Regulatory submission invalidation from AI and automated system drift in GxP

What regulators already treat as drift risk in practice

Across GMP and GCP, regulators rarely need to write the words "model drift" to describe an intolerable failure mode: a computerized or automated system behaves differently over time than intended, and the organization cannot reliably detect, explain, reconstruct, or bound the impact on regulated data. A pattern that recurs in the warning letters below is not "AI drift," but the governance precursor that makes drift catastrophic: disabled audit trails, shared or admin-level accounts, unvalidated spreadsheets and worksheets, poor backup and restore, inadequate change control, and continued use of automated inspection systems after demonstrated performance failures. [1]

Regulators consistently anchor compliance on traceability and maintained control "through time," not on one-time "go-live" validation. That expectation is explicit in both U.S. and EU computerized-system frameworks (validation for "consistent intended performance," audit trails, periodic evaluation, and change control), and it is increasingly explicit for AI systems that may change after deployment (scheduled monitoring, periodic re-evaluation, data-drift handling). [2] [21] [24] [25]

FDA warning letters and inspection observations tied to unmonitored computerized and automated system change

The cases below are "submission invalidation grade" because they connect computerized and automated system control failures to (a) specific CFR citations and (b) explicit FDA language about data deletion, disabled audit trails, uncontrolled privileges, unvalidated calculation logic, or continued reliance on a degraded automated inspection system.

Contract testing labs and QC data systems: audit trails disabled, admin privileges, deletion risk

Advanced Botanical Consulting and Testing Inc. dba ABC Testing. Warning Letter, June 4, 2019

• Core failure mode: FDA cited "disabled audit trails on many HPLC instruments," lack of user restrictions, and non-unique logins ("multiple analysts logged in as 'admin'"). FDA framed this as a controls failure over computerized systems and a traceability failure for regulated electronic data. [3]
• Key CFR citations: 21 CFR 211.68(b) (computer controls); also 21 CFR 211.68(a) (equipment calibration, inspection, checking), with FDA describing stability chamber temperatures that "fluctuated wildly…for months" and extended periods where actual temperatures differed from intended temperatures: an explicit "performance drift" example in a regulated stability system. [3]

Grace Analytical Laboratory Inc. Warning Letter, November 19, 2019

• Core failure mode: FDA stated the lab "has not enabled the audit trail feature for the chromatographic data management system" and did not adequately control access (no employee-specific logins). FDA called this a repeat observation and required a plan for enabling audit trails, preventing disabling audit trails, implementing audit-trail review procedures, and enforcing unique logins. [1]
• Key CFR citation: 21 CFR 211.68(b). [1]

Adamson Analytical Laboratories, Inc. Warning Letter, August 17, 2021

• Core failure mode: FDA observed GC/HPLC instruments operating "in the absence of an activated audit trail," and that personnel had administrative privileges including the ability to "enable and disable audit trails," delete sequences, and change or delete methods. FDA also flagged unvalidated electronic worksheets with "unvalidated cell formulas resulting in erroneous data generation," explicitly stating these calculations "call into question the validity of the data generated." [4]
• Key CFR citations: 21 CFR 211.68(b); and 21 CFR 211.160(a) for failing to adequately control critical changes to electronic monitoring operations (including "activation of instrument software audit trails…without any governing procedures or change control"). [4]

Green Wave Analytical, LLC. Warning Letter, August 19, 2022

• Core failure mode: FDA described insufficient controls to prevent deletion or alteration of raw data; administrative privileges to delete sequences and change method parameters; absence of activated audit trails; lack of secure backup; and failure to validate electronic signatures used to approve analytical records over a multi-year period. [5]
• Key CFR citations: 21 CFR 211.68(b); plus related CGMP record and sterility-system citations (e.g., 21 CFR 211.194(a), 211.42(c)(10)(iv)) that underscore submission-relevant risk when sterility decisions are based on deficient, traceability-poor data. [5]

Drug manufacturers: deletion, disabled audit trails, and "computer system performance and security" CAPAs

Outin Futures Corp. Warning Letter, September 25, 2024

• Core failure mode: FDA stated there was "no assurance" systems could prevent deletion or modification; "electronic raw data…was deleted and not accessible;" analysts had administrative rights and "disabled audit trails for some…systems;" and backups were inadequate. FDA required a "comprehensive…assessment of computer system performance and security," explicitly including evaluation of configuration, audit-trail state and implementation, validation status, deviation history, backup capabilities, and change management. [6]
• Key CFR citation: 21 CFR 211.68(b). [6]

