The FDA’s First AI Warning: Over-Reliance Is a cGMP Violation

‍

On April 2, 2026, the FDA issued a warning letter to Purolea Cosmetics Lab in Livonia, Michigan. The letter cited the usual violations: insanitary conditions, failed batch testing, and inadequate quality unit oversight. But buried in the findings is something the industry should pay close attention to:

The FDA explicitly cited the manufacturer for inappropriate use of AI in pharmaceutical manufacturing.

During the inspection, the owner told investigators she had used AI agents to create drug product specifications, procedures, and master production records. When investigators found she had never conducted process validation, a basic cGMP requirement, her response was that the AI never told her it was required. She was not aware the legal requirement existed because the AI agent, in her words, never surfaced it.

The FDA's reply was unambiguous. The letter states that if a manufacturer uses AI as an aid in document creation, it "must review the AI generated documents to ensure they were accurate and actually compliant with cGMP," and that failure to do so is a violation of 21 CFR 211.22(c).

This case is a warning for any manufacturer that has handed compliance work to an AI tool without asking hard questions about what that tool might be missing.

What the FDA Actually Requires

The warning letter does not say AI cannot be used in regulated manufacturing. It says human accountability cannot be delegated to it. Any output or recommendations from an AI agent "must be reviewed and cleared by an authorized human representative of your firm's quality unit" before use. That requirement sits in the same section of the FD&C Act that governs quality unit responsibility more broadly. FDA is not creating a new standard for AI. It is applying the existing standard and finding that AI over-reliance violates it.

That framing matters. It means manufacturers cannot treat AI governance as a future problem or a technology problem. It is a compliance problem, and the FDA has now said so in writing.

How Could This Happen?  The “Lazy Genius” Problem

What makes the Purolea case uncomfortable isn’t that something failed. It’s how it failed.

When a system produces something that looks complete, structured, and authoritative, people are less likely to question it. Not because they’re careless, but because the output removes the usual signals that something might be wrong This is automation bias. The more competent the system appears, the less scrutiny it gets. Research has consistently shown that people defer to automated systems even when they are wrong, especially when outputs appear high quality (see Psychology Today, “The Lazy Genius Problem”).

At the same time, teams start to offload thinking to the tool itself. They assume it checked the requirements, surfaced the important constraints, and filled in the gaps. This aligns with what researchers describe as cognitive offloading, where reliance on external tools reduces active critical thinking.

In reality, AI is generating patterns, not validating obligations. It can produce a clean, professional procedure that quietly omits something fundamental like process validation and give no indication anything is missing. The result is a shift in behavior that’s hard to detect. Review becomes lighter. Assumptions go unchallenged. Completeness is inferred rather than verified. In a regulated environment, that is exactly where failures start. Purolea wasn’t a failure of capability. It was a failure to maintain skepticism in the presence of convincing output.

What This Case Makes Clear and What It Requires

The Purolea case highlights three failures that are easy to repeat if AI is not implemented correctly:

1. AI does not surface what it missed:  It can generate something that looks complete and authoritative, but it will not surface missing requirements. If outputs are not checked against verified regulatory facts, gaps stay hidden until an inspection finds them.

2. AI cannot replace oversight:  At Purolea, AI wasn’t used within a process. It replaced it. Every missed review, validation, and challenge became a compliance gap. Regulators will draw a hard line between AI as a tool and AI as a substitute for oversight.

3. Accuracy is a data and a system problem:  AI is only as good as the data it operates on. Structured, current, validated data leads to reliable outputs. Weak or unverified inputs compound errors. Strong implementations start with the data foundation and layer capability on top.

Making AI reliable in a regulated environment is not about asking better questions. It is about grounding it in a consistent, verified foundation of facts. That requires structured data, resolved entities, and a system that produces the same answer across use cases.

Most teams don’t have that, so they default to one-off usage: a prompt, a document, an answer that looks right but isn’t connected to anything durable.
That is what showed up in the warning letter.

Redica’s Approach: An Intelligence Cloud, Not a One-Off Tool

Redica is built around the idea that AI is only as reliable as the data and system it sits on.

Instead of one-off outputs, the Intelligence Cloud creates a connected foundation of facts that everything draws from:

• A unified, verified data layer for regulatory and inspection intelligence that continuously ingests and structures regulatory and inspection intelligence
• Resolved entities and relationships so sites, suppliers, and signals are consistent across every use case
• A persistent model of truth that produces the same answer whether it’s used in analysis, workflows, or AI-generated outputs
• Reusable intelligence, not one-off outputs, so insights can be applied across decisions instead of recreated each time
• Built-in traceability so every output ties back to underlying data and can be inspected and defended.

The goal is simple. AI should not generate answers in isolation. It should operate on top of a system that makes those answers consistent, explainable, and reliable.

That is the difference between something that looks right and something that holds up under inspection.

Why This Moment Matters

This warning letter is the first of its kind. It will not be the last. 

As AI tools become easier to access and faster to deploy, the pressure to use them as shortcuts will increase, particularly in resource-constrained facilities. FDA has now firmly established that the output of an AI system is not a substitute for the judgment of a qualified human, and that relying on it as one is a citable violation.

The question for every quality and regulatory team is not whether to use AI. It is whether the way you are using it would survive an inspection.

If you want to see what it looks like to build on a verified foundation of inspection intelligence, we can show you how.