The State of AI in Clinical Trials

The question has changed

Two years ago the question in clinical development was whether AI had any legitimate place in a regulated trial. Today the question is narrower and more useful: which tasks, with which controls, and who is accountable for the output. That shift — from posture to practice — is the real state of AI in clinical trials.

The honest summary is that AI is delivering measurable value in specific, bounded places, and delivering hype almost everywhere else. The teams seeing returns are not the ones chasing an autonomous trial. They are the ones who took the most painful, highest-volume, most checkable work — reading documents, cleaning data, mapping datasets, filing the TMF — and let AI do the first pass while a qualified human owns the decision. This paper maps where that is working, the technology underneath it, and the governance that lets you adopt it without putting a submission at risk.

Where AI is real today

Value is concentrated where three conditions hold at once: the task is high-volume and repetitive, the output is verifiable against a source or a standard, and a human can stay in the loop without erasing the efficiency gain.

At study build, models read a protocol — PDF, Word, or scanned via OCR — and turn it into structured elements that seed CRF design, edit-check logic, and a first-draft informed consent. At conduct, AI extracts values from source documents into the EDC and drafts the clarifying queries a data manager would otherwise write by hand. In oversight, centralized analytics and anomaly detection surface adverse events buried in unstructured notes and rank sites by risk. In analysis, automation maps collected data to SDTM, derives ADaM, and runs conformance checks continuously instead of in one terminal scramble. In reporting and archive, models assemble first-draft clinical study report sections from the protocol, SAP, and statistical outputs, and classify incoming documents to the correct TMF artifact and zone. None of these are autonomous. All of them move a human from author to editor.

The pattern that holds: AI drafts, a human decides

The single most important design decision in regulated AI is where the human sits. The durable pattern places the model as a drafting and detection engine and the qualified professional as the accountable decision-maker. The AI proposes an SDTM mapping; a data-standards lead approves it. The AI flags an event that may meet seriousness criteria; a physician judges causality and expectedness. The AI drafts a narrative; a medical writer signs it.

This is not timidity. It is what makes the output defensible. A regulatory record needs an accountable owner and a path back to source, and neither survives full automation. The efficiency comes from collapsing the blank-page and transcription work, not from removing judgment. Organizations that try to skip the human find that the review they saved upfront returns, with interest, as rework and risk downstream.

The technology underneath

Three capabilities do most of the work, and understanding them is the difference between buying a black box and deploying a defensible system.

Large language models (LLMs) provide the language understanding — reading a protocol, drafting a query, summarizing a document. On their own, though, general-purpose LLMs have a fatal flaw for regulated work: they generate fluent text from training data, which means they can be confidently wrong and cannot cite where an answer came from.

Retrieval-augmented generation (RAG) is the architecture that fixes this, and it is why LLMs became usable in trials at all. Instead of answering from memory, a RAG system retrieves the relevant passages from *your* documents — the protocol, the SAP, the TMF — and grounds its answer in them, with citations back to the source.

OCR and document intelligence handle the reality that much of a trial's source is scanned, multilingual, and unstructured. Optical character recognition turns those images into text the rest of the stack can read. Layered together — OCR to read, RAG to ground, an LLM to draft, orchestration to route work through human gates, and integrations to the systems of record — you get a stack whose outputs are traceable rather than mysterious. Traceability is the whole game.

Where regulators actually stand

A common myth is that regulators forbid AI in trials. The reality is more encouraging: they have engaged, and they have given you a framework to work within.

In January 2025, the FDA issued draft guidance on the use of AI to support regulatory decision-making for drugs and biologics. Its centerpiece is a risk-based credibility-assessment framework: define the question the AI is answering, assess how much your decision relies on it (its context of use and risk), and establish credibility evidence proportionate to that risk. This is a workable mental model for any AI deployment, regulated or not — match the rigor of your evidence to the consequences of being wrong. The FDA has also signaled openness through its Emerging Drug Safety Technology Program and related engagement.

The EMA has published a reflection paper on the use of AI across the medicinal product lifecycle, emphasizing a risk-based, human-oversight-centered approach and data quality. Underneath the drug-specific guidance sit the standards that already govern this work: 21 CFR Part 11 for electronic records and signatures, ICH E6(R3) for good clinical practice and risk-proportionate oversight, and computer system validation under GAMP 5 for the systems themselves. AI does not exempt you from any of these; it operates inside them.

Governance you can actually build

The good news for 2026 is that AI governance is no longer improvised. There is a standards scaffold to build on.

• ISO/IEC 42001 is the first management-system standard for artificial intelligence — an auditable framework for governing how AI is developed, deployed, and monitored across an organization, analogous to what ISO 27001 did for information security.
• The NIST AI Risk Management Framework provides a shared vocabulary and a set of functions — govern, map, measure, manage — for identifying and controlling AI risk.
• 21 CFR Part 11 and GAMP 5 remain the backbone for records integrity and validation, and ALCOA+ principles still define what trustworthy data looks like.

The practical move is to treat an AI feature like any other GxP system: define its intended use, validate it, control access, log what it does in an immutable audit trail, and keep a human accountable for its outputs. Vendors that cannot show you this are not ready for a regulated trial.

A staged adoption roadmap

The gap between a compelling demo and a deployment you would put in front of an inspector is bridged in stages, not in one leap. The organizations that cross it treat adoption as a sequence with a gate at each step.

First you prove the capability on a single, bounded, checkable task — often in shadow mode, where the AI runs alongside the current process and its output is compared rather than trusted. Then you validate: does the AI-assisted path beat the status quo on cycle time and quality, measured against the real baseline and not the demo? Only then do you integrate it into the systems of record — the EDC, the eTMF, the safety database — so the output lands where the work actually happens rather than in a side tool. Governance is wrapped around all of it from the first day: intended-use definition, validation evidence proportionate to risk, access control, and an audit trail. Finally you scale, task by task, letting each proven deployment fund the next and retiring anything that does not earn its keep. The discipline is refusing to skip a stage. Most failed AI programs did not fail because the model was weak; they failed because they jumped from demo to production without the validation and integration in between.

What separates the teams getting value

Across the organizations seeing real returns, the playbook rhymes. They start narrow — the painful, high-volume, checkable task, not the autonomous moonshot. They keep the human accountable and design the review step in from the start rather than bolting it on. They demand grounding and traceability, refusing outputs that cannot cite their source. They validate and govern from day one, under the standards they already know. And they measure honestly, comparing AI-assisted cycle time and quality against the old way rather than against a demo.

The state of AI in clinical trials, then, is neither the revolution the loudest voices promised nor the risk the most cautious feared. It is a set of specific, valuable, governable capabilities that give skilled people their time back — provided you adopt them the way the work demands: grounded, validated, and with a human always in control.