FDA’s Current Position on Artificial Intelligence in Pharmaceutical Quality (2026)
A practical, inspection-ready translation of FDA’s AI posture for GMP quality systems.
Xevalics Consulting, LLC
Who This Is For
This post is for QA/QC leaders, manufacturing and MS&T teams, CSV/CSA practitioners, and digital/IT stakeholders who are implementing—or evaluating—AI/ML in GMP-impacting workflows and want a practical, audit-defensible way to align AI governance with FDA expectations under 21 CFR Part 211 and related guidance.
Introduction
Artificial intelligence is increasingly being used across pharmaceutical development, manufacturing, and quality operations—sometimes through formally approved systems, and other times through tools that gradually become embedded in daily decision-making. As adoption accelerates, FDA’s regulatory focus is not on whether AI is present, but on whether the pharmaceutical quality system remains in control of how AI is used.
Recent FDA public communications, panel discussions, and industry engagements signal a consistent regulatory posture: artificial intelligence is expected to be governed using existing GMP principles, including defined intended use, risk-based assurance, human accountability, and data integrity.1,2
These expectations are grounded in current regulations and guidance, not in AI-specific exemptions or standalone frameworks.
Public remarks by FDA officials—including Tina Kiang (FDA Office of Pharmaceutical Quality)—provide useful insight into how the Agency is reinforcing these principles in practice. While such remarks do not constitute binding guidance, they align closely with established regulatory requirements and help clarify how FDA is currently framing AI in regulated pharmaceutical environments.1
This article synthesizes those signals and translates them into inspection-relevant expectations, mapped directly to applicable FDA and ICH citations.
A qualified professional reviewing electronic records within a controlled digital quality system, illustrating human oversight and accountability in regulated pharmaceutical operations.
Key Takeaways
- FDA’s recent public messaging indicates that artificial intelligence is expected to be managed as GMP-impacting software when it influences regulated activities, records, or decisions, consistent with 21 CFR Part 211 requirements.3
- FDA continues to reinforce that human accountability for GMP decisions remains unchanged, even when AI systems are used to support analysis, prioritization, or decision-making workflows.4,5
- FDA’s current posture places significant emphasis on context of use, with regulatory expectations scaling based on the impact an AI system has on product quality, patient safety, and regulatory decisions.2,6
- Consistent with ICH Q9(R1) and FDA’s Computer Software Assurance framework, the Agency favors risk-based assurance strategies over prescriptive, one-size-fits-all validation approaches for AI-enabled systems.6,7
- FDA data integrity expectations remain fully applicable when AI is used, including requirements for traceability, audit trails, record reconstruction, and governance over data used to generate or support GMP records.8,9
- FDA regulations continue to place final authority with the Quality Control Unit, requiring that AI outputs be reviewable, challengeable, and subordinate to established quality oversight processes.4,10
- FDA has signaled openness to innovation involving AI, particularly where organizations apply appropriate controls, define clear use boundaries, and engage transparently on higher-risk or novel applications.11
FDA’s Core Message on AI in Pharmaceutical Quality
1) AI Is Acceptable—But Only as a Regulated Tool
AI is not “outside GMP.” If it performs a function that can impact product quality decisions, GMP records, or process control, FDA will view it as part of the regulated system landscape—requiring routine checks, appropriate controls, and documentation.
Regulatory anchors to cite internally
- 21 CFR §211.68(a) — Automated/electronic equipment must be routinely calibrated/inspected/checked per a written program, with records maintained.3
- 21 CFR Part 211 — Establishes the baseline CGMP context for finished pharmaceuticals.3
Practical implication: Treat AI like other GMP-impacting computerized functionality: defined intended use, controlled configuration, appropriate assurance evidence, and lifecycle governance.
Controlled infrastructure supporting validated digital quality systems and risk-based oversight in GxP operations.
2) Human Accountability Is Non-Negotiable
FDA’s posture is that AI may inform work, but it does not own accountability. Someone must remain responsible for decisions and be able to explain why the decision was appropriate despite uncertainty, model limitations, or data gaps.
