What is built
Two helpers, each behind a screen that works without it. Neither touches clinical data, a person's details or a study's records.
| Helper | What it does | Who may use it | Where |
|---|---|---|---|
| Form generator | Turns a plain-language request into a first-draft form (a structured definition, validated against the form schema before anything is created). The designer edits and makes it active like any other form | ai.generate (Organization Admin, Project Manager, eCRF Designer), the organization licensed for ai.crf_builder, and a provider configured | The AI Assist dialog of the form builder, and the same in the form library (AI form generation and the AI workstation) |
| Role assistant | Suggests the permissions that fit a role from its name, scope and description, and explains a warning the guardrails raised. It proposes; the guardrails judge every proposal and nothing is applied for the administrator | rbac.manage (the Organization Admin) and a provider configured | The role editor of the setup wizard (Set up your organization) |
The form generator turns a plain-language request into a first-draft form, and the model's answer is never trusted: it is checked and repaired, shown to a person as a draft, and takes effect only through the normal build, test and sign-off gates. It is off unless a provider is configured, and it never receives participant data.
What is not built
- Medical coding suggestions, query auto-generation, summaries for monitors and deviation classification are not built. The AI service's interface used to declare some of them with no caller; they were removed so that an architecture reading does not claim them. A capability is added to the AI port only with a caller.
- The AI Workstation (drafting a whole study design from the protocol) is a preview screen: its generation is not built.
- AI features in data entry, review or reporting: none.
Where the data goes
The provider is Google Vertex AI (Gemini models through @google/genai), authenticated with a service account. It is the only place in the system that talks to a model provider, so the regulatory surface is one module wide and every call is attributable.
| Form generator | Role assistant | |
|---|---|---|
| Sent | The designer's request text and the study's phase and therapeutic area, with the form schema's contract | The role's name, scope and description, and the permission catalog for that scope |
| Not sent | Participant data: generation happens at design time | Study data, people, clinical data |
| Stored by Trialion | In ai_form_generations (and library_form_generations): the full request text, the phase and area, the outcome, the form's name and field count, the model, and an error; never the model's raw answer | An audit entry rbac.ai.suggestion_requested: who, the scope, how many suggestions came back and how many were dropped, the model; never the text |
Two properties matter for a privacy review. Google states that Vertex AI prompts and responses are not used to train its models, and processing stays in the configured location, so the region (AI_LOCATION) is a data-residency decision. The request text is stored and sent exactly as typed, so a designer must not put personal data into it (Data privacy).
How it is gated
Independent gates, all of which must pass:
- A provider is configured. The default is
AI_PROVIDER=none, in which case form generation answers501and the role assistant503 ai.unavailable; binding a provider is a deliberate boot-time choice (it needsGOOGLE_CLOUD_PROJECTand a service-account key). - The organization is licensed (form generation only): the
ai.crf_builderfeature switch, read from the control plane. This gate fails open: if the control plane is unreachable the feature is allowed and a warning is logged (Feature switches). - The person holds the permission (
ai.generate, orrbac.managefor the role assistant), and for form generation the study's state allows version work. - An allowance. The role assistant has an hourly limit for the organization (
AI_ROLE_ASSISTANT_MAX_PER_HOUR, default 30) for suggestions and explanations together, because each call is a paid call to the provider.
Reliability
The output is constrained to JSON, but the correctness gate is validation of the answer, not the provider's JSON mode: a generated form is checked against the form schema and the formula contract, a repair pass fixes what it can (AI_FORM_REPAIR), and a form is limited to a number of fields (AI_MAX_FIELDS, default 60). A role assistant's proposal is validated against the permission catalog, the role's scope and the guardrails before anyone sees it. If the primary model (gemini-2.5-flash by default) is overloaded or times out (AI_TIMEOUT_MS, 45 s), the service retries and then falls back to a lighter model (gemini-2.5-flash-lite) before it surfaces an error.
What this means for validation
A generated form is a draft authored by a person who accepted it. The audit trail records the generation, the designer's edits and the activation; the artefact under control is the form version and its immutable snapshot, the same as a hand-built form. The role assistant creates nothing: every permission it suggests passes the same guardrails as one typed by hand, and the administrator's reason is recorded with the role.
Compliance Q&A
No. The two helpers work at design time on text the person typed. A generated form is created as a draft and enters the study only when a person edits, activates and releases it through the normal gates; a suggested permission is judged by the guardrails and applied only by the administrator.
Limits: the request text is stored as typed, so keeping personal data out of it is the designer's responsibility.
Evidence: server/src/infrastructure/ai (two capabilities, neither takes clinical data)forms-ai and role assistant validate outputthe form is created as a draftsimulation of 20 Oct 2026 (one generated form, one assistant use)
The provider's terms say prompts and responses are not used for training, and the region is a setting (AI_LOCATION). Whether that satisfies a given customer's processor agreement and data-residency rules is the customer's assessment; leave the provider off (AI_PROVIDER=none) if it does not.
Related
AI form generation and the AI workstation · Design forms · Data privacy · Not built yet · Configuration