On 2 April 2026, FDA issued a warning letter with a section it had never written before: "Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing". The firm was small, the products were homeopathic, and the lesson applies to every GMP site that has started using AI tools to write documents.

What happened

The letter went to Purolea Cosmetics Lab, a manufacturer in Livonia, Michigan, after a three-day inspection in late October 2025. The company had used AI agents to generate core GMP documents: drug product specifications, procedures and master production records. Process validation, one of the most basic cGMP requirements, had not been done before product was distributed. When investigators asked why, the firm said it had not known the requirement existed because its AI agent never flagged it.

FDA's position was short and clear: AI-generated outputs or recommendations must be reviewed and approved by an authorised representative of the quality unit. AI output does not replace human review, and it does not relieve the quality unit of its obligations.

AI agent Specification Procedure (SOP) Master batch record WITHOUT REVIEW Used as isProcess validation never flagged WITH A QUALIFIED REVIEW GATE Quality unitchecks, signs Approved GMP recordAccountability stays human Based on the FDA warning letter of 2 April 2026 (Purolea Cosmetics Lab).
Figure 1. The failure was not the AI. It was the missing review gate between the AI and the GMP record.

Europe is writing the rulebook: draft Annex 22

In July 2025 the European Commission and PIC/S published a draft Annex 22 on artificial intelligence, together with revised drafts of Annex 11 and Chapter 4. Consultation closed on 7 October 2025. As of August 2026 the annex is still a draft: it is not part of EudraLex Volume 4 and has no effective date. Its direction is nevertheless clear.

IN SCOPE FOR CRITICAL USE
Static, deterministic models
Models whose parameters are fixed and do not change during use. Allowed in GMP-critical applications, subject to validation: defined intended use, representative test data, acceptance criteria and performance monitoring.
NON-CRITICAL USE ONLY
Generative AI and LLMs
Excluded from critical GMP use in the current draft. They may support non-critical work with documented human oversight. EMA planned a stakeholder workshop in June 2026 on whether a risk-based framework could cover them.

Alongside the GMP annex sits horizontal law. The EU AI Act's AI literacy duty has applied since February 2025, and its further obligations are being phased in from 2026, with some dates adjusted by the 2026 Digital Omnibus. These apply to manufacturers using AI whether or not Annex 22 is finalised in its current form.

Where AI can help in GMP today

None of this means "do not use AI". It means use it where its output is checked, and design the check before you deploy the tool.

UseRiskMinimum control
Drafting SOPs, summaries, training materialLowerAuthor and QA review against the regulation, not against the draft
Deviation trending, literature screening, case intakeMediumValidated workflow, human decision on every output, audit trail
Batch release decisions, visual inspection, specificationsHighOnly validated static models with defined intended use and monitoring; QU approval
FIVE CONTROLS TO PUT IN PLACE NOW
1An inventory of every AI tool touching GMP or GVP work, with intended use and owner.
2A written rule that no AI output becomes a GMP record without review and approval by a qualified person.
3Risk classification of each use (critical or non-critical) aligned with draft Annex 22.
4Validation evidence for critical uses: test data, acceptance criteria, performance monitoring.
5AI literacy training for everyone who uses these tools, documented in the training matrix.

This "AI assists, a qualified person decides" principle is the foundation of VAIO-PV, Molgenium's validated AI operating system for pharmacovigilance and quality. If you want an independent review of how AI is used at your site, contact us.

Sources