Business case and benefits
- Head of clinical operations
- A · Accountable
- Product owner
- R · Responsible
- Solutions architect
- C · Consulted
- Technical PM
- C · Consulted
- Engineers
- I · Informed
- QA
- C · Consulted
- DPO
- I · Informed
- Security
- I · Informed
Sites chosen on evidence: feasibility answers read and compared in days, past performance alongside, and the trial master file checked every day, not just before an inspection. The sponsor decides, and no patient-identifiable data leaves controlled environments.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
Choosing sites starts with a feasibility questionnaire sent to dozens of NHS and private sites. The answers come back as PDFs, spreadsheets, portal exports and emails. Someone reads each one, compares it with the protocol's eligibility criteria and required procedures, looks up how the site did on earlier studies, and builds a shortlist. Under time pressure, relationships and memory count for more than evidence. Sites that over-promise get picked, and a share of opened sites recruit few patients or none.
Set-up time is now under national scrutiny. The government reported in April 2026 that average set-up for commercial interventional trials had fallen from 169 to 122 days against a 150-day commitment, and combined MHRA and ethics review averages around 41 days. With approvals faster, feasibility and site paperwork are more often what holds a study back.
Then come the documents. Every site needs its essential records in the trial master file (TMF): CVs, GCP training, delegation logs, approvals, agreements, and the right version of every protocol and participant document after each modification. Under the amended regulations, in force since 28 April 2026, the TMF for a new trial has to be readily available for inspection and kept for at least 25 years. In many teams completeness is still checked by hand, often in the weeks before an inspection.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
From the last feasibility response to a shortlist the study team can discuss.
ExampleFrom 6 weeks to 2
How closely selected sites recruit against what they said they would.
ExampleThe gap narrowing study on study
Share of opened sites that recruit nobody.
ExampleDown, measured against past studies
Share of expected documents present, current and filed within the agreed time.
ExampleAbove 95%, checked continuously
How often TMF staff change the AI's suggested filing. Very high means it isn't helping; near zero can mean nobody is checking.
ExampleStable, and sampled weekly
Findings about missing, late or misfiled essential records.
ExampleFalling, audit on audit
Cross-sector rules are on the UK regulation map.
Combined MHRA and ethics review, a notifiable route for lower-risk trials, Route B for eligible substantial modifications, and for the first time legal duties to register trials and publish a results summary within 12 months of the end of the trial. The sponsor classifies each modification. The AI can list what a modification touches, but a person decides its category and route.
The sponsor stays responsible for work it transfers to service providers, and must select investigators and sites that are qualified and adequately resourced. Quality management is risk-proportionate. Computerised systems must be fit for purpose, validated in proportion to risk, and keep audit trails. Feasibility scoring and TMF checks are such systems.
For trials applied for from 28 April 2026, the TMF is kept for at least 25 years after the trial ends and must be readily available for inspection. A person confirms every filing the AI suggests, originals or certified copies stay the record, and any migration is validated and documented.
Feasibility uses aggregate counts, produced inside the site or an NHS secure data environment. If anyone outside the care team needs identifiable records without consent, that needs section 251 support through the Confidentiality Advisory Group, and in England the national data opt-out then applies. Properly anonymised and aggregate counts are outside the opt-out.
Site documents carry personal data about investigators and staff: CVs, training records and signatures. That means a DPIA before the pilot, processing in UK regions, retention set by the TMF rules, and a contract that stops providers training their models on your data. If performance is scored per investigator, tell them, and let them comment on their record.
The HRA is clarifying expectations for AI used in writing protocols, participant materials and lay summaries. Any AI-drafted participant-facing text is reviewed by the study team and goes through the usual approval route.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: documents and responsesFeasibility responses and site documents land in one place, whichever route they came by. | API Gateway, S3 | API Management, Blob Storage | Kong or your existing API gateway; Ceph or IONOS S3 Object Storage |
| Reading and classifying documentsBedrock Data Automation processes London requests in London (checked 9 November 2026; re-check at build time). Textract plus an in-region model is the alternative. Test on signed, scanned delegation logs and handwritten CVs, not just clean PDFs. | Amazon Textract, or Bedrock Data Automation | Azure Content Understanding (includes Document Intelligence) | Open-source parsing (e.g. Docling) plus an open-weight vision model |
| Reasoning and summariesBoth clouds offer a choice of models, including Claude. Check which run in-region in London or UK South. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Protocol and study knowledge (retrieval)The current approved protocol, its modifications, the expected document list and your SOPs, each with version and status. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| Site performance dataPlain queries over your own history, not a model. Scores are explained by the numbers behind them. | Amazon Redshift, fed from CTMS extracts | Microsoft Fabric, fed from CTMS extracts | PostgreSQL, fed from CTMS extracts |
| Eligibility countsOnly aggregate counts come back, with small numbers suppressed under the data provider's rules. The AI never sees a patient record. | Run by the site or an NHS secure data environment | Run by the site or an NHS secure data environment | Run by the site or an NHS secure data environment |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| Workflow | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Middleware and events | Amazon EventBridge, SQS | Event Grid, Service Bus | Apache Kafka or RabbitMQ |
| Link to CTMS and eTMFAgree in discovery what each supplier allows: reading metadata, suggesting filing, raising tasks. | Through the suppliers' published APIs, plus your existing integration platform if you have one | Through the suppliers' published APIs, plus your existing integration platform if you have one | Through the suppliers' published APIs, plus your existing integration platform if you have one |
| Human reviewFeasibility leads and TMF staff work where they already do, not in a new screen. | In your existing CTMS and eTMF review queues | In your existing CTMS and eTMF review queues | In your existing CTMS and eTMF review queues |
| GuardrailsBlocks patient identifiers from entering prompts or the index. | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, keys, data protectionStudy-level access: a CRO team sees only the sponsor studies it is contracted for. | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every extraction, comparison, filing suggestion and human decision, with the reason. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. Sites and NHS data providers may require UK-only processing. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The CTMS, the eTMF and any patient data stay where they are. Eligibility counts are produced inside the site or an NHS secure data environment, and only the totals leave.
