TL;DR
- FDA sent Purolea Cosmetics Lab a warning letter on April 2, 2026, citing, for the first time, a standalone section titled "Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing" (FDA Warning Letter 320-26-58, April 2, 2026)
- The firm used AI agents to draft specifications, procedures, and master production records — and never had a human from its quality unit review the output, a violation of 21 CFR 211.22(c)
- When investigators found the firm hadn't validated its manufacturing process under 21 CFR 211.100, the owner's stated defense was that the AI agent "never told" them it was required
- The letter also cites insanitary conditions (insects, filth, an exposed loading dock) and two unapproved new drugs marketed for shingles and genital herpes relief
- Takeaway: FDA is treating an AI tool exactly like any other contractor — the firm that deploys it owns the compliance failure, full stop
Can you blame an AI agent for a CGMP violation? FDA just answered that.
No. FDA's answer, delivered April 2, 2026, is that the firm using the tool owns every word the tool produces. Purolea Cosmetics Lab, a small drug manufacturer in Livonia, Michigan, told FDA investigators it had used AI agents to write its drug product specifications, manufacturing procedures, and master production and control records. Nobody at the firm checked that output against CGMP requirements before it went into use. FDA's warning letter treats that gap as a violation in its own right, separate from the underlying manufacturing failures it also found (FDA Warning Letter 320-26-58, April 2, 2026).
This is worth pausing on. FDA warning letters cite CFR sections. They cite specific batch numbers, specific inspection dates, specific insanitary conditions. They do not, as a rule, carve out a dedicated section for a technology category. This one does. And the section isn't about AI being unsafe or unapproved — it's about accountability. The letter states plainly: "If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP." Purolea's failure to do that review is cited as a violation of 21 CFR 211.22(c), the regulation governing quality unit responsibility.
What did the inspection actually find?
FDA inspected Purolea's facility October 28 to 30, 2025 (FDA Warning Letter 320-26-58). The findings split into two buckets: conventional CGMP failures, and the AI-specific one.
Insanitary conditions. Investigators observed insects, filth, leaves, and clutter in several areas of the facility. The loading dock door, when opened, exposed the manufacturing space directly to the outside environment. Under section 501(a)(2)(A) of the FD&C Act, that alone is enough to render drug products adulterated, independent of any testing failure.
21 CFR 211.165(b) — no microbiological release testing. Purolea released finished homeopathic drug products without testing them for objectionable microorganisms. Some of these products are applied to mucous membranes. Without batch-level testing, the firm had no scientific basis for claiming the products were free of harmful contamination.
21 CFR 211.84(d)(1), (d)(2), and (d)(6) — component testing failures. The firm didn't test incoming components for identity, purity, or microbiological quality, and it leaned on supplier certificates of analysis without ever verifying those suppliers were reliable. FDA specifically flagged that Purolea never tested for a named contamination risk in one of its bulk ingredients, despite that contaminant's documented link to serious harm in FDA's own guidance.
21 CFR 211.22 — quality unit failure. The QU didn't ensure procedures were followed, didn't review batch records before release, and didn't establish adequate production controls under 211.100(a). This is the same CFR section that anchors the AI-specific citation below, and that overlap is not a coincidence: an under-resourced quality unit is what let an unreviewed AI output become an official manufacturing record in the first place.
Unapproved new drugs. FDA also flagged two products, "Dermveda Extra Strength Shingles Relief" and "Dermveda Extra Strength Ultra Genital Herpes Relief," as unapproved new drugs under section 505(a) of the FD&C Act. Labeling homeopathic products for shingles and genital herpes treatment doesn't exempt them from the approval requirement; homeopathic status carries no special carve-out under the FD&C Act.
What exactly went wrong with the AI use?
Two distinct failures, both under existing CGMP regulations, not a new AI-specific rule.
First, no human review of AI-generated documents. Purolea told investigators it used AI agents to draft specifications, procedures, and master production and control records. FDA's position: using AI as a drafting aid is not itself the violation. Publishing that output as an official CGMP record without a qualified human checking it against regulatory requirements is the violation, and it falls under 21 CFR 211.22(c), the same section that requires a quality unit to review and approve procedures before they govern production.