Lex Inc. Warning Letter, August 17, 2023

• Core failure mode: FDA described staff with administrator rights allowing uncontrolled deletion or modification of HPLC files, "no mechanism to facilitate traceability," and inadequate backups. FDA demanded a multi-system inventory of software configurations (including LIMS), user privilege mapping, and "robust use and review of audit trail data," plus "strict ongoing control" over additions, deletions and modifications. [7]
• Key CFR citations: 21 CFR 211.68(a) and 211.68(b). [7]

Automated inspection and automated data filtering: demonstrable degradation and hidden suppression

Baxter Healthcare Corporation. Warning Letter, July 25, 2023

• Core failure mode: FDA stated the firm "did not adequately investigate failures of the…automatic inspection machine to detect known defects," continued using it despite data showing "significant deficiencies," and "fully relied on this automated visual inspection system…for an extended period." FDA also underscored that automated inspection must be studied for "capability and robustness," and cannot replace required controls (including manual inspection for other attributes). [8]
• Key CFR citation: 21 CFR 211.192 (investigations), with the automated system's performance degradation central to the finding. [8]

Bayer Pharma AG. Warning Letter, November 14, 2017

• Core failure mode: FDA observed discarded automated tablet visual inspection parameter records and noted the firm did not preserve "calculations generated in support of those parameters." FDA explicitly asserted that programming inspection parameters is a CGMP activity because parameters discriminate acceptable from unacceptable product. FDA also found "unreported data" created by programming an in-process weight checker not to report out-of-range values: an archetypal "algorithmic suppression" failure mode. [9]
• Key CFR citations: includes 21 CFR 211.22(a)/(c) and 211.194(a) in the cited excerpt, with FDA linking audit trails and completeness of reported data to release decisions. [9]

Hospira Inc. Warning Letter, February 14, 2017

• Core failure mode: FDA described a semi-automated visual inspection procedure that allowed reinspecting rejects and mixing them with acceptable units without quarantine, accounting or documentation of differences: an automated-process integrity and traceability breakdown. [10]
• Key CFR citation: 21 CFR 211.110(d) (control of rejected materials). [10]

Clinical trial electronic data capture: audit trail edits and unverified "offline mode" claims

Clinical investigator. Warning Letter, May 29, 2024

• Core failure mode: FDA described outcome scores entered into tablets after the assessments, with gaps of up to 25 days, lack of source documentation, and times and dates "later edited to appear as if" recorded contemporaneously. FDA explicitly referenced audit trail documents and found the site's "offline mode" explanation could not be demonstrated. FDA concluded the contradictions and gaps raised "concerns about the reliability of the data and the integrity of…study conduct." [11]
• Key CFR citations: 21 CFR 312.62(b) (case histories and records), 312.60 (conduct according to plan), and 312.62(c) (record retention). [11]

Documented clinical and bioequivalence data invalidation and remediation linked to "system behavior over time"

Publicly documented invalidations are most visible in bioequivalence and GCP/GLP contexts, where regulators can reject entire study packages when integrity or reproducibility breaks down, whether due to misconduct, uncontrolled retesting, or systemic process failures that evolve over time.

Bioequivalence data questioned across multiple years: sponsor notifications and downstream regulatory action

Cetero Research. FDA action (2010 inspections; FDA letter July 26, 2011)

FDA documented "widespread falsification of dates and times" and "manipulation…to meet predetermined acceptance criteria," stating these violations raise concerns about the reliability of bioequivalence and bioavailability data used for FDA decisions. [12]

FDA also wrote to NDA holders about the Cetero findings, asking each to identify any Cetero studies in its application and to re-assay samples, repeat the studies, or justify why no action was needed, illustrating a concrete regulatory pathway from CRO integrity failure to sponsor remediation obligations. [13]

The regulatory consequence can extend to product approvals: in 2019 FDA proposed withdrawing approval of a generic drug whose bioanalytical work had been done at Cetero, after the application holder repeatedly failed to submit the required bioequivalence data; FDA had called on sponsors using the site to redo certain studies. [14]

