How CDISC Standards Shape AI Document Generation in Clinical Research

The promise of AI-generated clinical documents has attracted considerable attention over the past two years. Drafting a protocol in hours rather than days, generating a Clinical Study Report (CSR) narrative from structured analysis outputs, producing an Informed Consent Form (ICF) that mirrors the source protocol without manual transcription errors: each of these is now technically within reach. But within reach is not the same as regulatory-ready. The question that sponsors, CROs, and medical writers are actually asking is more specific: when an AI system generates a document for a clinical trial, how does it interact with CDISC standards, and does that interaction help or create risk?

The answer depends entirely on which CDISC standard is in scope, at which point in the trial lifecycle, and whether the AI system treats CDISC terminology and structure as constraints rather than suggestions.

What CDISC Standards Actually Govern

The Clinical Data Interchange Standards Consortium was formed in 1997 with the stated mission to enable the accessibility, interoperability, and reusability of clinical research data ^[1]. Over the following decades, CDISC developed a suite of foundational standards that now touch every phase of a clinical trial, from data collection through regulatory submission.

The most widely implemented are four, and two additional standards are central to submission workflows: Define-XML, which transmits machine-readable dataset metadata, and CDISC Controlled Terminology, which governs the permitted values within those datasets. The four foundational data models are:

CDASH (Clinical Data Acquisition Standards Harmonization) establishes how data should be captured at the point of collection, standardizing variable names and formats on electronic Case Report Forms (eCRFs) so source data maps cleanly to downstream tabulation requirements ^[2].

SDTM (Study Data Tabulation Model) defines how clinical data must be organized and formatted for regulatory submission. SDTM organizes raw trial data into standard domains, such as adverse events, laboratory results, and demographics, with prescribed variable naming conventions and controlled value sets ^[3]. As of early 2026, SDTM v3.0 and its accompanying Implementation Guide v4.0 are in public review, with major structural changes including new representations for subjects with multiple participations and a revised horizontal structure replacing supplemental qualifiers ^[4].

ADaM (Analysis Data Model) governs the analysis-ready datasets derived from SDTM. ADaM defines dataset and metadata standards that support the efficient generation, replication, and review of clinical trial statistical analyses, and maintains traceability between analysis results and the underlying SDTM tabulation data ^[5].

SEND (Standard for Exchange of Nonclinical Data) applies the same structure to preclinical and toxicology studies, operating as an SDTM implementation for animal research domains ^[6].

Together, these standards are mandatory for FDA submissions under section 745A(a) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 379k-1(a)), with effective dates that vary by submission type ^[7]. The FDA guidance "Providing Regulatory Submissions in Electronic Format: Standardized Study Data" (June 2021) specifies that sponsors must submit data in formats listed in the FDA Data Standards Catalog, which designates SDTM, SEND, ADaM, Define-XML, and CDISC Controlled Terminology as required standards ^[8]. Specifically: NDA, ANDA, and certain BLA studies starting after December 17, 2016 must conform; commercial IND studies starting after December 17, 2017 must conform; and noncommercial INDs are generally exempt ^[7]. Japan's PMDA issued comparable requirements effective October 2016, requiring SDTM, ADaM, and Define-XML for new drug application submissions ^[9].

This mandatory status is the first thing any AI document generation system operating in clinical research must contend with. CDISC compliance is not optional for the data submissions it governs; therefore AI outputs touching that submission-bound content cannot treat CDISC constraints as negotiable.

One boundary is worth stating clearly up front: CDISC standards govern data collection, tabulation, analysis datasets, and submission format. They do not directly regulate the word-for-word content of narrative documents such as protocol prose, ICF language, or CSR discussion sections. That distinction matters for understanding where AI has immediate regulatory exposure and where it has more latitude. An AI-generated CSR narrative does not itself need to be CDISC-formatted, but it must accurately represent the underlying CDISC-conformant ADaM results it describes. Inconsistency between the narrative and the datasets it references creates a submission deficiency regardless of whether the prose itself contains any CDISC terminology.

