🎓 AURELYN AI CLINICAL ACADEMY  |  WEBINAR ATTENDEE RESOURCE

90-Day Clinical AI
Governance & Implementation
Roadmap

A structured, regulation-aligned framework for clinical research organizations implementing AI — covering governance, technology implementation, and change management with week-by-week sequencing across three phases.

3
Phases with clear
sequencing
36
Governance &
implementation tasks
6
Regulatory frameworks
mapped
12
Weekly focus plans
with milestones
ICH E6(R3) · EU AI Act · 21 CFR Part 11 · NIST AI RMF · ALCOA+ · ICH E8(R1)
The Framework

Three Phases. Twelve Weeks. One Operating Model.

This roadmap is designed for organizations at any stage of AI readiness. Each phase builds on the last, and each workstream — Governance, Implementation, and Change Management — runs in parallel throughout. You cannot separate technology deployment from governance. You cannot separate governance from people change. All three move together.

🏛️
GOVERNANCE
Policies, committees, risk frameworks, regulatory documentation, and accountability structures that make AI use defensible to any regulator.
⚙️
IMPLEMENTATION
Technology deployment, system integration, validation, analytics, and the technical infrastructure that makes AI work in your specific clinical environment.
🔄
CHANGE MANAGEMENT
Workforce readiness, champion networks, training programs, resistance mitigation, and the organizational culture work that determines whether AI adoption succeeds or stalls.
⚠️
IMPORTANT: HOW TO USE THIS ROADMAP
This roadmap provides a structured framework — not a rigid script. Every organization has different starting points, regulatory jurisdictions, system landscapes, and team capabilities. Use the sequencing as a guide and adjust timelines based on your organizational context. The regulatory references are directional — consult qualified regulatory counsel for jurisdiction-specific compliance advice. Where you see Aurelyn AI Clinical references, understand that these represent one proven implementation path. The framework is yours regardless of which platform you choose.
PHASE 01 OF 3
Days 1–30
🔍 ASSESS & ALIGN
"Build the foundation before you build the system."
PHASE OUTCOME