Bioequivalence dataset "would have failed" without improper replacement with repeat analysis data

Synapse Labs Pvt. Ltd. FDA letter (June 17, 2024)

FDA documented cases where "original, valid test data…was rejected and replaced with reanalyzed data," concluding "the study would have failed using the original…data" and that substitution "changed the final result." [15]

FDA further stated that substituting original concentrations with reanalyzed concentrations "caused the study which otherwise failed…to pass," and emphasized that reanalysis and replacement should not occur without a "systematic investigation to understand the root cause." [15]

This is a regulator-authored example of repeat analysis and data substitution materially changing a regulatory endpoint; FDA concluded that the site's systems "were insufficient to prevent and/or identify these anomalies." [15]

EMA product suspensions tied to unreliable clinical studies

GVK Biosciences. EMA referral (confirmed May 21, 2015)

EMA confirmed a recommendation to suspend medicines where EU authorizations were primarily based on studies conducted at the site, because concerns about reliability of the studies remained (with some products exempted when concerns were addressed or other data existed). [16]

This is "submission invalidation at scale" (around 700 pharmaceutical forms and strengths of medicines recommended for suspension) and demonstrates the commercial blast radius when regulators lose confidence in a clinical or bioanalytical data factory, regardless of whether the failure is human fraud or uncontrolled system or process behavior. [16]

21 CFR Part 11 and FDA guidance: point-in-time validation is not enough without audit-trail and lifecycle controls

Part 11's core requirement is "consistent intended performance," which is inherently longitudinal

21 CFR 11.10 requires "validation…to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records." [2]

Part 11 also requires "secure, computer-generated, time-stamped audit trails" for actions that create, modify or delete electronic records, retained as long as the records and available for FDA review. [2]

Continuous monitoring is not spelled out as "always-on telemetry" in Part 11 text, but FDA's expectations clearly extend beyond deployment

FDA's Part 11 "Scope and Application" guidance emphasizes that even under enforcement discretion for some Part 11 requirements, firms must still comply with predicate rule requirements, and audit trails or other controls may be important to ensure record trustworthiness based on risk and impact. [17]

In parallel, FDA's CGMP data integrity guidance frames audit trails as a key control and asks operational questions that are inherently ongoing (e.g., "Is there a record of changes to data?" and "Are records reviewed for accuracy, completeness…?"). [18]

Clinical investigations guidance makes the "ongoing" expectation explicit via periodic audit-trail review and anti-disable controls

FDA's clinical investigations Q&A on electronic systems states audit trails "must capture" changes, who made them, and date and time; "should include reasons"; and "should be protected…from being disabled." It also notes that "periodic review of the audit trail may be helpful" and should be risk-based. [19]

Similarly, FDA's 1999 guidance "Computerized Systems Used in Clinical Trials" states that changes to electronic data "will always require an audit trail," including who, when and why, and reminds that FDA may inspect all records supporting submissions regardless of format. [20]

An inference from these texts: Part 11 and the predicate rules establish a compliance theory where it is insufficient to validate at deployment if the organization cannot (a) detect and reconstruct changes over time (audit trail and review) and (b) demonstrate the system remained in a fit-for-purpose state when generating submission data. FDA's own language in multiple warning letters operationalizes this expectation (audit trails must be enabled, cannot be disabled, access privileges must be restricted, and historical impacts must be assessed). [1]

EU Annex 11 and EMA expectations: periodic evaluation, audit-trail review, and AI that "may exhibit adaptiveness after deployment"

Annex 11 explicitly requires periodic evaluation that includes "performance" and "upgrade history"

EU GMP Annex 11 requires computerized systems be "periodically evaluated to confirm that they remain in a valid state," including (where appropriate) "upgrade history, performance, reliability, security and validation status reports." [21]

Annex 11 also states that, based on a risk assessment, consideration should be given to building in an audit trail of GMP-relevant changes and deletions, that audit trails should be "regularly reviewed," and that changes to a computerised system should only be made in a controlled manner in accordance with a defined procedure. [21]

Separately, Annex 11 requires that backup integrity and restore capability be periodically monitored. [21]

The EU's draft updated Annex 11 (consultation text) goes further: "significant variation from the expected outcome" found in audit-trail review should be investigated

