How Do Pharmaceutical Companies Govern AI in Clinical Trials?

ICH E6(R3), the international good clinical practice guideline, allows a sponsor to transfer trial activities to a service provider, but states that "the ultimate responsibility for the sponsor's trial-related activities, including protection of participants' rights, safety and well-being and reliability of the trial data, resides with the sponsor." It also says the sponsor "should ensure appropriate oversight of important trial-related activities that are transferred to service providers, including activities further subcontracted by the service provider."

For AI, that has a practical meaning. If a vendor supplies a model that screens records, drafts a narrative or flags a safety signal, the sponsor still needs its own owner, its own approval record and its own way to see when the model changes. Governance is how a sponsor builds that capability.

The FDA published a draft guidance in January 2025 on AI used to support regulatory decision-making for drugs and biological products. It is marked as containing non-binding recommendations and as not for implementation, and it covers a risk-based credibility framework for a specific context of use. In January 2026 the EMA published a two-page document of ten guiding principles of good AI practice in drug development. Neither sets out a required org chart or committee structure. The operating model below is a way to meet the direction they share, not a quotation of a rule.

NIST describes its AI Risk Management Framework as "intended for voluntary use." It is a shared vocabulary, not a legal requirement. Which obligations apply to a given trial is a question for your regulatory affairs team and counsel.

The EMA principles say the use of AI should "follow a risk-based approach with proportionate validation, risk mitigation, and oversight based on the context of use and determined model risk." ICH E6(R3) says oversight measures "should be fit for purpose and tailored to the complexity of and risks associated with the trial." Governance turns that into tiers.

A common design is two or three tiers. A low-risk use, such as drafting internal meeting notes, can be approved by the business owner with an inventory entry. A use that influences trial conduct or data, such as screening, coding or signal triage, needs quality assurance review and sign-off from the accountable executive or the governance group. The tiers, who may approve each and who may grant an exception should be written down before the first request arrives.

The FDA draft guidance says AI models "may be highly sensitive to variations or changes in model inputs" and that sponsors "should anticipate inherent, model-directed changes and the need to identify and evaluate those changes, as well as any intentional changes to the model over the drug product life cycle." It also says "The level of oversight for a model over its life cycle should be risk-based."

In its manufacturing example, the draft says changes should be evaluated by the manufacturer's change management system within its pharmaceutical quality system. The same idea carries over to trials: a model update, a new data source, a vendor release or a change in the population it sees goes through the existing change control process, is assessed for impact on performance, and may require parts of the credibility assessment to be repeated. A vendor that can change a model without telling you is a governance gap, so notification terms belong in the contract.

The EMA principles state that AI technologies "undergo scheduled monitoring and periodic re-evaluation to ensure adequate performance (e.g., to address data drift)." The FDA draft says "Model performance metrics should be monitored on an ongoing basis to ensure that the model remains fit for use."

Neither document prescribes an interval, so the cadence is a sponsor decision based on risk. As an illustration, a higher-tier use might have performance metrics reviewed by its technical owner at a fixed interval, a periodic governance group review of the inventory and exceptions, and a full re-approval at a set point or whenever a trigger fires, such as a material model change, a deviation or a drift signal. Record the interval and the triggers in the approval so the review happens because it is scheduled, not because someone remembered.