By Day 30 you will have a fully chartered AI Governance Committee, a documented current-state assessment across technology, data, and regulatory alignment, a stakeholder map with identified champions, and a sequenced Phase 2 execution plan ready to deploy.
WORKSTREAMS
Charter your AI Governance Committee
Week 1
Establish a cross-functional steering group with representation from Clinical Operations, Regulatory Affairs, IT/Data, Legal, and Quality. Define scope, decision rights, meeting cadence (bi-weekly minimum), and escalation pathways. This committee will own every AI adoption decision for the next 90 days and beyond.
📋 ICH E6(R3) §5.0 — Sponsor Oversight Obligations
Appoint an AI Program Sponsor
Week 1
Secure named executive sponsorship at VP or C-suite level. The sponsor's role is to remove barriers, communicate organizational commitment, and authorize budget. Without a named sponsor, AI initiatives stall at the department level. Document the sponsorship formally in the governance charter.
📋 NIST AI RMF — GOVERN 1.1: Policies & Accountability
Draft your AI Use Policy (v0.1)
Week 2
Begin drafting a policy that defines: which AI use cases are approved, prohibited, or under review; who is authorized to approve new AI tools; how AI-assisted outputs must be documented in regulated workflows; and what disclosure is required in regulatory submissions. This is a living document — v0.1 is a starting point, not the final word.
📋 EU AI Act Art. 9 — Risk Management; 21 CFR Part 11 §11.10
Define your AI risk classification framework
Week 3
Map each current and planned AI tool against the EU AI Act risk tiers (unacceptable, high, limited, minimal) and FDA's AI/ML action categories. For clinical research, most AI tools touching patient data, protocol decisions, or regulatory submissions will be classified as high-risk — which triggers conformity assessment obligations. Document your classifications with rationale.
📋 EU AI Act Annex III — High-Risk AI Systems; FDA AI/ML Action Plan
Conduct a current-state technology audit
Week 1
Map every software system used in your clinical operations: eTMF, EDC, CTMS, safety database, LIMS, communication tools. For each system, document: the vendor, validation status, integration points, data formats, AI/automation features currently in use (including shadow AI), and regulatory qualification status. This audit is your implementation foundation.
📋 21 CFR Part 11 §11.68 — System Validation Requirements
Complete a data governance gap assessment
Week 2
Evaluate your current data governance posture across five dimensions: data ownership and stewardship, access controls and authentication, audit trail completeness, data quality standards, and AI-specific data handling policies. Score each dimension against ALCOA+ principles. This assessment will directly inform your Phase 2 technology priorities.
📋 ICH E6(R3) §8.1 — Essential Documents; ALCOA+ Framework
Map your regulatory compliance baseline
Week 2–3
Conduct a structured gap analysis against each of the four primary regulatory frameworks governing clinical AI: ICH E6(R3) GCP (with focus on risk-based monitoring and data integrity), 21 CFR Part 11 electronic records, EU AI Act high-risk obligations, and NIST AI Risk Management Framework. Quantify your gaps, not just identify them — assign severity and remediation effort.
📋 ICH E6(R3) §5.18; EU AI Act Art. 43; NIST AI RMF Core Functions
Evaluate AI vendor landscape for your top 3 use cases
Week 3–4
Based on your gap assessment, identify your top 3 AI use cases by ROI potential. For each, evaluate 2–3 vendors against a standardized scorecard covering: regulatory validation documentation, audit trail capability, integration with your existing systems, data residency and security, vendor regulatory track record, and total cost of ownership. Aurelyn AI Clinical's eTMF Intelligence Engine and Consistency Engine are built specifically for this environment.
📋 ICH E6(R3) §5.5.3 — Computerized Systems
Deploy a Change Readiness Assessment
Week 1
Survey your clinical teams to establish a baseline understanding of AI literacy, attitudes toward AI adoption, and perceived barriers. Use a structured instrument (not an informal conversation) — you need quantifiable data you can track over the 90 days. Key dimensions: current AI tool use, training needs, trust levels, workload concerns, and regulatory confidence. This data shapes your entire change strategy.
📋 NIST AI RMF — GOVERN 5.1: Organizational Risk Tolerance
Identify and activate your AI Champions network
Week 2
Select 1–2 AI Champions per functional area (Clinical Operations, Regulatory Affairs, Data Management, Quality, IT). Champions should be respected peers — not management appointees. Train them before the broader rollout on: what AI can and cannot do, how to answer common skeptic questions, and how to escalate genuine concerns. Champions are your most powerful change lever.
📋 ICH E6(R3) §5.0 — Staff Training & Qualification
Develop your 90-day Communication Plan
Week 2
Create a structured communication calendar covering all stakeholder groups from CRAs to the C-suite. Each communication should be role-specific: what does this mean for YOUR work, not generic AI messaging. Include a dedicated 'myths and facts' communication addressing AI replacement fears directly — silence creates rumors. Set a monthly all-hands touchpoint minimum.
📋 NIST AI RMF — COMMUNICATE 1.0: Transparency
Map resistance hotspots and mitigation strategies
Week 3–4
Using your readiness assessment data, identify the 3–5 highest-risk resistance points — these are typically senior staff who are confident in current processes, QA/regulatory teams worried about validation burden, and IT teams concerned about integration complexity. For each hotspot, develop a targeted engagement strategy before Phase 2 launches, not during it.
📋 FDA Digital Health Center of Excellence — Organizational Readiness
WEEK-BY-WEEK SEQUENCING
WEEK 1
Establish Foundations
  • Governance Committee kickoff meeting
  • Executive sponsor confirmed and announced
  • Technology audit initiated
  • Change readiness survey deployed
WEEK 2
Assess Current State
  • Data governance gap assessment delivered
  • Regulatory compliance baseline mapped
  • AI Champions identified and briefed
  • Communication plan v1 published
WEEK 3
Prioritize & Plan
  • AI risk classifications documented
  • Top 3 use cases validated with stakeholders
  • Resistance hotspot analysis complete
  • Vendor shortlist developed (2–3 per use case)
WEEK 4
Synthesize & Launch
  • AI Governance Committee: Phase 1 review session
  • Phase 2 plan approved and resourced
  • AI Use Policy v0.1 circulated for comment
  • Champions trained and ready to deploy
PHASE SUCCESS METRICS
✓
AI Governance Committee chartered with named members and meeting cadence
✓
Current-state assessments completed across technology, data, and regulatory dimensions
✓
Top 3 AI use cases prioritized with documented business case and ROI estimate
✓
AI Champion network activated (minimum 1 per department)
✓
Phase 2 plan approved by executive sponsor with allocated budget
COMMON RISKS & MITIGATIONS
Executive sponsor disengaged after kickoff
Pre-schedule monthly sponsor briefings. Send weekly one-pagers — no more than 1 page, no more than 3 decisions needed.
Assessment scope creep extends Phase 1 beyond 30 days
Timebox each assessment to 5 business days. Prioritize speed over perfection — you are establishing a baseline, not conducting a full audit.
AI Champions self-select as technology enthusiasts, not respected peers
Nominate champions based on peer trust and influence, not self-volunteering. Have managers recommend, not appoint.
Not sure where your organization stands on these 12 tasks?