Regulatory anchors
- 21 CFR §211.22(a) — Quality Control Unit authority and responsibilities.4
- 21 CFR §211.192 — Production record review and investigation of discrepancies/failures.5
- ICH Q10 — Management responsibilities and Pharmaceutical Quality System model.12
Practical implication: If AI influences deviation triage, OOS/OOT evaluation, or batch-impact decisions, define explicit human review steps, decision authority, and escalation paths.
3) Context of Use Drives Compliance Expectations
The same model can be low-risk or high-risk depending on what it influences. FDA scrutiny scales with impact, not novelty.
Examples
- Lower impact: internal knowledge retrieval, drafting assistance, scheduling, operational analytics with no GMP decision impact.
- Higher impact: release-related analytics, deviation decision support, process parameter optimization, automated exception closure.
Regulatory anchors
- ICH Q9(R1) — Risk management concepts to scale governance and formality with impact.6
- 21 CFR §211.68(b) — Controls to prevent unauthorized changes (high relevance where models/configurations can change).3
Practical implication: Define context of use up front, in writing. Most governance confusion begins when “what the model is allowed to influence” is vague.
4) Risk-Based Thinking Over Prescriptive Checklists
FDA’s direction is not “wait for an AI rulebook.” It is “apply quality risk management and document defensible control decisions.” Risk-based assurance is increasingly the expected method for deciding how much evidence is enough.
Regulatory anchors
- ICH Q9(R1) — Establishes the risk-based logic and discourages using QRM to justify unacceptable practices.6
- FDA CSA Guidance — Risk-based assurance logic for software used in production and quality systems.7
Practical implication: Focus assurance on what can fail and what matters: decision impact, detectability, data integrity exposure, change frequency, and oversight effectiveness.
5) Data Integrity Still Rules—AI Doesn’t Change It
AI can increase throughput and complexity, but it does not relax expectations that data and records remain trustworthy across their lifecycle. If AI creates, transforms, summarizes, or prioritizes GMP-relevant information, you should expect questions about traceability and reconstruction.
Regulatory anchors
- 21 CFR §211.194(a) — Laboratory records must include complete data and be properly maintained.8
- FDA Data Integrity Q&A — Clarifies the role of data integrity under drug CGMP.9
- 21 CFR Part 11 (where applicable) — Electronic record controls and audit trail expectations for regulated records.14
Practical implication: Be able to reconstruct the “why” behind outcomes: what data was used, what version/model/configuration ran, what outputs were generated, who reviewed them, and what actions followed.
6) Quality Units Retain Final Authority
Even advanced AI does not displace QA/QC authority. Where release, disposition, or critical investigations are involved, quality oversight must remain independent, informed, and able to overrule or reject AI recommendations.
Regulatory anchors
- 21 CFR §211.22(a) — QC unit authority.4
- 21 CFR §211.165 — Testing and release requirements for distribution.10
Practical implication: AI may recommend. QA decides. Your governance should prove that this is true in practice (not just in policy).
7) FDA Is Open to Innovation—When It’s Transparent and Controlled
FDA is not signaling “no” to AI. The signal is “yes, with control.” For novel manufacturing technologies (and, by extension, novel high-impact digital approaches), FDA also encourages early engagement mechanisms.
Regulatory anchors
- FDA CDER Emerging Technology Program (ETP) — Pathway for early engagement on innovative manufacturing technologies within OPQ scope.11
Practical implication: If your AI use case is novel, high-impact, or difficult to explain, build a governance package that can be discussed openly and early—internally and with regulators when appropriate.
Cross-functional stakeholders conducting structured oversight for regulated quality decisions.
What FDA Inspectors Are Likely to Ask
Expect questions that sound like classic GMP, phrased for modern systems:
- What GMP decisions does the AI influence, and how is that bounded?3,6
- Who reviews outputs, and what do they do when the system is uncertain or wrong?5,6
- How do you control changes (model updates, configuration drift, vendor changes, retraining)?3,7
- Can you reconstruct a decision trail for a specific event (data lineage, versions, review evidence)?8,9
- How does QA maintain authority and oversight when AI is embedded in workflows?4,10
Frequently Asked Questions
Does FDA require an “AI validation framework” separate from GMP?
