Published reports name pharma companies in PA across several regions of the state. Greater Philadelphia holds GSK’s US headquarters and a strong cell and gene therapy base. Montgomery County holds Merck’s West Point campus and GSK’s planned Upper Merion biologics plant. Lancaster County holds GSK’s Marietta site. The Lehigh Valley holds Eli Lilly’s new injectables plant, alongside B. Braun, Sharp and Piramal Critical Care. Pittsburgh is where ElevateBio is building a genetic-medicine plant, expected to be operational in 2027. Pennsylvania is home to more than 3,900 life sciences companies, in a sector valued at over $73 billion. Pennsylvania drug manufacturers answer to the state’s drug statute and code and to the FDA’s CGMP regulations; under the state act, a product that complies with federal rules is not deemed adulterated or misbranded.

That double layer is why AI added to quality work here needs records built to satisfy both.

Pharma companies in PA, region by region

The table below lists the named companies and scale figures the sources give for each region. It does not try to be a full directory, and leaves out smaller AI-led firms such as Abridge and Ellumigen in Pittsburgh.

Region	Named companies and sites	Scale, as the source states it
Greater Philadelphia	GSK US headquarters; big pharma presence plus cell and gene therapy developers	Almost 55,000 life sciences workers, nearly 19,000 of them in R&D; 11.6 million sq ft of lab/R&D space
Montgomery County	Merck West Point (400 acres, Merck’s largest integrated research and human health manufacturing site); GSK biologics flex factory planned in Upper Merion	Merck: West Point is the county’s largest employer and the state’s seventh largest private employer
Lancaster County	GSK Marietta	Up to $800 million expansion doubling the site, at least 200 new jobs (DCED)
Lehigh Valley	Eli Lilly (Fogelsville, Upper Macungie Township); B. Braun US headquarters (Bethlehem); Olympus, Thermo Fisher Scientific, Sharp, Piramal Critical Care, OraSure	Lilly $3.5 billion, 850 jobs; more than 180 life sciences establishments employing about 5,800 people
Pittsburgh	ElevateBio BaseCamp Pittsburgh at BioForge, Hazelwood Green	A CBRE report ranked Pittsburgh the top emerging US life sciences cluster

Two notes on the figures. The Lehigh Valley establishment count differs a little between sources: the regional development body says more than 180, while Business Facilities magazine says more than 170. The same Business Facilities article cites Chmura Economics JobsEQ for the claim that the Lehigh Valley has one and a half times the US average concentration of pharmaceutical manufacturing jobs. Because ElevateBio’s facility is still under construction, treat Pittsburgh as a growing manufacturing base, not an established one.

The Lilly project is described as the largest single economic development project in Lehigh Valley history and the largest life sciences project in Pennsylvania history. The plant will make injectable weight-loss medicines.

Which rules govern a pharma manufacturer in Pennsylvania?

The short answer: Pennsylvania registration and supervision rules, the state GMP chapter of the Pennsylvania Code, and federal CGMP under 21 CFR Parts 210 and 211, with the state treating federally compliant products as not adulterated or misbranded unless it has said otherwise.

State registration and the Act 101 change

The Controlled Substance, Drug, Device and Cosmetic Act bars anyone from operating as a drug manufacturer in Pennsylvania until registered with the Secretary of Health, and requires annual renewal. Registration is per location. Each business location that physically manufactures, compounds under 503B, distributes or wholesales drugs generally has to register with the Department of Health’s Drug, Device and Cosmetic (DDC) programme. The department returns a manufacturer application as incomplete if the FDA registration is not yet in place. The facility must also physically produce product at the address on the application, and that site may be inspected.

Supervision is a statutory requirement. Manufacturing must run under a registered pharmacist, a chemist or another person with at least five years’ experience in drug manufacture, or someone the Secretary approves as qualified. The DDC guidance adds that this person must physically oversee day-to-day operations.

The recent change concerns in-state virtual manufacturers and wholesalers. Act 101 of 2024 was signed on 16 October 2024 and took effect on 13 April 2025. Under it, in-state virtual manufacturers holding an FDA commercial product label code must obtain a licence, and in-state licensed wholesalers of human prescription drugs must lodge a surety bond. Virtual manufacturers need the bond as well. Facilities that hold only a registration do not. Virtual manufacturers do not qualify for registration but may obtain a certificate of record. For a Pennsylvania company that outsources all production to a CDMO, this is the change most likely to have caught it out.

