By Brook White
AI is everywhere at industry conferences, but most sessions focus on what the technology can do. At SCOPE Europe, our VP of Compliance & Security, Marc Wartenberger, moderated a panel that asked a harder question: what does it take to use AI in GCP-regulated work and still defend it in an inspection?
The panel brought together a sponsor, a CRO, and a regulator. Despite their different vantage points, the same themes kept surfacing. Most organizations are somewhere between piloting and scale, and the work now is operationalizing responsible use. Here is what sponsors and sites should take away.
You don’t need to start over
The most common misconception is that AI means scrapping existing processes. Established GCP lifecycles are sound. What changes is the addition of checks that didn’t exist before, such as monitoring for bias and drift. Start with what you have and adapt it.
Governance starts with visibility
You can’t govern what you can’t see. Organizations that manage AI well tend to route new use cases through a single, central intake rather than letting adoption happen team by team. A cross-functional group can then ask the right questions:
- What business problem is this solving?
- Are there simpler or existing solutions?
- Does the proposed AI already have an approved context of use?
One clear path to a decision gives leadership a complete picture of where AI is being used. It also makes it far easier to show an inspector that your oversight is deliberate.
Validate the tool, then validate the use
Validation of an AI tool has two parts. First, validate the tool itself, including governance, testing, and checks. Second, scope the specific use case and set guardrails around it. A validated tool used outside its defined context is still a risk, and a new use case means revisiting the process.
For sponsors, this means oversight expectations for AI vendors are broader than traditional software validation. For sites, it means being clear about what a tool is approved to do and what it isn’t. In both cases, validation is no longer one-and-done. Use cases shift and technology moves quickly, so documentation needs regular refreshing.
The inspector’s view on dynamic models
ICH E6(R3) is risk-based and technology-neutral, but applying it to AI creates real tension. Traditional full validation assumes a system that doesn’t change, while a continuously learning model may drift over time. In that gap, quality management systems and professional judgment have to do the work.
Inspectors will also look for traceability that goes beyond the usual audit trail. Each AI output should be linkable to:
- the validated model version
- the dataset used for training
- the environment in which training took place
Validation alone isn’t enough. Without guardrails and an active monitoring strategy, a validation package is incomplete.
“Human in the loop” looks strongest on paper and fails first in practice
Of all the controls discussed, human review was the one most likely to look good in an SOP and fall apart in reality. If reviewers see the same information repeatedly, it’s easy for “review” to become “accept.” To keep the control meaningful:
- Treat very high acceptance rates as a signal. If reviewers accept roughly 99% of AI outputs, investigate why.
- Design for attention. Showing the justification alongside the output reduces blind acceptance.
- Monitor the control itself. Track the compliance rate and the time reviewers take to reach a decision.
- Keep evidence. Human review must be demonstrable in the trial file, not reconstructed later from recollection and emails.
This connects to a broader concern: cognitive offloading. AI frees people from repetitive work, which makes the judgment humans still apply more important, not less.
If you could put only one control in place
When asked to name the single must-have control before using AI on GCP-regulated processes, the answers were different but complementary:
- A well-defined use case. Design to solve a problem rather than hunting for somewhere to deploy AI.
- Accountability. It can’t be delegated to technology. People must understand and evidence the decisions they make.
- Data quality and clear ownership. Pair them with a control and accountability matrix, and with compliance with GDPR and regional data protection requirements.
Takeaways for Monday morning
- Reframe the conversation around trust in your data, your models, and the outcomes you expect AI to deliver.
- Find out where AI is already in use. Ask what it does, what failure would look like, and whether oversight and ownership are clear.
- Demand role-specific AI training. Staff should understand how their jobs have changed, how a model may drift, and what monitoring is in place.
Transparency is a vendor’s job
Sponsors and sites make risk-based decisions about the technology they use, and that requires prompt access to validation documentation, white papers, and a clear account of the vendor’s software development and AI governance. This applies to pre-trained models too. A vendor that can’t provide this information quickly is a concern worth weighing.
What to do next
- Audit current AI use across your organization. Identify where AI is deployed, what oversight exists, who owns outcomes, and whether evidence of human review is documented.
- Review vendor AI documentation readiness. Confirm that validation packages, white papers, and AI governance materials exist and can be provided promptly on request.
At CRIO, we believe transparency opens doors. Our Document Center gives clients access to validation documentation, compliance materials, and release summaries, so you can make confident, risk-based decisions. To learn more, reach out to your Customer Success Manager or visit clinicalresearch.io.