Every EDC pitch now has an agent in it. Some of it is useful, some is a chatbot with a new name and a little is risky. Here is a way to sort them by what the software is allowed to do, with the rules that already apply.
Free sandbox · No credit card · 21 CFR Part 11 aligned
| Acts on trial data? | Human gate | Our view | |
|---|---|---|---|
| 1. Drafts study build | No | Review before save | Good fit |
| 2. Suggests query text | No | Data manager sends | Reasonable |
| 3. Flags anomalies | Reads only | Human decides | Reasonable |
| 4. Raises queries itself | Writes | After the fact | Needs validation |
| 5. Changes data | Writes | None | Do not allow |
The short version
Terms
An assistant answers when asked and a person does the work. An agent is given a goal and takes steps itself, such as reading data, drafting a query and sending it. The line matters because everything regulators care about in a data capture system, who made a change, why, and whether you can trust the record, depends on who or what took the action.
There is a lot of noise on this subject. We have written separately about the regulatory record in what FDA's AI guidance means for sponsors in 2026 and the EU side in EU AI Act for clinical trial software. This post is the practical filter for the product in front of you.
What works
Drafting is the clearest win. Reading a protocol and proposing a visit schedule and forms saves hours of typing that nobody enjoys. Capture's AI study builder does exactly this: it reads a protocol (PDF, DOCX or DOC) and drafts the visits and forms, can draft questions or a lab table from a description or an uploaded file (CSV, XLSX, PDF or DOCX), and saves nothing without human review. It works only on draft forms, and reviewed forms then go through the draft-to-approved lifecycle before anything reaches a participant.
Suggesting and flagging are similar in spirit: the model reads and a person decides. Proposed wording for a query, or a list of values that look unusual against the rest of the study, can speed up a data manager's day without altering a record. The test is simple. If you turned the feature off, would the data in the database be any different? If not, the risk is mainly about confidentiality and quality of advice.
The line
Three provisions of 21 CFR 11.10 do most of the work. Paragraph (a) asks for validation of systems to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records. Paragraph (e) asks for secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify or delete records, without obscuring earlier information. Paragraph (f) asks for operational system checks to enforce permitted sequencing of steps and events.
Apply them to an agent that raises queries or edits values. Who is the operator in the audit trail? Is the agent a named, role-limited identity or a shared service account? Can you show that its behaviour was validated for your use, and what happens when the underlying model is updated? FDA's October 2024 final Q&A on electronic systems, records and signatures in clinical investigations sets out how it views trustworthy electronic records in practice, and it is worth reading with these questions in mind.
An agent that changes trial data without a human in the loop fails the simplest reading of a Part 11 audit trail and the draft FDA framework's model-risk test: the model alone decides, and a wrong decision changes what the study shows. If a vendor offers it, ask what the validation package looks like and who signs for the change. We would not accept "the AI did it" as a reason for change.
Upload a protocol to the free sandbox. The AI drafts visits and forms, you review each one, and nothing is saved until you approve it.
The framework
FDA's January 2025 draft guidance, Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products (docket FDA-2024-D-4689), proposes a risk-based credibility framework built on a defined question of interest and context of use. Model risk is a combination of model influence and decision consequence. As far as we could verify, it is still a draft, so treat it as the best statement of FDA thinking rather than a requirement, and check the FDA page for the current status.
You can use that logic with a vendor in plain language. What is the exact job of this feature? How much does the outcome depend on the model alone? What happens if it is wrong? A feature that drafts a form a human reviews and tests has low influence and a contained consequence. A feature that decides whether a safety signal is raised has neither. Our GxP checklist for AI in clinical data capture turns this into ten checks you can run.
Ask the vendor
Forms and settings, queries, or participant data. Get the answer per feature.
A named agent identity with a role, not a shared admin account.
Enforced by the system and logged, not just written in an SOP.
Whether prompts or study data go to third-party model providers, and under what terms.
Notification, release notes and a way to re-test before it applies to your study.
A control for the sponsor, not just the vendor.
The behaviour in your use case, not generic accuracy claims.
Our view
In our view, the practical value of AI in EDC in 2026 sits mostly at the front, in building studies faster, and at the edges, in helping people read and triage. The back, where data is changed and decisions are made, is where unglamorous controls win: identity, permission, reason for change, review. Vendors who can explain those clearly are worth more than vendors with the longest list of agents.
That is also how we think about Capture: AI where a human reviews the output, and the platform's audit trail and role-based access doing the work of making records defensible. We will revisit this post when FDA finalises its framework or the picture changes.
An AI agent takes steps toward a goal on its own, such as reading study data, drafting a query and sending it, while an assistant only responds when asked. The difference matters because agents that write to trial data affect the audit trail and validation.
Technically yes, but we would not allow an agent to change data without human review. 21 CFR 11.10(e) expects audit trails of who made each change, and a model acting alone is hard to attribute and validate.
Part 11 applies to the electronic records and signatures in your trial, whatever software produces them. Validation under 11.10(a) and audit trails under 11.10(e) apply to systems that use AI like any other.
The central document, the January 2025 draft on AI to support regulatory decision-making for drugs and biologics, was still a draft when we last checked. Verify its status on the FDA site before relying on it.
Drafting study builds and forms where a person reviews every output and the build is tested before use. Capture's AI study builder works this way: nothing is saved without review and it only works on draft forms.
Ask what the agent can write to, how its actions appear in the audit trail, what a human must review, what data leaves your study, how model changes are handled and whether you can turn it off per study.
Keep exploring
FDA AI guidance for trials in 2026
The regulatory record.
AI in clinical data capture: GxP checklist
Ten checks before AI touches your study.
EU AI Act for clinical trial software
The EU side.
AI study builder
Protocol to draft study, with human review.
Audit trail software
How field-level logging works.
21 CFR Part 11 compliance checklist
The rules that already apply.
Free sandbox with every feature. No credit card, and you pay only when you go live.