AI in Drug Manufacturing CMC — Emerging Technology Application

FDA’s draft guidance “Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products,” published January 7, 2025, was the first document from the agency to establish in writing what CGMP-relevant compliance looks like for AI and machine learning models used in the manufacturing phase of the drug lifecycle. FDA had signaled finalization for Q2 2026; whether or not the final guidance has issued by the time you read this, the FDA/EMA joint “Guiding Principles of Good AI Practice in Drug Development,” published January 14, 2026, is already the operative interim framework — and if your organization is using AI/ML in process control, real-time release testing, or quality event classification without a documented model qualification and monitoring program aligned to it, your compliance gap is now measurable against two converging agency frameworks, not a hypothetical future one.

For CMC and quality organizations that have been deploying AI/ML capabilities in manufacturing over the past several years, this is not a distant policy signal — it is the moment FDA and EMA jointly established the compliance baseline against which inspectors will evaluate what your organization has built. Organizations that treat this guidance sequence as background reading rather than a compliance trigger are making a consequential mistake.

What FDA’s January 2025 Draft Guidance and the January 2026 Joint Principles Establish — and Why the Compliance Calculus Has Changed

FDA’s draft guidance does something no prior FDA document accomplished: it places AI and machine learning models used to produce information supporting regulatory decisions — including in the manufacturing phase — squarely inside a risk-based credibility assessment framework, built around a seven-step process for establishing and documenting the credibility of an AI model for a specific context of use. Prior to this document, organizations deploying AI/ML in manufacturing operated in an interpretive space — applying Computer Software Assurance principles from FDA’s September 2022 CSA guidance, GAMP 5 Second Edition validation frameworks, and 21 CFR 211.68 calibration requirements by analogy. The January 2025 draft, now reinforced by the January 2026 FDA/EMA joint principles, closes much of that interpretive gap.

The FDA/EMA joint principles, published January 14, 2026, set out ten high-level principles applicable across the AI lifecycle: human-centric design, a risk-based approach, adherence to standards, clear context of use, multidisciplinary expertise, data governance and documentation, model design and development practices, risk-based performance assessment, life-cycle management, and clear essential information. These are not aspirational statements — regulators have framed them explicitly as the foundation for forthcoming formal guidance, and CDER’s own 2026 guidance agenda (published in the agency’s February 2026 update) lists “AI/ML Quality Considerations in Pharmaceutical Manufacturing” as a document in active development. The practical consequence is that a CGMP investigator inspecting your facility today has two converging reference frameworks — the January 2025 draft’s credibility assessment structure and the January 2026 joint principles — to compare against your quality system documentation, whether or not the CDER manufacturing-specific guidance has been finalized.

If your AI/ML model deployed in process control or real-time release testing does not have a qualification record, an ongoing performance monitoring program, and a change control procedure that routes model retraining through your pharmaceutical quality system, that absence is increasingly documentable as a 483 observation rather than an area of regulatory ambiguity. The actionable implication for CMC and quality leadership is immediate: conduct a structured inventory of every AI/ML model currently deployed in your manufacturing and quality environment and assess each against both frameworks now in effect.

Model Qualification, Performance Monitoring, and Change Control — The CGMP Requirements Regulators Are Now Publishing Expectations For

FDA’s January 2025 draft guidance establishes model qualification as a foundational requirement, framing qualification activities in terms explicitly analogous to the critical thinking framework introduced in FDA’s Computer Software Assurance guidance (September 2022). Qualification evidence must be commensurate with the risk of model failure for the specific manufacturing application — an AI/ML model influencing a lot release decision carries a higher qualification burden than a model supporting process monitoring without direct quality system output. Under 21 CFR 211.68, equipment used in manufacturing must be routinely calibrated, inspected, or checked according to a written program; the emerging AI framework extends this logic to AI/ML models through ongoing performance monitoring as the functional equivalent of calibration verification for a model-based system.

The FDA/EMA joint principles reinforce this through their explicit “life-cycle management” and “data governance and documentation” principles: changes to AI/ML models — including retraining on new data, hyperparameter adjustments, algorithm updates, and training data updates — must be managed through the pharmaceutical quality system under ICH Q10 change control procedures, not treated as IT system updates. An organization that retrains its process control model on updated manufacturing data, routes the update through IT change management with a software version record, but generates no quality system change control record or impact assessment, creates a documentation gap that is a 483 observation waiting to happen under 21 CFR 211.192, which requires that production and investigation records document the basis on which manufacturing decisions were made.

Real-Time Release Testing, Process Control, and Quality Event Classification — The CMC Applications Where AI/ML Compliance Risk Is Highest

Real-time release testing using AI/ML multivariate models represents the highest-risk compliance application because the model output directly substitutes for or supplements traditional analytical test results as the basis for a lot release decision. FDA has approved RTRT approaches in NDA and BLA submissions using multivariate models, and the emerging AI framework makes clear that AI/ML models used for RTRT need qualification evidence equivalent to traditional analytical method validation for the specific lot release decision. Under 21 CFR Part 11, electronic records generated by AI/ML systems used to satisfy CGMP requirements — including lot release records — are subject to audit trail requirements, access controls, and electronic signature requirements like any other computerized system record.

Process control applications present a related risk: training data for models used in manufacturing decisions is subject to the data integrity requirements in FDA’s Data Integrity and Compliance With Drug CGMP guidance (December 2018) — training datasets must be complete and traceable, model validation data must be retained under CGMP data retention requirements. Quality event classification applications — AI/ML models used to triage deviations, classify out-of-specification results, or route investigations — carry compliance risk that is less visible but structurally significant: under 21 CFR 211.192, when an AI/ML model is part of the basis for an investigation conclusion, the model’s qualification status and output traceability become part of the investigation record’s completeness requirement.

XGene AI/ML Manufacturing CGMP Compliance Assessment

1. AI/ML Application Inventory and GAMP 5 Categorization Review: Identify and document every AI/ML model deployed in manufacturing and quality systems, classify each under GAMP 5 Second Edition, and map each to the manufacturing decisions it influences.

2. Model Qualification Evidence Assessment: Review existing qualification records against both the FDA January 2025 credibility framework and the January 2026 FDA/EMA joint principles, evaluating whether qualification evidence is commensurate with model failure risk.

3. Ongoing Performance Monitoring Program Evaluation: Assess whether each deployed model has a documented, pre-specified performance monitoring program with defined metrics, monitoring frequency, and drift response thresholds.

4. Change Control and Data Integrity Compliance Verification: Evaluate whether model retraining and training data updates are routed through ICH Q10 change control with documented impact assessments, meeting the data integrity and life-cycle management principles both frameworks now establish.

The engagement deliverable is a compliance gap report and prioritized remediation roadmap for each AI/ML application, structured for presentation to VP and C-suite quality leadership.

Organizations that have invested in AI/ML capabilities for manufacturing efficiency, real-time release, and quality system automation have created compliance obligations that regulators have now made explicit through two converging documents in just over a year. The cost of identifying and remediating gaps proactively is a fraction of the cost of responding to 483 observations or Warning Letter findings that cite these frameworks once CDER’s manufacturing-specific AI/ML guidance finalizes.

Identify every AI/ML model currently deployed in your manufacturing or quality system environment and assess whether each has a documented qualification record aligned to both FDA’s January 2025 draft framework and the January 2026 FDA/EMA joint principles, a pre-specified ongoing performance monitoring program, and a change control procedure addressing model retraining through your ICH Q10 pharmaceutical quality system.