The state GMP chapter: dual checks and two-year records

Title 28, Chapter 25 of the Pennsylvania Code sets out the state’s own good manufacturing practices. Three of its provisions matter for a digital or AI-assisted workflow:

• Dual verification. A competent individual performs each significant production step and a second one checks it. Where precision automatic, mechanical or electronic equipment controls the step, competent individuals check that the equipment performs properly. Master production records are checked and signed by a second responsible person.
• Retention. Batch production records and laboratory data must be kept for at least two years after distribution or one year after expiry, whichever is longer.
• Review and investigation. Production and control records are reviewed before release. Any unexplained discrepancy is investigated whether or not the batch has shipped, the investigation extends to associated batches, and it produces a written record with conclusions and follow-up.

The code also permits electronic equipment in production “when adequate inspection and checking procedures are used to assure proper performance”. That clause predates machine learning, but it already states the principle an AI deployment has to meet: automation is allowed when people can show it is working as intended.

The bridge to federal CGMP

Under the state act, a drug or device is not adulterated or misbranded if it complies with the applicable federal act, regulations and interpretations. The exception is a provision the Secretary, on the board’s recommendation, has declared by regulation will not be followed. The state act also ties manufacturers’ record-keeping to federal requirements. The FDA describes its CGMP regulations as minimum requirements for the methods, facilities and controls used in manufacturing, processing and packing. The core drug rules are 21 CFR Part 210 and Part 211. ICH Q10 is intended to be used together with those regional GMPs. It describes quality system elements such as CAPA, change management, process performance monitoring and management review throughout the product lifecycle.

Part 11 and data integrity: what electronic quality records must show

Part 11 applies when a company keeps electronically, in place of paper, a record that a predicate rule such as Part 211 already requires. The FDA’s scope guidance says the agency interprets Part 11 narrowly. It uses enforcement discretion on the Part 11 requirements for validation, audit trails, record retention and record copying, but it still enforces every predicate rule requirement. It also continues to enforce access limits, authority and device checks, training of system users, and written accountability for electronic signatures.

The guidance still requires that changes to records not obscure previous entries where predicate rules demand it, and it says audit trails are particularly appropriate when users create, modify or delete regulated records during normal operation. The FDA asks for decisions on validation and audit trails to rest on a justified, documented risk assessment. The FDA’s data integrity Q&A states the expectation plainly: all data should be reliable and accurate. The agency issued that guidance in response to rising data integrity findings in inspections.

For an AI system that suggests a root cause or drafts an impact assessment, the record in question includes the suggestion and what the human reviewer did with it.

What an Allentown warning letter shows about investigation failures

The FDA issued a letter citing CGMP violations to Central Admixture Pharmacy Services, a 503B outsourcing facility in Allentown. The letter cites failure to investigate unexplained discrepancies or batch failures thoroughly, whether or not the batch had been distributed (21 CFR 211.192). It also cites failure to set scientifically sound laboratory controls (21 CFR 211.160(b)). The investigator recorded that the firm had not adequately evaluated product or taken corrective action after microbial contamination was recovered in the ISO 5 aseptic area. The FDA found similar deficiencies at the company’s Phoenix and San Diego sites and concluded that management oversight was inadequate.

Pennsylvania’s own code contains the same investigation duty, word for word in places: investigate any unexplained discrepancy, extend to associated batches, write it down. A 503B facility is not a traditional manufacturer, but the letter states that outsourcing facilities must comply with CGMP under Parts 210 and 211. The failure it describes, an investigation that did not go far enough, is work AI vendors now pitch tools for. That makes it a fair test of whether an AI tool helps or just produces faster paperwork.

Where AI is already applied at Pennsylvania pharma sites

Several of the named Pennsylvania companies have announced AI in manufacturing or analysis:

• GSK will implement AI and advanced digital technology across its five manufacturing sites in four states, Pennsylvania among them.
• Merck’s ADVANCE facility at West Point combines automated robotic systems with digital AI capabilities to analyse biological samples from clinical development programmes. This is closer to the AI in pharma R&D side than to manufacturing.
• ElevateBio says BaseCamp Pittsburgh will use AI, electronic batch records and manufacturing execution systems for the repetitive work where human error is most likely.