The Aurelyn AI Clinical Readiness Assessment scores your organization across all five governance dimensions — data, literacy, infrastructure, regulatory, and leadership — in under 10 minutes. Get your instant report.

PHASE 02 OF 3
Days 31–60
⚡ PILOT & BUILD
"Prove value on one trial. Build the infrastructure to scale."
PHASE OUTCOME

By Day 60 you will have a live AI pilot running on at least one active trial, a finalized AI Use Policy, a validated workflow for AI-assisted TMF management, a role-based training program deployed to your clinical workforce, and measurable early ROI data to present to leadership.
WORKSTREAMS
Finalize and ratify AI Use Policy v1.0
Week 5
Incorporate feedback from Phase 1 circulation, legal review, and regulatory affairs input. The policy must address: approved AI use cases by function, prohibited applications (especially any autonomous decision-making in regulated workflows without human oversight), documentation requirements for AI-assisted work, vendor qualification standards, and the process for adding new AI tools. Formally ratify through your Governance Committee.
📋 EU AI Act Art. 9 — Risk Management System; ICH E6(R3) §5.1
Establish your AI Validation Framework
Week 5–6
Define your Computer System Validation (CSV) approach for AI/ML tools, distinct from traditional software validation. Key elements: intended use definition, performance specification, training/testing data documentation, algorithm change management policy, model drift monitoring triggers, and periodic performance requalification schedule. This framework must be approved by QA before any AI tool is used in a regulated workflow.
📋 21 CFR Part 11 — Electronic Records Validation; FDA AI/ML Action Plan §3
Create and populate your AI Risk Register
Week 6
Stand up a formal risk register that catalogs every AI tool in use or under evaluation. For each tool record: risk classification, validation status, data inputs and outputs, human oversight mechanisms, audit trail configuration, last performance review date, and responsible owner. Review this register at every Governance Committee meeting. This becomes your primary inspection-readiness artifact for AI.
📋 NIST AI RMF — MANAGE 1.0: Risk Treatment; EU AI Act Art. 9(2)
Define AI ethics and bias review process
Week 7
Establish a lightweight but formal process for reviewing AI tools for potential bias before deployment. For clinical research AI, bias risks include: training data that underrepresents certain patient populations, models that perform differently across site geographies, and document classification systems that under-perform on non-English language documents. Assign a named reviewer and build the review into your tool approval workflow.
📋 EU AI Act Art. 10 — Data & Data Governance; FDA AI/ML Guiding Principles
Launch your eTMF AI pilot on one active trial
Week 5–6
Select a trial that is in active monitoring (not database lock) with manageable document volume (500–5,000 documents ideal for a first pilot). Configure AI-assisted auto-classification against your TMF Reference Model structure. Run parallel filing (manual + AI) for the first two weeks to validate accuracy. Set your target: 90%+ classification accuracy before removing manual parallel processing. Document everything — this is your validation evidence.
📋 ICH E6(R3) §8.1 — TMF Maintenance; 21 CFR Part 11 §11.10(e)
Deploy TMF completeness monitoring dashboard
Week 6–7
Stand up a real-time completeness tracking dashboard for your pilot trial. Metrics to track: expected vs. filed document count by zone, missing document aging (days outstanding), filing accuracy rate, and time-to-file benchmarks. Run your first AI-generated inspection-readiness report at Day 45 and compare it to a manually prepared report. The delta in preparation time is your first ROI data point.
📋 ICH E6(R3) §5.18.3 — Site Monitoring Reports; MHRA GCP Inspection Expectations
Launch role-based AI training program
Week 6–7
Deploy structured training to all clinical staff in three tracks: (1) CRA Track — AI tools in daily monitoring workflows, TMF AI interface training, anomaly flag interpretation; (2) Manager Track — AI dashboard navigation, exception management, reporting workflows; (3) Regulatory/QA Track — AI validation documentation, audit trail review, disclosure requirements. Minimum 2 hours per track. Track completion rates — you need this data for Phase 3.
📋 ICH E6(R3) §5.0 — Training & Qualification; EU AI Act Art. 26 — User Obligations
