A cosmetics and pharmaceutical manufacturer let an AI agent draft its specifications, procedures, and compliance records. Nothing in the public reporting says the output was wrong. The FDA shut down the facility's drug production anyway, and the warning letter didn't cite a bad formula or a contaminated lot. It cited the missing signature.
That's Clarkston Consulting's April 21, 2026 report on a warning letter the FDA issued April 2, 2026 to Purolea Cosmetic Lab (Clarkston Consulting, 2026). The citation named violations of 21 CFR Parts 210 and 211, the core current Good Manufacturing Practice regulations for finished pharmaceuticals. The finding: AI agents had generated specifications, procedures, and compliance records without the human oversight and review those regulations require. By the time the letter became public, the facility had already ceased drug production and was told to implement human verification protocols before resuming.
AI documentation governance, as the FDA is now enforcing it, means a named human reviews and clears every AI-generated specification, procedure, or compliance record before it becomes part of the manufacturing record, regardless of whether the output is correct. The review is the control. Correctness was never the thing the FDA found missing from Purolea's file.
Name the assumption this breaks. Most manufacturing and quality teams treat AI-generated documentation as a data-quality problem: if the numbers check out, the risk is handled. The FDA's letter doesn't support that reading. Nothing in Clarkston's report suggests Purolea's AI-generated records contained an error. The violation was procedural, no qualified human had reviewed and cleared the output, and a procedural violation doesn't get more forgivable because the underlying data happened to be right. Accurate and approved are two different properties of a compliance record, and a warning letter now exists to prove regulators will enforce the second one even when the first one holds.
The cGMP violation the FDA actually cited
The FDA's own framing, per Clarkston's report, is precise: AI should function "as an aid rather than a replacement for human judgment," and "treating AI as the final authority on documentation within manufacturing operations can lead to gaps in regulatory compliance." The letter goes further than a general caution. It states that any output or recommendation from an AI agent must be reviewed and cleared by an authorized human representative in accordance with applicable regulatory requirements.
Read what that requires against what most AI documentation tools actually ship. A drafting assistant that generates a batch specification, a testing procedure, or a deviation report is doing exactly the job it was bought to do. The gap isn't the drafting. It's what happens between the draft and the record becoming final, and for Purolea, per the FDA's citation, nothing happened there at all.
Why AI-generated cGMP records fail without a named human approver
GxP manufacturing has run on a quality-unit sign-off requirement for decades: a specific, identifiable person reviews a specification or procedure and takes responsibility for it before it governs production. That requirement didn't disappear when AI started drafting the document. The FDA's letter applies the same standard to AI output that already applied to a junior analyst's first draft, and the standard was never really about catching errors. It's about naming who's accountable for what the manufacturing record says.
An AI agent has no accountability to assign. It cannot be deposed, audited, or held to a quality agreement. When an AI-generated specification becomes final with no named reviewer, the manufacturing record has no accountable author, and that gap is what an FDA investigator, or a plaintiff's attorney years later, is actually checking for. Purolea's letter is the first public instance of that check landing as an enforcement action instead of a hypothetical.
What a named-approver control actually requires: OpsGrid's Approve stage, mapped
Strip the pharma specifics away and the control the FDA is describing is structural, not industry-specific: an AI-generated output routes to a named human, that human reviews it before it's final, and the review leaves a record. That's the same shape as Signal → Route → Approve → Execute → Audit, the model behind OpsGrid, IntelliConnectQ's decision infrastructure layer for Dynamics 365 Business Central, currently in live beta.
Mapped onto Purolea's process, an AI-drafted specification is the Signal. Routing it to the person on the quality unit who owns that document type is Route. A named reviewer clearing the specific version before it governs production is Approve, and Approve is where OpsGrid blocks the write from reaching Execute until that clearance exists, no exceptions, no "the AI was probably right." Audit is the exportable record of who cleared what, and when. OpsGrid doesn't ship for pharmaceutical manufacturing today. The point isn't that it does. It's that the control the FDA cited as missing is the same control this architecture already treats as non-optional, in a different ERP, for a different set of writes.
Ungoverned AI documentation vs. a governed Approve stage
Four questions separate a defensible record from the one the FDA cited.
| Documentation control | Purolea's process, per the FDA's citation | A governed Approve stage |
|---|---|---|
| Who reviews the AI's output before it's final | No one named. The AI's output stood as the manufacturing record | A named reviewer, assigned per document type, before the record is final |
| What's logged about that review | Nothing. No review occurred, so there was nothing to log | Approver identity, timestamp, and the exact version cleared |
| What happens if the output is accurate but unreviewed | Still a cGMP violation, per 21 CFR Parts 210 and 211 | Not reachable. The write can't post until a named approval exists |
| What a regulator sees on request | An AI-generated record with no clearance trail behind it | An exportable record naming who approved what, and when |
The Decision Latency Diagnostic scores whether your AI-assisted workflows have a real named-approver step, or just a draft that got treated as final.
Take the diagnostic →For the broader argument, why a correct AI-driven decision still needs a named approver to be legally and operationally defensible, not just a compliant one, see why an AI agent making the right call still isn't enough on its own.
Frequently asked questions
Does the FDA require human review of AI-generated cGMP documentation?
Yes, as of a warning letter reported April 21, 2026 by Clarkston Consulting. The FDA's own framing states that AI should function as an aid rather than a replacement for human judgment, and that any output or recommendation from an AI agent must be reviewed and cleared by an authorized human representative before it enters the manufacturing record. Treating AI as the final authority on documentation, the agency wrote, can lead to gaps in regulatory compliance.
What did the FDA actually cite in the Purolea Cosmetic Lab warning letter?
The FDA issued the letter April 2, 2026, citing violations of 21 CFR Parts 210 and 211, the core current Good Manufacturing Practice regulations for finished pharmaceuticals. The specific finding was that AI agents had been used to generate specifications, procedures, and compliance records without the necessary human oversight and review. The facility had already ceased drug production and was required to implement human verification protocols before resuming.
Is accurate AI-generated documentation enough to pass a cGMP audit?
No. Nothing in the public reporting on the Purolea warning letter suggests the AI-generated records were factually wrong. The violation was procedural: no qualified human had reviewed and cleared the output before it became part of the manufacturing record. A cGMP audit is checking for a named approval, not just a correct answer, and a record with no reviewer of record fails that check regardless of accuracy.
What does a defensible approval record for AI-generated compliance records need to include?
Four things, at minimum: a named individual who reviewed the AI-generated specification, procedure, or record; a timestamp for that review; a snapshot of the exact version they cleared; and an export format that survives outside the AI vendor's own interface. An operational log showing what the AI produced isn't the same record a regulator is asking for. They're asking who signed off on it, and when.
Ask your own quality or regulatory team a narrower version of the same question: for the last AI-drafted specification or procedure that went live, who is the named approver, and where's the timestamp. If the honest answer is a shrug, the gap Purolea's letter describes already exists in your process, whether or not a regulator has found it yet.
Written from 5+ manufacturing and distribution engagements, 2022–2026, building the same named-approver requirement the FDA's Purolea letter now makes explicit into AI-assisted workflows. The pharma-specific regulatory detail above is sourced directly from Clarkston Consulting's report and the FDA's own stated framing, not an implied pharma deployment; the underlying control it describes, no AI output becomes final without a named human clearing it, is the same one built repeatedly across manufacturing and distribution ERP workflows.