Where root cause analysis breaks down in pharmaceutical manufacturing – and how AI can change the game

In our 2026 survey of 230 quality professionals across more than 100 pharmaceutical companies, CDMOs, and med-tech organizations, 91% named deviation performance as a board-level priority. Meanwhile, time to closure is the metric that leadership watches most closely.

Most of that time is lost to root cause analysis. The reasons why are structural, and confirmed by three independent lines of evidence. In an ISPE webinar poll, more than 60% of participants pinpointed root cause analysis as the most resource-intensive step of deviation management. In our own survey, 37% of respondents named it as the number-one reason deviations get delayed or stuck, and 81% nominated it as the stage involving the most manual work. Finally, peer-reviewed work on bioreactor fermentation specifies root cause analysis as an out-of-trend or out-of-specification event because it takes between two and eight weeks to complete. 

Four ways an investigation can break down

Vital evidence sits in systems that don’t talk to each other

Evidence on deviations is distributed across multiple sources: the QMS, the MES, laboratory systems, equipment logs, and paper batch records. That fragmentation inevitably means that no single system has visibility across the entire timeline.

In a 2026 warning letter to an Irish biologics site, the FDA found particulate excursions and test failures recorded in equipment logs but absent from the laboratory records. As a result, those issues were never investigated at all. The evidence did exist. But it was stored in the wrong system, and nobody ever joined the dots.

ISPE ranks cross-functional collaboration second only to root cause analysis among the most difficult aspects of the deviation management process. So it’s little wonder that three-quarters of our respondents are only moderately satisfied with their current tools, and that they name limited root cause analysis support among their most troublesome pain points.

Leadership watches time to closure

When investigations are under pressure to reach closure, they settle on the most salient explanation – which is usually human error. ECA Academy states the problem in stark terms: human error is rarely the actual root cause, and treating it as a conclusion means that by the time the deviation closes, nothing has actually changed.

Attribution can also point outward. In a 2026 warning letter to a French sterile manufacturer, the FDA found the firm had attributed repeated contamination complaints to customer mishandling and concluded no further action was needed. However, inspectors on site identified blocked unidirectional airflow, an operator leaning into the filling area, poorly designed equipment, water ingress, and corrosion. Again, the plausible causes were available, but the investigation never uncovered them.

Documentation crowds out analysis

All too often, the heaviest administrative load falls on the same people who are tasked with carrying out the reasoning. ISPE's assessment is that the majority of total investigation time goes into writing, formatting, and reviewing reports, leaving materially less for the analysis itself. Most of our survey respondents locate manual effort in the judgement-heavy stages: root cause analysis (81%), initial investigation (51%), and impact assessment (42%).

Events are reviewed one at a time

Each deviation is investigated as an isolated incident, so patterns unfolding across multiple events go unseen. According to our survey, two teams in three see deviations recur roughly 5–20% of the time, and 79% say fewer than 15% are ever critical. The workload consists largely of preventable repeats.

Regulators treat that as a system failure. In FY2025, failure to thoroughly investigate unexplained discrepancies under 21 CFR 211.192 was the second most frequently cited drug GMP observation, appearing 164 times across 2,837 drug citations. ECA notes that FDA publishes warning letters criticising root cause analysis and CAPA execution almost every week.

What AI can change – and what it can’t

AI impacts the evidence layer and the hypothesis layer of an investigation, but it doesn’t alter the causal judgement.

The evidence layer is the clearest case. In the peer-reviewed fermentation study discussed above, automating parts of the analysis compressed root cause work from the usual two to eight weeks to just days – or even hours. That specific method is process analytical technology applied to batch time-series data, so it is not directly transferable to a paper-based deviation. The underlying principle is that when assembly and correlation are automated, the investigator starts with the timeline already built.

The real value sits in the hypothesis layer. Systems that read across years of prior deviations can surface correlations that a single-event review does not reach. They can also prompt an investigator with data-backed questions rather than leaving the 5 Whys to run on recollections alone. Our respondents rank the opportunities to use AI  in that order: guidance on root cause analysis first, detecting recurring patterns and trends second, drafting investigation reports and CAPA third, and completing the initial deviation reports fourth. In simple terms, people want better investigations, not faster forms.

