A new systematic analysis of FDA regulatory correspondence provides a more balanced picture of artificial-intelligence enforcement than individual headlines may suggest. Researchers reviewed all 3,011 FDA Warning Letters issued between 1 January 2022 and 28 September 2026 and found only seven that referred to AI. Just one letter directly treated a company’s use of AI as a current Good Manufacturing Practice violation.
The study, published on 31 October 2026 in Discover Pharmaceutical Sciences, also examined publicly released Form FDA 483 observations and Establishment Inspection Reports containing AI-related references.
Its most important conclusion is:
FDA is not creating a separate category of AI enforcement. It is applying established regulatory requirements to processes and products in which AI is used.
Only Seven of 3,011 Warning Letters Referred to AI
The researchers searched the full text of FDA Warning Letters using terms including:
- artificial intelligence;
- AI;
- machine learning;
- large language model;
- neural network;
- deep learning;
- chatbot.
After reviewing every potentially relevant letter, they identified seven AI-related Warning Letters, representing:
7 of 3,011 letters – approximately 0.23%.
The seven letters comprised:
- three medical-device letters;
- three tobacco-product letters;
- one drug-related letter.
The authors caution that the number is too small to establish an enforcement trend.
The findings also should not be interpreted as showing that AI use is rare in regulated industry. Warning Letters reflect only selected enforcement actions published by FDA, not the full extent of industry AI adoption.
AI Played Different Roles in the Seven Letters
The AI references were heterogeneous.
In the medical-device letters, AI-related claims helped establish what the products were intended to do.
For example, claims involving AI-based screening or diagnosis contributed to FDA’s conclusion that products required appropriate premarket authorisation.
In the tobacco letters, “AI chat” appeared as one of several smartphone-like features of unauthorised electronic nicotine-delivery products. AI itself was not the cited violation.
Only one drug Warning Letter directly addressed a company’s use of AI within CGMP activities.
This was the April 2026 letter issued to Purolea Cosmetics Lab.
The Purolea Letter Applied an Existing Quality Unit Requirement
FDA stated that the company used AI agents to write:
- specifications;
- procedures;
- master production and control records.
The firm’s Quality Unit had not reviewed and approved the AI-generated documents before use.
FDA connected this directly to:
21 CFR 211.22(c)
which requires the Quality Control Unit to approve or reject procedures and specifications affecting drug identity, strength, quality and purity.
The violation was therefore not:
“The company used AI.”
The compliance problem was:
“The company used unreviewed content in CGMP activities without the required Quality Unit approval.”
Existing CGMP Rules Were Sufficient
The analysis emphasises that FDA did not cite a new AI-specific regulation.
Instead, FDA applied an existing CGMP requirement governing Quality Unit responsibility.
This is important for pharmaceutical companies.
A new technology does not eliminate established responsibilities for:
- document approval;
- scientific accuracy;
- data integrity;
- process control;
- Quality Unit oversight;
- personnel accountability.
The technology used to create a document does not change the requirement that the document be correct, controlled, reviewed and approved before GMP use.
AI Was Never the Only Problem
In all seven Warning Letters, the AI reference appeared alongside other established regulatory issues.
These included:
- unauthorised or unapproved products;
- device premarket-authorisation failures;
- software-validation failures;
- CGMP deficiencies;
- insanitary conditions;
- missing microbiological testing;
- unapproved new-drug claims.
This provides useful perspective.
The Purolea letter should not be interpreted as evidence that FDA has launched a broad campaign against AI.
The firm had wider CGMP deficiencies, and unreviewed AI-generated documentation was one element of a larger compliance problem.
Form FDA 483 and Inspection Reports Show Another Regulatory Path
The study also identified three publicly available inspection records that referred to AI:
- one Establishment Inspection Report;
- two Form FDA 483s.
One pharmacovigilance inspection report recorded that the inspected company did not use automated algorithms or AI in drug-safety operations.
A later Form FDA 483 concerning another company’s pharmacovigilance operations recorded that free-text adverse-event data were initially reviewed using artificial intelligence.
Neither inspection record cited AI use itself as a deficiency.
This suggests that FDA inspectors may ask about AI even when its use does not result in an observation.
FDA Has Asked About AI in Pharmacovigilance Since Before the GenAI Boom
The researchers found indications that FDA investigators had asked firms about the use of automated algorithms or AI in pharmacovigilance inspections since at least 2020.
This predates the rapid public adoption of Generative AI.
For pharmaceutical companies, this is a useful reminder:
AI can enter regulatory correspondence not only through a violation, but also through routine inspector questions about how regulated processes operate.
An organisation should therefore be able to explain:
- where AI is used;
- what task it performs;
- which data it processes;
- what decisions it influences;
- how its output is reviewed;
- how performance and changes are controlled.
