One AI warning letter is not a trend. The rules behind it are.

Regulatory status as of October 7, 2026. Guidance and drafts below are not requirements. Check dates before you rely on any of it.

Introduction: what regulators have actually said about AI in GxP

As of October 7, 2026, my searches of FDA’s warning-letter database and the public web found one posted drug-CGMP warning letter expressly saying a firm used AI to create CGMP documents: Purolea Cosmetics Lab. They also found six medical-device letters naming AI or machine learning in the product or claims, RadLogics, Shenzhen Sunell, WAVi, Exer Labs, SeniorLife, and O.N. Diagnostics, and three tobacco letters quoting AI-chat product features: Green Rush, LLC d/b/a XHALE CITY and North Disposable (both October 29, 2024), and Hellosynixvape.com (October 9, 2025). The three tobacco letters concern unauthorized ENDS products and youth-attractive product features; they are not findings about AI used in a GxP process. My searches found no non-FDA formal action about AI use in GxP work and no public Form 483 mentioning AI. One MHRA Inspectorate blog post is an observation, not a finding against a named firm.

That count comes from my searches of FDA’s warning-letter database through October 6, 2026, the latest posting date visible when I searched, plus web searches. “None found” means none found in the sources I searched. It is not proof that none exist.

The count matters to Quality leaders deciding how much control AI-drafted procedures, specifications, and regulator letters need. The Pharma AI Tracker lists AI initiatives companies describe in public. It records what companies say, not what inspectors found. This post is the other side: what regulators have said, and what they have done.

The one precedent: Purolea

What FDA found

On April 2, 2026, the FDA Center for Drug Evaluation and Research issued warning letter 320-26-58 to Purolea Cosmetics Lab, a Livonia, Michigan drug manufacturer whose products included homeopathic drug products. The letter followed an inspection held from October 28 to 30, 2025.

FDA cited 21 CFR 211.22(c) because the quality unit (QU) did not review AI-generated specifications, procedures, and master production or control records. If you use AI as an aid in document creation, “you must review the AI generated documents” so they are accurate and compliant with current good manufacturing practice (CGMP).

FDA cited no new AI-specific rule. It applied an existing QU duty to documents an AI tool produced.

The same letter cites many items that are not about AI, including process validation, testing, and insanitary conditions. In its April 2, 2026 letter, FDA said it recognized that the firm had ceased drug production and acknowledged the firm’s commitment to cease production and distribution at that facility. The letter does not attribute that cessation to the AI finding.

The AI did not tell them.

The letter records that the AI agent “never told you it was required”. FDA still said AI output must be “reviewed and cleared by an authorized human representative”. The tool’s silence did not change the QU’s duty to review.

There is a GCP parallel, and it is not an AI letter. In August 2024, FDA wrote to investigator Julio R. Flamini. His position, as FDA recorded it, was that “the electronic dispensing algorithm lacked safety guards to prevent errors”. FDA answered that “it is your responsibility” to follow the investigational plan. I use that letter as a general finding about an algorithm, not as a second AI case.

Why one letter is enough to act on, but not a trend

My searches found no second letter about a firm using AI in GxP work. They found no public Form 483 that mentions AI. The Purolea Form 483 is not public.

The six device letters, dated from 2018 to 2026, are about AI or machine learning in the product or its claims. For Exer Labs and SeniorLife, AI-based screening claims put the software in device territory, and the quality-system findings in these letters are generic, such as design controls, complaints, CAPA, and audits. They are not evidence that FDA is enforcing AI validation in GxP work.

RadLogics (April 5, 2018) is the earliest. FDA’s letter says its software used “machine learning algorithms”. Shenzhen Sunell (March 4, 2021) named an “AI Fever Screening Network Camera”. Exer Labs (February 10, 2025) was cited for AI-based screening claims and those quality-system gaps. SeniorLife (August 21, 2025) was cited for an app using AI-based screening algorithms, with the same kind of findings. WAVi (October 20, 2023) called its software “research software”. FDA wrote: “Under 21 CFR 820.30(g), there is a requirement for the software to be validated.” WAVi is a device product. A research label did not remove the validation duty. O.N. Diagnostics (September 1, 2026) added “a new machine learning algorithm” to its VirtuOst VFA software; FDA said the feature “must be adequately validated” and needed a new premarket notification.

One letter is not a trend, and I will not call it one. It is enough to act on, because it applies a QU duty firms already have.

