AI in clinical trials now sits inside a more recognizable regulatory architecture than it did two years ago. The important change is not that regulators have suddenly blessed every model used in a trial. It is that FDA has described how it expects sponsors to justify AI outputs that support regulatory decision-making, while modern GCP has moved further toward risk-proportionate oversight of technology-enabled trials.
The convergence happened in January 2025. FDA issued its draft guidance on the use of artificial intelligence to support regulatory decision-making for drugs and biological products, including a 7-step credibility assessment framework organized around context of use. FDA also stated that, as of that month, it had experience with more than 500 drug and biological product submissions containing AI components, a cumulative figure that does not by itself tell us how many involved trial evidence or regulatory decisions, but does show that AI is no longer an occasional novelty in submissions. [1]
In the same month, ICH E6(R3) reached Step 4 adoption, marking the first comprehensive Good Clinical Practice overhaul since 2016 and explicitly accommodating technology-enabled trial models such as AI-assisted workflows, EHR integration, wearable devices, and decentralized trial operations through a technology-neutral, risk-proportionate approach. [2] The FDA and EMA’s jointly developed Guiding Principles for Good AI Practice in drug development supply the connective tissue: human-centric design, risk-based approaches, data governance, lifecycle management, transparency, accountability, security, reproducibility, representativeness, and continuous improvement. [3]
Taken together, these materials do not create a permission slip for uncontrolled automation. They create a disciplined route through which a sponsor can use AI in a clinical trial and still answer the questions that matter during submission review or inspection: what was the model used for, what evidence did it affect, who relied on the output, how was its performance evaluated, and can the result be reconstructed later?
The Boundary That Matters: Evidence Generation
The FDA draft guidance is centered on AI used to produce information or data intended to support regulatory decision-making for drug and biological products. That framing matters because many AI tools in clinical operations do not sit cleanly inside or outside the evidentiary chain. A model that routes monitoring reports, summarizes site communications, or predicts enrollment delays may begin as an efficiency tool. A model that classifies endpoint events, flags safety signals, imputes missing values, selects patients for analysis, or interprets trial data is much closer to regulatory evidence generation.
FDA’s draft guidance distinguishes AI used for regulatory evidence generation from tools used for internal operational efficiency, with the latter outside the direct scope of the draft framework. [1] That distinction is useful, but it should not be read as a safe harbor for anything labeled “internal.” In real trial operations, internal systems can shape source data review, monitoring priorities, protocol deviation handling, adverse event workflows, and the timing or quality of human review. A tool may not appear in a submission package and still influence the record that later supports one.
A practical first cut is to ask whether the AI output changes, selects, interprets, prioritizes, or validates information that becomes part of the clinical trial record or a regulatory argument. If the answer is yes, the sponsor should assume a higher documentation burden. If the answer is no, the tool may fall outside FDA’s AI-specific draft guidance, but it still remains subject to GCP expectations for quality, data integrity, vendor oversight, and fit-for-purpose systems.
| AI use in the trial environment | Regulatory posture |
|---|---|
| Generating, analyzing, or interpreting data used to support a regulatory decision | In scope for FDA credibility assessment under the draft guidance |
| Supporting trial operations without changing evidence, analysis, or interpretation | Outside direct FDA draft guidance scope, but still governed by GCP quality controls |
| Prioritizing review, escalation, or monitoring actions that affect the clinical trial record | Boundary case requiring governance review because operational outputs may shape evidence quality |
| General productivity use with no effect on trial data, participant safety, or regulatory records | Lower regulatory risk, but still requires appropriate organizational controls |
The middle rows are where compliance work becomes real. A sponsor does not need to pretend that every scheduling tool is a regulatory model. It does need a defensible method for identifying when an operational model has crossed into the evidentiary chain.
The FDA 7-Step Credibility Assessment Is the Load-Bearing Route
FDA’s draft framework organizes AI credibility assessment into seven steps: define the question of interest, define the context of use, assess AI model risk, develop a credibility assessment plan, execute the plan, document the results, and determine the adequacy of the model for its context of use across the lifecycle. [1] The order is not cosmetic. It prevents a common failure mode: validating a model in general terms before the sponsor has defined the specific regulatory question the output is supposed to support.
1. Define the question of interest
The question of interest is the regulatory or scientific question the AI output is meant to help answer. This is where sponsors should be specific enough that the model’s role can be tested. “Improve data review” is not a useful question. “Identify potential endpoint events for adjudicator review” is closer, because it names the task, the affected evidence, and the downstream human role.
This first step also forces ownership. If a model’s output is used by clinical operations only to allocate staff time, the question may remain operational. If the output influences which records are escalated, included, excluded, or interpreted in an endpoint process, the question has moved closer to regulatory decision support.
2. Characterize the context of use
Context of use is the hinge of the framework. It describes how and where the AI model will be used, what input data it receives, what output it produces, who uses that output, what decision it informs, and what controls surround it. The same model can carry different regulatory risk in different contexts. A model used to generate a non-binding triage queue for human review is not the same as a model whose classification directly determines an analysis dataset.
