Meeting Minutes
The Use of AI Platforms in Clinical Research
Meeting Date:
10 September 2025
Meeting Type:
CRSC Meeting
Prepared By:
Lisa Mulder (Admin)
ATTENDEES
Suzanne Plezier
CRSC Chair
Jennifer Goldman
CRSC member
Ross Petit
CRSC member
Jennifer Burg
CRSC member
Kristina Johnson
CRSC member
Dan Larson
CRSC member
Katerina Adragna
Guest
Lisa Mulder
Admin
AGENDA / KEY QUESTIONS
01
02
03
04
05
Any recommendations for GDPR vendors?
06
KEY TAKEAWAYS
Recommendations of Potential AI Platforms
Members shared experiences using generative AI (ChatGPT, Gemini, Claude) for tasks such as: Writing job descriptions, confirmation letters, and study documents. Medical writing support (e.g., drafting CSRs and protocols). Competitive intelligence (summarizing publicly available data). Some companies are piloting specialized AI vendors for medical writing and clinical documentation.
Recommendations of Potential AI Platforms
- Members shared experiences using generative AI (ChatGPT, Gemini, Claude) for tasks such as:
- Writing job descriptions, confirmation letters, and study documents.
- Medical writing support (e.g., drafting CSRs and protocols).
- Competitive intelligence (summarizing publicly available data).
- Some companies are piloting specialized AI vendors for medical writing and clinical documentation.
- Committee members stressed the importance of knowing what data models were trained on, to avoid unreliable outputs.
- For site selection, tools like Sightline (https://www.sightline.com) were mentioned.
- Vi (https://vi.co/) was mentioned for recruitment (US only for now).
- Overall, it seems AI is mostly used for Medical Writing; however, it is not as widely implemented for other process improvements or efficiencies.
Processes for Using AI Platforms
Discussion highlighted the need for practical policies rather than bans, since employees will use AI regardless. Training on effective prompting and proper use cases. There is a huge array of prompt training platforms and tools, but it really depends on the depth of knowledge people are looking for and, probably more importantly, how they are planning to use generative AI (like ChatGPT).
IIT Models and Strategic Timing
- Full IIT: Investigator holds IND in the US / clinical trial application in the EU, while the sponsor provides drug and/or funding. This provides the least sponsor control and carries the highest risk.
- EU clinical trial application seems always owned by the Investigator for an IIT.
- US IIT can operate under its own IND or under the Company IND; the latter seems preferred from a safety-reporting perspective.
- NIH does not seem to be very flexible with IITs. NIH contracting through a CRADA was mentioned as particularly challenging.
- Hybrid IIT: Sponsor retains the IND in the US or provides structured support in the EU, while the investigator leads scientifically. Sponsor involvement may include protocol development, database build, safety reporting, and data outputs.
- Timing is critical: IITs should align with development plans and financing events and should not be initiated too early.
When to Use / Stay Away from Social Media
Not discussed due to time limitations after other topics were prioritized.
Community Letter
Community letter (lay press release to advocacy groups, IRB/IEC approval requirement). Not discussed due to time limitations after other topics were prioritized.
Community Letter
- Community letter (lay press release to advocacy groups, IRB/IEC approval requirement).
- Not discussed due to time limitations after other topics were prioritized.
General Data Protection Regulation
Appoint Data Protection Representatives (DPR) in EU and UK (approx. $1k/month). Data flow mapping (collection, storage, transfer, deletion).
General Data Protection Regulation (GDPR) Vendor Recommendations and Patient Data Deletion
- Priority agenda item; in-depth discussion held.
- Vendors mentioned:
- MyData Trust (https://www.mydata-trust.com) — seen as conservative; sometimes over-complicates.
- RSM Global (https://www.rsm.global/) — good IT/legal coverage; more costly.
- DPO Center (https://www.dpocentre.com/) — life sciences focus, positive feedback, but services considered expensive by some.
- KPMG, McKinsey, CROs, or DIY platforms — less tailored.
- Consensus:
- Small biotechs might not need to be fully compliant immediately but must show a roadmap to compliance.
- Essential elements:
- Appoint Data Protection Representatives (DPR) in EU and UK (approx. $1k/month).
- Data flow mapping (collection, storage, transfer, deletion).
- Updated consent language with GDPR requirements.
- Clear SOPs for data storage, deletion, and breach response.
- PMN: Contract and clinical trial agreement review (apply standard contractual clauses [SSC]).
- Deliverables are usually assessments and compliance roadmaps, not certificates.
- It was flagged that even email addresses as part of company website inquiries fall under GDPR if the person is in/from the EU/UK.
- Clarifications:
- Sponsors (data controllers) remain accountable, even if vendors act as processors.
- Clinical trial data from EU patients remains subject to GDPR, regardless of where analysis is done.
- Similar privacy standards are emerging in the UK and California.
Additional Notes
Additional Notes
- Options to either create your own platform including an in-house Data Protection Officer (DPO), or outsource through a vendor or consulting.
- Make sure you allocate $$ in your budget for GDPR compliance setup and maintenance, or accept the risk for (high) fines.