The Controlled Terminology Problem

CDISC Controlled Terminology (CT) is the set of CDISC-developed or CDISC-adopted standard expressions used with data items within CDISC-defined datasets. The CDISC Terminology Team maintains and updates these codelists quarterly in collaboration with the National Cancer Institute's Enterprise Vocabulary Services (NCI EVS), covering all foundational standards: SDTM, CDASH, ADaM, and SEND ^[10].

For AI document generation, controlled terminology represents one of the most consequential technical constraints. When an AI system drafts a protocol endpoint section, a CSR narrative, or an adverse event listing, the terminology it uses should align with current CDISC CT codelists, not with the system's training data, which may reflect an older CT version or a mix of sponsor-specific conventions from training corpora.

The practical consequence is specific. An AI that generates a demographics table using a race categorization term not in the current NCI/CDISC codelist creates a conformance gap that will appear in validation output during submission review. An AI that refers to laboratory test names using non-standard labels may produce documentation that does not trace cleanly to the corresponding SDTM LB domain records. These are not stylistic problems; they become traceability failures in regulatory review.

This is why teams evaluating AI document generation tools for regulated use should specifically ask how the system handles CT version management: which quarterly release is embedded, how updates are propagated, and whether the system flags deviations from current controlled values programmatically. CDISC CT governs structured data fields, not all narrative prose, so this concern applies most directly to AI tools generating data annotations, define-XML content, eCRF specifications, and document sections that reference specific coded values.

Where AI Has Demonstrated Genuine Value: SDTM Mapping

The most established application of AI within the CDISC ecosystem is automated SDTM mapping. Converting raw eCRF data into SDTM-conformant datasets has historically required substantial manual programming effort, and the process is prone to inconsistency across studies and teams.

A 2024 study published in PLoS ONE by Yang, Katz, and Shenoy demonstrated automated mapping of electronic data capture fields to SDTM domains using machine learning techniques, providing peer-reviewed evidence that AI can reduce the manual programming burden in this context ^[11]. AbbVie's case, presented at PharmaSUG 2025 as a conference proceeding (Paper SI-180), documented an AI and human-in-the-loop (HITL) workflow for SDTM transformation, describing how custom large language models trained on historical study mappings and technical documents reduced reliance on manual programming while maintaining conformance with CDISC standards ^[12]. Conference proceedings are implementation-level evidence and not peer-reviewed validation, but they reflect real production decisions by a major sponsor.

Both examples share a core design principle: AI generates a proposed mapping or output, and a qualified data manager reviews and approves it before the output enters submission workflows. The traceability requirement that SDTM enforces, from source data through derived SDTM variables to ADaM analysis datasets, cannot be delegated to a model that lacks visibility into the full audit chain. The 2025 CDISC AI Innovation Challenge, which drew 22 submissions from over 40 organizations across three use cases including Digital Protocols, Biomedical Concepts, and Semantic Traceability, surfaced a consistent finding across solutions: standards worked best when they were structured and executable, and validation and explainability mattered more than novelty ^[13].

A structured review of clinical trial statistical programming automation, posted as a preprint in December 2025 and awaiting peer review, found that open-source R ecosystems collectively termed "pharmaverse," aligned with SDTM IG 3.4 and ADaM IG 1.3, reduced TLF (tables, figures, and listings) development time by 15 to 25%, though the authors rated that evidence as low certainty ^[14]. The same review documented emerging applications of large language models for code generation in statistical programming, noting that these are early-stage explorations rather than validated production practices.

The Protocol Layer: ICH M11, USDM, and the Shift to Structured Documents

The interaction between CDISC standards and AI document generation becomes considerably more interesting at the protocol layer, where work over the past three years has begun to replace document-based protocols with machine-readable, structured representations.

The CDISC Unified Study Definition Model (USDM) is the foundation of this shift. First introduced in 2021, USDM provides a standardized structure for representing study designs as machine-readable data rather than narrative documents. Version 3.0 was released in April 2024 and version 4.0 in June 2025, with technical capabilities including a REST API, OpenAPI 3.0 specifications, and machine-executable conformance rules ^[15]. The model covers study objectives, endpoints, Schedule of Activities (SoA), and biomedical concepts.

