Pharma · Dietary supplements · Cosmetics · Medical devices

AI inside an FDA-regulated quality system

ISO 42001 for
GMP Manufacturers

AI arrived in the quality system before the rules for it did. This page covers what FDA has already cited, what ISO 42001 adds to a GMP or ISO 13485 system and what those systems already give you, where validation fits, and where to start.

"Keep it Simple. Keep it Real."

Schedule Free Consultation 858-240-4353
April 2026
First FDA AI citation
211.22(c)
The clause cited
$5,000
First step
Jared Clark, GMP and ISO 42001 consultant

What FDA Cited

The first AI warning letter was a quality-unit finding

In April 2026 FDA issued a warning letter to Purolea that included a finding most quality professionals had been expecting for two years: inappropriate use of artificial intelligence, cited under 21 CFR 211.22(c). The company had used an AI tool to produce specifications, procedures and master production records and had put them into use without the quality unit reviewing and approving them. The regulation cited was not new. Part 211 has always required the quality unit to approve those documents. What the letter established is that a document written by a machine is still a document, and skipping the approval step is still a violation.

The same logic reaches every FDA-regulated manufacturer. Part 111 requires quality control to approve specifications and master manufacturing records for dietary supplements. Part 117 puts a preventive controls qualified individual behind the food safety plan. Part 820 and ISO 13485 require document approval and design controls for devices, and MoCRA is moving cosmetics toward the same expectations. In each case the rule names a responsible person, and AI does not change who that person is. It changes how easily the step can be skipped.

In our view this is the clearest reason a regulated manufacturer should care about ISO 42001, and it has nothing to do with Europe or with selling AI. The standard is the management-system way of making sure the review happens, the tool is fit for its use, and the record exists.

Where AI Already Is

Eight places to look in a GMP plant

Most of these arrived without a change control, because nobody thought of a writing assistant or a vendor feature as a system change.

Documents

SOPs, specifications, master records and protocols drafted or revised with AI. The Purolea finding.

Deviations and CAPA

Investigations and root-cause narratives written with a chatbot and closed without anyone checking the reasoning against the data.

Batch record review

Review-by-exception tools that flag, or fail to flag, what a person used to read line by line.

QC and vision inspection

Model-based inspection, chromatography interpretation, trending and OOS detection inside LIMS or instrument software.

Supplier qualification

AI-scored questionnaires and risk ratings that decide which suppliers get audited.

Training content

Courses and assessments generated by AI, which then train the people who approve records.

Regulatory writing

Submissions, responses to observations and annual reports drafted with AI assistance.

Complaints and pharmacovigilance

Triage and classification of complaints and adverse events, where a misclassification is a reportability failure.

Two Systems, One Set Of Controls

What ISO 42001 adds, and what GMP already gives you

What ISO 42001 adds that GMP does not require

  • An inventory of every AI system, including vendor features and personal tools
  • An AI policy with objectives and an accountable owner
  • AI system impact assessments on patients, consumers and staff, not only on product
  • Contract terms for AI that suppliers run on your data or in your process
  • Monitoring for models that drift after validation
  • The Annex A controls and the Statement of Applicability that says which ones you use

What GMP already gives you that ISO 42001 needs

  • Computer system validation and computer software assurance under GAMP 5, which is how you decide an AI tool is fit for use
  • 21 CFR Part 11 and data integrity, which already answer who wrote a record and whether it was changed
  • Change control, which is where a new model version or a vendor's new AI feature belongs
  • Document control, training records, CAPA and management review, which ISO 42001 clauses 7, 9 and 10 assume
  • A quality unit with the authority to say no, which is the human oversight the standard is looking for

Because the two lists interlock, an integrated approach is much smaller than either one looks on its own. We explain the mapping in AI governance for pharma: ISO 42001 meets FDA expectations.

Validation

The hinge is intended use

Every AI question in a GMP plant eventually turns into a validation question, and validation starts with a written intended use. A tool intended to draft text that a qualified person will rewrite and approve needs a modest, risk-based package and a review step that actually happens. A tool intended to decide whether a batch is released, a complaint is reportable or a chromatogram is acceptable needs the full treatment: requirements, a risk assessment, testing against known cases, acceptance criteria, periodic review, and change control that treats a new model version the way it treats a new firmware version.

Computer software assurance is the right frame for most of this. It lets you spend validation effort where the risk is and use vendor evidence where it is credible. What it does not let you do is skip the intended-use statement, and in our experience that is the document most sites are missing for the AI they already use. Without it, nobody can say whether the tool is doing what it was validated to do, because it was never validated to do anything.

Our principal consultant holds certifications in Computer System Validation, Computer Software Assurance and Pharmaceutical Validation Management alongside his quality and regulatory credentials, which is why our ISO 42001 work for manufacturers starts from validation rather than from policy. The detailed guides are validating AI in pharma, AI and 21 CFR Part 11, AI and data integrity and AI and GMP compliance.

Where To Start

Two steps, in order

First · Fixed fee $5,000

AI in the Quality System Review

Two weeks, one site. Every place AI touches a GMP record or decision, what review and validation evidence exists, findings ranked by inspection risk, and a control plan written against 21 CFR and ISO 13485 with ISO 42001 cross-referenced.

What the review covers

Then, if a customer or your board asks · Fixed fee $9,750

ISO 42001 Gap Assessment

The whole organization against the whole standard, with the review's findings carried in so nothing is done twice, and an honest estimate of what certification would take.

What the gap assessment covers

Background reading for pharma and life sciences: ISO 42001 for pharma · GxP-compliant AI · an AIMS inside a GxP system · our dietary supplement GMP practice

Frequently asked questions

Does FDA require ISO 42001?

No. FDA requires that the quality unit review and approve specifications, procedures and records, and that computerized systems used in GMP work be validated for their intended use. ISO 42001 is a voluntary standard that organizes the same controls for AI. FDA's April 2026 warning letter cited the regulation, not the standard, but the gaps it described are exactly the ones ISO 42001 is designed to close.

Do we have to validate AI tools like ChatGPT if staff use them for drafting?

If the output becomes a GMP record without independent review, you have a validation problem and a review problem at once. The practical answer for most sites is a documented intended use that keeps AI in a drafting role, a required qualified-person review before any output is approved, and validation or computer software assurance proportionate to the risk for tools that do more than draft.

Which comes first, the AI review or an ISO 42001 gap assessment?

For a GMP site, the AI-in-the-quality-system review. It is smaller, it is written in the language of 21 CFR and ISO 13485, and it answers what an inspector will ask. Its findings become the first part of a gap assessment if you later decide to pursue the standard.

Does ISO 42001 apply to dietary supplement, cosmetic and food manufacturers, not just pharma?

Yes. The standard applies to any organization that uses AI. The regulatory hook differs: 21 CFR Part 111 for supplements, Part 117 for food, MoCRA for cosmetics, Part 820 and ISO 13485 for devices. In each case the quality function is responsible for the records, and AI does not change who is responsible.

Find out what your AI has already touched

Book a free 30-minute call. Tell us which AI tools your quality, production and regulatory teams use, and we will tell you where an inspector would look first and whether the $5,000 review or the full gap assessment is the right start.

Schedule Free Consultation Call 858-240-4353

Or email us at [email protected]