FDA Warning Letter Breakdown: A Manufacturer Tells Investigators Its AI Agent Never Said Process Validation Was Required
The firm outsourced both document production and decision-making to an AI tool.
This is a special free edition warning letter breakdown. Only paid subscribers get regular full access to our breakdowns and other analyses. If you’re not already a paid subscriber, you can upgrade here.
Want to stay out of our warning letter breakdowns? Contact us to access our global network of 3,750+ consultants and 325+ former FDA employees. We run audits, mock inspections, and remediation for 17 of the top 25 life science firms.
Earlier this month, CDER issued a warning letter to a Michigan-based manufacturer of homeopathic drug products following an inspection conducted October 28–30, 2025, at the firm’s facility in Michigan.
The letter covers a range of CGMP failures (which we’ll touch on), but the section that sets this letter apart from every other warning letter we’ve seen is the one headed “Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing.”
The firm told FDA investigators that it used AI agents to create drug product specifications, procedures, and master production or control records in an effort to comply with FDA requirements. When investigators pointed out that the firm had not conducted process validation before distributing its drug products, the firm responded that it was not aware of the legal requirement because the AI agent it used never told it that validation was required. This is the slippery slope of AI: the temptation to outsource policy production and core decision-making.
The FDA’s response gives us a pretty clear idea of its position here: AI-generated documents must be reviewed by a qualified human to ensure they are accurate and actually compliant with CGMP. Not using them is fine. But using them without human review and clearance violates 21 CFR 211.22(c), which requires the quality unit to review and approve all procedures and specifications.
The agency further stated that “any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative of your firm’s [quality unit].”
This is the first warning letter we’re aware of where the FDA has directly addressed the use of AI in drug manufacturing operations and articulated a regulatory position on it. That alone makes it worth reading carefully, given the anecdotes we’ve already heard about firms quietly turning to AI to generate documents from more or less whole cloth, and then turning around to have the AI also review its own output and trust its determination.
Let’s start with the other CGMP issues first.
The facility: insects, filth, and a docking bay that opened directly onto the manufacturing area
The FDA found that drug products at the site were prepared, packed, or held under insanitary conditions, rendering them adulterated under Section 501(a)(2)(A) of the FD&C Act.
According to the letter:
The investigators observed insects, filth, leaves, and clutter in several areas within the facility.
The facility also lacked adequate separation to prevent contamination from external or internal sources.
The docking bay door, when opened, directly exposed the manufacturing area to the outside environment.
For a facility producing drug products of any type, environmental control is of course a baseline expectation. A manufacturing area that can be exposed to outdoor air, debris, and insects whenever the dock door opens does not have the separation required under CGMP.
No microbiological testing of finished products before release
The firm manufactures multiple homeopathic drug products, some of which can be applied in ways that create microbiological risk. According to the letter, the firm released finished drug products without testing for microbiological attributes: no total count testing, no testing for objectionable microorganisms.
Without testing each batch before release, the firm had no scientific basis for concluding that its products were free of harmful microbial contamination. The FDA cited the agency’s guidance on microbiological quality considerations in non-sterile drug manufacturing.
This is a fundamental release control failure. Finished product testing for microbiological quality isn’t optional for drug products with routes of administration that pose contamination risk.
No adequate component testing, and a reliance on supplier COAs without validation
The firm, according to the FDA, also failed to perform adequate testing for purity, strength, quality, and identity of the components used in its drug products. It relied on certificates of analysis from suppliers without establishing the reliability of those suppliers’ test analyses at appropriate intervals.
Two specific gaps stand out here:
First, a bulk component used in manufacturing was not tested to confirm it met the relevant USP monograph, was not tested for microbiological quality, and was not tested for a specific contaminant that the FDA has linked to serious health consequences in similar products.
Second, incoming components at high risk of a particular type of contamination were not tested for identity before use, including a required limit test per USP. The FDA notes that contamination of the type at issue has resulted in lethal poisoning incidents in humans worldwide.
Without component testing, the firm couldn’t ensure the quality or safety of its drug products at the input level, and without finished product testing, it could not ensure quality or safety at the output level. The quality system had no analytical verification at either end of the manufacturing process.
A quality unit that was “inadequate”
The FDA found that the firm’s quality control unit failed to exercise its responsibility to ensure drug products were manufactured in compliance with CGMP and met established specifications.
Three specific failures were cited here:
The quality unit failed to ensure procedures were established or followed.
It failed to ensure batch records were reviewed before drug product release.
It failed to ensure adequate production and process controls were established.
The FDA concluded that the firm’s quality systems are “inadequate” and cited the agency’s guidance on quality systems approaches to CGMP.