ICH M11, the Clinical Electronic Structured Harmonised Protocol (CeSHarP), builds on this foundation at the regulatory level. FDA published the final M11 guidance in the Federal Register on May 22, 2026 (FR Doc 2026-10295), finalizing the draft guidances issued in December 2022 and June 2025 ^[16]. The guidance creates an internationally harmonized standard for the content and electronic exchange of clinical trial protocol information, with a Template specifying format and structure (including standardized headers and common text elements) and a Technical Specification containing harmonized terminologies and standardized data fields to support interoperable electronic exchange ^[16]. CDISC is collaborating with HL7 through the Vulcan project to enable M11-conformant protocols to be exchanged using HL7 FHIR resources, and the FHIR-to-CDISC Joint Mapping Implementation Guide has been published ^[15]. It is worth noting that finalization of M11 does not mean industry-wide adoption of USDM-structured workflows is already in place: many sponsors are still working through document-based protocol processes, and implementation timelines will vary considerably by organization and therapeutic area.

For AI document generation, this structural shift has a direct consequence. When a protocol is represented in USDM-aligned JSON rather than as a PDF narrative, an AI system can ingest that structured representation with far greater fidelity. The current paradigm, in which an AI reads a 200-page protocol PDF to generate an ICF or SAP, requires the model to reconstruct intent from narrative text and then produce output that may not trace cleanly back to the source document. A USDM-structured protocol input changes that: the AI can reference specific structured data elements, endpoint definitions, and schedule elements by identifier rather than by text parsing, which improves the traceability and verifiability of its outputs.

A 2024 PhUSE conference paper documented a working implementation in which USDM-aligned JSON metadata was used to generate an HTML version of an M11 protocol document with explicit traceability to structured source fields ^[17]. This is a proof-of-concept implementation, not a validated regulatory workflow, but it illustrates the direction the field is moving: documents as governed views over structured data, not documents as the primary artifact.

TransCelerate's Digital Data Flow (DDF) initiative captures this ambition at the industry level. The DDF "write once, read many" model envisions a single digital protocol definition feeding all downstream operational systems, including EDC, CTMS, IRT, and EHR connections, eliminating the manual transcription of protocol content into each system ^[18].

CDISC 360i: End-to-End Automation from Protocol to Submission

The most comprehensive programmatic effort to integrate CDISC standards with AI-driven automation is the CDISC 360i initiative, with its program kickoff webinar held February 18, 2025 ^[34]. The "i" stands for implementation, distinguishing this program from an earlier proof-of-concept phase. The 360i mission is to enable end-to-end automation of the clinical research data lifecycle, from protocol development to study results, by adding a semantic layer to CDISC standards that eliminates the fragmentation between design, collection, analysis, and submission ^[19].

The 360i program is running pilot demonstrations using both Alzheimer's and breast cancer trial designs, proving out the workflow from protocol to submission-ready SDTM datasets ^[20]. A core component is the CDISC Open Rules Engine (CORE), an open-source validation tool already available for validating clinical trial data against CDISC standards, including USDM JSON Schema validation against versions 3.0 and 4.0 ^[32]. In October 2025, CDISC announced a collaboration with Verisian to refactor CORE, accelerating rule authoring flexibility and broader standards coverage ^[33]. Within the 360i framework, CORE is being extended to support conformance checking earlier in the study lifecycle, with the goal of catching issues during document and dataset creation rather than at the submission stage.

Lindus Health announced a collaboration with CDISC on February 13, 2025, to accelerate the generation of Biomedical Concepts across CDISC Foundational Standards and Therapeutic Area Standards using AI ^[21]. Biomedical Concepts are the semantic building blocks linking clinical observations to their standard representations across USDM, CDASH, SDTM, and ADaM: automating their generation addresses one of the most time-consuming bottlenecks in the current standards development pipeline.

AI-Generated CSRs and the CDISC ARS

The Clinical Study Report is the other major document where AI generation has attracted direct investment. A PharmaSUG 2025 conference paper (AI-349) documented an approach to generating CSR narratives using AI combined with the CDISC Analysis Results Standard (ARS) and Analysis Results Data (ARD) metadata ^[22]. The ARS defines how statistical analysis results should be structured in machine-readable format, providing the structured input that an AI system can use to generate CSR text with explicit traceability to the underlying analysis datasets.