Uses cloud AI
Reading feasibility responses and site documents, the protocol index, the feasibility comparison and TMF checks run in a UK cloud region, or on your own GPUs with open-weight models for the sovereign option.
How they connect
A private link (AWS Direct Connect or Azure ExpressRoute) and the API layer to the CTMS and eTMF. Sites and data providers send responses and counts through the inbound API or your existing portal.
If the link drops
Feasibility and filing carry on by hand, exactly as before. Documents queue safely and are classified and checked when the link returns; nothing is filed twice.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Feasibility analyst
Where a person signs offThe feasibility lead reviews the comparison and the study team selects sites, recording why. The sponsor stays responsible for site selection under GCP. The agent's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
TMF completeness checker
Where a person signs offTMF staff confirm every filing. The TMF owner decides on gaps, and QA owns inspection readiness.
The CTMS and eTMF stay the systems of record. The AI reaches them only through the suppliers' published APIs and an API layer. It reads metadata and documents, suggests filing and raises tasks; a person confirms each one in the eTMF's own workflow, so the audit trail stays where inspectors expect it.
Events keep everything current. A new feasibility response, a site document or an approved modification becomes a message on a queue. Each message carries an ID, so a retry never files or flags anything twice, and a slow eTMF never loses a document.
Patient data stays inside controlled environments. Eligibility counts are produced by the site or an NHS secure data environment and arrive as totals. If the AI is switched off, feasibility and filing carry on by hand exactly as before.
Map today's feasibility and TMF process, measure the baseline, confirm CTMS and eTMF API access, agree the feasibility measures, and confirm with data providers how aggregate counts are produced.
Gate · must be true to passBaseline agreed, supplier access confirmed, DPIA and risk assessment started, QA involved.
One study in shadow mode: the AI compares sites and checks the TMF, the team works as normal, and the two are compared.
Gate · must be true to passExtraction and filing accuracy within agreed limits, no patient-identifiable data in the platform, QA sign-off.
Feasibility comparisons and TMF checks go live for new studies, with monitoring, support and a rollback plan.
Gate · must be true to passValidation evidence, monitoring, support model and team training in place.
Add studies and therapy areas, then the document tracking for protocol modifications and results deadlines.
Gate · must be true to passEach new study passes the same pilot gate.
| Activity | Head of clinical operations | Product owner | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | QA | DPO | SecurityI can fill this |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Informed | Consulted | Informed | Informed |
| Feasibility measures and data sources | Accountable | Responsible | Consulted | Informed | Consulted | Consulted | Consulted | Informed |
| Target architecture and supplier integration | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Consulted | Consulted |
| DPIA and data-flow sign-off | Consulted | Consulted | Consulted | Informed | Informed | Consulted | Accountable and Responsible | Consulted |
| Build and integration | Informed | Consulted | Accountable | Responsible | Responsible | Consulted | Informed | Consulted |
| Validation and accuracy testing | Informed | Accountable | Responsible | Consulted | Responsible | Responsible | Informed | Informed |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Responsible | Consulted | Consulted |
| Run, monitor and improve | Informed | Accountable | Consulted | Consulted | Responsible | Consulted | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the document reading, the feasibility data, the integration with your CTMS and eTMF, the data flows that keep patient data where it belongs, and the gates. I'd report to your programme board and your head of clinical operations.
Option B
If your partner or your own team already has an architect, I'd take on the document AI, the agents and the CTMS and eTMF integration under their lead, and give them a second senior opinion on security, data protection and validation.
Goes wrong
The demo used tidy questionnaires. Real ones are scanned, half-completed and in a dozen formats.
How the design avoids it
Pilot on last year's real responses for one study, every format.
Goes wrong
Past performance punishes sites that had a hard study, or new sites with no history.
How the design avoids it
Show the numbers and their context, let sites comment, and keep a route in for new sites.
Goes wrong
Feasibility quietly starts using patient-level data.
How the design avoids it
Aggregate counts only, produced inside the site or a secure environment, and guardrails that block identifiers.
Goes wrong
TMF staff accept every filing suggestion, so errors are filed faster.
How the design avoids it
A filing correction measure, a weekly sample check, and an exception queue for low-confidence documents.
Goes wrong
A CRO uses AI on the sponsor's study and the sponsor doesn't know.
How the design avoids it
Service provider oversight in the contract, and the same logs available to the sponsor.
Changes already announced or under way that affect this design. More in the UK horizon scan.
Track end-of-trial dates and results deadlines per trial alongside the TMF checks.
If feasibility uses real-world data, design for Annex 2's expectations now.
Keep protocols and modification history structured and versioned, so they can be checked quickly by your tools and the MHRA's.
Keep feasibility on aggregate counts and record AI use in study documents, so the design fits the guidance as it lands.
Design the eligibility count as a query run inside a secure environment, so a national service can replace site-by-site requests.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.