Kitsa: the clinical research network connecting trial sponsors and research sites

Clinical regulatory writing produces the structured documents health authorities require to evaluate and approve pharmaceutical products. These aren't neutral scientific papers but compliance-focused submissions for FDA, EMA, and other regulators. The work spans protocols, Clinical Study Reports, Investigator's Brochures, informed consent forms, and marketing applications. Quality matters: analysis of 836 protocols found that 57% undergo substantial amendments, with approximately 45% of those classified as avoidable, often due to eligibility criteria or design inconsistencies not fully resolved before finalization. More recent data shows Phase III protocols now average 3.5 substantial amendments, up nearly 60% since 2015. Between 2018 and 2022, 37% of all NDAs and BLAs received Complete Response Letters. ICH E6(R3), finalized in January 2025 and effective in the EU as of July 2025, now emphasizes Quality Management Systems and risk-based approaches. For sites, this means documentation must reflect quality-by-design thinking, with risk assessments and quality tolerance limits visible in trial documents, not buried in operational procedures.

Large language models write fluent regulatory text, but they fail on the dimension that matters most: clinical logic aligned with current guidance. A 2025 study testing LLM-generated protocols found over 80% content relevance but only 40% accuracy on clinical thinking and logic, the measure of whether recommendations follow sound trial design and regulatory standards. Retrieval-augmented generation (RAG) fixes this by pulling relevant guidance documents into the model's context at generation time, rather than relying on outdated training data. The same study found RAG substantially improved clinical thinking scores, with the largest gains in the exact area where base models struggled.

RAG systems retrieve chunks from curated document libraries (FDA guidance, ICH standards, prior protocols, internal SOPs) and condition the model's output on those sources. Every substantive statement can trace back to a retrieved passage, making citations verifiable instead of fabricated. This matters for compliance: ICH E3 requires Clinical Study Reports to reflect the protocol exactly, and discrepancies between documents trigger regulatory questions. RAG architectures can ground all outputs in the same corpus throughout the writing process, reducing cross-document inconsistency.

Retrieval quality determines performance. Hybrid methods combining dense vector search with key

In November 2025, ICH endorsed M11, the first internationally harmonized clinical trial protocol template. The FDA finalized guidance in May 2026, and the EMA adopted it in December 2025. But M11 only defines what protocol content should contain, not how software systems can actually use it. That's where CDISC's Unified Study Definitions Model (USDM) comes in. USDM turns M11's structured content into a machine-readable data model that EDC systems, CTMS platforms, and registry submissions can consume directly.

Right now, roughly 90% of protocols still exist only as unstructured text, according to TransCelerate. That means every downstream system gets built by someone reading the protocol document and re-entering content by hand. The average lag between protocol approval and study start is four months, largely due to this manual work. When amendments happen, and 57% of trials have at least one substantial amendment, the cycle repeats. A 2016 Tufts analysis found the median direct cost of a Phase III amendment was over half a million dollars, not counting delayed enrollment.

For sites, USDM won't eliminate amendments or complexity. But once your sponsor's systems integrate with it, protocol changes should cascade automatically to your EDC, informed consent forms, and training materials instead of requiring fresh manual updates every time.

Using artificial intelligence (AI) in research offers many important benefits for science and society but also creates novel and complex ethical issues. While these ethical issues do not necessitate changing established ethical norms of science, they require the scientific community to develop new guidance for the appropriate use of AI. In this article, we briefly introduce AI and explain how it can be used in research, examine some of the ethical issues raised when using it, and offer nine recommendations for responsible use, including: (1) Researchers are responsible for identifying, describing, reducing, and controlling AI-related biases and random errors; (2) Researchers should disclose, describe, and explain their use of AI in research, including its limitations, in language that can be understood by non-experts; (3) Researchers should engage with impacted communities, populations, and other stakeholders concerning the use of AI in research to obtain their advice and assistance and address their interests and concerns, such as issues related to bias; (4) Researchers who use synthetic data should (a) indicate which parts of the data are synthetic; (b) clearly label the synthetic data; (c) describe how the data were generated; and (d) explain how and why the data were used; (5) AI systems should not be named as authors, inventors, or copyright holders but their contributions to research should be disclosed and described; (6) Education and mentoring in responsible conduct o

The average protocol now carries 3.3 amendments before completion, up 60% from pre-2015 levels. Each amendment triggers a cascade: revised protocol, updated ICF, amended Investigator's Brochure, sometimes a DSUR. Implementing one amendment takes an average of 260 days from identification to final IRB approval. Traditional medical writing outsourcing, built around word processors and email threads, hasn't scaled with this burden. The model still delivers real value for specialized therapeutic area expertise and flexible capacity, but four structural weaknesses now limit its effectiveness: writer availability determines document timing, with 25% of job postings unfilled for over three months; turnaround time between database lock and submission-ready CSR can delay regulatory filings by three to six months; cross-document consistency failures create compliance gaps that regulators flag as submission errors; and amendment cascades require separate engagements for each dependent document, creating natural version drift. AI-native tools change this calculus. Merck's generative AI platform cut CSR first draft production from 180 to 80 human-review hours while reducing errors by 50%, freeing medical writers to focus on interpretive work that requires clinical judgment rather than structured data extraction and terminology checking.

