FDA Enforcement and AI in Pharmaceutical Manufacturing
FDA enforcement activity related to artificial intelligence in pharmaceutical manufacturing has escalated significantly in 2024 and 2025. Warning letters, Form 483 observations, and import alerts have increasingly cited AI-related quality system failures — not as a new violation category, but as a new mechanism through which existing GxP violations are occurring.
The FDA's approach is instructive: it is not creating AI-specific regulatory requirements separate from its GxP framework. It is applying existing data integrity, CAPA and process validation expectations to AI systems — and finding that most pharmaceutical organisations have not extended quality system controls to cover AI's specific characteristics.
The Four AI-Related Warning Letter Patterns
Pattern 1 — AI system outputs used in GxP decisions without validation
The most common AI-related warning letter pattern: organisations using AI outputs in GxP decision-making — batch release, quality control, stability assessment — without validating that the AI system meets accuracy and reliability requirements for that use. FDA investigators cite failure to validate AI as failure to validate the computerised system — an existing GxP requirement. The AI was treated as a black box producing outputs, not a computerised system requiring qualification and validation.
Pattern 2 — Training data not retained as GxP records
FDA investigators in 2024–2025 are asking to see training data used to develop GxP AI systems. Organisations that cannot produce their training data — not retained as a GxP record, stored outside the controlled document management system, or a vendor dataset without adequate provenance documentation — receive data integrity observations. FDA's logic: if you cannot demonstrate training data integrity, you cannot demonstrate integrity of the AI's outputs.
Pattern 3 — Model updates not subject to change control
AI models updated — retrained, fine-tuned, or updated by vendors — without change control and revalidation create unvalidated software changes. FDA investigators have issued observations for AI systems where model updates were applied without the same change control rigour applied to other computerised system modifications. The observation is about the change control failure, not the model update itself.
Pattern 4 — No monitoring for performance degradation
AI systems in GxP environments without ongoing performance monitoring represent an uncontrolled process. FDA investigators cite absence of post-deployment monitoring as a process control failure: if you do not monitor your AI system's performance, you do not know whether it continues to meet the accuracy requirements on which its GxP use was validated.
FDA issued specific guidance on AI/ML in drug manufacturing in late 2024, signalling that AI governance will be a permanent, expanding component of pharmaceutical GMP inspection — not a temporary trend.
What FDA Expects — The Five Required Elements
- AI system validation as a computerised system — IQ, OQ, PQ extended with AI-specific performance validation
- Training data retained as GxP records with provenance documentation demonstrating ALCOA+ compliance
- Change control applied to all model modifications including vendor-supplied updates
- Post-deployment performance monitoring with documented acceptance criteria and alert thresholds
- AI system inventory maintained and available for FDA inspection on request
GAMP 5 and AI validation specialists. Gap assessment within 48 hours.