The approach described in that paper involves fine-tuning a language model using CDISC standards documentation, including SDTM and ADaM Implementation Guides, along with example protocols, SAPs, and CSRs, as contextual inputs ^[22]. The output requires review from clinical experts, who provide feedback to further refine model performance. This is conference-level evidence of a working prototype, not a validated regulatory-grade workflow, and the authors acknowledge ongoing requirements for human review and compliance verification.

A separate preprint (arXiv, April 2025, not yet peer-reviewed) documented InformGen, an AI system for ICF generation that uses retrieval-augmented generation (RAG) to process source protocols and produce consent documents with inline citations to specific protocol sections ^[23]. The authors identified regulatory compliance as the primary obstacle, noting that ICFs must adhere to FDA guidelines while meeting site-specific and IRB-specific requirements that vary across multinational trials. The cited examples in both papers retain human review as a required step throughout.

The Hallucination Problem in Regulated Environments

Any discussion of AI document generation in clinical research must confront the hallucination problem directly. McKinsey's November 2025 State of AI survey of nearly 2,000 organizations found that 51% of those using AI reported experiencing at least one negative consequence, with inaccuracy being the most commonly cited issue across nearly one-third of respondents ^[24]. That survey is cross-industry and the consequences described range broadly. Clinical teams should not treat a general enterprise benchmark as representative of regulated document risk: the accuracy standard for clinical documents entering regulatory submissions is categorically different from most enterprise AI deployments.

A peer-reviewed study published in Communications Medicine in August 2025 (Omar et al.) tested six leading large language models against 300 physician-designed clinical vignettes, each containing a single planted error such as a fabricated lab value, clinical sign, or disease name ^[25]. The models repeated or elaborated on the planted error in up to 83% of cases. A simple mitigation prompt halved the error rate but did not eliminate it. The study authors concluded that LLMs are highly susceptible to adversarial hallucination in clinical decision support contexts when used without structural safeguards.

In a regulated clinical document context, a fabricated protocol reference, an incorrect primary endpoint definition, or a misquoted inclusion criterion is not merely a drafting error. It is a potential GCP deviation, a protocol deviation risk, and a finding in a regulatory inspection. The consequence scales with the document's role in the submission and the oversight process around it.

CDISC-grounded AI document generation reduces hallucination risk through several mechanisms. When the AI drafts from a USDM-structured protocol definition rather than an unstructured PDF, there is less inferential space for the model to confabulate details not present in the source. CDISC Controlled Terminology constrains the vocabulary space for certain data fields, enabling programmatic validation of AI outputs against known valid values. Define-XML provides machine-readable metadata for each dataset, enabling automated cross-checks between what a document claims about study variables and what the dataset definitions actually specify.

None of these mechanisms is sufficient on its own. They reduce the risk surface. They do not eliminate it.

Regulatory Considerations for AI-Generated Documents

The regulatory environment governing AI in clinical research has become considerably more explicit since January 2025, though several key documents remain guidance rather than binding regulation.

FDA credibility framework. FDA's January 2025 draft guidance, "Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products," applies to AI models used to produce information or data supporting regulatory decisions about safety, efficacy, or quality ^[26]. It was informed by FDA's experience with more than 500 AI-component submissions received between 2016 and 2023 ^[26]. The draft proposes a risk-based credibility assessment framework under which sponsors would define the context of use for any AI model, assess model risk based on influence and decision consequence, and document a credibility assessment plan. Higher-risk uses, such as AI-generated analysis narratives anchoring primary endpoints, would warrant more rigorous qualification than lower-risk uses. The guidance does not cover AI used solely for operational efficiencies that do not affect patient safety, drug quality, or study reliability ^[26]. It remains a draft as of mid-2026; sponsors should monitor FDA for finalization.