More broadly, the FDA’s CDER discussion paper on artificial intelligence in drug manufacturing lists advanced process control, equipment monitoring, vision-based inspection of packaging, labels and vials, and text analysis of complaints and deviation reports to find trends and support root cause identification. A BioProcess International article describes AI support for deviation and CAPA management, change-control impact assessment, document retrieval for inspections and simulated mock inspections. Which of these uses are proven in production, and where the return shows up, is covered in our piece on proven AI use cases on the pharmaceutical manufacturing line. The FDA’s stance specifically is covered in artificial intelligence in drug manufacturing and FDA expectations.

How do you keep an AI-assisted deviation or change-control workflow audit-ready?

Treat the model as a controlled element of the pharmaceutical quality system. Every version should be validated, every change should go through change control, its performance should be monitored, and a named person should review its outputs before they become quality decisions. The FDA describes the current approach this way: models used in manufacturing are developed, validated, implemented and updated through change control within the quality system. ICH Q10 says change management should give a high degree of assurance of no unintended consequences, and that CAPA should come from a structured root-cause investigation scaled to risk. The EU’s new Annex 22 sets requirements for a defined intended use, performance metrics, training data quality, test data management and continuing oversight, including change control, model performance monitoring and human review where necessary. The ISPE GAMP Guide: Artificial Intelligence offers a best-practice framework for such AI-enabled systems. It covers model governance for decision traceability, testing with fit-for-purpose data, ongoing monitoring on live data, AI-specific CAPA, and human oversight.

We hold that this evidence is an engineering output, built alongside the model, not a policy document written after it. A QA reviewer or inspector has to be able to read it and sign against it without reverse-engineering the pipeline.

Checklist: evidence an inspector can follow

Use this to check an AI-assisted quality workflow before it touches a GMP record:

1. Intended use is written down. The record says what the model may suggest (for example, likely root causes for a deviation) and what it may never decide.
2. Part 11 applicability is assessed. A documented risk assessment says which outputs are predicate-rule records and which controls apply to them.
3. The model version is under change control. Each retrain or prompt change has an impact assessment, and the FDA itself flags continuously learning models as an open question.
4. Performance is measured on test data, against defined metrics, and monitored on live data afterwards.
5. The audit trail records who performed and who checked each step. Later edits must not obscure earlier entries.
6. A competent person checks the automated step, as Pennsylvania’s code requires for equipment-controlled production steps, and as Annex 22’s human review provides for where necessary.
7. Retention meets at least the state period for the workflow’s batch and laboratory records: two years after distribution or one year after expiry, whichever is longer.
8. Model failures feed CAPA, using incident and CAPA considerations specific to AI-enabled systems.

The fifth item deserves the most care. A log that keeps the final decision but drops the model output that prompted it cannot show the human review was real. Explainability makes this harder as models grow more complex, a challenge the FDA paper names directly.

TechnoLynx builds these artefacts as part of the engineering: task-specific evaluations, lineage and traceability for production decisions, and evidence packs aligned to named rubrics such as GxP references. That is not regulatory sign-off or certification. The manufacturer remains responsible for the quality decision. Teams weighing an outside partner against in-house work can find selection criteria in our guide to choosing among pharma automation companies. The wider compliance picture is in pharmaceutical regulatory compliance and AI.

What the regulators have not settled yet

Some regulatory questions on AI models in manufacturing remain open. The FDA’s discussion paper says it may be hard to decide when an AI model counts as an established condition of a process, and what changes to a model would require regulatory notification. It also flags the question of how inspectors would examine a continuously updated model during a site inspection. Annex 22 is new, drafted by the EMA GMDP Inspectors Working Group with PIC/S. Until both settle, the conservative design updates models only through change control, as in the FDA’s current paradigm, records human review at the decision, and holds up under the oldest rule in the stack. For a plant in Pennsylvania, that rule is a state code that already asked, long before machine learning, for automated steps to be checked by a competent person.