On April 2, 2026, the U.S. Food and Drug Administration (FDA) issued Warning Letter 320-26-58 to Purolea Cosmetics Lab. It appears to be one of the first publicly visible FDA drug current Good Manufacturing Practice (CGMP) Warning Letters with a dedicated section on the inappropriate use of artificial intelligence (AI) in pharmaceutical manufacturing.
This matters less for what FDA created and more for what FDA reaffirmed. The Warning Letter does not establish new AI rules. It applies long-standing Part 211 requirements — Quality Unit oversight and production and process controls — to a firm that used AI without authorized Quality Unit (QU) review.
The broader AI governance conversation is moving quickly. FDA and EMA’s joint Good AI Practice principles describe the direction of travel. Purolea is narrower: it shows FDA applying existing CGMP requirements when AI-supported work enters the manufacturing record.
The underlying thesis is short. AI changes the mode of error. It does not change the locus of responsibility.
The inspection ran October 28–30, 2025, at Purolea Cosmetics Lab in Livonia, Michigan. The Warning Letter followed on April 2, 2026.
The AI finding didn’t appear in isolation. FDA cited broader CGMP deficiencies, including insanitary conditions, missing microbiological release testing, missing component identity testing, and missing process validation. The firm has since ceased drug production. That context matters because the letter should not be read as a warning against thoughtful, controlled AI use in an otherwise mature quality system. The AI finding appeared alongside broader CGMP deficiencies — it was not an isolated AI enforcement action.
What makes the letter notable is the inclusion of a dedicated section titled “Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing.” In that section, FDA documents that the firm used AI agents to create drug product specifications, procedures, and master production or control records. The firm then failed to perform authorized Quality Unit review of those AI-generated documents before they took effect in the operation.
That is the part of the letter every GMP-regulated organization should read carefully.
FDA tied the AI finding to two long-standing sections of Part 211. Both predate AI by decades.
21 CFR 211.22(c) — Quality Unit responsibilities (the CFR text uses “quality control unit”; this post uses “Quality Unit” throughout). FDA’s framing in the Warning Letter is direct: “If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP. Your failure to do so is a violation of 21 CFR 211.22(c).”
That sentence does a lot of work. It does not prohibit AI or create a standalone AI-validation rule for AI-assisted document drafting. It says the Quality Unit owed the same review it has always owed, and the use of AI as the drafting tool did not change that obligation.
21 CFR 211.100 — written procedures for production and process control. FDA cited 21 CFR 211.100 in connection with the firm’s failure to conduct process validation before distribution. The firm’s response highlights the risk of bypassing human expertise: they stated they were not aware of the validation requirement because the AI agent they used never told them it was required.
A precision point matters here for validation professionals. 21 CFR 211.100 does not use the phrase “process validation.” FDA cited the section as the regulatory anchor for the firm’s process-control failure. FDA applies 211.100 within the broader CGMP expectation. Production and process controls must be established, approved, followed, documented, and capable of assuring product quality.
Together, the two citations make a single point: the Quality Unit owes review of AI-generated GMP-critical content, and process controls owe validation regardless of how the underlying procedures were drafted.
The Purolea letter is precise about what it does and doesn’t establish.
Do not conclude:
Do conclude:
The distinction matters because AI governance in life sciences is moving quickly. Several signals point toward governed, reviewable AI use. The FDA and the European Medicines Agency (EMA) have issued joint Good AI Practice principles. The International Society for Pharmaceutical Engineering (ISPE) released the GAMP Guide for AI in GxP-Regulated Systems in July 2025, and the guide extends the Good Automated Manufacturing Practice (GAMP) framework to AI use. The draft EU Annex 22 went through public consultation in 2025 and, if finalized, will become the EU’s first GMP-specific AI annex.
One caution worth flagging: the draft Annex 22 text treats generative AI and large language models (LLMs) more restrictively than narrow, deterministic AI/ML systems. It signals that generative tools should not be used in critical GMP applications. Purolea should be read inside that broader movement, not inflated into a sweeping FDA AI doctrine.
In the end, the takeaway is simple: AI can be a drafting aid, but CGMP still treats the controlled output as the firm’s responsibility.
A misdrafted SOP is still a misdrafted SOP whether the human who erred drafted it from scratch or accepted it from an AI agent without review. The Quality Unit’s responsibility is identical in both cases. FDA has used the same production-control framework in non-AI contexts, including for process-validation failures — Diamond Chemical (2024) is one prior example with no AI involved. The Purolea Warning Letter reinforces a long-standing rule: the same oversight requirements apply when AI enters the workflow.
Three operational checks follow directly from the Warning Letter. Each one is something a Director of Quality or Validation Manager can act on this week. By GMP-critical content, we mean AI-generated or AI-assisted documents, records, or recommendations used to support GMP decisions.
Any AI-generated content that influences a GMP decision needs to flow through authorized Quality Unit review. That includes specifications, standard operating procedures (SOPs), master production records, control records, and batch documentation. Apply the same scrutiny you would apply to human-drafted content.
For each AI-generated GMP-critical document in your operation, ask:
The firm that used AI to draft procedures still owed process validation under the same CGMP framework. The drafting tool doesn’t change the validation expectation. Validation Managers should treat AI-drafted procedures with the same scrutiny they apply to human-drafted procedures.
When AI is involved in drafting a GMP-critical document, the governing procedure should define what evidence is retained and why. This is not a new Part 11 requirement. If an AI-supported workflow creates or changes GMP-controlled electronic records, your existing record-retention requirements determine what the record trail must show. Generally, that means what was generated, what was reviewed, what changed, and who approved the result.
During an inspection, expect to show:
These checks are not new. They are the same Part 211 obligations Quality Units have always owed. Purolea is the public reminder that AI in the workflow doesn’t change them.
Worth saying clearly: FDA has moved quickly to deploy AI internally. The agency launched Elsa in June 2025, announced agency-wide agentic AI capabilities in December 2025, and released Elsa 4.0 and the HALO data platform in May 2026.
FDA’s own AI adoption supports a narrower reading of Purolea: it is not evidence of agency hostility to AI. It is evidence that FDA expects accountable human review when AI supports regulated work. We’ll cover FDA’s AI posture in more depth in a forthcoming post in this series.
The Purolea Warning Letter doesn’t change what CGMP requires. It applies what CGMP has always required to a firm that used AI without authorized Quality Unit review.
For Quality and Validation teams, the immediate task is not to decide whether AI is permitted in the abstract. The task is to identify where AI touches GMP-controlled content, define how those outputs are reviewed, and preserve the evidence trail. That trail should show that an authorized Quality Unit reviewer approved the final record before use.
For the broader regulatory context this Warning Letter sits inside, read our analysis of the FDA/EMA Good AI Practice principles.
