How should a research site govern the use of AI? Through one written procedure that names every approved AI use, the person who owns it, the training behind it and the record it leaves. Governance is a standing operating condition at the research office, and the procedure is the instrument that holds it in place.
This guide sets out that procedure section by section. The definitional companion is How is AI used in clinical trials? A guide for UK research sites, and choosing the platform that carries the features is a separate exercise set out in AI for compliance and inspection readiness.
How Should a Research Site Govern the Use of AI?
Most research offices already run AI without a procedure that says so. A nurse drafts a deviation narrative in a general assistant, and a coordinator accepts a classification proposal in the trial platform. Neither act is wrong. Both are ungoverned until a procedure covers them, and an ungoverned use is the one an inspector finds first.
One standard operating procedure covers it, in seven sections. Each fixes one decision and leaves one record.
| SOP section | The decision it fixes | The record it produces |
| 1. Scope and definitions | Which tools and uses the procedure governs, and which it excludes | A scope statement naming the categories in and out |
| 2. Roles and responsibilities | Who approves a use, owns a system and answers for an output | A named role list held with the quality manual |
| 3. Approving a new AI use | Whether a use proceeds, proceeds with conditions, or stops | An entry in the AI use register, signed and dated |
| 4. Training and competence | What a person must do before using an approved feature | A training record linked to the delegated activity |
| 5. Monitoring in use | What is measured after approval, how often and by whom | A periodic monitoring summary per approved use |
| 6. Incident and error reporting | What happens when an AI-assisted output is wrong | A quality event record and, where triggered, a CAPA |
| 7. Periodic review | When the register and procedure are read again | A dated review note against each register entry |
The register in section 3 does most of the work. It answers an inspector asking what AI this site uses, and the other six keep it accurate.
A tool nobody approved is still your tool. The register is where that stops being true.
What Rules Does an AI Governance SOP Have to Satisfy?
No UK instrument requires a research site to hold an AI-specific SOP. Four published items set the expectations such a procedure has to meet.
| Instrument | Date | What it asks of the procedure |
| Amended UK Clinical Trials Regulations, with ICH E6 GCP principles | In force 28 April 2026 | Compliance with the ICH E6 principles is a legal requirement under Regulation 28. Training in GCP and UK legislation is expected to be proportionate to a person’s role and delegated activities, and documented. |
| EMA and FDA guiding principles of good AI practice in drug development | 14 January 2026 | Ten joint principles, including a risk-based approach, a clear context of use and life cycle management. They are a foundation for later guidance rather than binding rules. |
| ICO guidance on AI and data protection | Under review following the Data (Use and Access) Act | Accountability sits with the controller and senior management. A data protection impact assessment is usually required, started early and kept live. |
| HRA plan to enable safe AI-powered innovation in health and social care research | 29 May 2026 | A two-year programme across three priorities: safe innovation, clarity for researchers, and public confidence in AI use in research. |
The MHRA guidance on compliance with ICH E6 good clinical practice in the United Kingdom, published 27 March 2026 and updated 28 April 2026, is explicit on documentation. It expects a documented assessment of E6(R3) and Annex 1 against the quality management system, and a documented rationale for any departure from the Annexes.
The EMA and FDA guiding principles add the structural instruction: a risk-based approach and a clear context of use mean the procedure grades uses rather than treating them alike.
What Should the SOP Cover, and What Should It Leave Out?
Scope decides whether the procedure is usable. A scope drawn around the trial platform misses the assistant a coordinator opens in a browser tab, which is where most unapproved use sits. A scope reaching every piece of software with a model inside collapses within a month.
Three tiers of use carry different risk and different approval routes, and a graded procedure stays proportionate.
- Tier 1, embedded in a validated trial system. A classification, retrieval or flagging feature in a system the site runs under change control, which means the approval question is about the use rather than the software.
- Tier 2, a general-purpose assistant used on trial content. A public or enterprise assistant that a member of staff pastes trial text into, which raises an information governance question before it raises a quality one.
- Tier 3, AI as the subject of the research. An AI-enabled device or model under investigation in the trial itself, which sits with the sponsor and the protocol.
Tier 3 belongs outside the scope statement, with a sentence saying so. Tier 2 is the one most procedures forget. A worked scope line reads: this procedure governs any use of artificial intelligence by research office staff on trial-related content, whichever tool it happens in, and excludes AI under investigation under a protocol.