The draft text describes audit-trail reviews under documented procedures (who, what, when), encourages tooling, and states that "any significant variation from the expected outcome found during the audit trail review should be fully investigated and recorded." It also addresses timeliness (review prior to batch release, unless the risk of later detection can be justified). [22]

This is unusually direct regulatory language aligning audit-trail review with the detection of "variation from expected outcome." [22]

EMA's 2024 reflection paper explicitly acknowledges AI that can change after deployment and expects lifecycle performance monitoring

EMA's reflection paper references an OECD definition of AI systems that "may exhibit adaptiveness after deployment," and states that a risk-based approach for "development, deployment, and performance monitoring" allows proactive risk management through the system lifecycle. [23]

The paper also states that sponsors, applicants, MAHs and manufacturers are expected to "systematically manage relevant risks from early development to decommissioning," and explicitly warns that regulatory and GxP requirements "may…be stricter than what is considered standard practice in…data science." [23]

Practical bottom line: EU expectations already require maintaining validated state through periodic evaluation and audit-trail review, and EMA explicitly frames AI and ML as lifecycle-governed, performance-monitored systems. [21]

FDA and joint FDA and EMA AI lifecycle monitoring: explicit drift language now exists

Three documents, two for drug and biologic evidence generation and one for device AI change management, now contain direct language that supports runtime monitoring as a regulatory expectation, not just an engineering best practice.

FDA draft guidance (January 2025): life cycle maintenance and ongoing performance monitoring for AI used in drug regulatory decision-making

FDA explicitly identifies the "challenge" that "model's performance [may] change over time… (i.e., data drift) requiring life cycle maintenance." [24]

In its life cycle maintenance section, FDA states that "Life cycle maintenance of AI models is a set of planned activities to monitor and ensure the model's performance," and further: "Model performance metrics should be monitored on an ongoing basis to ensure that the model remains fit for use," including anticipating "model-directed changes" and evaluating both incidental and intentional changes. [24]

FDA also states that when changes affect performance, steps in the credibility assessment may need to be re-executed, including retraining and retesting, and changes should be reported to FDA per regulatory requirements; and that life cycle maintenance plans (metrics, monitoring frequency, retesting triggers) should be available for review as part of the pharmaceutical quality system, with summaries in marketing applications for product- or process-specific models. [24]

The guidance says life cycle maintenance is "critical" where AI use extends over the drug product life cycle, and names pharmaceutical manufacturing as an example. [24]

FDA explicitly states that use of AI in drug discovery is not in scope. [24]

Joint FDA and EMA "Good AI Practice in Drug Development" principles (January 2026): scheduled monitoring to address data drift

The joint principles state that AI systems benefit from "careful management throughout the…life cycle," and Principle 9 ("Life cycle management") states AI technologies undergo "scheduled monitoring and periodic re-evaluation to ensure adequate performance (e.g., to address data drift)." [25]

FDA PCCP guidance for AI-enabled device software functions (December 2024): monitoring over time and real-world monitoring plans

FDA states a PCCP Modification Protocol should include update procedures including "real-world monitoring plans as applicable," and that FDA "anticipates that manufacturers will monitor their device's…effectiveness (e.g., performance) over time as modifications are implemented." [26]

On consequence language: the PCCP framework ties compliance to whether changes are "consistent with a PCCP approved or cleared by FDA" (otherwise new submissions or supplements may be required), and FDA notes it may withhold clearance of a PCCP in certain circumstances based on quality system regulation (QSR) compliance history when failure could present serious risk. [26]

Taken together, the drug and biologic AI guidance and the joint principles now provide direct, regulator-authored language supporting (1) drift as a known risk, (2) scheduled or ongoing monitoring as expected governance, and (3) triggers and documentation for revalidation, retesting and reporting. [24]

GxP failure modes from automated systems in the enforcement record

The enforcement record supports a practical failure-mode taxonomy for automated and AI-augmented lab environments.