Second, overreliance in a way that produced a real compliance gap. FDA investigators found Purolea hadn't conducted process validation before distributing its drug products, a requirement under 21 CFR 211.100. When investigators raised this, the firm's response was that it wasn't aware of the requirement, because the AI agent it used never flagged it. FDA's letter doesn't treat that explanation charitably, and it shouldn't. The regulation doesn't require FDA to prove a firm intended to skip validation, only that validation didn't happen. An AI tool's silence on a regulatory requirement is not a defense to a strict-liability CGMP obligation.
FDA's instruction going forward is unambiguous: "any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative of your firm's QU in accordance with section 501(a)(2)(B) of the FD&C Act." That single sentence is doing a lot of work. It confirms FDA isn't drawing a new bright line specific to AI tools; it's applying the existing quality-unit-review requirement to a new category of input. The regulatory theory is old. The fact pattern is new.
Why this matters beyond one small cosmetics firm
Purolea is not a household name, and its violation profile, insects near a loading dock, untested components, was going to draw a warning letter with or without the AI angle. What makes this letter worth reading closely is the template it sets.
FDA didn't need new legislation or new guidance to reach this conclusion. It applied 21 CFR 211.22(c) and 21 CFR 211.100, both decades-old regulations, directly to an AI workflow. That's a signal every quality and regulatory affairs team should read carefully: FDA does not intend to wait for AI-specific rulemaking before enforcing against unreviewed AI output in CGMP documentation. The existing quality-unit-review framework already covers it, in FDA's own reading.
It also reframes how firms should think about AI vendor relationships. FDA's warning letter draws an explicit parallel worth internalizing, one this letter doesn't state directly but its outcome makes clear: an AI agent, like a contract manufacturer or a contract lab, does not absorb regulatory responsibility just because it did the work. The firm that deploys it remains fully liable for the output.
What compliance teams should do now
- Inventory every place AI touches a CGMP document. Specifications, batch records, SOPs, deviation write-ups, if an AI tool drafted or suggested language anywhere in that chain, it needs a documented human review step before it's official.
- Put the review requirement in writing. A verbal norm of "someone probably checks this" will not survive an inspection. The review step needs to live in an SOP, with a named responsible role, the same way any other document-control step would.
- Don't treat AI as a substitute for a validation program. Process validation under 21 CFR 211.100 is a specific, documented activity. An AI tool that never mentions the requirement doesn't relieve a firm of it, and "the tool didn't tell us" will not read as a mitigating factor in a future inspection.
- Audit your quality unit's actual authority, not just its org chart. Purolea's QU failures (211.22) and its AI failures trace back to the same root cause: a quality function that existed on paper but wasn't actually reviewing what left the building. Fix the authority gap and the AI-specific risk shrinks with it.
- Assume this citation category will recur. FDA doesn't typically write a novel section into a warning letter once and never again. Firms using AI anywhere in their quality system should expect this exact framing, human review of AI output tied to 211.22(c), to show up in future letters across sponsors far larger than Purolea.
FAQ
Is this the first FDA warning letter to cite AI misuse?
Yes. The April 2, 2026 letter to Purolea Cosmetics Lab is the first FDA warning letter to include a standalone section specifically addressing inappropriate use of artificial intelligence in pharmaceutical manufacturing (FDA Warning Letter 320-26-58).
Did FDA say firms can't use AI to help with CGMP documentation?
No. The letter doesn't prohibit using AI as a drafting aid. It requires that any AI-generated output used in a CGMP context be reviewed and cleared by a qualified human member of the firm's quality unit before it governs manufacturing, under 21 CFR 211.22(c).
What CFR sections did FDA cite for the AI-related violation?
21 CFR 211.22(c), for failing to review AI-generated documents for CGMP accuracy, and 21 CFR 211.100, for the process validation failure that the firm attributed to the AI agent not flagging the requirement.
Is Purolea still manufacturing drug products?
No. FDA's letter acknowledges the firm's commitment to cease production and distribution of drugs at the Livonia facility. Products already in distribution within expiry remain subject to the firm's obligations under the letter.
Source: FDA Warning Letter, Purolea Cosmetics Lab, MARCS-CMS 722591, April 2, 2026. Byline: The Argus Regulatory Analysis Team. Published 2026-07-09.