This is the precise sequence around which Devin has been built. Capture at the moment of the event, independent of QMS availability. Retrieval across ERP, LIMS, and operational records alongside historical deviations, SOPs, and process records. A root cause recommendation drawn from similar past events, passed to an investigator who remains the decision-maker, plus classification and prioritisation to flag batch-release impact early.

AI adoption is still at an early stage. Thirty-nine percent of our respondents are actively exploring AI, 16% use AI tools informally, 15% are running pilots, and 12% have something live in production, with frequent variation between sites within a single company.

Strong interest in AI… but with strings  attached

Quality teams are not asking whether AI works. They are asking whether it can be trusted, and they have named their terms. When we asked quality professionals to reveal their biggest concerns over AI, their top five responses were: 

• Hallucinations or incorrect suggestions (60%)
• Data privacy or IP leakage (56%)
• Bias or inconsistent outputs (49%)
• Validation burden in GxP environments (44%)
• Explainability and traceability (29%).

More than 65% say they would be highly interested in a validated, GxP-compliant system that could meaningfully cut investigation time or clear backlogs.  

Regulators are drawing the same line in the sand. Draft EU GMP Annex 22 went out for consultation in July 2025 and remains unadopted as of August 2026. The current draft keeps generative models and large language models firmly at arm’s length from critical GMP applications. Where AI does support non-critical work, qualified personnel are still responsible for the suitability of the output. Annex 22  also sets a sobering benchmark: the acceptance criteria for a model should be at least as high as the performance of the process it replaces. “Nearly as good” is far from good enough. 

The FDA has made the point through enforcement. In April 2026, it cited a Michigan manufacturer for using AI agents to create drug product specifications, procedures, and master production records without quality unit review – a violation of 21 CFR 211.22(c). When the firm was asked why a required process validation step had not been completed, it responded that the AI agent had "never told you it was required". The corrective expectation is unambiguous: any output from an AI agent must be reviewed and cleared by an authorised human representative of the quality unit. ISPE reaches the same conclusion: AI-generated content must be reviewed and approved by qualified personnel before it becomes GMP documentation.

The message is clear. Human sign-off and a complete audit trail must be built into the architecture, not just mentioned on the roadmap. Devin logs every agent action as traceable and exportable for inspection, with role-based controls and support for GxP validation.

How to test the business case

When it comes to the value case for investing in AI, our respondents are split almost evenly across less manual work (23%), fewer recurring deviations (22%), faster time to closure (19%), and better right-first-time performance (22%). 

Since no single KPI carries the decision, a system that only saves time probably won’t make the grade. In fact, it’s notable that three of those four factors are quality outcomes rather than efficiency gains.

Gains in quality are measurable, but only when the measurement is set up in advance. ISPE's guidance is to establish baseline metrics before deployment and track closure rate, CAPA cycle time, and first-pass documentation accuracy afterwards. In Deloitte's 2025 survey of 103 biopharma executives, 50% reported fewer errors and deviations following quality control lab modernisation, while 45% reported improved compliance and 43% shorter testing timelines. Deloitte separately flags that its more eye-catching numbers, including a 20% to 50% reduction in compliance issues, are executive forecasts rather than realised results.

We suggest that you apply that distinction to every supplier claim – including ours. Ask for the baseline, the sample size, the metric definition, and who verified it. A single figure that survives that test is worth more than five ranges that do not.

Taking a step back, one crucial organisational point underlies everything discussed above. Ownership of AI in quality currently sits with IT and digital teams first, quality leadership second, and executive management third. Digital teams can supply the infrastructure. But quality must own the intended use, the controls, and the definition of success – because quality is the team that an inspector will hold accountable.

Root cause analysis is where the time goes and where all four failure modes converge. Investigators need a validated, controlled system that helps them reason faster while keeping the reasoning under their control. Only that will move the one vital metric that keeps leaders awake at night.

‍