How do I know if my research site is ready for AI? Score seven things: connected records, data quality at source, a named governance owner, current delegation and training, validation capacity, information governance, and staff confidence. Each scores nought to three. A total of sixteen or more means your site can adopt AI safely today.
This checklist scores the site rather than a platform. The companion guide to evaluating a platform’s AI claims carries the weighted vendor scorecard, and the two run in sequence. A site that scores badly here buys the wrong thing whichever vendor it picks, because every AI feature in a trial system reads records the site already holds. The wider guide to how AI is used across a UK clinical trial sets out what those features do at each stage.
What Does Readiness for AI Mean at a Research Site?
Readiness is a property of the site’s records and the site’s people. Software arrives already built. The records it reads, the person who confirms what it proposes and the evidence an inspector asks for all belong to the site. Three statements make the point concrete.
- The records an AI feature reads are the records you already keep. A model proposes nothing useful from a deviation log held in a spreadsheet that no other system can reach.
- The person who confirms a proposal has to be delegated that activity. Confirmation is an act on the trial record, so it follows the delegation log in the same way a signature does.
- The evidence belongs to the site. An inspector asks your team what the model proposed, who confirmed it and on what date. The vendor’s validation pack answers a different question.
The standard behind all three is published. The amended Clinical Trials Regulations took full effect on 28 April 2026, and the MHRA’s good clinical practice inspections guidance, last updated 22 September 2026, names ICH E6(R3) as the guideline, with overarching principles, Annex 1 for interventional trials and Annex 2 for non-traditional interventional trials. Annex 2 reached Step 4 on 3 June 2026 and comes into effect on 15 January 2027, per the European Medicines Agency guideline page. The guideline governs the activity rather than the technology. It applies in full to what a site does with an AI proposal.
How Do I Know If My Research Site Is Ready for AI?
Score the seven dimensions below. A quality assurance lead and an R&D manager can complete the table together in five minutes, with the study portfolio open in front of them. Each dimension scores on the same four-point scale, so the totals from two different sites mean the same thing.
- 0: nothing is in place, and no one owns the gap.
- 1: something exists for one study or one team, arranged ad hoc.
- 2: it is in place for most studies, with gaps the team can name.
- 3: it holds across the portfolio, and a document or a system record evidences it.
| Dimension | The question to answer | What a 0 looks like | What a 3 looks like | Your score |
| 1. Connected records | Can one query reach the deviation log, the delegation log, the document register and the training record for the same study? | Each record sits in its own system or spreadsheet, joined by hand. | One platform holds all four against a single study identifier. | |
| 2. Data quality at source | Are the fields an AI feature would read populated consistently, with dates, categories and owners? | Deviations are free text, and categories vary by who typed them. | Controlled categories, mandatory dates and a named owner on every entry. | |
| 3. A named governance owner | Is one named person accountable for approving a new AI use and holding the register? | No one owns the decision, and staff adopt tools informally. | An AI lead is named in a written procedure, with a register of approved uses. | |
| 4. Delegation and training | Is the delegation log current, and does the training record cover the AI feature itself? | The log is updated at monitoring visits, and training covers the system generally. | The log is current to the week, and each confirmer has a dated training record for the feature. | |
| 5. Validation capacity | Can the site write an intended-use statement and review a vendor’s validation evidence against it? | Validation is treated as the vendor’s paperwork. | The site writes intended use, sets acceptance criteria and files its own qualification record. | |
| 6. Information governance and DPIA | Has the processing been assessed, and does the assessment cover the AI feature specifically? | No assessment exists for the tool, or an old one predates it. | A current data protection impact assessment names the feature, the data and the lawful basis. | |
| 7. Staff confidence | Will the people confirming proposals reject a wrong one rather than accept it unread? | Staff have never seen the feature, or they accept everything it offers. | Staff have rejected proposals, and the rejections appear in the audit trail. |
The maximum is twenty-one. Score honestly, because the exercise has value only where it finds the weak dimension. A site that scores itself at twenty-one in five minutes has measured its optimism.
The Seven Readiness Dimensions, One by One
1. Connected records
An AI feature earns its place at a site by reading across records rather than inside one. A single deviation reads as an isolated event. Four deviations of the same category in eleven weeks read as a trend, and only a system holding the whole log can see it. The guide to AI-assisted quality risk detection covers the signals that appear only across records.
