Purolea Cosmetics Lab – 722591 – 04/02/2026 | FDA
When AI Makes Compliance Look Better Than It Is: FDA’s Purolea Warning Letter Is a Wake-Up Call for cGMP Operations
FDA’s April 2, 2026 warning letter to Purolea Cosmetics Lab should get the attention of every manufacturer, quality leader, and compliance consultant working in regulated production. The letter is notable not just because FDA identified serious cGMP deficiencies, but because the Agency expressly addressed the company’s use of artificial intelligence in creating specifications, procedures, and master production or control records that were supposed to support FDA compliance. FDA’s message was clear: using AI to generate compliance documents does not relieve a firm of the obligation to ensure those documents are accurate, complete, and actually compliant with cGMP requirements.
That is the part of this warning letter that deserves broader industry attention. The problem was not simply that the company used AI. The problem was that the firm appeared to treat AI-generated materials as though they were a substitute for a functioning quality system. FDA stated that if AI is used as an aid in document creation, the output must be reviewed to ensure it is accurate and actually compliant with cGMP, and FDA tied that failure to 21 CFR 211.22(c). The Agency also documented what it described as overreliance on AI during manufacturing operations.
FDA then gave the kind of example that will likely be repeated in compliance discussions for some time. According to the letter, investigators found that the firm had not conducted process validation before distributing drug products, as required under 21 CFR 211.100. When that was raised during the inspection, the company reportedly responded that it did not know validation was required because the AI agent it used had not identified that requirement. FDA did not treat that as an excuse, but rather as evidence of a deficient system.
In a cGMP environment, the standard is not whether documents look sophisticated, organized, or professionally written. The standard is whether the firm’s methods, controls, procedures, and oversight actually operate in a way that satisfies Parts 210 and 211. In the same warning letter, FDA cited the company for failing to perform appropriate microbiological testing on finished product batches, failing to adequately test components for identity and conformity with specifications, failing to validate the reliability of supplier test analyses at appropriate intervals, and failing to ensure adequate quality unit oversight over manufacturing operations. The AI discussion appeared in the middle of those larger operational oversights, which is exactly the point: polished language cannot compensate for missing controls.
This is where some companies get into trouble. They assume that a set of procedures, batch templates, specifications, and quality forms that read well must also be compliant. But cGMP compliance is not a document aesthetics exercise. It is an operational discipline. A procedure is not protective just because it sounds credible. It has to reflect the actual process, assign responsibility correctly, require the right controls, and be followed in practice. A master record is not meaningful if it was copied, generated, or assembled without site-specific review. A quality system is not real if the quality unit is not exercising actual oversight over release, investigations, deviations, supplier qualification, validation, and change control. FDA’s own Quality Systems Approach guidance makes the same point in broader form: quality systems and risk management approaches can help manufacturers meet cGMP requirements, but they do not replace the underlying requirements in Parts 210 and 211.
The warning letter also reinforces why working with experienced compliance partners is so vital. FDA recommended that, before the firm pursues resolution of its compliance status, it should engage a qualified consultant under 21 CFR 211.34 to assist with meeting cGMP requirements, perform a comprehensive six-system audit, and evaluate the completion and effectiveness of corrective and preventive actions. That recommendation is important because it reflects FDA’s expectation that remediation must be substantive, not cosmetic. The right compliance partner is not there to hand over documents that sound sophisticated. The right partner helps ensure the procedures are legally and operationally sound, mapped to the actual manufacturing process, integrated into the firm’s quality system, and capable of standing up during inspection.
That is especially important now, when AI tools are becoming easier to use and easier to overtrust. AI can help organize information, accelerate drafting, and support internal workflows. But in a regulated manufacturing environment, those benefits only matter if they are paired with competent human review, independent quality unit oversight, and site-specific implementation. Otherwise, the technology can create a dangerous illusion of compliance: documents that look complete, systems that appear mature, and records that seem polished, while the underlying controls are incomplete, misunderstood, or absent. FDA’s Purolea letter is a reminder that the Agency inspects how a system functions, not how well it reads.
The real lesson here is simple. Compliance has to be operative. It has to live in the training, the batch review process, the validation program, the raw material controls, the microbiological safeguards, the quality unit’s decisions, and the data that support release. If AI is used anywhere in that process, it must remain a tool, not the decision-maker. And if outside consultants are involved, their role should be to help build a system that works in practice, not just one that looks impressive in a binder.
The same point extends beyond cGMP and beyond AI. Across healthcare compliance more broadly, a policy, consent form, SOP, training module, audit framework, or marketing review process is not protective simply because it sounds polished, sophisticated, or legally informed. In regulated settings, the real question is whether the measure is accurate, operationalized and aligned with the actual legal and regulatory requirements that apply to the business. FDA’s criticism in the Purolea letter reinforces that appearance is not the standard, operational compliance is.