Also Read: Automation vs AI in a trial platform classes the features a platform ships, so a scope statement can separate a rule firing on a fixed date from a model returning a proposal.
Who Owns AI Governance at a Research Site?
Four roles carry the procedure, and a research office of any size can fill them from existing staff. A named owner stops AI governance becoming an orphan task.
| Role | What this role decides | What this role signs |
| AI lead for the research office | Whether a proposed use enters the register, and on what conditions | The register entry and the annual review note |
| System owner | That the feature is configured as approved, and that model changes reach change control | The configuration statement held against the register entry |
| Principal investigator | Whether a use is acceptable on their study, and who may run it | The delegation entry for the member of staff who uses it |
| Quality assurance lead | Whether monitoring evidence shows the use still performs as approved | The monitoring summary and any resulting quality event |
The information governance lead joins for the data protection impact assessment question on any Tier 2 use, and the chief pharmacist for anything touching the investigational medicinal product (IMP) record.
These roles are internal, and they leave the regulatory chain where ICH E6(R3) puts it. That chain is set out in who is accountable when AI gets it wrong at a trial site?, and the separate panel approving a platform purchase in the inspection readiness evaluation guide.
A role that signs something is a role. A role that signs nothing is a line in a document.
How Is a New AI Use Approved?
Approval runs as a short sequence. Six steps cover every case.
- Proposal. The requester states the task, the records involved and the tier on a single form.
- Intended use statement. The AI lead writes what the feature is for in terms a test could check, naming the records in scope and the role that confirms each output.
- Risk triage. The use is graded on what a wrong output would reach: a draft a person edits, a field in an index, or the trial record.
- Data protection screening. Any use touching personal data goes to the information governance lead, who decides whether a data protection impact assessment is required first.
- Validation requirement. The AI lead records the evidence needed before go-live, proportionate to the triage grade.
- Decision and register entry. The outcome is recorded as approved, approved with conditions, or refused, with its conditions in full.
Step 5 is where sites overreach. Validation is for the intended use written at step 2, and the depth of testing follows the triage grade rather than the vendor’s documentation. The method is in validating an AI feature in a regulated clinical trial system. Step 4 rests on duties covered in UK GDPR for clinical trial sites.
A refusal is a valid outcome and belongs in the register with its reason. A register holding only approvals tells an inspector nothing was assessed.
What Training and Competence Records Does AI Use Need?
The MHRA guidance on ICH E6 compliance expects training to be proportionate to a person’s role and delegated activities, and to be documented. An approved AI use adds a competence, so it belongs in the same training record as everything else.
Four things make an AI training record hold up.
- Named to the use rather than the tool. A record reading “trained on the platform” fails, because it cannot show competence in the specific feature used on a given date.
- Dated against the register entry. Training sits after the approval that authorised the use, which lets an inspector see the order of events rather than infer it.
- Covering the confirmation step. The person is trained in what to check before confirming, which is the control the arrangement rests on.
- Refreshed on a material change. A model update that changes behaviour triggers a competence check, which keeps the record current.
Staff confirming a proposal perform the delegated activity it belongs to, and the record naming each person and activity is held in Digital DoA. A training record covering a feature the delegation log never authorised is a mismatch.
How Is an Approved AI Use Monitored?
Approval is a point in time and performance drifts. Measurement turns the register from a list of permissions into evidence those permissions are still sound. Three measures suit most site-side uses, and all three come out of the system.
- Acceptance rate. The proportion of proposals accepted unchanged, which shows whether the feature helps or generates rework.
- Override pattern. What the rejected proposals share, which locates the record set where the feature is weak.
- Sampled accuracy. A periodic read of accepted proposals by the quality assurance lead, which tests whether confirmation is a check or a habit.
The third measure matters most. A high acceptance rate reads as success and can equally mean the confirmation step has become a click. Ten accepted proposals a quarter, read properly, settle which.
AQ writes every AI action to the audit trail, so the acceptance rate and the sample a monitoring summary needs come out of the record rather than a manual count. These three measures watch the feature. A separate capability turns AI on the quality record, and it is set out in AI-assisted quality risk detection for UK research sites. The summaries belong in the quality management system.
How Should an AI Error Be Reported?
An AI-assisted output that proves wrong is a quality event, and the existing deviation route handles it. The procedure adds three things that route misses.
- The register entry it belongs to. The event is tagged to the approved use, which makes a pattern across several events on one feature visible.
