FDA’s First AI Warning Letter: What It Means for AI-Drafted SOPs and Batch Records

FDA’s First AI Warning Letter: What It Means for AI-Drafted SOPs and Batch RecordsRxCloud  |  therxcloud.com/fda-ai-warning-letter/

For two years, the industry debated whether FDA would ever cite a firm for how it used AI. On 2 April 2026, it did.

The FDA AI warning letter to Purolea Cosmetics Lab is the first to call out AI misuse in drug manufacturing by name. The firm had used AI agents to write its drug product specifications, procedures and master production and control records. Nobody in the quality unit checked them properly.

FDA did not ban AI. It said something more useful: the tool changes nothing about who is accountable. If your teams, or your contract manufacturers, are drafting SOPs or batch records with ChatGPT, Copilot or an AI agent, this letter tells you what an investigator will ask for.

What the FDA AI warning letter actually said

FDA’s position is simple: AI can help write a GMP document, but the quality unit still owns it.

Purolea is a small homeopathic drug maker in Livonia, Michigan. FDA inspected the site from 28 to 30 October 2025 and issued Warning Letter 320-26-58 on 2 April 2026. Most of the letter covers familiar failures: insanitary conditions, no microbial release testing, and components accepted on supplier certificates alone.

The new part sits under the quality unit citation. The firm told investigators it used AI agents to create:

• drug product specifications
• standard operating procedures
• master production or control records

FDA wrote that if you use AI as an aid in document creation, you must review the AI-generated documents to make sure they are accurate and actually compliant with cGMP. Failing to do that was cited as a violation of 21 CFR 211.22(c), which requires the quality unit to approve or reject procedures and specifications.

“The AI never told us” is not a defence

Investigators also found the firm had not performed process validation before distributing product, as 21 CFR 211.100 requires. Asked why, the firm said it did not know about the requirement because the AI agent never told it.

FDA rejected that answer. If the firm resumes manufacturing, the letter says any output or recommendation from an AI agent must be reviewed and cleared by an authorised human representative. FDA also asked the firm to bring in a qualified consultant for a full six-system audit before resuming.

Why AI-drafted SOPs and batch records are a quality unit problem

AI-generated SOPs and batch records fail in a specific way: they look finished. That is exactly what makes them risky.

Three failure modes show up in the Purolea case and in the commentary that followed:

1. Delegated judgement. An AI draft becomes an effective GMP document without documented review by a qualified person.
2. Silent omission. AI does not flag what it leaves out. Purolea’s agent never mentioned process validation, so it never happened.
3. Automation bias. Polished, complete-looking output lowers the reviewer’s guard. Errors pass because the document reads well.

The fix is not a new rule. FDA applied the existing one: the quality unit must approve procedures and specifications, and review batch records before release. What changes is how much scrutiny an AI draft needs.

For electronic records, the same logic extends to 21 CFR Part 11 and ALCOA+: you should be able to show how a final record was created, who edited it and who approved it.

After Purolea: why CMOs in India are in the spotlight

Purolea was the first letter, not the last. One industry analysis counted 11 AI-adjacent warning letters and 3 that named AI explicitly in Q2 2026 (April to June).

The same analysis says most of the AI-adjacent letters went to overseas sites, particularly in India. Its explanation is inspection frequency, not AI adoption: Indian sites are inspected more often, so gaps surface there first. Treat these counts as indicative; the analysis reconstructed them from FDA’s letter index and trade press.

For sponsors, the message is direct. If you rely on a contract manufacturer, assume your partner will be asked to show AI controls on the same terms you would be. Your accountability for product quality does not move to the CMO.

Four questions inspectors are reportedly asking

Can your team use ChatGPT or Copilot to draft SOPs?

Yes, but only inside a controlled process. The model itself cannot be validated the traditional way; the way you use it can.

A reasonable expectation is that an auditor will treat a general-purpose chatbot like any other unqualified software. If it drafts SOPs, you should be able to show that the activity was assessed, controlled and verified. Europe is heading the same way: draft EU GMP Annex 22 would keep generative AI and large language models out of critical GMP uses, allowing them in non-critical tasks with documented human oversight. The draft is not yet in force.

Nine controls to put in place before AI touches a GMP document

1. Write an AI use policy with an approved tools list. Use enterprise accounts with data training switched off.
2. Build an inventory of every AI tool touching GxP work, owned by quality as well as IT.
3. Define the context of use and risk class for each tool.
4. Validate the process, not the model: intended use, test prompts with known answers, acceptance criteria. Scale effort with risk, in line with FDA’s computer software assurance approach.
5. Require qualified human review and quality unit approval for every AI-assisted GMP document.
6. Keep records: the tool and model version, the prompt or source material, reviewer edits and the approval.
7. Put model versions, prompt templates and vendor updates under change control.
8. Train reviewers on AI failure modes: hallucinated references, missing steps, outdated regulations.
9. Add AI clauses to quality agreements with CMOs and suppliers.

How RxCloud helps you use AI without inviting a 483

RxCloud helps life sciences teams adopt AI in a way that stands up to inspection, at your sites and at your partners’.

• GMP and GxP audits: AI-readiness audits of your own sites and CMOs, built around the four questions inspectors are asking.
• QA consulting: AI use policies, review SOPs, reviewer training and AI clauses for quality agreements.
• CSV and CSA validation: risk-based validation of AI-assisted workflows, scaled to their GMP impact.
• RxQCAgent: the controlled alternative to a general chatbot. It screens controlled documents for review-readiness as they enter your GxP workflow. It is advisory only, never auto-approves, keeps a human in the loop, logs a reason-coded audit trail and runs in your environment.

RxQCAgent is built for exactly the gap Purolea exposed: it helps reviewers catch problems earlier, while the approval decision stays with your quality unit.

Related reading: EU GMP Annex 22 explained · How to validate AI in pharma · GxP-compliant AI systems

Frequently asked questions