Seven warning letters

A new study looked at every FDA warning letter issued from January 2022 through late September 2026, which comes to 3,011 letters, and found that only seven of them mention AI at all, and only one treated a company's use of AI as the violation itself. The authors are careful to say that seven letters can't tell you anything about a trend, and they're right, but I don't think the low number means what some people will want it to mean.

The one letter that did cite AI use is the one worth reading. In April the FDA sent a warning letter to Purolea Cosmetics Lab, a homeopathic drug manufacturer that had used AI agents to generate specifications, procedures, and production records and then put them into use without its quality unit reviewing them. The FDA didn't need a new AI rule to cite it, because the existing GMP requirement that the quality unit approve those documents already covered it.

That's the lesson I'd take from the study. Regulators aren't waiting to write AI-specific rules before they enforce anything, they're applying the rules we already have, and those rules were always about whether a qualified person reviewed and stood behind the work. The FDA and MHRA have also been signaling that they'll audit companies against their own AI policies, which means the governance document you wrote to get a tool approved is now something you can be held to.

So I'd read seven letters out of 3,011 as a measure of how early we are, not of how much risk there is. Enforcement usually trails adoption by a few years, and adoption across our industry has moved a lot faster than that over the last eighteen months.