Ordinary findings that matter for AI. Intas (March 30, 2026): a quality assurance employee instructed the vendor to change an electronic batch record outside the audit trail. Shiva Analyticals (July 23, 2025): laboratory analysts performed hundreds of entries related to “Add/Modify/Delete peaks”, and FDA found that the quality unit failed to ensure the reliability and integrity of analytical testing data. Curia (September 18, 2026): an analyst “used another analyst’s login credentials”. Applied Therapeutics (late 2024): a third-party vendor deleted electronic data, including audit trails, for all 47 subjects. None of these letters mention AI. I am applying the same logic.

What the record shows, as of October 7, 2026

1 FDA drug-CGMP warning letter saying a firm used AI to create CGMP documents (Purolea) AI finding

6 FDA device letters, 2018 to 2026, naming AI or machine learning in the product or claims (RadLogics, Shenzhen Sunell, WAVi, Exer Labs, SeniorLife, O.N. Diagnostics) Device product

None formal AI actions outside FDA found in the sources searched Search result

None public Form 483s mentioning AI found in the sources searched Search result

1 MHRA Inspectorate blog post, an observation and not a finding against a named firm Observation

Across the Atlantic: same message, different tools

MHRA: the risk is now real

On June 29, 2026, the MHRA Inspectorate published “Use of AI for GXP inspection responses: setting standards without stifling innovation”. In at least one case, “an AI-generated response to a serious, patient safety impacting deficiency contained material inaccuracies, including non-existent references”. The blog says inappropriate use has “shifted from theoretical risk into actual, realised risk”. It adds: “our concern isn’t whether you use AI”.

MHRA may reject such a response, treat the organization as higher risk on later inspections, or refer it to the Inspection Action Group (IAG). This is an anonymised observation. It is not a finding against a named firm, and it is not enforcement.

The blog is about correspondence sent to the regulator. Purolea is about GMP documents used to make product.

The EU is writing AI-specific text, but it is not law yet

Draft Annex 22 was open for consultation from July 7 to October 7, 2025. The EMA GMP/GDP Inspectors Working Group drafted it with PIC/S. It is not yet in effect. On October 3, 2026, the EudraLex Volume 4 page still listed Annex 11 (January 2011) and Chapter 4 (January 2011), and it listed no Annex 22.

The draft applies to static, deterministic models in critical GMP applications. It says it does not apply to generative AI and large language models, and that “such models should not be used in critical GMP applications”. That is a draft sentence, not a binding ban.

An EMA workshop on Annex 22 was held on June 30 and July 1, 2026, and its report was first published on October 2, 2026 (reference EMA/156789/2026, accessed October 3, 2026). The drafting group discussed scope “to allow dynamic or adaptive models, probabilistic models, and Generative AI/LLMs in GMP applications”. I read the report as a record of an expert workshop. Much of it records consolidated industry views, followed by regulator questions and possible effects on drafting. It is not an EMA decision.

The EMA GCP guideline on computerised systems (March 9, 2023) says requirements for AI beyond the general ones “will not be covered in this guideline initially”. My reading: “no AI annex yet” is not “no requirements”. The MHRA policy paper of April 30, 2024 says there is no specific AI reference in pharmacovigilance regulations, but quality system requirements still apply.

FDA’s January 2025 draft guidance, still listed by FDA as Draft Level 1 Guidance on October 3, 2026, says in a footnote that “the responsibilities of the quality control unit described in 21 CFR 211.22 and 211.68 are applicable.” Both Purolea and that footnote rest on 211.22. The footnote also names 211.68, which the Purolea letter does not cite.

Rules for what must be exact, AI for the language, a person for the decision

1. 1Exact: rules and checksCGMP requirements, specifications, references, citations.
2. 2Language: AI drafts, under controlWording around the locked items.
3. 3Decision: a named person in the quality unit clears itApproval on the record before use.

What must be exact

CGMP requirements, specifications, references, and citations have to be exact.

At Purolea, the letter says the AI agent did not tell the firm about a requirement, and the QU did not review the AI-generated documents. In the MHRA case, the response “contained material inaccuracies, including non-existent references”.

My recommendation: check exact items with rules. Do not generate them. Test the output against a source you control.

Where AI helps

Use AI for the wording around those locked pieces, and keep the draft under document control.

