Biopharma leaders are facing a regulatory environment shaped by AI, digital transformation, inspection scrutiny, and increasingly interconnected quality systems. The challenge is no longer simply knowing the regulations—it’s understanding how FDA expectations are evolving and what those changes mean operationally.
The rules themselves have been remarkably stable. Parts 210 and 211 read the same as they did a decade ago, and ICH Q9(R1) and Q10 still describe the same architecture for a pharmaceutical quality system. What has moved is the standard of proof. Investigators are arriving with sharper questions about how a decision was reached, what data supported it, who reviewed it, and whether the system that produced that decision can be trusted to keep producing good ones. A company can be fully compliant on paper and still struggle to answer that line of questioning.
That gap between knowing the regulation and demonstrating control is where most of the friction sits right now. Five issues are driving it.
1. Human error is being retired as a root cause
“Failure to follow procedure” has been one of the most durable entries in FDA’s inspection observation record, and it has survived a decade of retraining, procedure rewrites, and individually targeted corrective actions. The industry’s working assumption—that a deviation traced to a person has been explained—is now under direct challenge from both regulators and senior quality leaders, who increasingly borrow from aviation and other high-reliability industries to argue that design, workload, staffing, and culture generate error long before any operator does.
The operational consequence is immediate. Retraining as a standalone corrective action is becoming difficult to defend, and human error risk assessment is moving from a niche practice into a governance expectation. Some organizations have already institutionalized it: Eli Lilly now has a global senior director dedicated to human error prevention and performance reliability, a title that would have been unusual a few years ago. Expect investigators to ask less about what the operator did and more about what the system allowed.
2. AI now sits on both sides of the inspection
FDA has been unusually public about its own adoption. The agency launched Elsa, its internal generative AI tool, in June 2025, and said at the time it was already using the system to accelerate scientific evaluations and to help identify high-priority inspection targets. In May 2026 it went further, releasing Elsa 4.0 to all FDA staff—reviewers and investigators alike—and consolidating more than 40 separate data systems into a single platform called HALO. Manufacturers, meanwhile, are applying AI to GMP analytics at the site and network level, to regulatory intelligence, and to trending across quality systems.
That symmetry changes the nature of the conversation. The question is no longer whether a company may use these tools, but whether it can describe the guardrails, the validation approach, the data security posture, and the points where a qualified human stays in the loop. PDA has stood up a dedicated AI resource area in its science and regulation program, a reasonable signal of how quickly this moved from novelty to standing agenda item.
Underneath it sits a less glamorous problem. Most manufacturing and quality data was never structured to be acted on—it is fragmented across systems, inconsistently coded, and heavy with free text. Data governance is becoming the gating item for anything AI-related, and the industry is starting to treat it as a quality risk management problem rather than an IT project, including through a new PDA technical report on data governance within the quality management system. Organizations that cannot demonstrate credible data governance will find their AI ambitions capped well before a regulator raises an objection.
3. Effectiveness checks are where CAPA credibility gets decided
Recurring deviations, repeat observations, and systemic quality issues persist across the industry despite CAPA programs that are, procedurally, doing what they were designed to do. The distance between closing a corrective action and proving it worked has become its own area of scrutiny, and effectiveness checks are drawing attention as a discrete inspectional topic rather than a footnote to the investigation.
The direction of travel is toward anticipation instead of confirmation—identifying where a fix is likely to fail before the next deviation reveals it. That reframes remediation as well. Responding to an FDA 483 with technical fixes to the specific observations is increasingly read as an incomplete answer; the expectation is that a company also addresses the system that produced them, which means mistake-proofing, automation, reliability engineering, and honest analysis of how work actually gets done on the floor.
4. Networked and relocating manufacturing is stressing state of control
Manufacturing footprints are changing shape faster than quality systems were built to accommodate. Multi-site networks, modular facilities, technology transfers, R&D-to-commercial transitions, and foreign-to-domestic site changes all introduce the same underlying challenge: maintaining a consistent state of control across sites that are being added, converted, or scaled while the product is in flight. Advanced modalities compound it, since raw material strategies for cell and gene therapy often depend on single-source or research-grade materials and must satisfy FDA, EMA, PMDA, and PIC/S expectations that do not perfectly align.