The Practical Lesson for Quality Units
The new analysis provides a relatively narrow but important enforcement lesson:
If AI is used to prepare CGMP documentation, the responsible Quality Unit must review and approve the resulting content before it is used.
That review should be substantive.
It should not consist only of confirming that someone clicked an approval button.
Depending on the document, the reviewer may need to verify:
- technical and scientific accuracy;
- consistency with approved procedures;
- accuracy of referenced data;
- correct regulatory references;
- consistency with the validated process;
- absence of unsupported or fabricated content.
AI-Generated Content Should Be Treated as an Unverified Draft
A sensible operating principle is:
AI output remains an unverified draft until a qualified person confirms that it is correct and suitable for the intended GMP use.
This principle can be applied to AI-assisted preparation of:
- procedures;
- specifications;
- investigation narratives;
- CAPA proposals;
- risk assessments;
- validation documentation;
- master records;
- regulatory responses.
The required review depth should reflect the risk and intended use of the output.
Human Review Does Not Remove the Need for System Controls
The Purolea finding should not be interpreted as meaning that human review is the only necessary AI control.
Depending on the application and risk, organisations may also need controls covering:
- approved AI platforms;
- confidentiality and data protection;
- prompt and source-data management;
- model and configuration identification;
- output traceability;
- supplier oversight;
- change control;
- performance monitoring.
However, the Warning Letter demonstrates that the absence of required Quality Unit review can itself create a straightforward CGMP violation under existing law.
Rarity of Enforcement Is Not a Safe Harbour
The study found very few AI references in Warning Letters.
This should not be interpreted as evidence that pharmaceutical companies can use AI without governance.
There are several reasons for caution:
- Warning Letters represent only selected published enforcement actions;
- Form FDA 483s and inspection reports are not comprehensively searchable;
- inspectors may describe AI using terminology not captured by the study;
- many companies are still in early stages of AI deployment;
- regulatory expectations continue to develop.
The practical conclusion is not that AI creates little compliance risk.
It is that FDA can address AI-related failures using existing regulatory requirements.
No Separate “AI Exception” Exists
The broader message is consistent with FDA and EMA’s risk-based AI principles.
AI should have a clearly defined Context of Use, and the evidence and controls should be proportionate to the influence of the AI output and the consequences of an incorrect decision.
But when AI is embedded in an established GMP process, the existing process requirements remain applicable.
For example:
- AI-generated procedures still require controlled approval;
- AI-supported investigations still require scientifically justified conclusions;
- AI-generated records still require data-integrity controls;
- AI-supported quality decisions remain the responsibility of authorised personnel.
What Pharmaceutical Companies Should Do
Companies using GenAI or other AI tools in GMP activities should consider:
- maintaining an inventory of AI-enabled activities;
- defining approved and prohibited uses;
- requiring Quality Unit review where applicable;
- verifying source data and regulatory references;
- documenting responsibility for final approval;
- training users to detect hallucinations and unsupported statements;
- ensuring that suppliers cannot change critical functionality without appropriate notification;
- being prepared to explain AI use during inspection.
Why This Study Matters
Individual enforcement cases can generate exaggerated conclusions.
This study provides useful context.
FDA’s published AI-related enforcement remains:
- rare;
- recent;
- heterogeneous;
- grounded primarily in existing law.
The most useful compliance lesson is therefore not:
“FDA has created a new category of AI violation.”
It is:
“When AI is used inside a regulated process, existing responsibilities for review, approval, validation and accountability continue to apply.”
Study Limitations
The authors identify several limitations.
The analysis was based on published Warning Letters and selectively released inspection records.
Keyword searching may have missed documents that used other terminology.
Only seven relevant Warning Letters were identified, and the analysis cannot establish a trend.
The study also did not examine FDA treatment of AI in product approvals or AI-enabled medical-device submissions.
Its findings should therefore be interpreted as an analysis of published FDA enforcement correspondence, not as a complete measure of AI use or FDA oversight.
Regulatory Status Note
The publication is an independent, peer-reviewed retrospective study.
It does not represent formal FDA guidance or policy.
Its findings are based on public FDA Warning Letters and selected inspection records.
The Purolea Warning Letter is an official FDA enforcement communication, but it concerns the specific facts and deficiencies identified at that firm.
Sources
Kwiecinski G., Nandy R. – Artificial intelligence in FDA regulatory correspondence, 2022 to 2026: a retrospective document analysis. Discover Pharmaceutical Sciences. Published 31 October 2026.
https://link.springe … 7/s44395-026-00061-5
DOI:
https://doi.org/10.1 … 7/s44395-026-00061-5
FDA – Purolea Cosmetics Lab Warning Letter:
https://www.fda.gov/ … -lab-722591-04022026
FDA – Warning Letters database:
https://www.fda.gov/ … ties/warning-letters
FDA – Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products: