Artificial intelligence in the pharmaceutical industry: do you really need to validate ChatGPT?
Computerised System Validation | Data Integrity | Artificial Intelligence | GxP
Artificial intelligence is gradually becoming part of the pharmaceutical industry.
Today, tools such as ChatGPT and Claude can help professionals draft documents, analyse information, prepare procedures and research regulatory requirements.
These tools can save time. But their use raises an important question:
Does ChatGPT—or any other AI tool used in a GxP environment—need to be validated?
The answer depends primarily on how it is used.
The question is therefore not simply whether the tool needs validation, but:
What is the AI used for, what risks does that use introduce, and how can those risks be controlled?
Two recent developments help put this question into perspective.
1. Artificial intelligence on the FDA discussion agenda
The PDA/FDA Joint Regulatory Conference took place in Washington, D.C., from 14 to 16 September 2026.
Artificial intelligence was among the topics covered, particularly in relation to regulatory compliance, data management and pharmaceutical manufacturing.
The official programme included a session on how regulators and industry use AI tools. It focused on governance, safeguards and the role of human experts. For companies, this means:
- Establishing clear rules for using AI.
- Protecting the data entered into these tools.
- Ensuring that qualified experts review the results.
The programme for another session, focused on digital tools in CGMP environments, highlighted the importance of controls, human oversight and validation.
The message is simple: AI can be used in the pharmaceutical industry, but its use must remain under control.
2. An FDA warning letter that illustrates the risks
On 2 April 2026, the FDA issued a warning letter to Purolea Cosmetics Lab.
The company had been using AI agents to help it comply with regulatory requirements.
These tools had been used to prepare procedures, specifications and manufacturing records.
During its inspection, however, the FDA identified a significant problem: the documents produced with AI assistance had not been adequately reviewed to ensure their accuracy and compliance with CGMP requirements.
The company had also failed to perform process validation before distributing its products.
During the inspection, it explained that it had been unaware of this requirement because its AI tool had not identified it.
The FDA stated that AI-generated outputs and recommendations for the CGMP activities concerned must be reviewed and approved by an authorised human representative of the company’s Quality Unit.
What this means in practice
AI can produce a document that looks complete and professional.
That does not mean its content is correct.
AI can help draft a procedure. It cannot take over the responsibilities of Quality Assurance.
This letter illustrates how existing CGMP requirements apply to a specific case. It does not establish a blanket requirement to validate every AI tool.
3. So, does ChatGPT or Claude need to be validated?
Not in every case.
It depends on what the company does with the tool.
Consider these three examples.
Example 1: rewording an email
An employee uses ChatGPT to improve the wording of an internal email with no GxP impact.
The tool does not make quality decisions or modify regulated data.
The GxP risk is generally low.
Formal validation may therefore not be justified for this use.
Example 2: drafting a GMP procedure
A Quality Manager uses AI to prepare the first draft of a procedure.
The document is then reviewed, corrected and approved through the company’s document control process.
In this case, AI contributes to a GxP activity.
Rules for its use, review requirements and responsibilities need to be defined.
The level of assurance or validation should be determined through a risk assessment.
Example 3: automatically analysing quality data
A company uses AI to analyse quality control results and automatically recommend decisions.
The AI output may directly influence a GxP decision.
The risk is therefore higher.
The company will need to demonstrate that the solution is fit for its intended use, that its results are sufficiently reliable and that appropriate controls are in place.
These examples show that the same tool can present very different risks depending on how it is used.
That is why defining its intended use is the essential starting point.
4. Intended use comes first
Before introducing AI into a GxP environment, a company needs to understand exactly what it intends to use it for.
A few questions can help start this assessment.
What is the purpose of the AI?
Does it simply assist an employee, or does it contribute directly to a GxP process?
How are its outputs used?
Are they checked by a competent person before use?
What data is entered into the tool?
Is the data public, confidential, personal or GxP-related?
What would happen if the output were wrong?
Could an incorrect response affect product quality, patient safety or data integrity?
The answers help identify the risks and determine the necessary controls.
A straightforward approach based on risk
The approach can be summarised as follows:
Intended use → GxP impact → Risk assessment → Controls → Appropriate assurance or validation
This approach helps avoid unnecessary validation for low-risk uses while strengthening controls for more critical applications.
5. Human review remains essential
The term human-in-the-loop (HITL) is often used to describe human involvement in a process that uses AI.
But that involvement must be meaningful and effective.
It is not enough for an employee to click “Approve” after briefly reading an AI-generated document.
The reviewer must be able to identify errors.
In particular, they need to assess:
- The accuracy of the information.
- Compliance with regulatory requirements.
- Consistency with internal procedures.
- The appropriateness of the proposed conclusions.
An AI-generated response can be convincing and still be wrong.
Human review must therefore be performed by a competent person and must be more than an administrative step.
The company remains responsible for decisions made using AI outputs.
6. How can companies control the use of AI in GxP environments?
A pharmaceutical company does not necessarily need to create an entirely new validation framework to manage AI.
It can build on existing principles of Computerised System Validation (CSV), Computer Software Assurance (CSA) and Data Integrity.
A practical approach includes the following steps.
1. Identify how AI is used
Create an inventory of the tools in use and the activities they support.
2. Assess the GxP impact
Determine whether their use could affect product quality, patient safety, data or regulatory decisions.
3. Assess the risks
Identify the potential consequences of an error, an incomplete response or inappropriate use.
4. Define the necessary controls
These may include human review, data protection, access management, user training and checks on outputs.
5. Determine validation needs
Adapt assurance and validation activities to the level of risk and the intended use.
6. Maintain control over time
Reassess the risks when AI uses, capabilities or conditions of use change.
This approach allows companies to gradually integrate AI into existing processes while maintaining control over GxP activities.
7. Focus on how the tool is used
Artificial intelligence offers opportunities for the pharmaceutical industry.
It can help teams work more efficiently, make better use of information and prepare documents.
It also introduces new risks.
The topics covered in the PDA/FDA 2026 conference programme and the warning letter dated 2 April 2026 reinforce a fundamental principle:
Using AI does not remove a company’s regulatory responsibilities.
Companies should not assume that every use of ChatGPT automatically requires full validation.
Equally, it would be risky to assume that validation is never needed simply because the tool is described as an assistant.
The approach must remain based on intended use and the associated risks.
Ultimately, the key question is:
“Do we understand how we use AI, what risks it introduces, and how we check that its outputs are reliable?”
This provides the foundation for a controlled and compliant approach to AI in GxP environments.
How VeriData Advisory can help
Integrating AI into GxP activities requires an approach tailored to the risks and regulatory requirements.
VeriData Advisory supports pharmaceutical companies and regulated organisations in assessing their computerised systems, managing Data Integrity risks and defining validation strategies suited to their intended uses.
Our approach follows a simple principle: put the necessary controls in place, at the right level, to ensure the reliability of systems and data.