The FDA draft guidance says it “does not address” AI used “for operational efficiencies”, such as internal workflows or drafting a regulatory submission, when that use does not affect patient safety, drug quality, or study-result reliability. That has a limit. At Purolea, FDA applied 211.22(c) to AI-drafted GMP documents, because the QU approves procedures and specifications that affect product quality.

Draft revised Annex 11, not yet in effect, is a small EU example. Clause 12.5 says “The use of tools to help conduct audit trail reviews is encouraged”. My reading: any such tool would need validation for its use.

Who decides

For Purolea’s stated use, FDA said AI output must be “reviewed and cleared by an authorized human representative” of the firm’s QU. The workshop report says “Accountability remains with qualified/responsible persons and cannot be delegated to AI”. That sentence is from the workshop record, not an EMA decision.

Draft Annex 22 section 3.3, also not yet in effect, says “the training and consistent performance of the operator should be monitored like any other manual process”. The MHRA GxP data integrity guidance (2018) names the risk of “an overreliance on the system’s validated state”.

The Purolea language quoted here stops at review and clearance. The other FDA materials cited here address broader risk, validation, and lifecycle controls. The EU and MHRA texts add monitoring of the reviewer. My suggestion is spot checks of approved AI drafts. The workshop report adds: “Oversight should be evidenced and periodically reviewed; it cannot compensate for inadequate validation”.

Scale validation to the context of use

The FDA draft guidance builds on “context of use”. Name what the tool may do, then scale the evidence. It is still a draft.

Computer Software Assurance, reissued February 3, 2026, covers production and quality-system software for devices. Its risk framework can be applied to “artificial intelligence/machine learning tools”. That sentence is device scope.

The joint FDA and EMA principles of good AI practice are non-binding. There are 10 principles. They describe a risk-based approach “with proportionate validation, risk mitigation, and oversight”.

FDA’s data integrity questions and answers (December 2018) say a CGMP workflow such as creating an electronic master production and control record “is an intended use of a computer system to be checked through validation”. WAVi, a device product, is the matching caution: a “research software” label did not remove validation.

Draft Annex 22 limits its scope by model characteristics and then applies risk-based controls. FDA’s draft organizes model-credibility evidence around risk and context of use. The Purolea letter does not apply either framework. It cites 21 CFR 211.22(c).

Version changes. A changed model or algorithm can need its own evidence, and an update can change controls. Dexcom (March 4, 2025) is a device letter, not an AI letter. FDA said Dexcom’s response did not adequately support using data from the G6 pivotal study to support the G7 device because the two sensors use different glucose algorithms. Ava (April 14, 2026) is not an AI letter either: the firm said a software update let users bypass security access restrictions. O.N. Diagnostics (September 1, 2026) is a direct AI example, but it is a device letter, not a GxP letter. After the firm added a new machine learning algorithm, FDA wrote: “A new model trained on different data, with different architecture, or optimized for a different objective may perform differently across patient populations, imaging equipment types, or clinical settings.” The CDER 2023 discussion paper, not policy, says “Continuously learning AI systems that adapt to real-time data may challenge regulatory assessment and oversight.”

My recommendation: pin model versions in validated use, and treat a vendor model update as a change that needs an impact assessment.

What it costs, and what skipping it costs

I will not invent a cost. The sources do not state one.

The controls mostly exist already. On July 7, 2026, FDA cited Specialty Health Products, a device maker, for controlled documents kept as editable Word files “without password protection”, with no electronic signatures or other controls against unauthorized modification. One procedure’s text had been saved under another procedure’s title. On May 14, 2026, FDA cited GC America because data was deleted on shutdown, and “no records were available” to show QU review.

Applying those controls to AI drafts costs effort. Skipping them has a published cost in outcomes: the Purolea letter, and the steps MHRA says it may take: a rejected response, a higher risk rating, or a referral to the Inspection Action Group. This is reasoning from those pages.

What I would check this quarter

This quarter I would sit with the quality unit and ask for evidence on the nine rows below. I would start with work already in use: who approves an AI draft, where that draft is filed, and which account the tool runs under. Each check is my recommendation. None of them is a new requirement.

This note only starts on two harder areas: vendors who hold the model, and oversight you can show an inspector. To see what companies say publicly about their own AI use, start with the Pharma AI Tracker.

Related reading: how FDA uses Elsa in inspections.

---

I work with Quality and AI leaders on questions about using GenAI and agents in GxP workflows defensibly. If you are asking what your AI use would look like against the requirements and checks above, get in touch. You can also check your AI controls against the rules.