- The model version in force. The version running on the date of the event is recorded, which makes a vendor conversation possible months later.
- The confirmation given. What the confirming person saw and accepted is captured, which separates a model failure from a review failure.
That third distinction drives the corrective action. A model failure leads to a change in the configuration, the threshold or the approval conditions. A review failure leads to training. The record sits in CAPA.
Also Read: Is it safe to use AI in GxP clinical trial systems? What MHRA expects gives the activity-by-activity line between what a model may propose and what it must never do, which is the line an incident report is written against.
How Often Should the SOP Be Reviewed?
Periodic review runs on a fixed interval with four events that pull it forward. An annual cycle suits most research offices, and register entries are read individually.
| Trigger | What gets re-read | Who signs the outcome |
| Annual cycle | Every register entry, its monitoring summary and training coverage | AI lead |
| Model or version change notified by a vendor | The affected register entry, its intended use statement and its validation evidence | System owner |
| A new use requested on an existing tool | The scope statement and the existing entry for that tool | AI lead |
| A regulatory publication affecting AI in research | The instrument table and any entry it touches | Quality assurance lead |
| A quality event on an approved use | That entry’s conditions, threshold and training requirement | Quality assurance lead |
The fourth trigger is already live. On 10 September 2026 the HRA welcomed the recommendations of the National Commission into the Regulation of AI in Healthcare, saying it would consider them alongside its two-year plan. A site whose procedure carries a trigger for this will pick the output up.
AI Governance Inside the AQ Platform
Connected Intelligence is the AI capability across the AQ Platform, and AQ Assist is the in-platform assistant. A governance procedure is easier to evidence where the platform produces the records it asks for.
- AQ’s AI proposes, flags and drafts, and a named person reviews and confirms, which puts the confirmation step the SOP relies on into the configuration rather than a policy document.
- Every AI action is written to the audit trail, so the acceptance rate, the override pattern and the sample for a monitoring summary come out of the record itself.
- Checks read across the electronic investigator site file, the quality management system, CAPA and the clinical trial Pharmacy record, which lets a training record that misses a delegated activity surface as a flag.
- Every AQ release goes through validated release and change control, with installation and operational qualification evidence and a 21 CFR Part 11 and EU Annex 11 assessment, so an AI feature ships inside the same release evidence as the version a site runs. Performance qualification stays with the site, against its own configuration and intended use.
- The platform is UK-hosted, holds NHS DSPT Standards Met for 2026, is Cyber Essentials certified and runs ISO 27001-aligned controls.
AQ was built by Phase 1 trial doctors and has been in continuous daily NHS use for six years. It supports MHRA compliance and is built for MHRA GCP inspection, and the judgement in every record stays with the research team. Book a live demo to see the audit trail a monitoring summary is drawn from.
Frequently Asked Questions
How should a research site govern the use of AI?
Through one standard operating procedure in seven sections: the scope of tools and uses it governs, the roles that decide and sign, the route for approving a new use, the training record behind each approved use, what is monitored afterwards, how an AI-assisted error is reported, and when it is all reviewed. The central artefact is a register of approved uses, each with a named owner and an intended use statement.
Does using AI at a research site require a DPIA?
Usually, and it is assessed case by case. The ICO position in its guidance on AI and data protection is that AI use will in most cases involve processing likely to result in high risk, which makes a data protection impact assessment necessary. The ICO expects it to begin at the earliest project stage and to be kept live as the processing changes.
What should an AI use register contain?
One row per approved use, holding the use reference, the tool and model version, the tier, the intended use statement, the records in scope, the named owner, the confirming role, the approval date and conditions, the training requirement and the next review date. Refused uses stay in the register with their reasons, because a register of approvals alone shows no evidence of assessment.
How often should an AI governance SOP be reviewed?
Annually as a fixed cycle, with four events pulling a review forward: a model or version change notified by a vendor, a new use requested on an existing tool, a regulatory publication affecting AI in research, and a quality event on an approved use. Each review is recorded as a dated note against the register entry it concerns.
Does an AI governance SOP cover staff using a public AI assistant?
It should, and this is the tier most procedures leave out. A general-purpose assistant used on trial content raises an information governance question before a quality one, and a scope statement confined to the trial platform leaves that use unexamined. The scope line needs to reach any use of AI by research office staff on trial-related content, whichever tool it happens in.
