AI Clinical Study Report Automation: SDTM to Module 5

The clinical study report (CSR) is the single largest, most structured piece of writing a drug sponsor produces, and it sits at the exact point where two very different worlds meet: tabular clinical data and regulatory prose. On one side sit the CDISC data standards, chiefly the Study Data Tabulation Model (SDTM) and the Analysis Data Model (ADaM), which discipline how trial data is collected, organized, and analyzed (^[1]). On the other side sits ICH E3, the 1996 guideline that still governs the structure and content of a CSR today (^[2]), and eCTD Module 5, the section of the electronic Common Technical Document where the finished report and its supporting data are filed with regulators (^[3]).

Generative AI is now being layered onto this pipeline in a handful of concrete ways: drafting narrative text from ADaM-derived tables, generating and quality-checking tables, listings, and figures (TLFs), cross-checking consistency between the numbers in a CSR and the underlying datasets, and triaging regulatory intelligence so writers do not have to manually track every agency requirement. Vendors including Certara, IQVIA, ArisGlobal, Parexel, Cytel, and Formedix have all shipped or announced generative AI features aimed at some part of this workflow, with claimed efficiency gains that range from twenty to sixty percent on specific sub-tasks such as medical writing time or site selection (^[4]).

None of this changes the underlying regulatory requirement: a CSR must still conform to ICH E3, still be traceable back to SDTM and ADaM, and still survive a human medical writer's and statistician's sign-off. The FDA's January 2025 draft guidance on AI in regulatory submissions applies a risk-based credibility framework to any model whose output feeds a submission (^[5]), and EMA's parallel reflection paper insists on a human-centric approach to AI across the medicine lifecycle (^[6]). The practical state of the art in mid-2026 is closer to AI-assisted first drafts and automated consistency checking than to any kind of autonomous CSR generation, and the published literature on large language models in clinical documentation continues to flag hallucination and validation gaps as the binding constraint (^[7]).

A clinical study report is the document a sponsor files to demonstrate that a specific trial was conducted, analyzed, and reported honestly enough that a regulator can rely on it to support (or fail to support) an approval decision. ICH describes the CSR as the single most important document a sponsor submits to support a new drug or biologic application (^[8]). A pivotal Phase 3 CSR for a modestly complex trial commonly runs several hundred pages of narrative plus thousands of pages of appendices, tables, and listings, all of which must trace back to a locked, validated clinical database.

That traceability requirement is why CDISC exists. The Clinical Data Interchange Standards Consortium is a global not-for-profit that develops universal standards for data collected during clinical research (^[9]), and its foundational standards, principally SDTM and ADaM, are what let a CSR's tables and narrative be regenerated, audited, and cross-checked years after database lock. SDTM has been a required FDA data standard for NDA, ANDA, and certain BLA submissions since December 2016, and PMDA in Japan requires it as well (^[1]). ADaM, layered on top of SDTM, is what actually drives the statistical programming that produces tables, figures, and listings, and both FDA and PMDA require it for regulatory submissions (^[10]).

The document that turns those datasets into a narrative regulators can read is structured by ICH E3, a guideline first adopted by ICH in 1995 and by FDA on July 17, 1996, that is still in force (^[2]). The guideline is explicitly a guideline and not a rigid template: it aims to allow the compilation of a single core clinical study report acceptable to all regulatory authorities of the ICH regions, with a core report and a set of appendices, some of which are regional and submitted only on request (^[11]). That single-core-report principle is what makes worldwide simultaneous filing practical, and it is also what makes the CSR such an attractive automation target: a standardized structure is exactly the kind of input generative AI systems handle best.

Where the CSR physically lands is eCTD Module 5, the clinical section of the electronic Common Technical Document. Module 5 contains the clinical study reports and related clinical data from the development program, organized per ICH M4E(R2) into a tabular listing of all studies (5.2), the individual clinical study reports themselves categorized by type (5.3), and literature references (5.4) (^[12]). Within 5.3, section 5.3.5, covering the efficacy and safety studies, is generally considered the single most important section in Module 5, since it contains the full clinical study reports for the pivotal, adequate and well-controlled trials that carry the approval decision (^[12]). The FDA's M4E(R2) guidance for the CTD's efficacy module explains how the Clinical Overview and the Clinical Summary reference back to those individual ICH E3 study reports (^[13]), and current practice, rather than filing a CSR as one monolithic document, recommends dividing it into synopsis, report body, and individual appendices so that reviewers can navigate it and sponsors can update pieces without resubmitting the whole thing (^[14]).

