Skip to main content

Generative AI Validation in Pharma: Controls, Evidence and Human Review

written by
Sundar
Director, GoVal
Published on
Last updated on
Reading time: 4 min read

Ready to modernize?

See GoVal in Action

Book a 30-minute walkthrough with our validation specialists. No slides — just your questions, answered live.

Contact Us
Summary

Generative AI validation in pharma centers on three controls: qualified human review and sign-off before any AI-generated content enters the quality system, documentation of what was checked and changed, and full integration into existing change control and audit trail processes rather than treatment as an exception. FDA's April 2026 warning letter to Purolea Cosmetics Lab — its first citing AI misuse as a cGMP violation — found a firm had used AI agents to generate specifications, procedures, and production records without human review, and cited 21 CFR 211.22(c) and 211.100; the firm's defense, that the AI never mentioned process validation was required, was explicitly rejected. The January 2026 joint FDA/EMA Good AI Practice principles and the EU's draft Annex 22 both converge on the same underlying rule: a qualified person, not the model, owns the output. GoVal integrates AI-assisted content into the same change control and audit trail structure used for every other GxP record, so review and sign-off are captured as evidence rather than assumed.

What controls does generative AI need for GxP use in pharma?

Three controls: qualified human review and sign-off before AI-generated content enters the quality system, documentation of what was checked and changed, and integration into existing change control rather than treatment as an exception. FDA's first AI-specific warning letter, issued April 2026, confirms exactly this — the model isn't the problem; using its output without review is.

A manufacturer told FDA its AI agent never mentioned that process validation was required. FDA's answer, in its first-ever AI-specific warning letter, is the clearest control spec generative AI in pharma has ever gotten.

The Warning Letter That Changed the Question

On April 2, 2026, FDA issued a warning letter to Purolea Cosmetics Lab, a Michigan drug manufacturer, marking the first time the agency carved out a dedicated section on inappropriate AI use in cGMP documentation. The firm had used AI agents to generate drug specifications, procedures, and master production records — and used them without human review. FDA cited 21 CFR 211.22(c), the rule defining the quality unit's responsibility to review and approve procedures and specifications, and 211.100, for process validation the firm never completed. When asked why, the firm said the AI agent never told them validation was required. FDA didn't accept that as a defense — the regulation doesn't transfer accountability to the tool that helped draft the document.

Three Controls, Not a New Framework

FDA didn't write a new rule for AI. It applied a decades-old one: a qualified human, accountable to a defined quality system, owns the output. In practice, that breaks into three controls.

  • ✓Qualified human review before use. A person with the authority to approve the document type checks AI output against source truth before it enters the quality system — not a passive skim, an actual verification.
  • ✓Documented evidence of that review. Reviewer identity, what was checked, and what was corrected — captured as a record, not assumed from the fact that a human's name appears on an approval field.
  • ✓Integration into change control. AI-assisted content follows the same document control and audit trail process as anything else, rather than existing as an ungoverned side channel.

What "review" actually has to mean: an unreviewed AI draft doesn't meet ALCOA+ expectations, no matter how accurate it turns out to be. The practical workflow regulators are pointing to is straightforward — AI drafts, a qualified person edits and verifies against source documents, and that review is itself recorded before the content becomes a GxP record.

Where This Converges With Annex 22

The EU's draft Annex 22 restricts generative AI to non-critical applications with documented human oversight, for the same underlying reason Purolea got cited: non-deterministic output can't be validated the way a static model can, so the control shifts to the review process around it. FDA and EMA's January 2026 joint Good AI Practice principles reinforce the same expectation from the US and EU sides at once. Two different regulatory tracks, one answer: the model drafts, a qualified person owns what happens next.

How GoVal Supports Generative AI Governance

GoVal integrates AI-assisted content into the same change control and audit trail structure used for every other GxP record, rather than treating it as a separate category needing its own process. Reviewer identity, what was checked, and the final sign-off are captured as a timestamped record tied to the document itself — the human review step FDA now explicitly expects, evidenced automatically instead of assumed after the fact.

References

Frequently Asked Questions

What is the Purolea warning letter and why does it matter for AI in pharma? +
On April 2, 2026, FDA issued a warning letter to Purolea Cosmetics Lab, a Michigan drug manufacturer, citing the firm's use of AI agents to generate drug specifications, procedures, and production records without human review — the agency's first warning letter with a dedicated section on inappropriate AI use in cGMP manufacturing. It cited 21 CFR 211.22(c) for the missing quality unit review and 211.100 for undocumented process validation, and rejected the firm's defense that the AI agent never mentioned validation was required.
Does generative AI need to be validated like other GxP software? +
Generative AI models don't fit the standard validation model because they're non-deterministic — the same input can produce different output. Regulators including the EU's draft Annex 22 treat them differently as a result: rather than validating the model itself for critical use, generative AI is restricted to non-critical applications with mandatory human review before any output is treated as a GxP record. The control shifts from validating the model to validating the review process around it.
What counts as human-in-the-loop review for AI-generated GxP documents? +
More than a read-through. Defensible review means a qualified person checks the AI output against source documents and current regulatory requirements, makes and documents any corrections, and provides a distinct, attributable sign-off before the content enters the quality system. An unreviewed AI draft, or one reviewed without a documented trail of what was checked, doesn't meet ALCOA+ expectations regardless of how accurate the output happened to be.
Can generative AI be used to write SOPs or specifications in pharma? +
Yes, as a drafting aid, provided a qualified human reviews and approves the output before it's used — exactly the gap that led to FDA's Purolea warning letter, where AI-drafted specifications and procedures were used without that review. Using AI to produce a first draft is not itself the violation; treating that draft as final without qualified human review and documented sign-off is.
What are the FDA/EMA Good AI Practice principles from January 2026? +
The Good AI Practice (G-AI-P) principles, jointly released by FDA and EMA in January 2026, are a set of high-level expectations covering traceability, validation, human oversight, and lifecycle management for AI systems used in drug development and manufacturing. They don't replace existing regulations like 21 CFR 211 — they reinforce the same underlying expectation the Purolea letter later enforced: a qualified human remains accountable for AI-assisted output entering the quality system.
How does GoVal support generative AI governance in GxP workflows? +
GoVal integrates AI-assisted content into the same change control and audit trail structure used for every other GxP record, rather than treating it as a separate category. Reviewer identity, what was checked, and the final sign-off are captured as a timestamped record tied to the document itself, so the human review step FDA now explicitly expects is evidenced automatically instead of assumed after the fact.

Bring AI-assisted content into your existing quality system

Change control, reviewer sign-off, and audit-trailed evidence for AI-generated documents — in GoVal.

Book a Free Demo →