Score this dimension against the four records a site-side AI feature reads most often: the deviation log, the delegation log, the document register and the training record. The test is whether those four share a study identifier inside one system. Export and reconciliation break the signal, because the joined copy is already out of date when the model reads it.
2. Data quality at source
Connected records still produce nothing where the fields inside them vary. A deviation category typed freehand gives a model nothing to count. The same protocol deviation recorded as “consent”, “Consent issue” and “ICF” on three occasions is three categories to a machine and one problem to a person.
- Controlled categories on deviations, CAPAs and document types, chosen from a list rather than typed.
- Mandatory dates on detection, review and closure, so an interval can be calculated.
- A named owner on each entry, so a flag has somewhere to go.
The data integrity attributes behind this are already familiar at a UK site. The explainer on ALCOA+ and the trial master file covers them in full.
3. A named governance owner
One person has to be accountable for approving each new AI use and for holding the register of approved uses. Sites score low here more often than they expect, because the tools arrive through individual staff rather than through procurement. The procedure that fixes the role, the approval route and the records is set out in the guide to governing the use of AI at a research site.
Score a 3 only where the role is named in a written procedure and a register exists. A willing volunteer with no procedure behind them scores a 1.
4. Delegation and training
Confirmation of an AI proposal is a trial activity, so it sits under the delegation log in the same way any other activity does. A proposal confirmed by someone who was not delegated that task is a finding, whatever the model got right. The Digital DoA record carries the effective dates that decide it, and the guide to accountability when AI gets it wrong sets out the chain.
Two tests separate a 2 from a 3 on this dimension. The delegation log is current to the week rather than to the last monitoring visit. The training record names the AI feature, not only the system that ships it.
5. Validation capacity
A vendor validates the product. The site validates the use. That split holds for every computerised system, and a probabilistic feature makes the site’s half harder, because the acceptance criterion is a rate rather than a single correct answer. The procedure is covered in the guide to validating an AI feature in a regulated trial system, and the risk-based framework sits in the GAMP 5 guide.
Score what the site can actually produce. A site with a quality team that writes user requirements, runs acceptance testing and files its own qualification record scores a 3. A site that files the vendor pack and nothing else scores a 1.
6. Information governance and DPIA
The Information Commissioner’s Office lists artificial intelligence, machine learning and deep learning as examples of innovative technology, and its guidance on when a DPIA is needed treats innovative technology as a trigger alongside another criterion, while noting an organisation may decide an assessment is needed on its own. Trial data brings the large-scale special category trigger with it. The practical answer at most UK sites is that a data protection impact assessment is expected.
Score the assessment against the feature rather than the system. A DPIA written for a trial platform in 2024 does not cover a model added to it in 2026. The controller and processor duties behind the assessment are covered in the guide to UK GDPR for clinical trial sites.
7. Staff confidence
The other six dimensions can all score well at a site where staff accept every proposal unread. Confirmation becomes a keystroke, and the control the whole model depends on quietly stops working. This dimension measures whether the people doing the confirming treat a proposal as a question.
- Exposure: the people who will confirm proposals have used the feature on real records.
- Rejection: proposals have been rejected, and the rejections sit in the audit trail.
- Escalation: staff know who to tell when the feature is wrong in the same way twice.
A rejection rate of zero over a month of use is a signal to look at. The guide to what AI a UK research site actually uses, role by role covers what each person is confirming in a working week.
Readiness is seven conditions, and six of them leave a document behind.
What Does Your Score Mean?
Three bands sit across the twenty-one points, and each carries a different decision. Read the band, then read the lowest single dimension, because one dimension at nought outranks a comfortable total.
| Total | Band | What it means | What to do next |
| 0 to 9 | Hold | The records an AI feature would read are not yet in a state to read. Adoption would create work rather than remove it. | Fix dimensions 1 and 2 first. Revisit the score in two quarters. |
| 10 to 15 | Narrow pilot | The foundations are present and the controls are partial. One feature on one study is testable. | Name the governance owner, write the intended use, and pilot on a single study with a named confirmer. |
| 16 to 21 | Ready to adopt | The site can put an AI feature into routine use and evidence it at inspection. | Adopt across the portfolio, and set the review interval in the governance procedure. |
One rule overrides the bands. A nought on dimension 3, 4 or 6 holds adoption whatever the total reads, because each of those three is a control an inspector asks about directly.
