By Deborah Borfitz  

November 10, 2026 | Implementing an artificial intelligence (AI) policy at the highest levels of a clinical research organization requires middle managers empowered and equipped to carry it out companywide. But not every AI workflow deserves the same level of scrutiny, according to Marc Wartenberger, vice president of compliance and security at CRIO, who moderated a panel discussion on the policy-to-practice issues at the recent SCOPE Europe event in Barcelona. 

Personal productivity tools are far less concerning than those looking at adverse events or a clinical trial value informing a go/no-go decision on a drug treatment, he says. In this heavily regulated space, the focus is on maintaining Good Clinical Practice (GCP) compliance and data integrity. Risk-based workflows and a risk-proportionate approach are core pillars of the updated ICH E6(R3) guideline.  

“Using AI in clinical research doesn’t necessarily require tearing up your existing quality system,” says Wartenberger. What it means is added checks for AI bias and drift—two of the main operational and ethical risks in working with machine learning systems. 

Moreover, “accountability can’t be delegated to technology,” he continues. People must understand what being accountable means as well as be able to evidence their AI-supported decisions, as was discussed by panelists Megan Olberding, head of U.S. operations for clinical data management at MSD, and Charlotte Byng, director of solutions consulting at Fortrea.  

It’s hard to be accountable for what you don’t understand, was an added point made by panelist Aurora Rojo Sanchís, head of the GCP and Good Pharmacovigilance Practice (GVP) Inspection Area of the Spanish Agency for Medicines and Medical Devices. A good first step, therefore, is training on the specific AI tool being used and the risks that come along with it.     

All too often, Wartenberger says, a human-in-the-loop approach that “looks strong on paper ... fails in practice.” “We have a huge opportunity to offload things [to AI] that may be tedious or repetitive, but that should free up our cognitive ability to focus on the things that matter.” Blindly accepting AI output can cause major risks.  

Based on his personal experience working with CRIO clients, data privacy and protection are two of the biggest concerns in the clinical research industry. “Just plugging [highly sensitive] data into an AI tool without adequate protections in place would be a terrible mistake. You can get into hot water very quickly if you don’t understand the implications of misusing that data, potentially with a free version of any of the publicly available AI tools,” he said.    

On the safe side are sanctioned versions of tools that have undergone your vendor assessment process and have been deemed acceptable for a particular use case. “You might even want to use AI to read and understand the lengthy privacy policy of another AI tool,” Wartenberger says. In his day-to-day work at CRIO, he uses a sanctioned internal AI tool to quickly query answers to customer and client questions regarding the company’s policies and procedures or to compose a summary of one of its sections (e.g., business continuity process).   

Regulatory Patchwork  

Relative to AI tools, validation of traditional software is much more of a “one and done” proposition unless the system changes, says Wartenberger. “With AI, it’s constantly evolving and improving and learning, so the concept of validation is shifting and ... different approaches might be needed to ensure the model [always] does what it’s intended to do.” 

In the European Union (EU), regulations have yet to catch up with the pace of AI evolution, he adds. In the U.S., the Food and Drug Administration (FDA) last year finalized guidance on predetermined change control plans, allowing pre-approved, iterative updates to AI software without requiring new marketing submissions.  

Regulators, like everyone else, are attending conferences like SCOPE to learn about the “latest and greatest” technologies and market trends, Wartenberger says. “They aren’t just sitting in their ivory towers ... they’re learning just like you and I about these tools to hopefully understand [them] better.”   

One of the major disconnects between regulatory rules and expectations is that EU Good Manufacturing Practice Annex 22—draft regulatory guideline created by the European Medicines Agency (EMA) to govern the use of AI—primarily applies to static, deterministic machine-learning models and not to clinical trials at all, says Wartenberger. That means sponsors and contract research organization (CROs) need to “lean on risk identification and risk management within a quality management system and use their professional judgment rather than waiting on a rule that might come [one or more] years down the road.”  

ICH E6(R3) is “technology-neutral by design,” he continues, which provides flexibility but also leaves the best remedy open to debate. “A sponsor or CRO can easily reach different conclusions ... on what validation is enough.” In the EU, the added complication is the General Data Protection Regulation (GDPR) and different requirements across regions.  

Sponsors therefore face a “patchwork of compliance elements” that they need to adhere to, says Wartenberger. The best thing they can do is determine the biggest risks to data and operations presented by any AI tool being used.   

While it’s necessary to be careful and methodical, “we have to move forward,” he says. “I tell people to go ride that bike ... just with a helmet on.” That is, “we’ll trust you to do the right thing, but ... play it safe by playing by the rules that exist.”  

Shared Problems  

Based on those present for the SCOPE panel discussion, most people are “somewhere between pilot and scale” in implementing AI, with tools for improving personal productivity being the most popular, Wartenberger reports. AI solutions for protocol intelligence, risk signaling, and enrollment forecasting have also seen some early traction. 

His advice to companies is to start with an inventory of where AI is already in use and map that against their GCP-relevant processes. “From there you can start building a use case designed to solve a defined problem ... [versus] looking for places to put AI,” Wartenberger says. “You can probably write that email yourself.”  

To validate the tool, “scope it and put the guardrails around it based on the specific use case,” he continues. “That can then be the groundwork for expanding that AI workflow. Start small and build slowly out from there and ... build in accountability for who owns the outcome.” What the AI output is to be used for identifies who owns the process, so there is a human in the loop—perhaps more appropriately termed the “human in the lead”—providing oversight. 

No single person manages this validation exercise, and a data protection specialist needs to be in the mix. “Ideally, it should be done by committee, but too many cooks in the kitchen is also a terrible idea,” says Wartenberger. This select group needs not only representatives from leadership but also different areas of the business where these AI tools are being used on a day-to-day basis.  

Attendees at SCOPE Europe were eagerly looking for guidance from regulators, but many of those guidances have yet to be published, he says. The FDA has collaborated with the EMA to come up with 10 “guiding principles” of good AI practice in drug development, but they are purposefully broad because regulations “cannot account for every single scenario.”  

It’s one reason regulators welcome hearing from sponsors, CROs, and study sites and networks with any questions. “If you reach out ... I promise they will email you back,” says Wartenberger. “They are people just like you and I.”   

Both GDPR and Annex 22 are European instruments with no U.S. equivalent. But, as the shared FDA/EMA principles indicate, regulators are talking to each other. “They are all trying to solve the same or similar problems globally,” he notes.