On April 2, 2026, the FDA issued Warning Letter 320-26-58 to Purolea Cosmetics Lab. The industry called it a watershed moment for AI governance in pharmaceutical manufacturing. Then they stopped reading.

I read the whole letter.

The AI finding is the last substantive citation before the closing. Before it: unapproved drugs for shingles and genital herpes in distribution to sick people. An ingredient with a documented link to lethal human poisoning, used in drug manufacturing without any testing. Insects, filth, and leaves in the manufacturing area. No microbial testing of finished products. No component testing. A Quality Unit that did not function.

One detail the coverage missed: the inspection was routine and unannounced. No complaint. No adverse event. FDA showed up on an ordinary Tuesday. What investigators found was the facility’s everyday operating state.

The industry built AI governance frameworks from the last substantive finding in that letter. That is the wrong lesson from the right case. And for quality leaders who have been in this industry long enough to know what a complete quality system failure looks like, it should be uncomfortable to watch.

What the Letter Actually Says

Read the violations in the order FDA named them. Sequence matters. FDA writes warning letters deliberately. The letter opens with what investigators physically saw when they walked through the door — then works through the quality system failures — then names the legal status of the products. That sequence is the argument.

1. Insanitary Conditions · 501(a)(2)(A)— The facility had insects, filth, leaves, and clutter in manufacturing areas. When opened, the docking bay door directly exposed manufacturing operations to the outside environment. This is what FDA saw first. This is what investigators documented before reviewing a single quality record.

2. No Microbial Testing · 21 CFR 211.165(b)— Drug products released with no microbial testing of any kind. No total count. No testing for objectionable microorganisms. No stability data. Products intended for topical application on the open, blistered skin of shingles patients — released without evidence they were free of contamination.

3. No Component Testing · 21 CFR 211.84(d)— Incoming components used without identity, purity, strength, or quality testing. Supplier certificates of analysis accepted without verification. One ingredient carries a contamination risk linked to lethal human poisoning incidents worldwide. That sentence is in the letter. It has received almost no industry attention.

4. Quality Unit Failures · 21 CFR 211.22(a)(c)(d) · 211.100(a)— The Quality Unit did not ensure procedures were established or followed. Did not review batch records before release. Did not establish production and process controls. Documented as its own finding, separate from and prior to the AI section.

5. Inappropriate Use of AI · 21 CFR 211.22(c) · 211.100— FDA titled this section “Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing” — a heading that does not exist in any prior warning letter. The company used AI agents to create specifications, SOPs, and master production records without QU review. When FDA investigators noted the absence of process validation, the owner said the AI agent had not told her it was required.

6. Unapproved New Drugs · 505(a) · 301(d) FD&C Act— Products bearing therapeutic claims for shingles and genital herpes — serious viral diseases — manufactured and distributed without an approved new drug application. Unapproved new drugs. In distribution. To sick people. FDA noted this as “especially concerning from a public health perspective.”

7. Products in Distribution— Products within expiry remain in distribution. FDA required a written market withdrawal and disposition plan as part of the response.

8. MoCRA Cosmetics Compliance— Some products may be regulated as cosmetics and must comply with Modernization of Cosmetics Regulation Act requirements. This is the closing citation — a separate compliance framework, lower urgency than the preceding findings.

Not a governance failure inside a functioning quality system. The absence of any quality system at all. The AI finding is the fifth citation in this letter — documented after insects on the floor, after no testing program, after a Quality Unit that did not function. The industry discussed the fifth finding as if it were the only one.

The Risk Ranking No One Is Publishing

If I am sitting across from the owner of this company, helping her understand what she is facing, the AI governance conversation is last. Here is the actual order of concern.

The AI governance finding is real. It matters. I will get there. But it is not where a qualified consultant starts when this phone rings.

The Quality System Argument

Here is the insight that the AI narrative misses entirely.

If any of the six pharmaceutical manufacturing systems had functioned — Quality, Facilities and Equipment, Materials, Production, Packaging and Labeling, Laboratory Controls — the AI problem would not have survived to become an FDA finding. These are the same six systems that the FDA examines on every pharmaceutical manufacturing inspection; they represent the complete operational infrastructure that a drug manufacturer is required to maintain under 21 CFR Parts 210 and 211.

The six systems are the operational infrastructure FDA inspects. One Quality™ is the governance architecture that determines whether those systems function. These are not competing frameworks. They operate on different dimensions of the same discipline.