Initiate integration assessment and priority connections
Week 7–8
Using your Phase 1 system map, begin implementing your top 2 integration priorities — typically eTMF ↔ EDC data flow and eTMF ↔ CTMS status synchronization. Even partial integration (bi-directional status updates) dramatically reduces manual reconciliation time. Document integration architecture with data flow diagrams — these are required for your AI validation package.
📋 21 CFR Part 11 §11.10(h) — Audit Trail; ICH E6(R3) §5.5.3
Activate Champions and begin peer coaching
Week 5–6
Deploy your Champions network into active peer-to-peer coaching. Each Champion should hold at least 2 informal 30-minute sessions with their team during this phase — not presentations, but genuine conversations about what the AI pilot is showing and what team members are feeling. Champions surface concerns that don't reach management. Brief them weekly and act on what they hear within 48 hours.
📋 NIST AI RMF — GOVERN 5.2: Organizational Culture
Deliver 'Mythbusting AI' communication campaign
Week 6
Launch a targeted, role-specific communication series addressing the top 5 fears your readiness assessment identified. Common fears in clinical research: AI will replace CRAs (it won't — it removes administrative burden), AI decisions won't be accepted by regulators (they will when properly validated), AI will create more work to review (initially yes, but net reduction within 60 days). Address them directly with evidence from your pilot.
📋 EU AI Act Art. 13 — Transparency & Information; NIST AI RMF — COMMUNICATE 1.1
Establish feedback loops and rapid response protocol
Week 6–7
Create a visible, low-friction feedback mechanism for pilot participants: a dedicated email alias, a brief weekly pulse survey (3 questions max), and a monthly open Q&A session with the Governance Committee sponsor. More importantly, establish a 48-hour response commitment — every piece of feedback gets acknowledged within 2 days, even if the answer is 'we're looking into it.' Speed of response is the trust signal.
📋 NIST AI RMF — RESPOND 1.0: Incident Response
Prepare your first AI ROI evidence package
Week 8
Compile the first 30 days of pilot data into a leadership-ready evidence package. Metrics: hours saved on TMF administration (before vs. after), inspection-readiness improvement (TMF health score), number of documents auto-classified vs. manual errors caught, training completion rates, and any early quality signals (faster query resolution, fewer missing document notices). This package unlocks Phase 3 resources.
📋 FDA Digital Health Innovation — Value Demonstration Framework
WEEK-BY-WEEK SEQUENCING
WEEK 5
Policy & Validation
  • AI Use Policy v1.0 ratified
  • CSV validation framework approved by QA
  • eTMF pilot trial selected and configured
  • Champions network activated
WEEK 6
Pilot Launch
  • eTMF AI pilot live (parallel running mode)
  • TMF completeness dashboard deployed
  • Training tracks launched (CRA + Manager)
  • Mythbusting campaign deployed
WEEK 7
Train & Integrate
  • Regulatory/QA training track delivered
  • Top 2 system integrations initiated
  • AI Risk Register populated
  • Feedback loops operational
WEEK 8
Review & Prepare
  • Day 45 inspection-readiness report generated
  • First ROI evidence package compiled
  • Governance Committee mid-point review
  • Phase 3 resources confirmed
PHASE SUCCESS METRICS
✓
AI pilot live on at least one trial with parallel validation running
✓
AI Use Policy v1.0 formally ratified by Governance Committee
✓
Training completion rate ≥80% across all role tracks
✓
TMF health score measurably improved vs. Day 1 baseline
✓
ROI evidence package presented to executive sponsor with documented findings
COMMON RISKS & MITIGATIONS
Pilot trial selected is too complex for first deployment
Choose a trial in active monitoring with standardized document types. Avoid trials in database lock, inspection phase, or with unusual protocol structures for the first pilot.
Parallel running creates workload resentment among CRAs
Set a hard 2-week parallel running window. Communicate the specific go-live date on Day 1 of the pilot so teams can see the end point. Reduce other administrative tasks during this period.
Training completion stalls below target
Make training completion a manager KPI, not a personal choice. Block calendar time in Week 6 specifically for training. 30-minute micro-modules complete faster than 2-hour sessions.
Ready to launch your eTMF pilot — but not sure how to configure it for your TMF structure?

