On April 2, 2026, the FDA issued Warning Letter #722591 to Purolea Cosmetics Lab in Livonia, Michigan. It was a routine inspection — insect findings, contamination risks, inadequate separation of operations. Standard stuff. But one citation was anything but standard.

Purolea had deployed AI agents to generate drug product specifications, manufacturing procedures, and production records. When FDA investigators asked why process validation had been skipped, the company’s response was that the AI agent had not flagged the requirement.

The FDA cited 21 CFR 211.22(c) — the regulation requiring the quality control unit to review all records and specifications — and stated explicitly: if a company uses AI as an aid in document creation, it must review the AI-generated documents to ensure they are accurate and compliant with cGMP.

“The AI said so” is now, for the first time in an enforcement action, a documented cGMP violation.

This letter changes everything for the QMS software industry. Because every major QMS vendor — Veeva, MasterControl, ComplianceQuest, Dot Compliance, Arena, Ideagen — is shipping AI features right now. And none of them have published a complete validation package for those features.

The problem no QMS vendor wants to talk about

Traditional Computer System Validation follows a simple logic. You define inputs. You test outputs. You verify that the same input always produces the same output. The GAMP 5 V-model was built for this. IQ/OQ/PQ was built for this. 21 CFR Part 11 was built for this.

LLMs break every single assumption.

Same input, different output. Ask an LLM the same question twice, you get different answers. Temperature settings can reduce variability but never eliminate it. A deviation classifier that returns “Manufacturing — Temperature Excursion” on Monday and “Environmental — HVAC Failure” on Tuesday for the same deviation description is not a system you can validate with traditional test scripts.

Non-transparent logic. You can’t trace why the model produced a specific output. The “reasoning” is billions of weighted parameters, not auditable business rules. When an inspector asks “why did the system classify this deviation as Critical instead of Major?” — “the model’s weights determined it” is not an answer that satisfies 21 CFR Part 11.

Behavior changes without warning. When Anthropic updates Claude or OpenAI updates GPT, your “validated” system just changed behavior. No change control. No impact assessment. No re-validation. The model your QA team validated in February is not the model running in production in July.

Hallucination. LLMs can generate confident, plausible, and completely wrong outputs. A hallucinated CAPA recommendation. A fabricated root cause. An invented regulatory reference. In a GxP context, these aren’t bugs — they’re patient safety risks.

What the ISPE GAMP AI Guide actually says

In July 2025, ISPE published a 290-page document that every QMS vendor should have read: the GAMP Guide: Artificial Intelligence. It’s the companion to GAMP 5 Second Edition, and it’s the document FDA and EMA inspectors will quietly assume you’ve internalized when they ask how you validated your AI-enabled QMS.

The Guide identifies five things that are genuinely new compared to traditional validation:

1. AI-specific Quality Risk Management. Traditional risk assessment asks “what could go wrong with the system?” AI risk assessment must also ask: what if the training data is biased? What if the input distribution shifts? What if the model overfits? What if it drifts? These risk categories have no analog in deterministic software.

2. Dynamic systems. A traditional system doesn’t change behavior between releases. An LLM can change behavior with every provider update. The Guide treats this across all phases: concept (decide upfront whether the system will adapt), project (define retraining triggers), and operation (monitor for drift).

3. AI cybersecurity. Prompt injection. Adversarial attacks. Data poisoning. These are attack vectors that didn’t exist in the GAMP 5 world.

4. Supplier qualification for AI vendors. When your QMS vendor uses Anthropic’s Claude or Amazon’s Bedrock, your supplier qualification must extend to the LLM provider. What’s their model update policy? What’s their data retention policy? What validation evidence can they provide?

5. Continuous validation. You cannot validate an AI system in February and assume it’s still validated in November. The Guide explicitly requires ongoing performance and drift monitoring evidence.

How QMS vendors claim to handle this (and what they’re not telling you)

Veeva

Veeva’s AI Agents use Anthropic and Amazon LLMs on Amazon Bedrock. They support customer-provided models. Quality AI Agents ship in April 2026.

Veeva’s validation approach: the Vault platform is validated; AI agents are validated as extensions of the platform. All AI actions are logged in the Vault audit trail. Human reviewers validate, approve, or override at defined decision points.

What Veeva hasn’t published: the actual IQ/OQ/PQ for AI features. Specific accuracy metrics. How they handle Anthropic model updates. Their hallucination rate in production. Their prompt validation methodology.

MasterControl

MasterControl has five named AI tools: Automated Risk Assessment, KPI Analyzer, APQR Generator, Auto Lot Tracking Report Generator, and Quality Event Report Summary Generator. They’re ISO 42001 certified — the only QMS vendor with this distinction.

The ISO 42001 certification is real and meaningful. It means their AI management practices are independently audited. But ISO 42001 certifies the management system, not the accuracy of specific AI outputs.

What MasterControl hasn’t published: accuracy metrics for each AI tool. Validation test results. Hallucination rates. How they handle LLM provider model changes.

ComplianceQuest

CQ.AI Agents shipped in Summer 2025. Built on Salesforce Einstein. The most mature Salesforce-native AI in QMS.

ComplianceQuest inherits Salesforce’s AI governance framework. Their specific features — nonconformance AI, risk recommendations, root cause investigation — are practical and production-ready.

What ComplianceQuest hasn’t published: the same things as everyone else. No public validation package. No accuracy metrics. No hallucination rates.

Dot Compliance

Dottie AI is in its third generation. Built AI-first from founding (2015). The only QMS vendor that was architected around AI from day one.

