What actually happened at Purolea
Purolea Cosmetics Lab, which manufactures OTC drug products in Livonia, Michigan, was inspected by FDA from 28 to 30 October 2025. The Warning Letter (MARCS-CMS #722591, reference 320-26-58, dated 2 April 2026) carries a discrete section titled Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing — the first cGMP warning letter we're aware of that carries a stand-alone AI section. The letter records the firm's use of AI agents to create drug product specifications, procedures, and master production or control records. Product was distributed without process validation. When FDA investigators informed the firm that validation was required before distribution, the letter records the reply: the firm "were not aware of the legal requirement, as the AI agent you used… never told you it was required."
FDA cited 21 CFR §211.22(c) — the Quality Unit's responsibility for approving or rejecting procedures and specifications — as the violation created by failing to review the AI-generated documents. It cited 21 CFR §211.100, written procedures for production and process control, as the clause the firm failed against by distributing before process validation, and §211.100(a) again under a separate Quality Unit finding, for failing to ensure adequate production and process controls were established. The letter carries adulteration findings under both FD&C Act §501(a)(2)(B) (methods and controls not conforming to cGMP) and §501(a)(2)(A) (preparation under insanitary conditions — the inspection also found insects, filth, and a docking-bay door opening directly onto manufacturing). Purolea has ceased drug production.
That last sentence carries the only consequence that matters for the rest of this post. A firm ceasing drug production is not a paperwork outcome. It's a multi-million-dollar consequence in lost revenue, batch destruction, remediation, and ongoing regulatory response, most of which is irreversible inside a fiscal year. The records the firm did not produce, which a properly disciplined eQMS would have produced as a matter of course, were the cheap version of avoiding it.
The first clause that does the work — §211.22(c)
The clause is short enough to quote in full, which almost no secondary coverage of the letter has done:
The quality control unit shall have the responsibility for approving or rejecting all procedures or specifications impacting on the identity, strength, quality, and purity of the drug product.
Three readings of that sentence are worth working through.
The verbs. The clause says approving or rejecting. It does not say reviewing, it does not say acknowledging, it does not say accepting on the basis of vendor representations. The act the Quality Unit owes is binary (approve or reject), and a binary act is a record. A QU member, named. A timestamp. A basis for the decision. A linkage to the procedure or specification the decision applies to. If the act is binary but the record is missing, the act did not happen for inspection purposes. This is why the Purolea staff's "the AI agent never told them validation was required" answer collapses under the clause: it's not about awareness, it's about a record that did not get written.
The scope. All procedures or specifications impacting on the identity, strength, quality, and purity. AI-drafted documents do not exit the scope because of their author. The clause does not distinguish between handwritten SOPs, vendor-provided templates, contract-acquired specifications, and AI-generated text. Every procedure entering the regulated workflow is approved or rejected by the QU. Every specification entering the regulated workflow is approved or rejected by the QU. The author of the draft is irrelevant; the gate is the QU record.
The implicit architecture. For the clause to be enforceable, the eQMS has to refuse to let a procedure or specification enter a production-affecting state until the QU approval record exists. The system has to enforce the gate at the workflow boundary, not at the user's awareness. Purolea's failure mode (distribution without validation) is exactly what happens when the gate isn't at the workflow boundary. A controlled eQMS does not allow distribution records to close without process-validation evidence linked to the batch record. The AI's silence on validation becomes irrelevant; the system rejects the workflow transition.
The second clause that completes it — §211.100(a)
The companion clause is similarly short and similarly under-read:
There shall be written procedures for production and process control designed to assure that the drug products have the identity, strength, quality, and purity they purport or are represented to possess... These written procedures, including any changes, shall be drafted, reviewed, and approved by the appropriate organizational units and reviewed and approved by the quality control unit.
The sentence the eQMS actually needs to deliver against is the last one. Procedures and any changes to them are drafted, reviewed, and approved by the appropriate organizational units, and reviewed and approved by the quality control unit. Five verbs, two organizational layers, one mandatory record set.
When AI participates in any of the first four verbs (drafting, reviewing for the appropriate organizational unit, suggesting an edit), the workflow gate the clause demands is still the same. The QU's review-and-approve record still has to exist. The AI is upstream of the gate, not downstream. The Purolea failure was not "an AI made the procedure." It was "the procedure entered production without the QU record §211.100(a) requires."
There's one consequence of §211.100(a) most coverage of the letter misses. The clause covers any changes to the procedures. If an AI agent suggests an edit to a controlled SOP (a routine operational use of AI assistance in many regulated firms today), that change is a §211.100(a) change. The workflow has to route it to the appropriate organizational unit, then to the QU, with both reviews captured as records. The AI's role is documentation lineage. The Quality Unit's role is approval lineage. The eQMS has to keep them distinct and produce both on demand.
