In April 2026, FDA issued a warning letter to Purolea Cosmetics Lab that changed the regulatory landscape for AI in life sciences. The company had deployed autonomous AI agents to author drug product specifications, SOPs, and master production/control records. When investigators asked why process validation had never been performed, the company’s defense was that the AI agent had not identified the requirement.

FDA’s response was unequivocal: “If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP.” Any output or recommendation from an AI agent must be reviewed and cleared by an authorized human representative of the Quality Unit.

Two months later, the UK’s MHRA published an inspectorate statement revealing it had received AI-generated inspection responses containing nonexistent regulatory references, fabricated guidance documents, and materially inaccurate technical claims. One response to a patient-safety deficiency ran to 90 pages and pushed inspector review time from roughly 4 hours to over 20 hours.

These aren’t hypothetical audit scenarios anymore. They are enforcement actions from the two most influential GxP regulatory bodies in the world. And they signal that auditors — internal, external, and regulatory — are fundamentally rewiring how they evaluate AI in regulated environments.

The paradigm shift auditors are absorbing

Traditional life sciences auditing rests on a deterministic assumption: given the same input, a validated computer system produces the same output every time. Validation proves this repeatability. Audit trails record who changed what, when.

AI systems violate every part of that assumption by design. They produce probabilistic outputs. They can drift over time. They behave differently across contexts. An LLM summarizing an SOP and the same LLM recommending batch disposition face radically different risk profiles — yet run on the same infrastructure.

The auditor’s question has shifted from “Is the system validated?” to something far more demanding:

“Show me where AI is being used, what it is allowed to do, what risk it creates, who is accountable, what evidence proves it works, and how you know it hasn’t changed or degraded.”

That is a fundamentally different audit model. And the frameworks for answering it are converging fast.

The regulatory baseline is finally concrete enough to audit against

For years, the industry validated AI the same way it validated any GxP computerized system, without dedicated guidance. That changed in 2025–2026 with a rapid crystallization of the regulatory architecture:

FDA’s risk-based credibility framework (January 2025 draft). The guidance “Considerations for the Use of AI to Support Regulatory Decision-Making for Drug and Biological Products” introduces a seven-step credibility assessment: define the regulatory question and context of use (COU), assess model risk based on influence and decision consequence, build and execute a credibility assessment plan scaled to that risk, then document and justify adequacy. This is a proportional framework — validation depth scales with how much the AI output influences a decision and how consequential getting it wrong would be.

Notably, the guidance explicitly excludes AI used for internal operational efficiency — drafting, workflow automation — that doesn’t touch patient safety, drug quality, or study reliability. If your AI agent summarizes internal meeting notes, it’s outside scope. If it recommends whether a deviation requires escalation, it’s squarely within it.

EMA’s Reflection Paper (finalized September 2024). Covers the entire medicinal product lifecycle and — unlike FDA’s draft — explicitly includes drug discovery and nonclinical development. For high-impact uses, EMA expects full model architecture, development and validation logs, and training data descriptions to be producible at authorization.

Joint FDA-EMA Guiding Principles (January 2026). Ten principles of Good AI Practice in Drug Development: human-centric by design, risk-based approach, clear context of use, data governance and documentation, lifecycle management, and clear essential information. This is the closest thing to a global audit benchmark the industry has.

Draft EU GMP Annex 22 (July 2025 consultation). The EU’s first GMP framework dedicated to AI systems. Its most contentious line: probabilistic and generative models “should not be used in critical GMP applications.” Only deterministic models — where identical inputs produce identical outputs — are in scope. EMA held a June 2026 workshop to reconsider guardrails for probabilistic systems, but the conservative starting position sets the regulatory floor.

EU AI Act. High-risk obligations phasing in 2025–2027. Many life sciences AI systems may be classified as high-risk under Annex III. Pharma companies using third-party AI are legally “deployers” with obligations for conformity assessments and monitoring.

ICH Q9(R1) and E6(R3). Q9(R1) introduces formality and product availability risk considerations directly applicable to AI risk assessments. E6(R3) extends risk-proportionate oversight of computerized systems in clinical trials.

The direction is unmistakable. The regulatory trajectory looks like this:

Era Regulatory Mindset
Traditional CSV “Is the software validated?”
CSA (2022+) “Is the assurance effort proportional to risk?”
Early AI (2023–2024) “Is AI appropriately governed?”
2025 “Can you demonstrate AI credibility for its intended use?”
2026 “Can you demonstrate actual AI behavior, oversight, and evidence?”
Emerging “Can you continuously demonstrate control as the AI changes?”

The two-track assurance model auditors are adopting

Leading auditors and compliance frameworks now evaluate AI using two distinct tracks, recognizing that validating the software does not automatically validate the AI’s outputs.

Track 1: System Qualification. Is the system reliably controlled in our GxP environment? This is the familiar CSA/GAMP territory — intended use statements, infrastructure security, RBAC, audit trail integrity under 21 CFR Part 11, formal change control for model weights and prompt templates.