Aurelyn AI Clinical's eTMF Intelligence Engine is pre-configured against the TMF Reference Model and can be configured for a live pilot in as little as 2 weeks. Our implementation team has launched pilots across multiple CRO environments.

PHASE 03 OF 3
Days 61–90
🏆 SCALE & LEAD
"From pilot to portfolio. From user to leader."
PHASE OUTCOME

By Day 90 your AI governance infrastructure is fully operational, your AI tools are scaling across the trial portfolio, your team is certified and confident, your regulatory documentation is inspection-ready, and your leadership has a data-driven case for sustained AI investment. You are no longer implementing AI — you are operating it.
WORKSTREAMS
Transition Governance Committee to standing operations
Week 9
Move the AI Governance Committee from a project governance structure to a permanent clinical quality body. Formalize its charter with defined annual review cycles, rotating membership where appropriate, and a permanent AI Risk Register review as the standing agenda item. The committee should now own the annual AI Governance Report — a document you will use for both internal accountability and external regulatory confidence.
📋 EU AI Act Art. 26 — Provider Obligations; ICH E6(R3) §5.1.1 — QMS
Complete EU AI Act conformity documentation
Week 9–10
For each tool classified as high-risk in your Phase 1 risk classification: complete the technical documentation file (Art. 11), ensure your AI system logs are configured per Art. 12, verify your human oversight mechanisms are documented and tested (Art. 14), and confirm your accuracy/robustness specifications are defined (Art. 15). These are legal obligations for EU operations — not optional. Engage legal counsel for final review.
📋 EU AI Act Art. 11–15 — High-Risk AI System Requirements
Establish quarterly AI performance review cycle
Week 10
Define a formal quarterly review process for all AI tools in production: model performance metrics vs. established thresholds, data drift analysis, regulatory guidance update review (new ICH guidance, FDA letters, EMA updates), user feedback synthesis, and risk register refresh. Document each quarterly review — these records demonstrate ongoing oversight and are your primary defense against an AI-related inspection finding.
📋 NIST AI RMF — MEASURE 2.5: AI System Performance; FDA PCCP Guidance
Prepare board/leadership AI Governance Report
Week 12
Produce a formal AI Governance Report for senior leadership and board visibility. Contents: AI portfolio overview (tools in use, validation status, risk tier), 90-day performance metrics, regulatory compliance status by framework, incident summary (any near-misses or anomalies and how they were resolved), year-2 investment recommendation with ROI projection, and risk appetite statement. This report establishes AI governance as a board-level matter — which protects the organization.
📋 NIST AI RMF — GOVERN 6.1: Governance Structures; EU AI Act Art. 26
Scale eTMF AI to full trial portfolio
Week 9–10
Using your pilot validation evidence, expand AI-assisted TMF management to all active trials. Configure trial-specific customizations (protocol-specific expected document lists, site-level completeness thresholds, sponsor reporting requirements). Set portfolio-level health score targets and alert thresholds. Document your scaling methodology — each trial's AI configuration becomes part of its Trial Master File.
📋 ICH E6(R3) §8.1 — TMF Completeness; 21 CFR Part 11 §11.68
Deploy cross-site data consistency monitoring
Week 10–11
Activate the data consistency engine across your active trial portfolio. Configure cross-site comparison rules for your most common data anomaly patterns (adverse event coding variations, protocol deviation classification differences, visit window discrepancies). Set escalation thresholds and notification routing. Your target: zero data inconsistencies reaching database lock that weren't already flagged and documented.
📋 ICH E6(R3) §5.18 — Risk-Based Monitoring; ALCOA+ Contemporaneous
Build and publish your AI performance analytics dashboard
Week 11
Create a real-time analytics dashboard visible to clinical operations leadership showing: portfolio-wide TMF health scores, data quality metrics by trial, protocol deviation detection rates, training completion and recency by staff member, AI system uptime and error rates, and cumulative time savings vs. pre-AI baseline. This dashboard has two audiences: operations teams who need to act on it daily, and leadership who need to see strategic value quarterly.
📋 ICH E6(R3) §5.18.6 — Monitoring Reports; FDA Risk-Based Monitoring Guidance
Complete regulatory submission disclosure documentation
Week 11–12
