What the AI does. What it does not. Who signs off.
You want AI-assisted efficiency across biometrics and biostatistics. You cannot ship patient-level data to a vendor cloud or put unreviewed output in a submission. These four rules are how we hold both.
01
Deterministic first
If a rule, a macro, a parser or a specification can do the job, that is what runs. A model is used only for the part no rule can be written for, and its scope is recorded.
THE AI DOES
Proposes mappings for unspecified source variables. Drafts derivation code from the SAP. Ranks data anomalies and drafts queries. Flags likely conformance issues before Pinnacle 21 runs. Flags figures and free text a parser cannot compare.
THE AI DOES NOT
Write to a production dataset. Choose controlled terminology. Approve its own output. Send a query to a site. Touch patient-level data outside your environment.
WHO SIGNS OFF
A named programmer, data manager or statistician reviews every proposal in their lane. The record shows what was proposed, what was changed, and who accepted it.
02
A rules layer, then a named reviewer
Model output never goes straight to a deliverable, a dashboard alert or a site. It passes through conformance and terminology checks, then a person signs it off.
Model proposal
CT check
Conformance
Spec match
Reviewer sign-off
Deliverable
WHAT THE RULES LAYER CHECKS
Controlled terminology at the submission's version. SDTM and ADaM conformance rules. Agreement with the mapping spec and the SAP. Reproducibility: same input, same output. Signal thresholds validated before they alert.
WHAT THE REVIEWER OWNS
Accepting or rejecting each proposal. The final derivation logic. The query that goes to a site. The sign-off record your QA team reads during an audit.
03
Nothing leaves your perimeter
Patient-level data stays in your environment, on premise or in a cloud tenancy you own, under your access controls. We work inside it. We do not host it, copy it, or route it through a third-party model endpoint.
Where the work happens
Your SAS 9.4, Viya, LSAF, R or Spotfire estate. Your repositories. Your accounts, logged. Models run where your security policy allows them to run, including private vector stores in your VPC.
What we never ask for
A data export. A copy of the study database. Credentials outside your identity system. An exception to your computerised-systems policy.
04
Automation inside your tools
No new platform to validate and no per-seat licence. The automation is delivered as macros, pipelines, agents, dashboards and repositories your team owns and can read.
You receive
Source code, specifications, test evidence, IQ/OQ/PQ where scoped, a change record, and a hand-over session with your programmers.
You do not receive
A black box. A platform fee. A dependency on us to run your own pipeline.
Why it matters
Validation scope stays small, the inspection story stays simple, and the work survives a vendor change.
Where we are not a fit
Saying this up front saves both sides a meeting.
You want patient-level data uploaded to a vendor platform.
You want unreviewed model output in a submission deliverable.
You need CRO replacement, FSP staffing or full study outsourcing.
Your environment has no audit trail and none is planned.
See the four rules applied to your bottleneck.
A scoped assessment on one domain, one macro library, one dashboard or one agent. Written proposal first, no number before the scope.
