Which platforms offer AI-powered quality risk detection? Search results for that question return supplier and manufacturing quality vendors, which hold no trial record. A UK research site needs a detector that reads its own deviation log, CAPA record, training file and document set together, and routes every signal to a named person for confirmation.
That distinction decides whether a feature is useful at site level. This guide sets out the four quality risks that appear only across records, what each one indicates, the record that confirms it, and who decides what it means. Evaluation of a platform as a whole is covered in the guide to AI for compliance and inspection readiness.
- A single deviation, a closed CAPA and an expired certificate each look ordinary inside their own module. The risk sits in the pattern between them.
- A signal is a statement about the records. The decision about the conduct behind it belongs to a named person, and that confirmation is the quality control.
Which Platforms Offer AI-Powered Quality Risk Detection?
Four categories of vendor describe this capability, and they differ by whose records the detection runs over. A UK research site reads the category first and the feature list second, because a detector pointed at the wrong record set cannot find a site-level finding however good the model is.
| Vendor category | What its detection reads | Whose records | What it leaves out at a research site |
|---|---|---|---|
| Enterprise and supplier quality management | Nonconformances, audit results and supplier performance in one quality database | A manufacturer’s or a supplier’s | Delegation, training, consent and site document records, which carry most site-level GCP risk |
| Clinical data analytics and central monitoring | Participant data, site performance metrics and statistical outliers across a portfolio | A sponsor’s or a CRO’s | The site’s own quality events, which rarely reach a sponsor dataset as records |
| Document and eTMF platforms | Completeness and currency against an expected document set | The site’s or the sponsor’s documents | Patterns that sit between a document and a quality event |
| Site operations platforms with a connected quality module | Deviations, CAPAs, training, delegation and documents held on one record | The site’s | Little structurally, provided the modules share a single record rather than exchange files |
Published technical detail is thin across all four categories, so a brand ranking would rest on marketing copy. Three questions separate a capability from a claim, and each has an answer a supplier can show on screen.
- Which records does it read across? A detector covering the deviation log, the CAPA record, the training file, the delegation log and the document register finds the contradictions between them. A detector inside one module reports that module’s contents back.
- Does every signal carry an owner, a due date and an attributable resolution? A dashboard count is a report. A routed signal is a control.
- Can the feature change a quality record on its own? The permission set and the configuration answer this in writing, before the system enters a qualification file.
Several features sold under this heading run on fixed rules rather than a model, and the two carry different evidence burdens. The guide to automation versus AI in a trial platform classifies them feature by feature.
A detector confined to one module sees one module’s worth of risk.
What Quality Risks Can Only Be Seen Across Records?
Four risks at a research site exist as patterns rather than entries. Each one passes inspection inside its own module, because every individual record is complete, current and correctly filed. The finding lives in the relationship between them, which is the ground a cross-record detector covers and a module-level report does not.
ICH E6(R3) Guideline for Good Clinical Practice, which reached Step 4 on 6 January 2025, places this work inside quality management at section 3.10 and requires that “risks should be considered across the processes and systems, including computerised systems” at section 3.10.1.1. The examples below are set at a hypothetical UK site, SITE 01 at Northgate General.
| Risk signal | What the pattern indicates | The record that confirms it | Who decides |
|---|---|---|---|
| Deviation trends by category Nine protocol deviations in a quarter, six of them on the same visit procedure | A process condition rather than six separate incidents | The deviation log read against the protocol section and the visit schedule | Principal investigator, with measures to prevent recurrence under section 2.5.3 |
| Repeat CAPAs on a single root cause A CAPA closed in March, the same cause returning in July under a new reference | A root cause analysis that stopped at the symptom | The CAPA record and its effectiveness check | Quality assurance lead, reopening the root cause |
| Training lapses against delegated activity A delegation effective from 6 April, the supporting certificate expired on 31 March | A currency control that has stopped running, with every entry made under the delegation in question | The training file compared by date with the delegation log and the visit records | Principal investigator, per affected person and activity |
| Overdue document review against study phase Two procedures past their review date as the study opens its dose-escalation phase | A document set drifting behind the conduct it governs | The document register read against the study status and the protocol | Research governance lead or the named document owner |
Each row depends on a comparison across two or more record sets. The detection work is arithmetic on dates, categories and references, applied to records a site already holds.
- Deviation trends need a category and a denominator. Six deviations on one procedure out of nine in a quarter is a trend. Six out of two hundred is background, so the detector compares counts against the activity that generated them.