For any trial entering submission phase, complete your AI use disclosure documentation. This includes: a list of all AI tools used in the trial with their validation status and version, the human oversight protocols applied, data quality attestation signed by a qualified person, and a summary of any AI-generated anomaly flags and their resolution. File this documentation in the TMF under a new AI Tools zone. This is increasingly expected by FDA and EMA.
📋 FDA AI/ML Action Plan — Transparency Obligations; EMA AI in Medicines Guidance 2024
Measure adoption depth and quality
Week 9–10
Go beyond usage metrics. Conduct structured interviews with 10–15 clinical staff (not surveys) to understand: how AI is actually changing their daily work, what workarounds they have created (workarounds reveal adoption failures), whether they trust AI outputs or are ignoring them, and what they still don't understand. This qualitative data tells you whether you have genuine adoption or compliance adoption — the difference matters enormously for sustainability.
📋 NIST AI RMF — MEASURE 2.7: AI Impacts on Individuals
Certify your AI Champions as trainers
Week 10
Formally certify your Champions to deliver AI onboarding training to new staff and new trial teams. Develop a standardized 90-minute onboarding curriculum they can deliver. This embeds AI expertise into your organizational structure permanently — not dependent on a single external trainer or vendor. Present certificates at a visible company event. Recognition matters for sustaining the Champion role.
📋 ICH E6(R3) §5.0 — Staff Training Documentation; EU AI Act Art. 26(6)
Present 90-Day ROI Report to leadership
Week 11
Compile and present a comprehensive ROI report demonstrating the value of the 90-day program. Quantify: total hours saved on TMF administration, reduction in inspection preparation time, decrease in missing document queries, training cost per certified staff member vs. external training equivalent, projected annual cost avoidance from early deviation detection, and pilot TMF health score improvement. Include a comparison of your pre-AI regulatory exposure vs. current status.
📋 FDA Digital Health — Value Assessment Framework
Launch Year 2 planning with your team
Week 12
Facilitate a structured Year 2 planning session with Champions, governance committee members, and clinical operations leadership. Agenda: what worked in 90 days, what needs refinement, what use cases are now within reach (patient recruitment AI, predictive enrollment modeling, automated safety signal detection), what skills gaps remain, and what organizational changes would accelerate the next phase. The team that built Phase 1 should own Phase 2.
📋 NIST AI RMF — GOVERN 1.4: Organizational AI Risk Strategy
WEEK-BY-WEEK SEQUENCING
WEEK 9
Scale & Formalize
  • eTMF AI scaling to full portfolio initiated
  • EU AI Act conformity documentation begun
  • Governance Committee transitioned to standing body
  • Adoption depth interviews initiated
WEEK 10
Consistency & Training
  • Cross-site consistency monitoring activated
  • Champions formally certified as trainers
  • Quarterly review cycle defined and scheduled
  • AI validation documentation complete for pilot trial
WEEK 11
Analytics & Compliance
  • AI performance dashboard live
  • Submission disclosure documentation completed
  • 90-Day ROI Report compiled
  • Regulatory documentation package finalized
WEEK 12
Report & Plan Forward
  • Board/leadership AI Governance Report delivered
  • 90-Day ROI presentation to executive sponsor
  • Year 2 planning session facilitated
  • AI program declared 'steady state' with standing governance
PHASE SUCCESS METRICS
✓
AI tools deployed across 100% of active trial portfolio
✓
TMF health score ≥85% across portfolio (vs. Day 1 baseline)
✓
EU AI Act conformity documentation complete for all high-risk tools
✓
90-day ROI report delivered to board/executive team with quantified value
✓
AI Champions certified as trainers — new staff onboarding capacity in place
COMMON RISKS & MITIGATIONS
Scaling exposes configuration issues not seen in pilot
Build a 5-business-day buffer in Week 9–10 specifically for scaling anomalies. Pre-configure a rollback procedure so any trial can revert to manual filing within 24 hours if needed.
EU AI Act conformity documentation is more complex than anticipated
Engage legal counsel and a regulatory consultant simultaneously in Week 9. The technical documentation requirement (Art. 11) is extensive — do not underestimate it or leave it to Week 12.
ROI report doesn't demonstrate clear enough value for Year 2 investment
Collect baseline data in Week 1 specifically for ROI comparison — hours spent on TMF admin, number of inspection findings in last trial, training cost per staff member. Without baselines, ROI is anecdotal.
Ready to take these 12 workstream activities off your plate?