Every number that appears in a CSR narrative or table originates, at least in principle, from an ADaM dataset, and every ADaM dataset originates from SDTM. SDTM organizes raw collected data (from an EDC system, a lab vendor, an ECG core lab, and so on) into standardized domains: demographics, adverse events, concomitant medications, laboratory results, and dozens more, each following the CDISC Study Data Tabulation Model Implementation Guide (SDTMIG), currently at version 3.4 (^[15]). ADaM datasets are then created from SDTM data, frequently drawing on multiple SDTM domains at once, and are named using a consistent ADxxxx convention where xxxx typically echoes the source SDTM domain (^[10]). The point of this second layer is that ADaM datasets are meant to be analysis-ready: they drive the statistical programming process that creates tables, figures, and listings more efficiently and with improved traceability (^[10]), and the CDISC ADaM Implementation Guide (ADaMIG, currently version 1.3) formalizes traceability as a foundational principle: any analysis result must be explainable by tracing back through the ADaM dataset to its SDTM source (^[16]).

CDISC's Define-XML standard, and specifically its Analysis Results Metadata (ARM) extension, is the piece that closes the loop between a specific CSR table or figure and the exact ADaM variables and analysis method that produced it. ARM establishes a standard format identifying key analyses, the analysis methods used, and the ADaM datasets and variables involved, and it explicitly supports regulatory review by linking results, documentation, and data together so a reviewer can verify how and why a given result was generated (^[17]). ICON's own technical writing on ARM makes the same point: it provides traceability for selected analysis results back to the data used as input, and when embedded in Define-XML it gives end-to-end traceability from data collection through to the final analytical conclusions reviewers see in the CSR (^[18]).

This is why "AI clinical study report automation" is really a data-lineage problem before it is a natural-language-generation problem. A model that drafts a safety narrative sentence like "12 (4.2%) of subjects in the treatment arm experienced a treatment-emergent adverse event of Grade 3 or higher" is only trustworthy if that number can be regenerated deterministically from the ADaM ADAE dataset, and any automation layer has to sit on top of, not instead of, the SDTM-ADaM-ARM traceability chain that CDISC and the regulators already require. Metadata repository vendors such as Formedix build their automation precisely on this principle, letting sponsors define SDTM and ADaM mappings, generate datasets, and validate studies against CDISC standards without manual coding (^[19]), and Formedix has continued expanding specifically to meet growing demand for this kind of clinical trial automation (^[20]).

ICH E3 lays out a report structure spanning roughly sixteen major numbered sections: title page and synopsis, table of contents and abbreviations, ethics, investigators and administrative structure, an introduction and study objectives, the investigational plan, the study population, efficacy evaluation, safety evaluation, a discussion and overall conclusions section, and appendices (^[8]). ICH's own E3 Questions and Answers document exists specifically because sponsors kept interpreting the guideline's flexible language inconsistently, and it is periodically updated to clarify implementation questions raised over nearly three decades of use (^[21]).

Once a CSR is finished, it does not simply get attached as a PDF. eCTD Module 5 requires every study referenced anywhere in the submission to appear on a single comprehensive tabular listing in section 5.2, covering the study number, title, type, design, patient population, subject counts, dosing regimen, duration, and status, cross-referenced to its eCTD location (^[12]). Section 5.3 then files the actual CSRs by category, from bioavailability and bioequivalence studies (5.3.1), through pharmacokinetic (5.3.3) and pharmacodynamic (5.3.4) reports, to the efficacy and safety studies in 5.3.5 that carry the approval argument, post-marketing experience reports (5.3.6), and case report forms or individual patient listings (5.3.7) (^[12]). The FDA's eCTD Technical Conformance Guide sets out the file-format, granularity, and hyperlinking rules that make this navigable at agency scale (^[22]), and the eCTD v4.0 comprehensive table of contents heading hierarchy is the living reference for exactly where each document type belongs (^[23]).

Practically, this granularity requirement is a major source of submission defects. Reviewers repeatedly flag hyperlinks that point at a folder instead of an individual document, since hyperlinks can only be made to individual documents, not to section folders (^[14]), and consolidating sections that should stay separate (for example, combining drug substance sections) means that any future update forces resubmission of the entire consolidated module rather than just the changed piece (^[14]). FDA-focused regulatory operations guidance is correspondingly specific about hyperlinking hygiene: anchor text should describe what it links to rather than reading "click here," links must be verified functional before submission, and every cross-reference to a document in another module should itself be hyperlinked (^[24]). This is precisely the kind of rules-based, high-volume, low-creativity checking task where deterministic automation and narrow AI classifiers already do reliable work, well ahead of where generative narrative drafting has gotten to.