A functioning Quality Unit reviews every document before it enters the quality record. AI-generated or not. If an AI draft omits a required element, the QU finds it. That is what the QU is for. Purolea had no functioning QU. Not because of AI — that is a separate finding, documented before the AI section.

A functioning laboratory system requires that every batch be tested and released against specifications before distribution. AI does not run the test. A qualified analyst does. The absence of testing is a laboratory controls system failure.

A functioning materials system requires that incoming components be qualified and tested. AI does not perform identity testing. A qualified person does. The contaminated-ingredient problem is a materials system failure.

The AI governance gap did not cause these failures. The absence of quality systems caused these failures. The AI tool exposed them — by generating documentation that looked like a quality system, without any of the underlying infrastructure a real quality system requires.

A reasonable reader will raise a counterargument here: even if AI did not cause these failures, isn’t a specific AI governance policy still warranted? That argument is correct. The response is not that AI governance is wrong. It is that building AI governance on top of systems that do not otherwise function addresses the symptom, not the disease — and gives organizations with real foundational gaps a framework to document instead of a system to build.

At Purolea, none of the six systems functioned. Not one. All six. Simultaneously.

One Quality™ is the architecture for what real looks like — five integrated pillars: Governance, Execution, Learning, Digital Quality, Inspection Readiness. Not five separate programs pretending to be integrated. One system. One discipline. One standard.

You cannot govern AI in a quality system that does not exist. Pillar 04 is never the first problem. It cannot be.

The industry is now teaching AI governance to organizations that may carry the same gap — not in AI governance specifically, but in the underlying systems governance is supposed to operate within. A policy governing AI-generated documents is valuable inside a quality system where the QU has the competency and authority to implement it. Applied to a system that does not otherwise function, it is a better-labeled version of the original problem.

What Real Remediation Requires

A qualified consultant conducting the quality system audit FDA required of Purolea does not start with an AI governance framework. The audit comes first. The root cause analysis comes second. The remediation plan comes third — built on verified findings, not on the warning letter or industry commentary.

A plan built before the audit addresses an incomplete picture. A CAPA built on assumed root causes corrects the assumption, not the actual cause.

In every assessment I conduct, I find quality gaps that no one has documented, investigated, or resolved. Not because the organizations are negligent. Because the gaps live between the systems — in the intersections that point-in-time document reviews miss and that only a cross-system audit reveals.

A training record proves completion. It does not prove capability. An AI-generated SOP proves the document exists. It does not prove the system functions. The difference between those two things is the difference between compliance theater and quality.

The Question I Ask

When I read a warning letter, I do not ask, "What AI governance policy should this company have had?”

I ask: which of the six systems failed first, and why did none of the others catch it?

At Purolea, the answer is all six — simultaneously — because none of them existed.

Most organizations reading this are not Purolea. Their quality systems function. Their QUs review documents. Their batches are tested. The AI governance gap is a real addition to address within an otherwise sound system.

Some organizations are closer to Purolea than they recognize. Not because of AI. Because one or more of the six systems has a gap that has never been audited, documented, or resolved. And the AI tools they are deploying are generating documentation for a system they have not fully built.

I want to talk to quality leaders who feel the same way about the second paragraph. Not the ones looking for a governance checklist. The ones who know their quality system has gaps that the last 483 did not capture — and who want a clear-eyed audit of what is actually there before the next investigator arrives.

That conversation does not start with AI. It starts with the six systems.

Check Out The One Quality™ Readiness Scorecard.

Six domains. Five maturity levels. Fifteen minutes.

It answers the question this article asks: which system needs attention first — and how far from inspection-ready are you? Free.

Get The One Quality™ Readiness Scorecard

If the scorecard raises questions you want to work through: schedule a 30-minute conversation. No sales pitch. A clear-eyed read of what you are actually looking at.

Schedule a Call

About the Author

Yolanda Jones-Williams is the Founder and Principal Quality Officer of Obsidian Excellence Group, LLC — an independent FDA quality advisory practice based in San Antonio, Texas. A chemist by training and quality executive by experience, she brings 30+ years of GxP practice across pharmaceutical, biotechnology, biologics, cell & gene therapy, and 503B outsourcing. Fractional Head of Quality for FDA-regulated life science organizations. Creator of the One Quality™ framework.

The Qualified Review™, One Quality™, and No Box Quality™ are intellectual property of Yolanda Jones-Williams of Obsidian Excellence Group, LLC. © 2026 Obsidian Excellence Group, LLC. All rights reserved.

Source: FDA Warning Letter 320-26-58 · Purolea Cosmetics Lab · April 2, 2026 · CDER Detroit District · fda.gov