For the BioHealth Capital Region and other hubs absorbing reshored capacity, the practical version of this is pre-approval and pre-license inspection readiness. New and repurposed facilities face a first inspection with commercial supply on the line, and PAI/PLI challenges continue to produce withholds and approval delays. Supply chain integrity runs alongside it, with counterfeiting, diversion, and supplier oversight now treated as quality system obligations rather than procurement concerns—and enforcement of those obligations sits with CDER’s Office of Manufacturing Quality, which brings warning letters and other actions against facilities with significant violations.
5. Workforce capability is being managed as an enterprise risk
GMP talent constraints have moved from a hiring problem to a compliance exposure. When a site cannot staff its quality unit at depth, cannot backfill experienced operators, or relies on training programs designed to document attendance rather than build capability, the effects show up in deviations, investigation quality, and inspection performance. It is a structural issue in regions scaling advanced modalities, where a workforce trained on traditional biologics has to be recalibrated for cell and gene therapy platforms and closed-system automation. Senior leaders are beginning to treat skills and capability as an enterprise risk with governance, strategy, and measurable resource allocation attached—the same treatment given to supply continuity.
Regulators are measuring the same thing from the outside. CDER’s Quality Management Maturity program evaluates practices that go beyond baseline CGMP requirements, including quality culture, and has been running voluntary prototype assessments with drug manufacturing establishments for three consecutive years. PDA maintains its own quality culture resources alongside it.
This is also where the other four issues converge. Error-resilient systems require people who understand why a control exists. Data governance requires analysts who understand GMP. Effectiveness checks require investigators who can distinguish a symptom from a cause. Maturity models and culture assessments are, at bottom, measurements of whether an organization has built that capability or assumed it.
Where these conversations are actually happening
All five will be argued out in the same building in a few weeks. The PDA/FDA Joint Regulatory Conference returns to Washington, DC September 14–16 at the Westin DC Downtown for its 37th year, and the 2026 program maps closely onto them: an opening plenary on designing error-resilient systems through a deeper understanding of human error, a multi-stakeholder session on how regulators and industry are interfacing with AI tools today, a session devoted specifically to effectiveness checks, sessions on quality systems under growth pressure and on supply chain integrity, and a track on building a resilient GMP workforce through upskilling and cross-training.
The draw has always been access. This year’s program is co-chaired by Paul Z. Balcer of FDA’s Office of Manufacturing Quality in CDER and Mary E. Farbman of Merck, and includes Center and Office updates from CDER, CBER, CVM, and OII, a Compliance Office Updates plenary with FDA’s compliance and enforcement leadership, and Lunch with the Regulators, where investigators, reviewers, and compliance officers take questions directly. Quality executives from AbbVie, Lilly, Pfizer, Merck, Roche, Takeda, Sanofi, GSK, Bristol Myers Squibb, Johnson & Johnson, Gilead, BioNTech, Genentech, and Amgen are on the agenda alongside them. A two-day PDA Data Governance Workshop follows the conference for organizations working that specific problem.
A few practical notes for anyone deciding late. Early registration closed in August, so in-person rates are at standard pricing, and the host hotel room block has sold out—surrounding downtown hotels are the fallback. A livestream option is available through September 16 at the early rate and covers plenary and concurrent sessions with the ability to submit questions, though it does not include the interest group meetings, the exhibit area, or the networking that most attendees say is the real value. Registering three people from one organization gets a fourth free, PDA member rates for early-career professionals run well below standard registration, and students can volunteer through PDA’s GPS program for complimentary registration—which makes this an unusually accessible room for people early in a quality or regulatory career.
The regulations will not change in September. What tends to happen in rooms like this one is that FDA describes how it is thinking about a problem several months before that thinking shows up in a guidance document, a warning letter, or an inspection report—and the companies in the room get to plan against it while everyone else is still reading the rule.
The PDA/FDA Joint Regulatory Conference 2026 takes place September 14–16 in Washington, DC. Registration and full agenda.