Which Dimension Should a Site Fix First?
The seven differ in sequence. Connected records and data quality at source carry the other five, because every later dimension describes control over something the first two produce. A governance procedure covering records that cannot be read is a procedure about nothing.
- First, the foundation: connected records and data quality at source. These two cap the maximum useful score of the rest.
- Second, the controls: a named governance owner, delegation and training, information governance. These three are written work, and a site can complete them in a quarter.
- Third, the capability: validation capacity and staff confidence. Both are built by use, so they move last and they move slowly.
Also Read: How AI Finds Documentation Gaps in an Investigator Site File
What the Site Supplies and What the Platform Supplies
Two of the seven dimensions can be bought. Connected records follow from the platform a site runs on, and data quality at source follows from how that platform is configured. The remaining five stay with the site whichever vendor it chooses. A buyer who reads a demo as a readiness answer has scored the wrong thing.
Platform evaluation is a separate exercise with its own method, covered on the AI compliance and inspection readiness page. Run the site score first, because it tells you which questions to put to a vendor.
Also Read: Is It Safe to Use AI in GxP Clinical Trial Systems? What MHRA Expects
AQ and the Seven Readiness Dimensions
AQ holds the site’s operational records on one connected study record. AQ CTMS, AQ eTMF, AQ eISF, AQ QMS, AQ CAPA and AQ Digital DoA write against the same study identifier, which is the condition the first readiness dimension scores. Connected Intelligence is the AI capability that reads across that record, and AQ Assist is the in-platform assistant staff work with.
AQ’s AI proposes, flags and drafts, and a named person reviews and confirms. Every AI action is in the audit trail, with the proposal, the confirmation and the person who made it held together. That design is what lets a site evidence dimensions 4 and 7 from the system itself rather than from a separate log.
- The AQ platform is UK-hosted, holds NHS DSPT Standards Met (2026) and Cyber Essentials certification, and runs ISO 27001-aligned controls.
- Every release goes through validated release and change control, with IQ and OQ evidence and a 21 CFR Part 11 and EU Annex 11 assessment, which a site reads against dimension 5 alongside its own PQ.
- AQ supports MHRA compliance and is built for MHRA GCP inspection, after six years of continuous daily NHS use across 13 sites on one connected record and 70 concurrent studies.
Score your site first. Bring the two lowest dimensions to a demo and ask to see them evidenced on screen. Book a live demo to work through your readiness score against a connected record.
Frequently Asked Questions
How do I know if my research site is ready for AI?
Score seven dimensions from nought to three: connected records, data quality at source, a named governance owner, delegation and training, validation capacity, information governance and DPIA, and staff confidence. A total of sixteen or more out of twenty-one means the site can adopt an AI feature and evidence it. A nought on governance, delegation or information governance holds adoption whatever the total reads.
What does a research site need before it can use AI safely?
It needs records an AI feature can read across, a named person accountable for approving the use, a current delegation log covering whoever confirms proposals, and an information governance assessment that names the feature. Validation evidence for the intended use sits alongside those four. Staff who will reject a wrong proposal complete the set.
Who should complete an AI readiness assessment at a site?
A quality assurance lead and an R&D manager together, with the study portfolio open. The quality lead scores validation capacity and governance. The R&D manager scores records, data quality and staff confidence. A five-minute joint scoring produces a more honest result than either role working alone.
Does a site need a DPIA before using AI on trial data?
The Information Commissioner’s Office lists artificial intelligence as innovative technology, one of the triggers in its screening criteria, and trial data brings the large-scale special category trigger with it. The practical answer at most UK sites is that a data protection impact assessment is expected. The assessment has to name the AI feature rather than the platform that ships it.
Can a site adopt AI before its records are connected?
A drafting assistant works on a single document and needs little else. Cross-record features need connected records by definition, because the signal exists only in the relationship between a deviation log, a training record and a document register. A site scoring nought or one on connected records gets drafting help and nothing further.
How long does an AI readiness assessment take?
Five minutes for the score, with two people and the portfolio to hand. The work that follows takes longer. Written controls such as a governance procedure and a DPIA take a quarter, and validation capacity and staff confidence build over several studies.