FDA/EMA joint principles. On January 14, 2026, FDA and EMA jointly published "Guiding Principles of Good AI Practice in Drug Development," a shared high-level framework spanning the full medicines lifecycle from early research through post-market surveillance ^[27]. The principles emphasize human oversight, risk-based approaches, robust data governance, lifecycle management, and ethical and human-centric values. Both agencies have indicated these principles will inform future jurisdiction-specific regulatory guidance; they are not themselves legally binding regulations and do not override existing submission requirements ^[27].

Submission data format evolution. From September 2023 through April 2024, FDA collaborated with CDISC and PHUSE to execute a pilot testing CDISC Dataset-JSON as a transport format for regulatory applications ^[28]. FDA published a Federal Register Request for Comments in April 2025, exploring Dataset-JSON version 1.1 as a potential long-term replacement for the SAS version 5 XPT format currently governing most SDTM/ADaM dataset exchange ^[28]. Any transition to Dataset-JSON would affect the technical format that AI systems must produce or ingest when handling submission-bound data packages.

Validation and qualification. The FDA Study Data Technical Conformance Guide describes traceability expectations for ADaM derivations and submission data auditability from source through tabulation through analysis ^[8],[29]. Computer System Validation (CSV) and, under ICH E6(R3)'s risk-proportionate quality management framework, finalized by FDA in September 2025 ^[31], qualification considerations apply to software tools used in trial-critical processes. AI document generation tools that produce or inform submission content are expected to have qualification evidence, defined validation protocols, and documented change control for model updates.

Practical Implications: A Framework for Evaluating AI Document Generation Tools

For sponsors, CROs, and medical writers actively evaluating AI document generation vendors, the CDISC interaction raises several questions that should be part of due diligence.

How Kitsa Fits Into This Problem

KScribe is Kitsa's AI-powered regulatory document generation product, designed to support protocol, ICF, DSUR, IB, SAP, and CSR authoring workflows. Its design follows the same principle that CDISC 360i is advancing at the standards level: structured study definition data as the authoritative input, with documents generated as governed outputs rather than assembled from scratch each time. For teams evaluating AI document generation vendors against the framework above, Kitsa's regulatory infrastructure and document generation capabilities are described at kitsa.ai/protocol-development ^[30].

Key Takeaways

• •CDISC standards (CDASH, SDTM, ADaM, SEND, Controlled Terminology, Define-XML) are mandatory for FDA submissions under section 745A(a) of the FD&C Act. The effective dates are: NDA, ANDA, and certain BLA studies starting after December 17, 2016; commercial IND studies starting after December 17, 2017. Noncommercial INDs are generally exempt.
• •CDISC standards govern data collection, tabulation, analysis datasets, and submission format. They do not directly regulate all narrative document content, but AI-generated documents that reference submission-bound data must remain consistent with the underlying CDISC-conformant structures to avoid submission deficiencies.
• •Controlled Terminology is updated quarterly by CDISC and NCI EVS. AI tools generating content against CDISC domains require a CT version management process; CT governs structured data fields rather than all prose.
• •The shift from document-based protocols to USDM-structured, machine-readable study definitions is a major enabling factor for reliable AI document generation. FDA finalized the ICH M11 CeSHarP guidance on May 22, 2026, establishing an internationally harmonized standard for protocol content and electronic exchange.
• •CDISC 360i, launched February 2025, is a multi-year initiative for end-to-end automation from protocol to submission-ready SDTM datasets. Its 2025 AI Innovation Challenge drew 22 submissions from 40+ organizations and surfaced that explainability and validation mattered more than novelty across winning solutions.
• •A peer-reviewed Communications Medicine study (Omar et al., 2025) found that LLMs repeat or elaborate on a planted clinical error in up to 83% of adversarial test cases; a mitigation prompt halved but did not eliminate the rate. CDISC-grounded architectures reduce this risk but do not remove the need for human review.
• •The FDA's January 2025 draft credibility framework and the joint FDA/EMA "Guiding Principles of Good AI Practice in Drug Development" (January 14, 2026) are guidance documents, not binding regulations; the draft framework proposes context-of-use documentation, risk assessment, and human oversight for AI models producing information relevant to regulatory submissions.

FAQ

References

Related Articles