Dot Compliance’s “vertical AI” positioning is important — Dottie is purpose-built for life sciences quality, not a generic LLM bolted onto a QMS. But they also haven’t published validation evidence.

The pattern

Every vendor validates the platform. No vendor has published validation of the AI model itself in the way the ISPE GAMP AI Guide expects. The wrapper is validated. The brain is in a grey zone.

What the FDA’s seven-step credibility assessment requires

The FDA’s January 2025 draft guidance introduces a structured framework for AI validation:

  1. Define the question of interest — What specific decision will the AI inform?
  2. Define the context of use — How will the AI output be used?
  3. Assess the model risk — What happens if the AI is wrong?
  4. Determine the credibility evidence needed — What level of evidence is proportionate to risk?
  5. Generate the credibility evidence — Testing, validation, monitoring
  6. Assess whether the evidence is sufficient — Does it meet the bar?
  7. Document and maintain — Ongoing monitoring and re-assessment

This framework doesn’t prescribe specific testing methods. It prescribes a risk-based process. And it makes clear: the burden of proof is on the organization deploying the AI, not on the vendor.

What actually works in practice

Several top-10 pharma companies have moved LLM use cases from pilot to validated production in the last 12-18 months. The full validation packages are confidential, but the pattern is reconstructable from conference talks, vendor announcements, and industry analyses.

The use cases that made it through first

The first LLM to reach validated production is never the most ambitious use case. It’s always “decision support with human review”:

  • Regulatory document drafting — LLM produces draft, human reviews
  • Pharmacovigilance case triage — LLM proposes classification, case processor validates
  • SOP search and retrieval — LLM answers questions from SOP content, with documented limitation that the SOP is authoritative
  • Clinical protocol drafting support — LLM produces draft language, clinical operations finalizes

The pattern: The LLM assists. The human decides. The human’s review is the control point.

The validation structure that holds up

The teams that have successfully validated LLMs in GxP follow a consistent structure:

  1. Lock the model version. Specific model, specific version, specific configuration. Document it.
  2. Set temperature to 0. Maximum determinism. Not truly deterministic (floating-point arithmetic still introduces variability), but close enough for validation.
  3. Define intended use narrowly. “Classify deviations into 5 categories” — not “help with quality management.”
  4. Curate a test dataset. Domain-specific, reviewed by subject matter experts, with known correct outputs.
  5. Run the test set N times. Typically 100-1000 runs. Measure accuracy, precision, recall against SME classification.
  6. Set acceptance criteria. Typically 85-95% agreement with human expert review.
  7. Document failure modes. Known limitations, hallucination patterns, edge cases.
  8. Treat prompts as code. Version-controlled, tested, change-controlled. A prompt change is a change control event.
  9. Human-in-the-loop at every decision point. AI recommends, human approves.
  10. Monitor post-deployment. Track accuracy over time. Detect drift. Trigger re-validation when performance degrades.

A real example

A deviation categorization LLM following this framework achieved 94% accuracy against SME review and reduced processing time from 4 hours to 30 minutes per batch. The validation documented: model version, temperature setting, prompt template version, test dataset of 500 historical deviations, acceptance criteria of ≥90% agreement, and a human review requirement for all AI-generated classifications.

That’s a validation package an inspector can review.

The question every QMS buyer should be asking

When your QMS vendor shows you their AI features, don’t ask “is it validated?” Ask these:

  1. What LLM model and version are you using? If they can’t tell you, they don’t have version control.
  2. What happens when the LLM provider updates the model? If they don’t have an answer, your “validated” system will change behavior without notice.
  3. What is your measured accuracy rate in production? If they can’t produce a number, they haven’t measured it.
  4. How do you handle prompt changes as change control events? If prompts aren’t version-controlled, the system isn’t under change control.
  5. What is your hallucination rate? If they haven’t measured it, they don’t know.
  6. Are you conforming to the ISPE GAMP AI Guide? If they haven’t read it, they’re behind.
  7. Can I see your AI validation package? Not a slide deck. The actual documentation. If they can’t produce it, they haven’t done it.

The uncomfortable truth

The honest answer to “how do you validate a non-deterministic LLM in a GxP environment?” is: the industry is still figuring it out.

The ISPE GAMP AI Guide provides the framework. The FDA’s credibility assessment provides the structure. The Purolea warning letter provides the enforcement precedent. But no QMS vendor — not Veeva, not MasterControl, not ComplianceQuest, not Dot Compliance — has published a complete, GAMP AI Guide-compliant validation package for their LLM features.

The vendors that are closest are MasterControl (ISO 42001 certified, five bounded AI tools) and Veeva (platform-level validation with AI agent extensions). But “closest” is not “there.”

The Purolea letter established a precedent: over-reliance on AI is a cGMP violation. The next warning letter will be for a company that deployed a QMS vendor’s AI feature without validating it for their specific use case. The vendor will say “we provide the platform, the customer is responsible for validation.” The customer will say “the vendor told us it was validated.” The FDA will cite the customer.

Because in GxP, the accountability is always on the company that ships the product. Not on the software vendor.

The QMS AI race is real. The features are shipping. The value is tangible — 35% productivity improvements, faster deviation triage, better CAPA investigations. But the validation gap is also real. And the first company to close that gap — to publish a complete, inspection-ready AI validation package — will have an enormous competitive advantage.

Until then, ask the hard questions. Document everything. And remember: “the AI said so” is not a defense.