Aurelyn AI Clinical's Advisory Services team can manage your full governance implementation — from committee structure to regulatory documentation to board reporting — while your clinical team focuses on running trials. We bring the framework, you provide the clinical expertise.

Regulatory Reference

Six Frameworks That Govern Clinical AI

Every task in this roadmap is mapped to at least one regulatory obligation. This section provides orientation to the six frameworks you will encounter most frequently. For jurisdiction-specific compliance advice, engage qualified regulatory counsel.

ICH E6(R3)
Good Clinical Practice — Integrated Addendum
Defines risk-based monitoring, essential documents (TMF), data integrity requirements, and sponsor oversight obligations. The 2023 revision introduced technology-neutral language specifically to accommodate AI-assisted monitoring.
Critical Priority Active: All 3 phases
21 CFR Part 11
FDA Electronic Records & Electronic Signatures
Governs validation of computerized systems, audit trail requirements, access controls, and e-signature workflows in FDA-regulated clinical trials. Every AI tool that touches regulated data must be validated under Part 11 principles.
Critical Priority Active: Phase 1–2
EU AI Act
Regulation (EU) 2024/1689 — Artificial Intelligence Act
The world's first comprehensive AI regulation, fully effective 2026. Clinical research AI tools affecting patient safety, regulatory decisions, or clinical trial management are likely classified as high-risk — triggering conformity assessment, technical documentation, and human oversight obligations.
Critical Priority Active: Phase 1, 3
NIST AI RMF
AI Risk Management Framework (NIST AI 100-1)
The foundational US framework for AI risk governance, covering GOVERN, MAP, MEASURE, and MANAGE functions. Adopted by FDA as a reference in AI/ML guidance. Provides the governance structure backbone for your AI Governance Committee.
High Priority Active: All 3 phases
ALCOA+
Data Integrity Principles for Clinical Research
Attributable, Legible, Contemporaneous, Original, Accurate — plus Complete, Consistent, Enduring, and Available. Every AI system that touches clinical data must demonstrate ALCOA+ compliance through automated audit trails and documentation.
High Priority Active: Phase 1–2
ICH E8(R1)
General Considerations for Clinical Studies
The 2021 revision emphasized quality by design and risk-proportionate approaches — directly applicable to AI-based risk-based monitoring design. Your AI monitoring configuration should document how it operationalizes ICH E8(R1) quality principles.
Medium Priority Active: Phase 2
Master Schedule

90-Day Master Timeline

All three workstreams, all three phases, at a glance. Use this as your planning reference and leadership communication tool.

