Summary

AI is now part of how clinical research is conducted, across the industry and in our own studies. What sets organizations apart is how they use it: the controls and oversight around it, and whether it improves quality across a study, from setup and protocol adherence to the data itself. At PicnicResearch, we use AI to raise the bar on quality, and we hold it to the same scientific standards as the rest of our work. Our clinical research experts set the controls, oversee the results, and remain accountable at every stage of the study. This paper explains what AI does in our studies, how we govern it, and, most importantly, who is accountable for the results.

‍

What our experts do

Our scientific and operational experts design every study and remain accountable for study conduct and every deliverable. They direct how AI is used: they provide the design, judgment, oversight, and final approval, while AI handles defined, repeatable work. No data delivery or sponsor correspondence goes out without their sign-off.

‍

What AI does

On ResearchOS, our proprietary study platform, our team uses AI for defined, repeatable work across the study lifecycle, from preliminary drafting of study documents and testing study configurations to abstracting data from medical records and running automated quality checks. Each workflow has defined instructions, quality requirements, and oversight appropriate to the task.

‍

Why this matters for sponsors

Our study team uses AI so that study guidelines are applied the same way to every record, every abstracted value can be traced to its source, and quality checks run on the full dataset rather than a sample. Protocol requirements, from the schedule of assessments to visit windows and eligibility criteria, are regularly checked for every participant, however complex the study. This allows our team to focus its attention on study design, ambiguous records, and the results themselves: what the data show and what they mean for the sponsor’s research questions. The result is faster study execution, more consistent data, adherence to the protocol, and clear accountability for quality at every step.

‍

Our principles for using AI

Five principles guide how we build and use AI. The sections that follow show each one in practice.

• Human-led. A person is accountable for every deliverable, sponsor communication, and change to a live study. AI completes tasks; people own the outcome.
• Dependable. Our experts approve the workflows AI works in and define the standard it must meet. AI acts only within them, so there are no surprises for our teams or sponsors.
• Accurate. Our experts test AI before it’s used in studies and review its work in proportion to risk, from checking every draft document to verifying data samples against the source. Whenever AI is unsure, it stops and brings the question to a person.
• Traceable. Our team holds AI’s work to the same guidelines and quality checks as people’s work. AI’s work is labeled, it’s clear what needs human attention, and its outputs link back to their sources.
• Supportive. Our experts choose the specific tasks AI takes on, like sharing context, making recommendations, and completing defined, repeatable work, so they can focus on study design, sponsor and site relationships, and the science.

‍

How our experts direct AI across ResearchOS

Every study involves defined, repeatable workflows: drafting documents, configuring participant activities and electronic case report forms (eCRFs), collecting and organizing medical records, abstracting data, running quality checks, performing analyses, and preparing sponsor reports.

For each workflow, our team determines where AI is appropriate, defines the instructions and quality standards it must meet, and establishes how its work will be verified. Depending on the task and associated risk, outputs get individual expert review, automated checks, risk-based sampling, or a combination. Our team remains accountable for the process and its outcomes.

‍

{{wp_table}}

‍

Expert oversight and accountability

Our written AI governance policy classifies every AI use into one of three risk tiers, each with defined levels of human oversight and accountability.

For assistive uses, such as meeting summaries, the person using AI directs the task and owns the result. For study work, such as document drafting, a person provides inputs upfront and reviews every output before it's used. For supervised work, such as data abstraction, people monitor AI performance, review samples, and individually review every item flagged by AI.

Oversight changes with evidence. Clinical data managers (CDMs) raise or lower sampling rates depending on accuracy results. Any significant change to a model, its instructions, or its data means supervised work is validated again before it's used.

• People are accountable for study design, key study decisions, and sponsor and site relationships. Epidemiologists drive study design, and biostatisticians own analysis plans and results. Trained research staff determine participant eligibility based on medical records. When PicnicResearch is responsible for study safety monitoring, qualified staff assess every potential safety event, with AI helping identify and surface events for review. People also review protocol deviations. Our study teams work directly with sponsors and partner sites, and review and approve any AI-drafted correspondence before it's sent.
• People approve changes before they take effect. Before study launch, our team reviews AI-generated test cases, evaluates the results, and performs risk-based spot checks. Sponsors provide final sign-off on user acceptance testing. After launch, a designated team member reviews and approves any changes to live study configurations.