The most mature commercial application is AI-assisted first-draft generation of standardized document sections. Certara's CoAuthor product, built around what the company describes as a purpose-built biomedical GPT layered into Microsoft Word with eCTD templates, is marketed explicitly for drafting patient narratives, clinical study reports, protocols, synopses, and toxicology reports, with the company citing greater than ninety percent accuracy on the tables, listings, and figures it helps generate and efficiency gains of up to forty percent in drafting time (^[25]). Certara separately markets a Pinnacle 21 automation suite aimed at removing manual case report form creation, annotation, data entry, and validation from the clinical data management side of the pipeline (^[26]).

A second cluster of applications sits in regulatory intelligence and consistency checking rather than drafting per se. ArisGlobal's LifeSphere platform layers generative AI, agentic workflows, and a cognitive computing engine (branded NavaX) across the regulatory information management lifecycle, with a chatbot that lets regulatory teams ask what a health authority has recently required and get answers with links back to the specific source document and page for verification, rather than an unverifiable summary (^[27]). In pilot use, ArisGlobal has reported roughly ninety percent accuracy and fifty percent faster processing on this kind of regulatory-intelligence lookup and drafting task compared to manual review (^[28]).

IQVIA and NVIDIA have taken the furthest step toward agentic, multi-step automation, announcing a set of orchestrator AI agents that NVIDIA's chief executive has described as the largest automation platform for clinical trials to date (^[29]). One of those agents, focused on clinical data review, is claimed to cut review duration from about seven weeks to as little as two through automated checks handled by specialized sub-agents doing speech-to-text transcription, clinical coding, structured data extraction, and summarization, with human experts retaining oversight of the orchestration (^[29]). IQVIA's broader public framing of AI in clinical operations emphasizes connecting disparate data streams, labs, claims, and EMR data, into insights while explicitly keeping humans in the loop for decision-making (^[30]).

Parexel has gone furthest in publishing task-level efficiency numbers specifically tied to CSR production. Its ParexelAI suite, launched under what the company calls a human-in-the-lead model, claims a thirty percent reduction in medical writing time specifically for clinical study reports, a twenty percent reduction in safety literature screening time, and, through a partner integration, up to a sixty percent reduction in IND and NDA authoring timelines, while explicitly positioning the AI as amplifying rather than replacing the judgment of its clinical and regulatory staff (^[4]). A contemporaneous industry report covered by Forbes cautions that these tools cannot fix clinical trials without the right people in place to supervise them, underscoring that the vendor efficiency claims assume continued expert review rather than a headcount-free pipeline (^[31]).

On the biostatistics and data-management side, Cytel frames AI's near-term value in narrower, more mechanical terms: spotting outliers, inconsistencies, and missing or duplicate data during cleaning, flagging fraud patterns such as identical dosing times across every patient at a site, and translating plain-text edit-check specifications into programmed edit checks to shorten database build timelines, with medical writing and statistical programming automation described as an emerging rather than mature capability (^[32]). This is a useful corrective to the more sweeping vendor marketing elsewhere in the sector: most of what is operational today is pattern detection and first-draft generation bounded by a human review step, not autonomous end-to-end CSR authorship.

Regulators have been explicit that they are watching this shift rather than blessing it wholesale. FDA's CDER has logged more than one hundred drug and biologic submissions in a single reported year that included some AI or machine learning component, spanning discovery through postmarket surveillance (^[33]), and its January 2025 draft guidance, "Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products," lays out a seven-step, risk-based credibility framework: define the question the model addresses, define its specific context of use, assess its risk level, build and execute a credibility-establishment plan, document results and deviations, and determine adequacy for that specific use (^[34]). That framework explicitly covers AI models used in the clinical and post-marketing phases where their output is meant to support a safety or efficacy conclusion, while carving out drug discovery and pure operational-efficiency uses that do not touch patient safety, drug quality, or study reliability (^[5]). A draft-guidance credibility framework is a fairly narrow needle to thread for a general-purpose large language model drafting free-text narrative, since the "context of use" concept was designed around quantitative models (population-PK, disease progression simulators) rather than open-ended text generation, and FDA and EMA have jointly published ten guiding principles of good AI practice meant to help developers think through exactly this kind of gap (^[35]).