When a quality unit isn’t reviewing batch records before release, isn’t ensuring procedures are followed, and isn’t ensuring process controls exist, it isn’t functioning as a quality unit in any operational sense. The CGMP regulatory structure puts the quality unit at the center of everything. If the quality unit is absent or passive, the rest of the system fails more or less by default.
The AI finding: what the FDA actually said and what it means
Here’s what the warning letter documents:
During the inspection, the firm told FDA investigators that it used AI agents to help it comply with FDA regulations. Specifically, the firm used AI to create drug product specifications, procedures, and master production or control records.
The FDA found that the firm had not conducted process validation before distributing drug products. When informed of this requirement, the firm responded that it was unaware of it because the AI agent it used never indicated that validation was required.
So, to be clear, the firm appears to have outsourced to AI both the production of documents and the decision-making around whether validation was needed.
The FDA’s response contains two distinct positions.
First, the procedural requirement: if a firm uses AI to aid in document creation, it must review the AI-generated documents to ensure they are accurate and comply with CGMP. Failure to do so violates 21 CFR 211.22(c), which requires the quality unit to approve or reject all procedures or specifications that impact drug product quality.
Second, the broader principle: any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative of the firm’s quality unit in accordance with the FD&C Act and 21 CFR 211.22.
The FDA also described the situation as “overreliance on artificial intelligence for drug manufacturing operations.”
So, what does this tell us?
First, the FDA is not saying firms cannot use AI tools. The letter explicitly acknowledges the possibility of resumed production with AI tools in place:
“If you plan to resume drug production, and use AI to help with CGMP activities, such as development of procedures and specifications, any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative of your firm’s QU.”
In other words, AI output does not substitute for human review and does not relieve a quality unit of its regulatory obligations. If an AI tool generates a set of specifications or procedures, and the quality unit approves and releases products based on those documents without independently verifying that they are accurate and compliant, the quality unit has failed to exercise its responsibilities under 211.22.
The “we didn’t know because the AI didn’t tell us” defense got no traction. The FDA’s position is pretty clear: the legal obligation to know and comply with CGMP requirements sits with the firm and its quality unit, not with the tool.
Ask yourself:
If your firm uses AI tools to draft SOPs, specifications, batch records, or other GMP documents, can you show documented evidence that a qualified member of your quality unit reviewed each output for accuracy and CGMP compliance before the document entered your quality system? The FDA’s position in this letter is that AI-generated documents require the same review and approval as any other document. If your process is “generate, format, file,” and the review step is missing or informal, this letter tells you exactly how the FDA will characterize that.
If an FDA investigator asked your quality unit to explain a specific regulatory requirement in one of your SOPs, could the QU representative explain why that requirement exists and confirm it was verified against the regulation, rather than saying it came from a template or a tool? The compliance obligation under 211.22 isn’t to produce documents. It’s to ensure those documents are correct. A quality unit that can’t explain the basis for its own procedures has the same problem documented here, whether it used AI or not.
For any component you receive with a supplier COA, can you show that you’ve established the reliability of that supplier’s test analyses at appropriate intervals, and that you’re conducting identity testing on incoming lots? Reliance on COAs without supplier qualification is a common 483 observation, and we catch it in audits and mock inspections all the time. This letter adds the layer of components at risk for a specific type of contamination that has caused fatalities. If your component testing program doesn’t include risk-based testing for known contaminants associated with your ingredient classes, that’s an exposure.
When was the last time you walked your manufacturing area and assessed environmental controls with the assumption that an FDA investigator would be doing the same walk tomorrow? The findings here (insects, filth, leaves, clutter, a dock door that opens onto manufacturing) are observable conditions. They don’t require analytical testing to detect. They require someone in the organization to actually notice and act.
Need audit, mock inspection, remediation, or warning letter/483 response support? Let’s talk.
Contact us to access our exclusive pool of over 3,750 SMEs and 325+ former FDA personnel. If we haven't yet partnered on project support, we provide end-to-end audit support and intensive, comprehensive mock FDA inspections that not only mirror real inspections but also delve deeper, providing the insights, corrections, and readiness you need before the FDA visits your facility.
With a staff of thousands of resources worldwide, we're the partner firms work with when they want deep domain expertise and the peace of mind that comes with a partner whose commitment to quality and integrity reflects their own.
Whether you need a complete audit program design, full execution, or specific audit support, we're here to help. Drop us a line to start the conversation.
Who is The FDA Group?
The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on Quality Assurance, Regulatory Affairs, and Clinical Operations.
With thousands of resources worldwide, hundreds of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee. Learn more and schedule a call with us to see if we’re a fit to help you access specialized professionals and execute your projects on time and on budget.