AI Wrote the Documents. FDA's Warning Letter Was Addressed to You.

CDER issued an April 2026 warning letter to a drug manufacturer for using an AI tool to generate product specifications, procedures, and master production and control records without adequate quality-unit review. Morgan Lewis, in a regulatory analysis published the same month, described this as a signal that FDA has extended its AI scrutiny from device regulation into pharmaceutical manufacturing quality systems. The underlying rule has not changed: under 21 CFR 211.22, the quality unit owns the review and approval of all GMP-applicable documents, and that responsibility does not transfer to the software that generated them.

The specific failure described in the warning letter follows a logic that quality professionals will recognize immediately. An AI tool generated documents that reached manufacturing operations. The quality unit did not conduct the substantive review required to verify those documents were accurate, complete, and appropriate for the specific product and process. The distinction matters: a signature on an AI-generated document is not a quality-unit review. It is evidence that someone touched the document. FDA is asking something different, which is whether anyone understood it well enough to own it.

The second failure cited in the letter is more revealing. The manufacturer attributed missed process validation requirements to the AI tool itself. FDA's response to that argument was to include it in the warning letter, which is its own answer. Under 21 CFR 211.100 and the agency's process validation guidance, validation requirements are the site's responsibility to identify and fulfill. If an AI-assisted workflow produced a document that omitted required validation steps and that document went to manufacturing, the compliance gap belongs to the site. A tool does not generate obligations. It generates output. What happens to that output is a quality system question.

What makes this warning letter worth examining beyond the specific citations is what FDA chose to signal. The agency has been careful not to prohibit AI use in GMP environments. What it is demonstrating through enforcement is where the accountability floor sits. The floor is consistent with decades of GMP enforcement logic: the quality unit is accountable for what goes into manufacturing, regardless of how it was produced. AI changes the tool. It does not change who is responsible for the tool's output.

For quality teams that have deployed AI for document generation, specification drafting, or procedure development, the risk embedded in this warning letter is structural, not incidental. AI tools that produce plausible GMP documents reduce the review friction that slow, document-by-document human writing would normally generate. That friction exists because GMP document creation requires judgment: is this specification correct for this product and process, have the validation requirements been properly addressed, does this procedure account for the failure modes this site has actually seen?

When AI drafts the document and the review process does not recreate that judgment, the output looks reviewed but is not. This is the failure mode FDA identified. The documentation existed. The review signatures likely existed. What did not exist was a quality-unit review adequate to verify that AI-generated content met the standards the quality unit is responsible for maintaining.

The practical implication for any site using AI in GMP document workflows is that the review process needs to be defined, not assumed. Under 21 CFR 211.22, the quality unit's oversight responsibility is continuous and does not carry an exception for computer-generated content. What changes when AI enters the document pipeline is that the review must be designed to catch what AI commonly misses, which includes context-specific requirements, site-specific history, product-specific risk factors, and validation gaps that a general-purpose tool would not have been trained to flag. A review checklist built for human-authored documents does not automatically cover AI-authored ones.

Small and mid-size pharmaceutical manufacturers carry a specific version of this exposure. These sites adopt AI tools precisely because resources are constrained. When the tool produces a document that looks GMP-ready, the pressure to move quickly is higher than at a large site with a deep quality team. But the GMP accountability structure under Part 211 does not scale down with headcount. The quality unit at a fifty-person site owns the same document review responsibility as the quality unit at a five-thousand-person site. If an AI tool generates a specification with a missing validation requirement and that specification enters manufacturing, the site's size does not appear in the warning letter.

What an adequate AI document review checkpoint looks like under current GMP is not ambiguous. It names the reviewer. It identifies the criteria applied. It creates a record of what was checked, what was found, and how any discrepancy was resolved. It is specifically designed to verify the content of the AI-generated document, not to confirm that the document exists. Sites that cannot produce that kind of review record for their AI-generated GMP documents already have the documentation gap FDA found in this warning letter.

Pull one AI-generated GMP document from the last quarter. Ask whether the review record for that document could answer an investigator's question: how did the quality unit confirm it met applicable requirements, addressed all relevant validation steps, and was appropriate for the specific product and process? If the answer is not immediately obvious from the file, that is the gap to close before the next inspection cycle.