- Repeat CAPAs need a root cause field, not a free-text summary. A structured cause allows two records months apart to be matched, which is what turns a closed action into a recurrence.
- Training lapses need the delegation dates beside the certificate dates. Both records are complete on their own. The gap between them is the signal, and it reaches back over every activity performed in the interval.
- Overdue review needs the study phase, not only the calendar. A procedure three months past review matters more as a study starts the activity that procedure governs, which weights the signal by what the study is doing now.
Document-level gap detection sits next to this work and answers a different question. How a check establishes that an expected record is absent, misfiled or contradictory is covered in the guide to how AI finds documentation gaps in an investigator site file.
Every one of these four patterns is invisible to a complete, well-kept module.
How Does Deviation Trending Differ From Deviation Logging?
A deviation log records each event, its date and its description. Deviation trending reads the log as a distribution and asks which category is growing, against which activity, and how close it sits to a limit the study set in advance. The two run on the same data and answer different questions.
ICH E6(R3) supports the second question directly. Section 3.9.3 covers determining criteria for important protocol deviations, and section 3.10.1.3 covers risk control, including quality tolerance limits. A limit agreed at set-up gives a trend detector a threshold to measure against rather than an opinion about what counts as too many.
- Logging answers what happened. Each entry stands alone, is reviewed on its own merits, and closes when its action completes.
- Trending answers what is changing. A category rising across three months surfaces while the study is still running, which is the only point at which a process change helps.
- A tolerance limit converts judgement into a date. The limit set at set-up decides when the trend becomes a quality issue, so the review happens on a trigger rather than at the next scheduled meeting.
- The trend proposes, the investigator determines importance. Section 2.5.3 requires the investigator to explain a deviation and “implement appropriate measures to prevent a recurrence”, and that determination stays with the person.
Also Read: CAPA Example: A Clinical Trial Deviation Walked Through Step by Step
Why Does a Repeat CAPA Carry the Most Inspection Weight?
CAPA effectiveness is the signal with the clearest published consequence. The MHRA grades a finding higher where a quality system has failed systematically, and an action that closed without resolving its cause is that failure in documented form.
The MHRA good clinical practice inspections guidance, last updated on 22 September 2026, states that a systematic quality assurance failure can raise a finding to critical or major, and that a critical finding can follow from inadequate or late corrective action on an earlier major finding. The regulator’s own GCP Inspections Metrics Report for 1 April 2019 to 31 March 2020 records exactly that outcome: one critical finding cites a “failure to implement Corrective and Preventative Actions (CAPA) for previous major inspection findings”, and another records that CAPA from two previous inspections “continued to be ineffective”.
- The second occurrence changes the grade, not the event. One deviation with a sound action is ordinary quality work. The same cause returning is evidence about the quality system itself.
- Effectiveness checks are where recurrence is caught. An effectiveness check with a date and an owner turns closure into a verified statement, and a detector reading the cause field finds the recurrence the check was meant to prevent.
- Serious noncompliance carries its own duty. ICH E6(R3) Principle 6.3 states that “strategies should be implemented to avoid, detect, address and prevent recurrence of serious noncompliance”, which places detection inside the quality system rather than beside it.
- A pattern spanning studies needs one register. The same root cause appearing on three studies is a site-level condition, visible only where the CAPA record spans the portfolio.
Section 3.11.1 of ICH E6(R3) places corrective and preventive actions inside quality assurance, and section 3.10.1.5 requires risks to be reviewed periodically. A recurrence detector shortens the interval between a cause returning and somebody asking why.
Who Reviews an AI-Raised Quality Signal?
A signal reaches the role that owns the record it concerns, with a due date. The confirmation is the quality control, and the audit trail entry behind it is what an inspector can read. An unowned open signal evidences nothing at all.
- Participant-facing signals reach the principal investigator. A training lapse against a delegated screening activity concerns a participant, so it routes the same day and the investigator decides whether the activity pauses.
- Quality system signals reach the quality assurance lead. Deviation trends and repeat CAPAs are judgements about process, and the significance test under section 3.12 belongs to the quality function.
- Document currency signals reach the document owner. An overdue review has a named owner in the register, and the signal carries the study phase that made it urgent.
- Every confirmation writes four things. The signal, the records it compared, the person who confirmed or dismissed it and the reason given all sit in one trail entry, which is what makes the oversight evidenced rather than asserted.