Audit trail suppression or disablement (silent traceability loss)

Repeatedly cited: "audit trails…disabled," instruments operating "in the absence of an activated audit trail," or audit trail features not enabled; FDA also explicitly expects controls that prevent disabling audit trails. [1]

Privilege drift and role confusion (admins in the data path)

FDA repeatedly describes analysts with administrative privileges able to delete sequences and change methods or method parameters, and in one letter the ability to "enable and disable audit trails." [5] [4]

Electronic data deletion and missing backups (irrecoverable raw data loss)

FDA explicitly documented "electronic raw data…deleted and not accessible," inadequate backups, and lack of mechanisms to trace who deleted or changed data. [6] [7]

Unvalidated calculation logic (spreadsheets and worksheets behaving as hidden algorithms)

FDA explicitly cited "unvalidated cell formulas resulting in erroneous data generation" and stated this "call[s] into question" data validity. [4]

Sensor and instrument performance drift over time (calibration and environmental excursions)

FDA described stability chambers that had not been calibrated since 2016 and temperatures that fluctuated "on multiple occasions for months at a time," and asked the firm for a master index of equipment showing maintenance and calibration dates. [3]

Automated inspection performance degradation (known defects missed, system still used)

FDA described continued reliance on an automatic inspection machine despite data showing "significant deficiencies," and emphasized robustness studies under varied conditions and settings. [8]

Precedent AI and algorithm failures with adverse clinical, regulatory, or commercial outcomes

These cases are not all GMP enforcement, but they quantify the downside of algorithmic systems that are (a) deployed into high-stakes workflows and (b) not governed with strong lifecycle monitoring, external validation, and change control.

Clinical AI commercialization failure: Watson for Oncology

The University of Texas MD Anderson Cancer Center and IBM collaboration ended after roughly five years and about $62 million, with the system reportedly not used on actual patients in that program: an example of large sunk cost when AI tooling fails to meet real-world clinical and operational demands. [27]

Independent reporting documented broader struggles and under-delivery relative to expectations. [28]

Deployed predictive model underperformance: Epic Systems Corporation sepsis prediction

A large external validation study found poor discrimination and calibration for the Epic Sepsis Model and warned that widespread adoption despite poor performance raises fundamental concerns (the model generated frequent alerts yet missed many sepsis cases). [29]

Even absent software bugs, model performance can be inadequate or degrade under different populations and workflow contexts, making ongoing monitoring and recalibration a patient-safety and regulatory credibility issue.

Documented performance drift in a clinical ML algorithm during a COVID-era utilization shift

A peer-reviewed study of a deployed ML mortality prediction algorithm showed performance drift during the SARS-CoV-2 pandemic, linking changes in clinical utilization (e.g., labs, telemedicine) to a sustained decline in identifying high-risk patients. [30]

The study is a cited example that data drift is not theoretical: real-world operational changes can degrade model performance, requiring monitoring and potential retraining.

Regulatory collapse in diagnostics: Theranos, Inc.

A July 26, 2016 letter from House Energy and Commerce Committee members to the acting CMS administrator lists the CMS sanctions Theranos announced, including revocation of its laboratory's CLIA certificate, and cites CMS's finding that the laboratory's deficient practices posed "immediate jeopardy to patient health and safety," reflecting how regulators respond when laboratory practices are deemed to pose serious risk and integrity is compromised. [31]

The failure was not AI drift, but it is a reminder that regulated lab systems are judged on reproducible, auditable reliability.

Recent safety reporting analog: AI-assisted monitoring device allegations

A recent Reuters investigation described adverse-event reports alleging AI-assisted cardiac monitors failed to recognize abnormal rhythms, illustrating that algorithmic failures (and user confusion) can trigger real-world reporting and scrutiny even when injuries are not documented. [32]

High-stakes automation failure outside healthcare: Knight Capital Group

On August 1, 2012, a software deployment error in Knight Capital's automated order router sent millions of orders into the market over about 45 minutes, and Knight lost more than $460 million; the SEC found that Knight lacked controls to ensure the orderly deployment of new code and procedures to guide its response to the incident. [33]

Financial cost of undetected drift

Cost of one day of delay

A Tufts Center for the Study of Drug Development white paper (2024) estimates "a single day of delay" is worth about $800,000 in lost prescription drug and biologic sales (with therapeutic-area medians higher for some areas) and estimates mean direct trial costs of about $40,000 per day for Phase II and Phase III trials combined, with Phase III trials the highest at $55,716 per day. [34]

Even if a company can "eventually fix" data issues, delay economics make remediation expensive: every month of delay is plausibly tens of millions in lost sales once a product is commercially relevant. [34]

Phase III trials: published cost estimates vary widely

A peer-reviewed cost model for a Phase III HABP/VABP trial estimated $89.6 million total cost (about $89,600 per patient for 1,000 patients across about 200 sites). [35]