WORKSTREAM PHASE 1: ASSESS & ALIGN PHASE 2: PILOT & BUILD PHASE 3: SCALE & LEAD
Days 1–30 Days 31–60 Days 61–90
🏛️ GOVERNANCE
Charter AI Governance Committee · Appoint Executive Sponsor · Draft AI Use Policy v0.1 · AI Risk Classification
Ratify AI Use Policy v1.0 · Establish AI Validation Framework · Populate AI Risk Register · Define Ethics Review Process
Transition to Standing Committee · EU AI Act Conformity Docs · Quarterly Review Cycle · Board AI Governance Report
⚙️ IMPLEMENTATION
Technology Audit · Data Governance Gap Assessment · Regulatory Compliance Baseline · Vendor Evaluation
eTMF AI Pilot Launch · TMF Completeness Dashboard · Role-Based Training Program · System Integrations
Scale to Full Portfolio · Cross-Site Consistency Monitoring · Analytics Dashboard · Submission Disclosure Docs
🔄 CHANGE MANAGEMENT
Change Readiness Assessment · AI Champions Identified · 90-Day Communication Plan · Resistance Hotspot Mapping
Champions Activated · Mythbusting Campaign · Feedback Loops Established · ROI Evidence Package
Adoption Depth Assessment · Champions Certified as Trainers · 90-Day ROI Report · Year 2 Planning Session
Reference Guide

Key Terms & Definitions

Plain-English definitions of the terms used throughout this roadmap. No prior AI or regulatory expertise assumed.

AI Governance Committee
A cross-functional steering body responsible for overseeing all AI adoption decisions, policy ratification, risk management, and regulatory compliance for AI tools in clinical operations.
AI Use Policy
A formal organizational policy defining approved AI use cases, prohibited applications, documentation requirements, vendor qualification standards, and the process for approving new AI tools in regulated workflows.
ALCOA+
Data integrity principles: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available. Required for all clinical data and AI-generated records in regulated trials.
Conformity Assessment
Under the EU AI Act, the process by which high-risk AI systems are verified to meet legal requirements before deployment — including technical documentation, human oversight protocols, and performance specifications.
CSV (Computer System Validation)
The documented process of demonstrating that a computerized system consistently performs its intended function. Under 21 CFR Part 11, all AI tools used in regulated clinical workflows require formal CSV.
Model Drift
The degradation of an AI model's performance over time as the real-world data it encounters diverges from its training data. Regular performance monitoring is required to detect and remediate drift.
TMF Reference Model
The industry-standard framework defining the structure, content, and metadata requirements for Trial Master Files. Published by the TMF Reference Model Working Group and adopted by major regulators.
Risk-Based Monitoring (RBM)
An ICH E6(R3)-endorsed approach to clinical monitoring that focuses resources on the highest-risk data and processes, using centralized analytics and AI-assisted flagging to prioritize monitoring activities.
Aurelyn AI Clinical Academy

Ready to Execute This Roadmap?

You now have the framework. Three ways to move from planning to execution — all available to webinar attendees at no cost.

🎯 OFFER 1 — FREE
AI Readiness Assessment
A 45-minute personalized session with Sheilah + a written AI readiness report mapping your specific gaps to this roadmap's Phase 1 tasks.
Email: support@aurelynai.com
Subject: "AI Readiness Assessment"
🎓 OFFER 2 — FREE
First Course Free
Access the AI Governance Leadership Course — an 8-module, 22-lesson program that walks your team through the governance workstream tasks in this roadmap.
Code: AIWEBINAR26
at aurelynai.com
📘 OFFER 3 — FREE
2026 AI Clinical Research Playbook
The companion guidebook to this roadmap — covering all six regulatory frameworks in depth, with policy templates, maturity models, and implementation checklists.
Download free:
aurelynai.com
© 2026 Aurelyn AI Clinical. All Rights Reserved.
Aurelyn Clinical Engines™ and Aurelyn Trial | OS™ are proprietary frameworks and platforms of Aurelyn AI Clinical.
Unauthorized use, reproduction, or distribution is strictly prohibited.