‍

Data protection

• Where data live. Study data are stored in the United States and encrypted in transit and at rest. Our security program holds HITRUST r2 certification, covering the PicnicResearch platform.
• Who processes data. Some AI tasks use models from third-party vendors, which process only the content each task needs. Each vendor works under a business associate agreement that prohibits training on the data we send, follows a zero data retention policy, and is assessed through our security program.
• Model training. We don't use sponsor confidential information or study data to train AI models, and our AI vendors are contractually barred from training on the data we send. Study-specific testing and review findings refine a study's abstraction guidelines and quality checks in ways that are restricted to that study.
• Use of study data. Data participants share for a study are used only for the research purposes described in that study's informed consent and our agreement with the sponsor.
• Staff use of AI. Our AI governance policy requires staff to use only approved AI tools when handling protected health information. Every employee must acknowledge the policy, new AI tools must pass an intake review before anyone can use them, and training and technical controls back these rules up.

‍

Expert-led abstraction and quality checks

Medical record abstraction carries a study's most extensive quality controls. Our clinical data team defines and oversees them throughout the study, from evaluating the AI before use to reviewing each dataset before delivery.

• Study guidelines and evaluation. Drawing on expert medical input, CDMs write the eCRF completion guidelines that direct the AI on each study. Our abstractors follow the same guidance, so people and AI apply identical definitions. Before testing, CDMs define acceptance criteria focused on fields our epidemiologists and the sponsor identify as critical to the study and on complex data elements. They compare AI entries with reference answers prepared from source records, investigate disagreements, and revise the workflow as needed. To reduce bias, they refine the guidelines on one set of participants and check performance on a separate set, then document whether the criteria are met.
• AI data entry. AI reads each participant's medical records, enters values into the study's eCRFs, and links each value to the source records it used.
• Resolving uncertain values. When an output falls below the confidence threshold set for the study, or the guidelines don't clearly determine a value, the AI flags it for review, and the participant's record waits until a CDM resolves or escalates it. The guidelines also name the variables that should be escalated readily.
• Automated quality checks. Coded quality rules run on every participant's data: point-of-entry checks block impossible values, and plausibility and study-specific checks flag unlikely ones. Blocking checks hold data from delivery until fixed, and our team resolves each finding with a recorded reason.
• Traceability and quality oversight. Every entry and change records who or what made it, and when. Every correction is tracked, CDMs review disagreements to find and fix the cause, and only data that clear every check are delivered.
• Risk-based source data verification (SDV). CDMs select critical and complex fields for verification and set a sampling rate for each based on risk. Trained reviewers check the selected fields against the source record, and a participant's data can't be delivered until those checks are done. The sample includes values the AI has not flagged, so verification can catch errors the AI doesn't recognize as uncertain. CDMs can raise or lower rates depending on accuracy results. Outside the sample, a value reaches the dataset once it passes the automated checks, and a person reviews it only if it's flagged.
• Batch reviews and corrections. Abstraction runs in batches, and after each one the team reviews findings and updates the guidance or checks before the next. When results fall below the study's acceptance criteria, CDMs scope the affected data, find the root cause, revise the guidance, and test the revision before it's used. They then reprocess every affected form and correct the data, and corrections to data already delivered go out in the next delivery.
• Final review before delivery. Before every data delivery, CDMs and epidemiologists review the full dataset, checking variable completeness, investigating unexpected trends, and flagging any data that need more verification.
• Example: correcting a guidance gap. On one study, a CDM found symptom dates that didn't match the start dates of the related clinical events. The team scoped the impact and traced it to an earlier version of the completion guidance. They revised the guidance, retired outdated form versions, and tightened related eCRFs with similar gaps. Because human and AI-assisted abstraction share the same guidance, the fix applied to both. Before the next delivery, the team compared it with the previous one to find every changed record, and a clinical abstractor re-reviewed each change.

‍

How we manage changes to AI use

Our AI governance policy defines how we introduce new AI uses and make changes to existing ones. It sets requirements for risk review, validation, monitoring, and appropriate sponsor communication.

• Review before use. An intake review sets the risk tier for each new use of AI, the data it may use, and the oversight it needs, and names an owner who answers for it.
• Validation and monitoring. Work such as abstraction is tested and validated before use and measured against reference data over time, and AI activity is logged so each output can be traced to its source. Any drop in quality is investigated and corrected.
• Evaluating changes before they go live. A significant change to a model, its instructions, or its data is evaluated and approved first, and supervised work is validated again.
• Sponsors stay informed. Sponsors can ask how AI is used in their study at any time, and our team will walk them through it.

‍

Regulatory context

Our approach draws on three principles from current regulatory guidance: quality management proportionate to risk and focused on what is critical to quality;¹ risk-based oversight, data governance, and documentation for AI;^2–4 and electronic health record (EHR) data that are accurate, complete, and traceable.⁵