Separately, a 2018 study of 138 pivotal trials supporting drugs approved by FDA in 2015 and 2016 estimated a median cost of $19 million, with more than 100-fold differences in cost between trials. [36]

Regulatory enforcement can carry nine-figure to half-billion-dollar direct costs (fines and settlements) even before remediation program costs

The U.S. Department of Justice announced in May 2013 that generic drug manufacturer Ranbaxy pleaded guilty and agreed to pay $500 million to resolve False Claims allegations, CGMP violations and false statements to FDA (criminal fine and forfeiture plus civil settlement). [37]

A breakdown in regulated data and quality systems does not cap out at "a few CAPAs": it can reach settlement-scale outcomes. [37]

Where current regulation is explicit, and where it is not

1. Regulations and enforcement are strong on traceability and maintained control, but historically weaker on explicit "runtime AI monitoring." Part 11 and Annex 11 are framed around validation, audit trails, change control, and periodic evaluation: requirements that imply ongoing control but do not mandate a specific continuous monitoring architecture. [2] [21]
2. Regulators are now explicitly naming "data drift" and "scheduled monitoring" for AI used to generate evidence, but drug discovery remains partially outside the clearest FDA guidance scope. FDA's January 2025 draft AI guidance explicitly excludes drug discovery from scope, even while acknowledging data drift and recommending life cycle maintenance for AI used in manufacturing and other lifecycle stages. [24] EMA's reflection paper covers discovery but highlights that regulatory and GxP expectations may be stricter than standard data science practice. [23]
3. The enforcement record proves that many organizations still fail basic computerized-system hygiene (audit trails, privileges, backups, change control) in 2019 to 2024. That persistent gap between what is required and what is done is documented directly by FDA across multiple recent warning letters, including repeat observations and explicit requirements to prevent disabling audit trails and to investigate historical impact. [1]

Summary

Regulators already invalidate or jeopardize submissions when they cannot trust evidence provenance, completeness, and reproducibility over time (Cetero, Synapse, GVK; and multiple warning-letter patterns for HPLC, CDS and LIMS environments). [12]

At the same time, the newest regulator-authored AI texts, both non-binding, name scheduled monitoring and periodic re-evaluation to address data drift as a guiding principle and recommend life cycle maintenance plans with performance metrics, monitoring frequency, and triggers for retesting. [25] [24]

