracy and compliance, and an authorised human representative of the quality unit must review and clear the output.
Is “the AI didn’t tell us” a defence?
No. The firm said its AI agent never told it that process validation was required, and FDA recorded that as overreliance on AI. Knowing and meeting the CGMP requirements stays the manufacturer’s responsibility.
What regulation did FDA cite for the AI use?
21 CFR 211.22(c), which makes the quality control unit responsible for approving or rejecting all procedures and specifications that affect the identity, strength, quality and purity of the drug product. The letter also pointed to 21 CFR 211.100, on written production and process control procedures.
What should a quality unit check in an AI-drafted document?
What it would check in any draft procedure or specification: that the content is accurate and actually compliant with CGMP. The letter adds nothing AI-specific to the review itself; it makes clear that the review has to happen and that an authorised human representative of the quality unit clears the result.
Do European regulators take the same view?
Broadly, yes. Ireland’s HPRA has said the company and the people responsible for a GMP activity are responsible for decisions made on AI outputs, and that verifying those outputs is key. The EU’s draft Annex 22 would also make qualified people responsible for checking generative AI output in non-critical uses.