What the audit trail actually owes
Most eQMS deployments record one or two facts about an AI-influenced document: the timestamp at which it was created, and the identity of the user account that created it. That's enough for generic Part 11 audit-trail requirements at the record level, but it doesn't make the approval decision verifiable once AI participates. The clause is about approval ownership; the audit trail has to make that ownership demonstrable rather than asserted.
What follows is a proposal, not a quotation. FDA has not published a field list for AI-influenced records, and neither §211.22(c) nor §211.100 names one. The ten fields below are what we think the clauses imply when you read them backward from the inspection into the record. Read them as a specification to argue with, not as a citation.
The gap is visible most clearly side-by-side.
| Audit-trail dimension | Standard eQMS capture | AI-aware capture (our proposal) |
|---|---|---|
| System that produced the output | (not captured) | model_id + model_version_hash |
| Training data the model was trained against | (not captured) | training_data_snapshot_id |
| What was asked | (not captured) | prompt_template_id + prompt_template_version |
| What input went in | (not captured) | input_payload_digest (SHA-256) |
| When the inference happened | Creation timestamp on the record | inference_timestamp + inference_latency_ms |
| What the model returned, before any edit | (not captured) | output_payload_digest |
| Who in the Quality Unit approved | User account that saved the record | human_reviewer_id + reviewer_decision |
| What the reviewer changed | (not captured) | reviewer_modification_diff |
| Downstream regulated record | Record ID | regulated_record_id |
| Tenant scope (multi-tenant SaaS) | (sometimes a column) | scoped by the isolation boundary — a separate database, or failing that a tenant_id |
The right-hand column is what an eQMS needs to carry if the §211.22(c) approval decision is to stay verifiable once AI participates in the drafting. The left-hand column is what most eQMS deployments produce today. Purolea is what happens when the right-hand column is empty and the inspector pulls.
The fields break into four groups. System identity: model identifier, version hash, training-data snapshot identifier. These answer the inspector's first question: which AI did this, on what data, on what date. Inference identity: prompt template identifier and version, input payload digest, inference timestamp. These answer the reproducibility question. Could a second human, presented with the same prompt and the same input, get the same output? If yes, the AI's behaviour is auditable. If no, the AI is an unaccountable black box, and the §211.22(c) approval rests on something nobody can re-examine. Output integrity: a hash of the output payload before any human edit. This is the field that demonstrates the human reviewer saw the same output the inspector is later examining. Human ownership: reviewer identifier, reviewer decision (approve, reject, approve-with-modification), reviewer modification diff. The third of those is the one almost no eQMS captures, and the one we would expect an investigator to reach for first. When the reviewer changes what the model produced, the change itself becomes the record of human judgment. Without the diff, the approval is asserted, not demonstrated.
The inspector traces an AI-driven CAPA
To make the schema concrete, take a hypothetical: a firm that has pointed an AI agent at CAPA triage, and an inspector who pulls one of those records. (Complere does not ship AI triage — see the Complere fit section below for what we do and don't do. The example is here because the chain is easy to follow, not because it describes our product.)
An inspector reads a CAPA record from twelve months ago. The complaint that triggered it is in the system. The investigator's root-cause analysis is signed. The CAPA plan is signed. Closure is signed. The signatures are real, the dates are clean, the workflow looks defensible at the form level.
The inspector asks what generated the root-cause analysis. If the answer is "a human analyst with a literature search," the inspection moves on. If the answer is "the AI agent we use for triage," the inspector asks for the record that captures the AI's contribution. Which model. What version. What prompt template. What input went in. What output came out. Who in the Quality Unit reviewed the output before the analyst accepted it. What that reviewer changed between the model output and the record as released.
Each question maps to one of the schema fields above. If the field is captured, the inspector moves to the next record in the chain (the CAPA action, the change control it triggered, the training assignments, the effectiveness check) and asks the same questions about each. If a field is blank, the inspector circles the gap and the inspection slows. If most fields are blank, the post-Purolea inspection produces a finding the firm has no defence against, because the §211.22(c) failure is structural, not procedural.
The chain isn't unique to AI. The novelty is that pre-Purolea, an inspector reading the same CAPA might have asked only who approved it. Post-Purolea, the inspector asks who approved each step and what AI participated at each step. The questions multiply, but the underlying clauses haven't changed. They were always there. The inspection questions are catching up to the records the clauses always required.
The records that weren't there — and what they cost
Purolea has ceased drug production. That outcome carries direct and continuing costs that are, in effect, the price the firm paid for not producing the records the clauses always required. We have not seen Purolea's financials, and the letter contains no figures; what follows are the cost categories any firm in this position absorbs, not an estimate of this firm's losses.
Lost revenue runs first. A manufacturer that stops production stops its run-rate for the duration of remediation, which is measured in months rather than weeks before product can release into commerce again. Inventory in distribution at the time of the letter faces recall pressure; unreleased inventory faces QU disposition under procedures that, at Purolea, did not exist in the form the clauses demand.
