TraceDraft

What Source Traceability Actually Means

Most concerns about AI in regulatory writing are about tone. Tone is not the risk. The risk is a sentence that reads well, sounds correct, and is not supported by the data it refers to — because an obvious error gets caught and a fluent one does not, particularly on page 180 of a document a reviewer has read four versions of.

TraceDraft is built so every factual statement carries its provenance: the table, listing or dataset value it came from. A reviewer confirms it in place rather than leaving the document to hunt for a source. That changes review from reading for plausibility into checking against a source, which is the only form of review that holds at length.

It also changes what happens when the data changes, which it always does. A re-run analysis, a corrected dataset, a late query resolution. Where statements are linked to sources, the statements affected by a changed table are identifiable. Where they are not, somebody re-reads the document and hopes.

The Documents It Drafts, and the Ones It Does Not

Clinical Study Reports, protocols and their amendments, Investigator Brochures, DSURs, safety narratives, and Clinical Evaluation Reports under EU MDR. The common property is that each is largely a structured restatement of material that already exists — the tables are produced, the analyses are run, the protocol said what would be done.

What it does not draft is the interpretation. The benefit-risk discussion, the clinical conclusions, causality assessment on an individual event, and the company comment are judgements a qualified person makes and signs. A system that drafts the descriptive sections and leaves those fields is working correctly. One that proposes a conclusion is doing something categorically different and should be assessed as such.

Consistency Across Three Hundred Pages

Ask a medical writer what consumes a submission cycle and the answer is rarely the first draft. It is reconciliation: the same figure appearing in the synopsis, the body, a table and the discussion, and making all four agree after the third data refresh.

This is mechanical work that people do badly, not through carelessness but because it requires holding hundreds of pages in mind at once. It is also the work most likely to produce a finding, because an inconsistency between the synopsis and the body is the first thing a reviewer notices and the thing they draw conclusions from.

Checking consistency against source rather than against other prose is a larger practical gain than generating the first draft, and it is the part that is least impressive to demonstrate.

Review That Is Genuinely Review

Human-in-the-loop is claimed by every vendor in this category and demonstrated by few. The question is not whether a person reviews the output. It is whether rejecting it is as easy as accepting it, because people defer to automated output and that tendency strengthens the longer the system is usually right.

So the review gate is enforced by the system rather than by a procedure: output cannot reach an approved state without a qualified signature, and the reviewer sees the source alongside the statement. If accepting is one click and rejecting takes a justification, a reassignment and a conversation, the control has a thumb on the scale whatever the SOP says.

21 CFR Part 11 Posture, Not a Part 11 Claim

Documents produced here are regulated records, so the controls are the ordinary ones and they have to be real: attributable actions, a tamper-evident audit trail, electronic signatures that meet the requirement rather than resembling it, and retention that keeps the original reachable rather than only the derived version.

Worth stating plainly, because the category is noisy about it: no regulator certifies software as Part 11 compliant. A vendor can make compliance easier or harder; the validated state belongs to your implementation, in your process, for your intended use.

Validating AI That Writes Regulatory Documents

A tool producing submission content is a computerised system and validates on the usual terms, with additions specific to AI. A stated intended use including what it is explicitly not for. Acceptance criteria defined before evaluation rather than after seeing results. An evaluation set with known-correct outputs that gates each release.

And one test the generic quality measures will not give you: a specific check for statements unsupported by source. An average accuracy figure hides the occasional fabricated reference, and an occasional fabricated reference in a regulatory document is the entire risk. Plus drift monitoring with a threshold set in advance, and a fallback path that has been exercised rather than documented.

Built for CROs and Multiple Sponsors

Strict client-by-client isolation, so a CRO or an enterprise team can run many studies and sponsors on one platform without the data of one reaching another. For a service organisation this is usually the first question asked and the one that decides the evaluation.

The AI provider is swappable by design. Starting today does not commit you to a particular model for the life of the contract, and moving later does not mean touching your workflows or rewriting your SOPs.

What Arrives With the Document

Drafts leave the system with their traceability and QC record attached, so the inspection posture travels with the document rather than being assembled afterwards from memory and email.

The practical test of whether that matters: pick a sentence in a submitted report and ask which dataset value it rests on. If answering takes an afternoon, the evidence existed and was not kept. If it takes a moment, that is the difference this is built to produce.