Track 2: Output Credibility. Can we trust this specific AI output for this specific GxP decision? This is where most organizations fail audits. It demands decision impact analysis, performance benchmarking against golden datasets, drift monitoring, bias and subgroup analysis, and explainability proportional to risk.

The GAMP 5 Second Edition (2022) with Appendix D11 was the first revision to include AI/ML-specific guidance. In July 2025, ISPE published a dedicated 290-page GAMP Guide: Artificial Intelligence that extends the lifecycle model from concept to retirement, covering data governance, model training, validation, deployment, performance monitoring, and change control. It now stands as the closest thing to an industry-consensus audit reference.

The six things auditors are actually checking

Across regulatory inspections, internal audits, and third-party assessments, auditors are converging on a consistent set of focus areas.

1. Context of Use and risk tiering

The same AI model deployed in different contexts warrants dramatically different scrutiny. A risk tiering framework is emerging:

Tier Example Assurance Approach
Critical / Autonomous ML visual inspection for injectable defects; batch disposition Full lifecycle validation, independent test sets, continuous monitoring, HITL design justification
High / Decision Support PV intake triage, deviation prediction, digital endpoints Risk-based verification, performance SLAs, human QC sampling with documented rationale
Moderate Literature screening, GenAI drafting of regulatory documents Use-case controls, human verification, prompt/output logging
Low / Non-GxP Discovery research, internal copilots Governance, data security, acceptable-use policy

Auditors expect a documented COU boundary defining what the model is validated to do — and explicitly what decisions it is prohibited from making without secondary verification.

2. Data lineage and ALCOA+ for training data

Because model quality is directly bound to training data, auditors spend significant time probing data provenance. They are extending ALCOA+ principles to the entire AI data pipeline:

  • Attributable: Who curated training data, who labeled it, who approved model changes
  • Legible: Model cards, data sheets, documentation of limitations
  • Contemporaneous: Time-stamped data acquisition and training runs
  • Original: Raw data retained, not only embeddings or processed features
  • Accurate: Data quality metrics, bias assessment, representativeness analysis
  • Complete, Consistent, Enduring, Available: Backup, archival, readability over defined periods
  • Traceable: Full provenance chain from source system through transformations to model artifact

Key questions auditors ask: Was the training/validation/test split clean with the test set withheld entirely from development? Does the training data reflect real-world distributions — patient demographics, defect types, edge cases? Is there evidence of train/test contamination?

3. Extended audit trails

Traditional audit trails record who edited a record and when. For AI, auditors inspect whether the system creates a reproducible chain of evidence that goes well beyond that:

  • Prompt and context logging: System prompts, retrieved document chunks with IDs and versions, model hyperparameters (temperature, top-p), model versions
  • Output attribution: Can the sponsor prove exactly which version of a foundation model generated a specific response or QC flag?
  • Tool calls and intermediate decisions: For agentic systems, every API call, retrieval step, and reasoning chain
  • Human reviewer identity and decision: Who reviewed, what they decided, how long they spent

The audit trail for an AI system looks fundamentally different from traditional software:

User → AI Agent → Model/Version → Prompt Hash → Retrieved Documents
→ Tool Calls → Intermediate Decisions → Output → Confidence Score
→ Guardrail Results → Human Reviewer → Human Decision → Timestamp

Under 21 CFR Part 11 and the Annex 11 revision, these logs must be tamper-evident, write-protected, and synchronized with enterprise identity systems.

4. Vendor management and supply chain

Most biopharma companies license foundation models or SaaS-based AI tools rather than training from scratch. This creates a supply chain assurance problem that is arguably harder than the model itself.

Auditors now expect:

  • Model transparency: Vendor disclosure of base model provenance, fine-tuning methodologies, and safety guardrails
  • Change notification: If a cloud vendor silently updates an underlying model endpoint, the biopharma client must receive automated alerts — silent updates break validated state
  • Data isolation: Confirmation that proprietary sponsor data and clinical records are never used in external training loops
  • Beyond SOC 2: SOC 2 and ISO 27001 attestations cover security, not model quality. Auditors are demanding supplemental evidence: validation summaries, benchmark results, model cards
  • Contract terms: Audit rights, data-use restrictions, liability, and exit provisions

This is one of the fastest-growing audit findings: organizations cannot answer basic questions about what AI is running inside their vendor products, which version is live, or when it was last changed.

5. Continuous monitoring and change control

Static “validate once, operate for five years” is rejected for dynamic AI pipelines. Auditors verify that:

  • SOPs mandate continuous performance monitoring (F1 scores, false discovery rates, embedding drift)
  • Retraining is governed by strict change control with automated regression testing before redeployment
  • Predetermined Change Control Plans (PCCP) define drift thresholds that trigger revalidation
  • Adverse events and misclassifications are fed back into CAPA loops
  • Model updates, prompt changes, RAG corpus changes, and vendor updates are all tracked under change management

The concept of “version” for an AI system is far more complex than traditional software. An AI configuration fingerprint needs to capture the model, model version, prompt hash, RAG corpus version, embedding model version, retriever configuration, guardrail version, tool access permissions, and policy reference — all as a single auditable unit.