A protocol gets approved on Tuesday. By Friday, three different teams are manually retyping the same eligibility criteria, visit schedule, and endpoint definitions into EDC, CTMS, and randomization systems. TransCelerate reports an average four-month lag between protocol approval and study startup, with document-based duplication as one contributor.

The Unified Study Definitions Model (USDM) is the CDISC and TransCelerate standard built to stop this duplication. It is not software, it is a shared data model that lets EDC, CTMS, and protocol authoring tools speak the same language. Instead of each vendor inventing its own internal representation of a protocol, USDM defines standardized classes and attributes for populations, interventions, activities, and encounters. Any conformant system can then produce, consume, or exchange that structured information without manual retyping.

The catch: two systems reporting the same USDM version are not automatically interoperable. Vendor-specific mappings, validation, and human review of eligibility and endpoint definitions are still required. USDM defines what a study looks like as data and how to move it. It does not, on its own, auto-populate your EDC or CTMS screens. Study build and data management staff still review the result, especially where a mapping error would be costly to miss.

When sponsors use AI to draft clinical trial documents, regulatory scrutiny hinges on what the tool generates, not just that it generates. The FDA's January 2025 draft guidance introduced a seven-step credibility assessment for AI systems whose outputs inform regulatory decisions on safety, efficacy, or quality. Pure formatting and template tools fall outside this scope, but AI that generates eligibility criteria, dose logic, or safety summaries may not. The EMA's September 2024 reflection paper takes a broader stance, requiring risk management and transparency for any AI with high regulatory impact, regardless of FDA scope.

The practical stakes are measurable. Tufts research tracking 950 protocols found substantial amendment rates rising, with approval timelines stretching to 260 days, nearly triple the prior decade. Per-amendment costs range from $141,000 to over $535,000, excluding indirect delays. Many amendments stem from drafting errors: mismatched eligibility language, inconsistent consent forms, omitted requirements.

Domain-specific AI tools address this through structured architectures that enforce cross-document consistency at the data layer. A 2025 preprint on InformGen, an ICF-specific AI system, showed near-100% compliance across 18 FDA-derived rules, outperforming GPT-4o by 30 percentage points. The difference came from hard

Deploying AI in clinical research expands your attack surface in ways traditional GCP frameworks weren't built to handle. Healthcare breaches now cost an average of $9.77 million, the highest of any industry for 14 consecutive years, and trial data carries unique risks: it's irreplaceable, regulatory-consequential, and flows across sponsors, CROs, sites, labs, and vendors. AI-specific threats include data poisoning (as few as 100 tampered samples can compromise a model), adversarial attacks that fool diagnostic tools without detection, and model inversion that reconstructs patient-level data from outputs. ICH E6(R3), finalized by FDA in September 2025, now requires explicit audit trails showing who changed what, when, and why across all computerized systems. Adaptive models that shift behavior between validation cycles create a gap: 21 CFR Part 11 requires validated systems, but AI that learns continuously may change without triggering formal revalidation. FDA's January 2025 draft guidance recommends ongoing credibility assessment aligned with NIST AI RMF principles. Sites and sponsors must now define performance thresholds that trigger revalidation, secure multi-party data boundaries, and ensure every AI output feeding a regulatory submission has a complete, tamper-proof lineage.

When FDA published its draft guidance on AI in drug development in January 2025, many regulatory teams assumed it applied broadly to all AI-assisted document work. It does not. The guidance explicitly excludes AI used for "drafting or writing a regulatory submission" when that drafting does not itself affect patient safety, drug quality, or study reliability. The scope covers AI models that produce information or data to support regulatory decisions about safety, effectiveness, or quality, such as AI that stratifies patients for safety monitoring or performs automated quality assessments. For in-scope AI, FDA recommends a seven-step credibility framework including defining context of use, assessing model risk, and documenting credibility evidence. ICH E6(R3), effective in 2025, reinforces that sponsors retain ultimate responsibility for AI-generated content and must maintain data governance and computerized system controls proportionate to risk. Part 11 applies when AI tools create regulated records, though it predates modern AI and does not address LLMs directly. The FDA and EMA's January 2026 joint principles emphasize that AI does not substitute for human accountability.

Most clinical teams focus on model performance, but when FDA or EMA audits arrive, the infrastructure underneath gets scrutinized first. Can your system produce complete audit trails? Enforce data isolation? Survive computer system validation? FDA's 2025 guidance introduced a seven-step credibility framework for AI used in trials, pharmacovigilance, and manufacturing contexts that inform regulatory decisions about drug safety or effectiveness. The documentation demands cannot be satisfied retroactively. EMA's finalized reflection paper is equally clear: AI in clinical development must meet the same GxP standards as any regulated technology, and sponsors remain fully accountable for AI outputs. In January 2026, FDA and EMA jointly published ten Guiding Principles for Good AI Practice, with data governance and lifecycle management front and center. Infrastructure choices determine whether you can meet 21 CFR Part 11 audit trail requirements, HIPAA business associate obligations, and ICH E6(R3) validation scope. Single-tenant or private VPC architectures provide dedicated infrastructure per sponsor, eliminating cross-tenant data exposure risks that multi-tenant SaaS designs carry. A disclosed PostgreSQL vulnerability showed how shared database isolation can fail. GAMP 5 and the new GAMP AI Guide set the validation standard for GxP AI systems. The compliance boundary starts at t