Not as a prerequisite to begin. FDA’s signals align with applying existing GMP principles and risk-based assurance proportional to the system’s context of use.6,7
Are “black box” models prohibited?
Not inherently—but the higher the impact, the more your organization must demonstrate appropriate control, traceability, oversight, and the ability to detect/mitigate failure modes.6,9
What is the fastest path to inspection-ready AI governance?
Define context of use tightly, then implement a control set proportional to risk: roles/responsibilities, evidence of assurance, change control, monitoring, and review workflows.3,6,7
Conclusion
The practical takeaway from FDA’s current messaging is straightforward: AI is welcome, but GMP fundamentals still rule. If AI influences GMP decisions or GMP records, it must be governed as part of the pharmaceutical quality system—risk-based, auditable, and accountable.2,6,9
Organizations that treat AI governance as a quality system capability—not a side experiment—will move faster with fewer regulatory surprises.
About Xevalics Consulting
Xevalics Consulting, LLC supports regulated organizations in the responsible design, qualification, and governance of agent-enabled technologies within validated and GLP-compliant environments.
Our focus is the qualified, controlled, and auditable deployment of agent-enabled systems to support regulated processes without compromising scientific integrity or regulatory expectations.
Transparency Statement
This article was developed with the assistance of artificial intelligence tools to support research synthesis, drafting, and editorial refinement. Human subject-matter expertise guided all analytical decisions. Xevalics Consulting, LLC retains full responsibility for the content and perspectives expressed.
Regulatory and Compliance Disclaimer
This article is provided for informational and educational purposes only and does not constitute regulatory guidance, legal advice, or an official interpretation of applicable laws, regulations, or guidance documents. Organizations remain solely responsible for determining regulatory applicability and compliance.
Works Cited
- RAPS — FDA official offers tips on leveraging AI in drug manufacturing (Jan 2026).
https://www.raps.org/news-and-articles/news-articles/2026/1/fda-official-offers-tips-on-leveraging-ai-in-drug - ISPE — AI in Pharma Regulation: Key Takeaways from the ISPE 2025 Global Regulatory Town Hall (Dec 8, 2025).
https://ispe.org/pharmaceutical-engineering/ispeak/ai-pharma-regulation-key-takeaways-ispe-2025-global-regulatory - eCFR — 21 CFR §211.68 Automatic, mechanical, and electronic equipment.
https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-D/section-211.68 - eCFR — 21 CFR §211.22 Responsibilities of quality control unit.
https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-B/section-211.22 - eCFR — 21 CFR §211.192 Production record review.
https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.192 - ICH — ICH Q9(R1) Quality Risk Management (Step 4, 2022).
https://database.ich.org/sites/default/files/ICH_Q9%28R1%29_Guideline_Step4_2022_1219.pdf - FDA — Computer Software Assurance for Production and Quality System Software (Guidance).
https://www.fda.gov/regulatory-information/search-fda-guidance-documents/computer-software-assurance-production-and-quality-system-software - eCFR — 21 CFR §211.194 Laboratory records.
https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.194 - FDA — Data Integrity and Compliance With Drug CGMP: Questions and Answers (Guidance).
https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers - eCFR — 21 CFR §211.165 Testing and release for distribution.
https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-I/section-211.165 - FDA CDER — Emerging Technology Program (ETP) (Program overview).
https://www.fda.gov/about-fda/center-drug-evaluation-and-research-cder/emerging-technology-program-etp - ICH — ICH Q10 Pharmaceutical Quality System (Guideline).
https://database.ich.org/sites/default/files/Q10%20Guideline.pdf - eCFR — 21 CFR Part 11 Electronic Records; Electronic Signatures.
https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11
Related Xevalics insights:
