AI in Clinical Trial Operations: Where AI Appears and Why Contracts Need to Catch Up, Part One

Artificial Intelligence (AI) is increasingly embedded in the daily operations of clinical trials, yet most contracts lack standardized language addressing AI. This makes diligence and contract drafting critical. Without asking the right questions – of your contracting partners, vendors and internally – organizations expose themselves to unnecessary and potentially significant risk.

In many cases, AI enters clinical trial operations not through deliberate deployment, but through tools already embedded in trial systems, vendor platforms, and everyday productivity software.

This two-part series examines how artificial intelligence is being used in clinical trial operations and the contractual and operational risks that follow. Part 1 outlines where AI appears in clinical trial operations and supporting technologies, and the questions companies and organizations should ask when AI touches Data (defined below). Part 2 addresses the contract provisions that respond to those risks, including intellectual property, data rights, regulatory compliance, cybersecurity, monitoring and validation, and risk allocation.

Many of the governance and contracting issues addressed here also arise in digital health platforms used in clinical care and healthcare operations. However, AI incorporated into regulated medical products themselves, such as Software as a Medical Device (SaMD), raises additional product and regulatory issues beyond the scope of this discussion.

For purposes of this post, “Data” refers broadly to data, documents, communications, and other information relating to the clinical trial, including outputs generated by AI systems using such information.

Where AI Is Appearing in Clinical Trial Operations

AI is increasingly embedded throughout clinical trial operations. It appears across several areas, including study design and recruitment, day-to-day operational support, AI embedded within trial platforms, regulatory and reporting activities and everyday productivity tools.  Examples include:

Study Design and Recruitment Analytics

• Protocol drafting and summarization
• Site feasibility and enrollment prediction
• Patient eligibility screening, including analysis of EHR/EMR data

Operational Support During Trial Execution

• Site communications and drafting
• Ambient listening or AI scribes during visits
• Visit summaries and clinical notes within EHR systems
• Adverse event narrative drafting
• Contract and document review
• Informed consent translation

AI Embedded in Clinical Trial Platforms

• AI functionality integrated into CTMS, EDC, and eTMF platforms
• Analytics embedded within the platforms, including risk-based monitoring analytics

Regulatory and Reporting Assistance

• Regulatory document drafting
• Clinical study report preparation

Everyday Productivity Tools

• AI-powered research, drafting, summarization, and document review used in daily work

Who is Using AI and Who Is Accountable?

Sponsors, sites, CROs, and service providers must understand where AI is embedded in trial operations and who remains accountable for its use.

In practice, AI can enter clinical trial operations without intentional deployment, through software updates, vendor platform features, or everyday productivity tools used by trial personnel.

Relationships to Review: Organizations need to review their relationships with entities across the trial ecosystem for AI usage and accountability, including:

• sponsor relationships with sites, CROs, and technology and service providers
• site relationships with sponsors, CROs, SMOs, and technology and service providers
• IRBs, decentralized trial providers, and digital health technology vendors

Productivity Tools:  Personnel may use everyday productivity tools to summarize protocols, draft narratives, or translate consent forms, which can result in Data being processed outside of controlled systems.

Downstream Risk:  Accountability does not stop with the immediate contracting partner. Contracting parties may rely on downstream technology providers, creating third- and fourth-party AI risk that should be addressed through diligence and contractual controls.

How Are Third- and Fourth-Party AI Vendors Governed?

Layered Relationships:  AI functionality is often delivered through layered vendor relationships, with technology providers relying on downstream AI developers or cloud services.

Example:  A sponsor may access an EDC platform through a CRO. The CRO may license the platform from an EDC vendor, which embeds AI functionality developed by another provider. In this structure, Data may pass through multiple organizations before the output is delivered, making it difficult to understand how Data is processed, used, or stored.

Limited Visibility:  If AI functionality is embedded within vendor platforms, sponsors and sites may have limited visibility into how Data is processed or flows through the vendor’s technology stack, including downstream AI providers.  This may limit their ability to conduct diligence or exercise oversight over how Data is used.

Lack of Awareness:  A related risk arises when vendors deploy AI tools without the sponsor’s or site’s knowledge or approval.  In these situations, the AI provider may not be subject to the sponsor’s or site’s security review, data governance policy or contractual controls.

Contracts:  For this reason, organizations should review the entire vendor stack for AI and ensure that contracts address downstream providers that may access or process Data.

What AI Is Used and Why?

To assess AI risk, organizations must understand what AI tools are being used—by themselves, their vendors, and their contracting partners—and how those tools interact with Data.

Key questions include:

• What AI is embedded in the technology?
  Identify whether AI tools can access, process, or generate Data, including (by way of example) source data, reported trial data, and operational documentation.
• What is the AI designed to do?
  Understand the AI’s capabilities, purpose, and outputs.
• Is the AI use transparten?
  Determine whether the service provider clearly discloses the AI functionality and provide documentation explaining how it operates.
• Has the AI been appropriately evaluated?
  • Technical evaluation: Determine whether the AI has undergone appropriate technical review, including evaluation of training data sources and transparency regarding the model, what Data it uses, and how outputs are generated.
  • Governance and safeguards: Confirm that appropriate controls are in place, including safeguards against bias, errors, and model drift; oversight (including human review) and monitoring; escalation procedures; and model updates.

AI use in clinical trial operations is expanding rapidly, and these examples represent only a subset of current use cases. As AI becomes more deeply embedded across trial operations and supporting technologies, organizations must understand where it is used and how it interacts with Data.

In Part 2, we examine how contracts address these risks.

If you have any questions or would like more information about these developing issues, please contact the following:

KATHERINE LEIBOWITZ
1-610-896-5788
Katherine.Leibowitz@LeibowitzLawTeam.com