6. Meaningful human oversight

Regulators and auditors reject “automation complacency.” Stating “a human reviews all AI outputs” is no longer sufficient. Auditors now assess whether the HITL is meaningful:

  • Is the reviewer prompted with explainability metrics — citation linkages, confidence scores, supporting evidence?
  • Do audit logs prove adequate review time took place prior to signature?
  • Does the human have actual authority and competence to challenge the AI’s recommendation?
  • Are override events logged and analyzed as quality signals?

The Purolea warning letter established the precedent: the Quality Unit cannot outsource its judgment to an algorithm. The chain must be AI recommendation → human Quality Unit review → regulated decision. The AI doesn’t become the responsible entity.

The hardest problem: AI agents break traditional audit trails

A traditional ML model has a simple audit path: input → model → prediction → human decision. An AI agent — the kind that retrieves SOPs, searches regulations, calls QMS APIs, analyzes CAPAs, consults other agents, and generates recommendations — creates a fundamentally more complex evidence chain.

When an auditor asks “what exactly happened?” for an agentic system, the answer might span 10–15 intermediate steps across multiple data sources, tools, and reasoning chains. Traditional audit trail concepts are insufficient. What’s needed is an AI execution trace that captures the full chain of thought, tool calls, data retrieval, and decision points.

This has architectural implications. AI agents need their own identity in audit trails — separate from the human user. They need configuration fingerprints that capture the exact state of every component in the pipeline. And critically, the agent orchestration must be deterministic — the LLM should never control routing, tool access, or escalation logic.

What “audit-ready AI” actually means

The emerging definition is not “AI that never makes mistakes.” That’s impossible.

Audit-ready AI means: an AI system whose behavior, evidence, configuration, data, decisions, changes, and human oversight can be reconstructed and evaluated after the fact.

Regulators don’t need perfect AI. They need:

  • Controlled risk — defined boundaries on what the AI can and cannot do
  • Detectable failure — monitoring that catches problems before they propagate
  • Accountable humans — named individuals with authority and competence to intervene
  • Reconstructable evidence — enough information to understand why a decision was made at a specific moment

That is an achievable engineering target. And it maps directly to the architectural pattern gaining traction in the industry: a Master Data Fabric providing authoritative source systems, a Semantic Knowledge Graph connecting requirements to SOPs to deviations to CAPAs to audit evidence, and an AI Agent layer that reads and analyzes but never controls the systems of record — all wrapped in a cross-cutting Assurance Plane that captures risk, evidence, monitoring, and human approval.

The bottom line

The organizations that will fare best in the next wave of AI-focused inspections are those that treat governance as an operational capability — embedded in pipelines, enforced by platforms, and visible in real time — rather than as a compliance exercise that begins and ends in a policy document.

The regulatory direction — FDA’s credibility framework, EMA’s lifecycle view, Annex 22’s deterministic starting point, MHRA’s outcome-based philosophy, and the EU AI Act’s high-risk regime — all converge on the same model:

Risk → Evidence → Traceability → Human accountability → Continuous monitoring

The enforcement precedent is set. The frameworks are crystallizing. The question is no longer whether auditors will scrutinize AI in your GxP operations — it’s whether you can produce the evidence when they do.

Sources

  1. FDA — Purolea Cosmetics Lab Warning Letter, April 2026
  2. MHRA Inspectorate — “Use of AI for GxP Inspection Responses,” June 2026
  3. EMA — GMP Multistakeholder Workshop on Annex 22, June 2026
  4. FDA — “Considerations for the Use of AI to Support Regulatory Decision-Making for Drug and Biological Products,” January 2025
  5. ISPE — GAMP Guide: Artificial Intelligence, July 2025
  6. ISPE — GAMP 5 Second Edition + Appendix D11, 2022
  7. ICH — Q9(R1) Quality Risk Management, 2023
  8. ICH — E6(R3) Good Clinical Practice, 2025
  9. EMA — Reflection Paper on AI in the Medicinal Product Lifecycle, September 2024
  10. FDA/EMA — 10 Guiding Principles of Good AI Practice in Drug Development, January 2026
  11. EU — AI Act (Regulation 2024/1689)
  12. EU GMP — Draft Annex 22 on AI, July 2025 consultation
  13. ISO/IEC 42001:2023, 42006:2025
  14. NIST — AI Risk Management Framework 1.0 + GenAI Profile
  15. ISACA — AI Audit Toolkit + IT Audit Framework 2026
  16. IIA — Global Internal Audit Standards 2025 + AI Auditing Framework
  17. PCAOB — Amended AS 1105/2301, effective 2026
  18. UK FRC — AI in Audit Guidance, March 2026