Remediation cost runs second. New SOPs. Retrospective validation. Computer-system validation for whatever AI integration replaces the unvalidated one. Outside consulting help, typically, before any new product can move.
Regulatory response is third. A formal response is required within fifteen working days of the letter; subsequent re-inspection adds operational disruption and reputational exposure that doesn't appear on the cost line but lands on every subsequent submission.
Market exposure is fourth, and the hardest to size. Distributor relationships under review. Customer audits intensified. Insurance premiums adjusted upward. None of these are line items in the letter; all of them carry forward for years.
Whatever the four categories sum to for a given firm, the comparison that matters is against the other side of the ledger. The records §211.22(c) and §211.100 always required — a QU review queue, a change-control workflow on AI introduction, a process-validation gate enforced at the workflow boundary — are ordinary eQMS configuration. They are cheap in a way that ceasing production is not.
The guidance the FDA already wrote
Three policy documents already in force translate cleanly into the same record schema when read against the eQMS. The joint FDA–EMA Guiding Principles of Good AI Practice in Drug Development (G-AI-P) published January 2026 is the policy backdrop the Purolea letter enforces, with its human-oversight principle landing as the reviewer-decision record. The FDA Predetermined Change Control Plan (PCCP) Final Guidance of December 2024 lands as a change-control record fired every time the model updates. The GMLP guiding principles of October 2021 land, particularly the principle requiring data sets representative of the intended population, as the training-data snapshot field on the inference record. GAMP 5 Second Edition Appendix D11 on AI/ML maps each validation-lifecycle phase to an eQMS record type.
Read forward, these are policy documents. Read backward against the eQMS, they're a record schema. Purolea is what enforcement looks like when only the forward read has been performed.
The inspector who arrives next
We don't know how FDA will operationalise this letter, and anyone telling you they've seen the new inspection script is guessing. But the questions the letter makes available to an investigator are not mysterious. Ask for a controlled record that used AI assistance in the last twelve months, and the follow-ups write themselves from §211.22(c). Who signed off on it. What was the model version. What was the prompt. Where is the training-data snapshot. What did the human reviewer change between the model output and the record as released.
The eQMS either produces the answers or it doesn't. A firm that has done the work knows which fields exist before the inspector arrives. A firm that hasn't will spend the next inspection learning, in real time, which records it should have been writing for the last twelve months. The cost of that lesson is what Purolea is paying now.
The clauses §211.22(c) and §211.100 weren't written for AI. They were written for accountability. AI raises the visibility of firms that have been operating around the clauses for years without an inspection sharp enough to find it. Purolea isn't a special case. Purolea is the case where the inspection was sharp enough.
Complere fit
Complere ships AI assistance inside the document and training workflows, so the design question this article raises — where does the AI stop and the Quality Unit begin — is one we've had to answer in our own architecture, not comment on from the sidelines. Here is the answer, specifically, because a post arguing that AI must never be the approver shouldn't be vague about the vendor publishing it.
- Our AI cannot move a record — it produces advisory output for a human. Three features are AI-assisted: document summarisation, version-to-version comparison, and drafting LMS assessments. None of them can change a controlled record, advance a workflow state, or approve anything. The summariser also returns an advisory note flagging possible compliance risks in a document; that note is advisory in the strict sense — it is not a Quality Unit decision, it is not written to the audit trail, and it cannot gate a transition. A human decides.
- The approval gate is enforced at the workflow boundary, not at the user's awareness. Any document — AI-assisted or not — must clear the required approver and QA signing records before it can reach
published. The gate does not care who or what drafted the text, which is precisely the point §211.22(c) makes and precisely the control Purolea did not have. - Signing fails closed. It requires both identity and a knowledge factor, re-verified at the point of signing. A missing or failed signature does not warn — it blocks the transition.
- Every controlled-record transition — created, reviewed, signed, approved, published — is written to an append-only audit trail at the application layer, per record type, so the QU's approve-or-reject decision is retrievable as a record rather than asserted from memory.
- Procedure changes route through Controlled Change, which links a change request to the affected documents and to the specific people whose training the change triggers — the §211.100(a) "including any changes" path, as records rather than as email.
- Tenant scope is a database, not a column. Each tenant runs in its own database with its own credentials, so the scoping question is answered by the isolation boundary rather than by a filter someone has to remember to apply.
Where the line sits today. The AI-specific fields in the table — model identity and version, the training-data snapshot, the prompt template, the input and output digests, the reviewer-modification diff — are ahead of what eQMS audit trails capture, ours included. The regulated record today is the human decision: who approved, when, against what. That is the record §211.22(c) is actually written about, and it is the record we enforce. The model's lineage is the next frontier, and we're publishing the ten fields because we'd rather define that frontier than pretend it's already behind us. When a vendor tells you they capture all ten today, ask to see the schema — you'll find a roadmap.