For trial teams, this means the context of use should be written in operational language, not only data science language. A reviewer should be able to see the workflow: where the data entered, what preprocessing occurred, when the model ran, what the output looked like, which role reviewed it, whether override was possible, and how the final decision was captured in the trial record.
3. Assess model risk
FDA’s draft framework is risk-based, so the credibility burden should match the possible consequence of an erroneous AI output in its stated context of use. [1] The sponsor should look at both the model influence and the decision consequence. A low-performing model used only to suggest records for optional review may create inefficiency. A low-performing model used to classify safety events, determine eligibility, or support endpoint interpretation can affect participant protection, data reliability, or a regulatory conclusion.
The risk assessment should also account for detectability. If a human reviewer is expected to catch model errors, the sponsor needs to show that the reviewer has enough information, time, training, and authority to do so. Human involvement is not a control if the human cannot realistically detect or challenge the output.
4. Develop the credibility assessment plan
The credibility assessment plan is where the sponsor decides what evidence will be sufficient to show that the model is fit for its context of use. This may include performance testing, sensitivity analyses, data representativeness checks, bias evaluation, reproducibility testing, security controls, human factors review, and procedures for handling model updates. The right plan depends on the risk and context already defined; it should not be copied from a vendor validation packet without adjustment.
This is also where sponsors should decide what will be preserved for reconstruction. If an inspector later asks how a specific AI-assisted output was produced, the answer should not depend on a transient dashboard, an overwritten model version, or a vendor employee’s memory. The plan should specify retained input data, model version, configuration, prompts or parameters where relevant, output files, human review records, and decision logs.
5. Execute the assessment
Execution is where credibility work often becomes uncomfortable, because the model may perform well in development and less consistently in the trial’s actual operating environment. The sponsor should test against the defined context of use, not against a more convenient abstraction. If the model will ingest multicenter trial data, the evaluation should consider the variability that the model will encounter. If the model will be used by site staff, monitors, adjudicators, or data managers, the evaluation should reflect the handoffs and review points in that workflow.
Execution also includes confirming that procedural controls work. Access restrictions, audit trails, change controls, override processes, and escalation pathways are not secondary paperwork. They are part of the evidence that the model was controlled in the setting in which it was used.
6. Document the results
Documentation should connect the evaluation results back to the context of use and the original question of interest. A general statement that the model was “validated” is too thin. The record should show what was tested, what data were used, what acceptance criteria applied, what limitations were found, what mitigations were adopted, and why the sponsor concluded that the model was adequate for the stated use.
This is where sponsors should be careful with vendor materials. Vendor documentation can support the sponsor’s assessment, but it rarely answers the sponsor’s full regulatory question on its own. The sponsor still has to show fitness for the particular trial, protocol, data flow, user group, and regulatory purpose.
7. Maintain credibility across the lifecycle
The draft FDA framework includes lifecycle maintenance, which is essential for AI because the risk does not end at deployment. [1] Trial conditions change. Enrollment patterns shift. Sites vary in documentation habits. Source systems are updated. A vendor may patch a model, adjust a feature, or change the infrastructure around it. Any of these changes can affect whether the model remains fit for its stated use.
Model drift monitoring should therefore be attached to the trial’s quality system rather than treated as a data science afterthought. Sponsors need defined triggers for review, criteria for acceptable performance, procedures for model updates, documentation of deviations, and a way to determine whether prior outputs remain reliable after a change or performance issue is detected.
ICH E6(R3) Supplies the GCP Backbone
The FDA draft guidance tells sponsors how to think about AI credibility when AI supports regulatory decision-making. ICH E6(R3) explains why that assessment has to live inside ordinary GCP controls. Its technology-neutral posture is important: the guideline does not need to name every model architecture to require reliable data, proportionate oversight, qualified systems, documented processes, and sponsor accountability. [2]
That matters for clinical trial AI because the highest-risk failure may not be the model alone. It may be the surrounding process: unclear handoffs between the CRO and sponsor, inadequate review of vendor changes, missing audit trails, poorly defined user permissions, insufficient training, or unexamined assumptions about who is responsible for model output. GCP does not let those issues disappear because the tool is new.
A risk-proportionate GCP approach should change the depth of oversight, not the existence of oversight. A low-impact AI assistant used to organize internal documents may require lighter controls. A model that affects endpoint adjudication, safety review, eligibility assessment, or analysis dataset construction requires more formal validation, documentation, and monitoring. The distinction is not whether AI is present; it is what the AI output can change.
- Audit trails should show what the AI system did, when it did it, what version or configuration was used, who reviewed the output, and what final decision was made.
- Vendor oversight should cover not only contracting and security review, but also model updates, performance claims, documentation access, and support for inspection reconstruction.
- Data integrity controls should address input quality, preprocessing, output retention, transfer between systems, and the risk that AI-generated content obscures the original source.
- Change control should define when a model, prompt, parameter set, data pipeline, or user workflow change requires reassessment.
- Training should be role-specific, especially where users are expected to review, override, or escalate AI outputs.
These controls are not separate from the FDA credibility assessment. They are how the assessment survives contact with the trial.