Sources

1. FDA Warning Letter, Grace Analytical Lab Inc., November 19, 2019. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/grace-analytical-lab-inc-586510-11192019
2. 21 CFR 11.10, Controls for closed systems (eCFR). https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11/subpart-B/section-11.10
3. FDA Warning Letter, Advanced Botanical Consulting and Testing Inc. dba ABC Testing, June 4, 2019. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/advanced-botanical-consulting-testing-inc-dba-abc-testing-572991-06042019
4. FDA Warning Letter, Adamson Analytical Laboratories, Inc., August 17, 2021. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/adamson-analytical-laboratories-inc-614644-08172021
5. FDA Warning Letter, Green Wave Analytical, LLC, August 19, 2022. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/green-wave-analytical-llc-630965-08192022
6. FDA Warning Letter, Outin Futures Corp., September 25, 2024. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/outin-futures-corp-684688-09252024
7. FDA Warning Letter, Lex Inc., August 17, 2023. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/lex-inc-656056-08172023
8. FDA Warning Letter, Baxter Healthcare Corporation, July 25, 2023. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/baxter-healthcare-corporation-654136-07252023
9. FDA Warning Letter, Bayer Pharma AG, November 14, 2017. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/bayer-pharma-ag-526288-11142017
10. FDA Warning Letter, Hospira Inc., February 14, 2017. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/hospira-inc-506761-02142017
11. FDA Warning Letter to a clinical investigator, May 29, 2024. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/konrad-rejdak-md-phd-671405-05292024
12. FDA letter to Cetero Research, July 26, 2011 (copy hosted by CIRCARE). https://www.circare.org/fdawls2/cetero_fdauntitled_20110726.pdf
13. FDA administrative correspondence, NDA 202513 (2011). https://www.accessdata.fda.gov/drugsatfda_docs/nda/2011/202513Orig1s000AdminCorres.pdf
14. RAPS, FDA to Withdraw Generic Drug After Company Repeatedly Fails to Resubmit Bioequivalence Data (October 25, 2019). https://www.raps.org/resource/fda-to-withdraw-generic-drug-after-company-repeate.html
15. FDA letter to Synapse Labs Pvt. Ltd., June 17, 2024. https://www.fda.gov/media/179326/download
16. EMA referral, GVK Biosciences. https://www.ema.europa.eu/en/medicines/human/referrals/gvk-biosciences
17. FDA guidance, Part 11, Electronic Records; Electronic Signatures: Scope and Application. https://www.fda.gov/media/75414/download
18. FDA guidance, Data Integrity and Compliance With Drug CGMP: Questions and Answers. https://www.fda.gov/media/119267/download
19. FDA guidance, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers. https://www.fda.gov/media/166215/download
20. FDA guidance, Computerized Systems Used in Clinical Trials (April 1999). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/fda-bioresearch-monitoring-information/guidance-industry-computerized-systems-used-clinical-trials
21. EU GMP Annex 11, Computerised Systems (2011). https://health.ec.europa.eu/system/files/2016-11/annex11_01-2011_en_0.pdf
22. EU GMP Annex 11, draft consultation text. https://health.ec.europa.eu/document/download/40231f18-e564-4043-94de-c031f813d38b_en?filename=mp_vol4_chap4_annex11_consultation_guideline_en.pdf
23. EMA, Reflection paper on the use of Artificial Intelligence (AI) in the medicinal product lifecycle (2024). https://www.ema.europa.eu/en/documents/scientific-guideline/reflection-paper-use-artificial-intelligence-ai-medicinal-product-lifecycle_en.pdf
24. FDA draft guidance, Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products (January 2025). https://www.fda.gov/media/184830/download
25. FDA and EMA, Good AI Practice in Drug Development principles (January 2026). https://www.fda.gov/media/189581/download
26. FDA guidance, Predetermined Change Control Plan for AI-enabled device software functions (December 2024; reissued August 2025). https://www.fda.gov/media/166704/download
27. Journal of the National Cancer Institute, on MD Anderson and IBM Watson (2017). https://academic.oup.com/jnci/article/109/5/djx113/3847623
28. STAT, IBM Watson for cancer (September 5, 2017). https://www.statnews.com/2017/09/05/watson-ibm-cancer/
29. External validation study of the Epic Sepsis Model (PMC). https://pmc.ncbi.nlm.nih.gov/articles/PMC8218233/
30. Performance drift in a deployed ML mortality prediction algorithm during the SARS-CoV-2 pandemic (PMC). https://pmc.ncbi.nlm.nih.gov/articles/PMC9846686/
31. House Energy and Commerce Committee members, letter to the acting CMS administrator on Theranos, July 26, 2016. https://democrats-energycommerce.house.gov/sites/evo-subsites/democrats-energycommerce.house.gov/files/documents/CMS%20Slavitt%20Theranos%20Letter%202016%2007%2026.pdf
32. Reuters investigation, February 9, 2026. https://www.reuters.com/investigations/ai-enters-operating-room-reports-arise-botched-surgeries-misidentified-body-2026-02-09/
33. U.S. Securities and Exchange Commission, Order in the Matter of Knight Capital Americas LLC, Release No. 70694 (October 16, 2013). https://www.sec.gov/litigation/admin/2013/34-70694.pdf
34. Tufts Center for the Study of Drug Development, Day of Delay white paper (August 2024). https://csdd.tufts.edu/sites/default/files/2025-02/Aug2024%20Day%20of%20Delay%20White%20Paper%20Final.pdf?1744237947=
35. Cost model for a Phase III HABP/VABP trial (PMC). https://pmc.ncbi.nlm.nih.gov/articles/PMC5848330/
36. RAPS, Phase 3 Trial Costs Estimated at $19M, Study Finds (September 26, 2018). https://www.raps.org/resource/phase-3-trial-costs-estimated-at-19m-study-finds.html
37. U.S. Department of Justice, Generic Drug Manufacturer Ranbaxy Pleads Guilty and Agrees to Pay $500 Million. https://www.justice.gov/archives/opa/pr/generic-drug-manufacturer-ranbaxy-pleads-guilty-and-agrees-pay-500-million-resolve-false