The FDA wants risk-based Quality. Most CDMOs are still built for zero risk.

Two recent pieces of FDA reporting point at the same problem from different angles. The agency is visibly trying to move faster, consolidating 25 submission portals into one, rolling out its Elsa AI tool across reviewers, and pushing centres toward risk-based oversight. Reporting from inside industry shows why that push keeps stalling once it reaches sponsors.

Tala Fakhouri, formerly of the FDA's drug division and now chief AI and regulatory strategy officer at Parexel, has seen both sides. She helped write the FDA's AI guidance to be flexible and context-specific, deliberately avoiding a rigid checklist. Now that she advises pharma companies on implementing it, she's watching that flexibility get read as risk rather than relief.

The example she gives is a good one for anyone hiring into Quality right now. A company using an AI tool to translate code between programming languages applied FDA software validation guidance from 2002, a framework built for deterministic software, to a generative AI tool that isn't deterministic at all. The result was an approach Fakhouri herself calls unworkable: screenshotting every step of a probabilistic process to build an inspection trail that doesn't map onto how the tool actually works.

Nobody at the FDA asked for that. The agency's own guidance calls for oversight that's proportionate to risk, focused on data and processes that are genuinely critical to quality rather than everything a company can think to document. But companies apply the older, heavier standard anyway, because the newer one doesn't spell out every step, and spelling out every step is what risk-averse teams reach for by default.

‍

Why Quality carries this as much as regulatory affairs

It's tempting to read this as a regulatory affairs problem, but the responsibility sits with Quality just as heavily. Quality functions are the ones deciding, day to day, what gets validated, how much documentation a process needs, and where the line sits between diligence and duplication. Get that judgement wrong in either direction and you either fail an inspection or bury your team in work the FDA never asked for.

Fakhouri's other point is just as relevant to hiring as it is to policy. She's watched the FDA lose experienced staff to recent job cuts, and she's blunt about what that does to decision-making: junior reviewers with limited experience and full responsibility default to caution, because caution feels safer than judgement when you haven't built the judgement yet. The same dynamic plays out inside CDMO and biotech Quality teams. A team built around less experienced hires, however capable, will tend to apply the heaviest available standard rather than the appropriate one, simply because the appropriate one requires calling a judgement that takes experience to make with confidence.

That default carries a real cost, in slower validation cycles, documentation built for tools that don't need it, and Quality teams spending time on paperwork rather than the manufacturing and product issues that carry the actual risk.

‍

What this means for Quality hiring in CDMOs

The FDA's own direction of travel, described by acting CIO Sri Mantha and CDER's Michael Davis in separate reporting on the agency's IT consolidation, is toward fewer systems, faster review, and AI embedded into reviewer workflow rather than treated as a novelty. Oncology Center of Excellence director Angelo de Claro has already flagged that FDA staff can spot under-reviewed AI output in submissions, which cuts both ways: sponsors need people who know how to use these tools properly and how to demonstrate that oversight when asked.

Closing the gap Fakhouri describes between FDA intent and industry practice takes people, not more guidance documents: Quality leaders and regulatory affairs specialists who've sat across enough inspections and enough technology transitions to know which standard actually applies, and who have the standing internally to push back when legal or risk-averse instinct defaults to the heaviest option available.

For CDMOs building out AI-enabled manufacturing and quality processes, that's the hire worth prioritising: Quality and regulatory affairs talent who can tell the difference between what the FDA is actually asking for and what a company assumes it should do to be safe, rather than headcount that keeps running the old checklist.