The FDA/EMA Principles Fill the Gaps Between Policy and Workflow
The FDA and EMA’s Guiding Principles for Good AI Practice in drug development are broader than the FDA draft guidance and less operational than a trial-specific SOP. Their value is that they name the recurring expectations that should be visible across the sponsor’s AI governance program: human-centric design, risk-based development, data governance, transparency, accountability, security, reproducibility, representativeness, lifecycle management, and continuous improvement. [3]
For sponsors, the principles are most useful as a cross-check. If an AI use has a defined context of use but no named accountable owner, the accountability principle is not met. If a model is evaluated once before launch but not monitored during the trial, lifecycle management is weak. If a model’s output cannot be reproduced because the system does not retain the relevant configuration or input state, reproducibility is only aspirational.
The principles also help avoid an overly narrow reading of the FDA draft guidance. A tool may be outside the direct scope of AI-supported regulatory decision-making and still create governance concerns around security, representativeness, transparency, or human oversight. That does not mean every internal tool deserves the same regulatory package. It means the sponsor should be able to explain why the chosen control level is proportionate.
What Changes When AI Output Enters the Regulatory Record
The operational shift is easiest to see at the point where an AI output becomes part of the evidence trail. Before that point, the sponsor may be managing a technology risk. After that point, the sponsor is managing a regulatory record risk.
Documentation needs to become more specific. The sponsor needs a written explanation of the question of interest, context of use, model role, input data, output, user workflow, evaluation method, limitations, and lifecycle controls. A generic validation certificate or vendor white paper is not enough if it cannot be tied to the trial’s actual use.
Auditability is more demanding. The sponsor should be able to reconstruct how an AI-assisted result was produced, including the source data, system version, model configuration, relevant parameters, output, human review, override activity, and final decision. If reconstruction depends on a system state that no longer exists, the evidence trail is fragile.
Reproducibility is a controlled-process issue. In deterministic systems, reproducing a result may be straightforward if the same inputs and version are retained. In AI-enabled systems, especially those involving configurable pipelines or generative components, sponsors need to decide in advance what must be preserved to reproduce or explain the output adequately for the stated regulatory purpose.
Monitoring has to be continuous enough to match the risk. A model used throughout enrollment or data review may need periodic performance checks, drift review, and predefined escalation triggers. A model used once for a limited analysis may need a different lifecycle plan. The key is that lifecycle control follows the context of use, not the sponsor’s desire to minimize paperwork.
The Draft Status Still Matters
FDA’s AI guidance remains draft guidance, not final binding law. [1] Sponsors should be careful not to overstate it as a regulation or assume that every detail will remain unchanged in final form. ICH E6(R3) is also a guideline that regulators implement through their own frameworks, and implementation can vary across authorities. [2]
That said, draft status is not a reason to ignore the framework. The 7-step structure reflects a regulatory logic that is unlikely to disappear: define the use, assess the risk, evaluate credibility, document the evidence, and maintain control over time. Sponsors waiting for final text still need a defensible method for governing AI that touches trial evidence.
There are also unresolved boundaries. The practical line between regulatory evidence generation and internal workflow optimization will be tested in real deployments. EU AI Act implications for clinical trial AI are an adjacent and developing issue, but the available materials here do not support a detailed mapping from EU risk classes to specific trial workflows. Medical device AI regulation is another useful comparison point, but drug development AI is being governed through a different policy route.
A Sponsor-Ready Compliance Posture
By mid-2026, sponsors can deploy AI in clinical trials under a recognizable risk-based framework. The control question is no longer whether AI is categorically acceptable. It is whether the sponsor can prove that the model was fit for its stated context of use and controlled across the trial lifecycle.
The first operational move is inventory. Sponsors should identify AI uses across trial design, startup, recruitment, monitoring, data management, safety, endpoint review, statistical analysis, reporting, and submission support. The inventory should not stop at systems branded as AI. It should include embedded models, automated classifiers, predictive analytics, generative tools, and vendor-managed functions that produce outputs used by trial teams.
The second move is classification. Each AI use should be mapped to the evidence chain: no evidence impact, indirect evidence quality impact, or direct regulatory evidence impact. Boundary cases should be escalated rather than quietly assigned to the lowest-risk category. A model that prioritizes which records receive human review may not make the final decision, but it can still influence what humans see and when they see it.
The third move is credibility assessment for AI uses that support regulatory decision-making. The assessment should follow the FDA’s draft structure: question, context of use, risk, plan, execution, documentation, and lifecycle maintenance. [1] For lower-risk or out-of-scope tools, sponsors still need proportionate GCP controls, especially around data integrity, audit trails, vendor management, and change control.
The fourth move is inspection readiness. Sponsors should be able to retrieve the records that show what the AI did, how it was evaluated, who relied on it, what controls applied, what changed during the trial, and how performance issues were handled. If that reconstruction is not possible, the issue is not merely technical. It is a weakness in the regulatory record.
The practical posture is straightforward: identify which AI uses touch regulatory evidence, subject those uses to credibility assessment, preserve audit trails, monitor lifecycle performance, and treat unresolved boundaries as governance risks rather than loopholes.
Comments
Join the discussion with an anonymous comment.