Inside AQ, a confirmed signal becomes a deviation or a CAPA action in the quality management system rather than a note on a dashboard, so one quality event stays in one thread from detection to verified closure.
The model raises the question. The named person answers it, and the answer is the record.
Does AI-Assisted Risk Detection Need Validating?
Yes. A risk detector is a computerised system function, and it is validated for the intended use a site writes down. Two points are specific to a detector whose output varies with the data it reads.
- Record the intended use narrowly. “Proposes a quality risk signal from a defined comparison across named record sets, for human confirmation” is testable. “Detects quality risk” is not.
- Specify the signal thresholds you accepted. The counts, intervals and tolerance limits that trigger a signal belong in the configuration record, so a change to them enters change control like any other.
What a model may and may not do at a site, and how a model update comes under change control, are set out in the guide to AI in GxP clinical trial systems and what MHRA expects. The testing method sits in GAMP 5 and computerised system validation.
Also Read: Common MHRA GCP Inspection Findings and How to Avoid Them
Quality Risk Detection Inside AQ QMS and AQ CAPA
AQ runs its AI as Connected Intelligence across the modules a site keeps its quality evidence in, with AQ Assist as the in-platform assistant. The design rule holds throughout: AQ’s AI proposes, flags and drafts, and a named person reviews and confirms.
- The four signals read across modules, not within one. AQ QMS, AQ CAPA, AQ Digital DoA and the electronic investigator site file sit on one connected record, which is what allows a training date to be compared with a delegation date and a visit date.
- A root cause is a structured field. Recurrence matching runs on the cause rather than on a description, so a CAPA closed in one quarter and a cause returning in the next are linked rather than filed apart.
- Every signal carries an owner and a due date. The routing follows the role that owns the record, and the confirmation lands in the audit trail beside it.
- Every AI action is in the audit trail. The proposal, the model version and the human confirmation are retrievable in the same trail as manual entries.
- Release evidence comes with each version. AQ is validated to GxP standards with every release, covering installation, operational and performance qualification with a 21 CFR Part 11 and EU Annex 11 assessment, so the AI features sit inside the validated scope of the version a site runs.
AQ holds NHS DSPT Standards Met for 2026 and Cyber Essentials certification, runs ISO 27001-aligned controls, and the platform is UK-hosted. It supports MHRA compliance and is built for MHRA GCP inspection. AQ was built by Phase 1 trial doctors and has been in continuous daily NHS use for six years, with 13 sites on one connected record and 70 concurrent studies, at organisations including University Hospitals of Liverpool Group and Royal Free London. Book a live demo to see a signal raised, confirmed and written to the audit trail in sequence.
Frequently Asked Questions
Which platforms offer AI-powered quality risk detection?
Four vendor categories describe it: enterprise and supplier quality management, clinical data analytics and central monitoring, document and eTMF platforms, and site operations platforms with a connected quality module. Only the last reads a research site’s own deviation, CAPA, training, delegation and document records together. Judge a platform on which records it reads across, whether every signal carries a named owner, and whether the feature can change a quality record without a human confirmation.
What quality risks can only be seen across records?
Four at site level: deviation trends by category, repeat CAPAs on a single root cause, training lapses against delegated activity, and overdue document review against study phase. Each one passes inspection inside its own module, because every individual record is complete and current. The finding sits in the relationship between two or more record sets.
How is an AI-raised risk signal confirmed?
The signal routes to the role that owns the record it concerns, with a due date. That person confirms or dismisses it with a reason, and the signal, the records compared, the confirming person and the reason are written to the audit trail. The confirmation is the quality control, so routing matters as much as detection.
Does AI-assisted risk detection need validating?
Yes. A detector is a computerised system function and is validated for the intended use a site records. Write that use narrowly, naming the record sets compared and the human confirmation step, and hold the counts, intervals and tolerance limits that trigger a signal in the configuration record so a change to them enters change control.
Who reviews an AI-raised quality signal?
Participant-facing signals reach the principal investigator, who decides whether an affected activity pauses. Deviation trends and repeat CAPAs reach the quality assurance lead, because the significance test is a judgement about process. Overdue document review reaches the named document owner in the register.
What is the difference between deviation logging and deviation trending?
Logging records each event, its date and its description, and closes when its action completes. Trending reads the log as a distribution and asks which category is growing, against which activity, and how close it sits to a quality tolerance limit set at study set-up. ICH E6(R3) section 3.10.1.3 covers risk control including those limits.