EMA's parallel reflection paper on AI across the medicinal product lifecycle, adopted after a 2023 draft consultation and developed jointly by EMA's Big Data Steering Group with its human and veterinary medicines committees, takes essentially the same stance: AI tools that draft, compile, translate, or review data in support of an authorization dossier are explicitly in scope, but a human-centric approach should guide all development and deployment of AI and machine learning, and developers whose models could plausibly move the benefit-risk balance of a medicine are told to seek early regulatory dialogue rather than deploy first and ask later (^[6]). The reflection paper's own scope statement covers everything from drug discovery and non-clinical development through clinical trials, manufacturing, and post-authorization use, including pharmacovigilance case management, which puts CSR-adjacent drafting activity squarely inside the paper's remit rather than in some ungoverned gray zone (^[36]).

The academic literature backs up the regulators' caution rather than the more optimistic vendor copy. A 2026 mini-review of generative AI in clinical settings found that AI systems translating imaging or structured data into narrative text show a persistent tendency to hallucinate clinical findings, describing factual grounding as a critical bottleneck that has to be solved before generative AI can be safely embedded in routine care, and it explicitly calls for robust validation, interpretability tooling, and governance frameworks as prerequisites rather than nice-to-haves (^[7]). A separate applied framework for generative-AI-assisted clinical data processing describes large language models functioning as a layer that helps design and deploy extract-transform-load pipelines for behavioral and clinical research data, a more modest, tool-assisted framing than "AI writes the CSR" (^[37]). Trade coverage aimed at medical writers and regulatory affairs professionals converges on the same message: generative AI is best deployed today for first drafts, summarization, and literature screening inside a workflow where a qualified human still owns the final sign-off on anything filed with a health authority (^[38]).

Two structural facts keep the human-in-the-loop requirement from being merely cautious box-checking. First, ICH E3 itself is not a fill-in-the-blank template; it is a flexible guideline whose intent is a report that is complete, free from ambiguity, well organized, and easy to review, which means judgment calls about what to include, how to frame a discrepant result, and how to phrase a safety conclusion remain inherently interpretive rather than mechanical (^[11]). Second, the SDTM-to-ADaM-to-CSR chain is only as trustworthy as its weakest traceability link, and CDISC's own ADaM guidance treats traceability, the ability to explain any analysis result by tracing back through the dataset to its SDTM source, as a foundational, non-negotiable principle rather than a best practice (^[16]). An AI system that drafts plausible-sounding narrative text without being wired into that traceability chain is producing something that looks like a CSR passage without being one in the regulatory sense.

The near-term trajectory looks like incremental automation of well-bounded sub-tasks rather than a single leap to autonomous CSR generation. Table, listing, and figure drafting from validated ADaM datasets is the most tractable target, because the mapping from structured data to a table cell is close to deterministic and can be checked programmatically, which is presumably why Certara markets a measurable TLF accuracy figure rather than a narrative-accuracy figure (^[25]). Narrative drafting for lower-stakes sections, patient disposition summaries, demographic descriptions, protocol deviation listings, is a reasonable next tier, since these sections are more formulaic and less consequential for the ultimate efficacy or safety conclusion than the discussion and conclusions section that ICH E3 places at the center of the report (^[8]).

Consistency checking, verifying that every number quoted in the narrative matches its source ADaM value, that every hyperlink in the Module 5 filing points to a document rather than a folder, that every study referenced in the body appears on the section 5.2 tabular listing, is arguably a better near-term automation target than drafting at all, because it is a verification task with a ground truth (the locked database and the existing filing structure) rather than a generation task with no single correct answer. The recurring, well-documented eCTD defects around hyperlink granularity and section consolidation are exactly the kind of rules-based error that a narrow, deterministic checker (AI-assisted or otherwise) can catch before submission far more cheaply than a health authority review cycle can (^[14]).

Regulatory acceptance will likely keep pace with, and possibly lag, the FDA's and EMA's own credibility and risk frameworks rather than industry's product roadmaps. The FDA's seven-step credibility framework and the FDA-EMA joint guiding principles were built with quantitative and simulation models chiefly in mind, and the agencies have said comparatively little in public guidance about how that framework applies to a large language model whose "model risk" is qualitative (a hallucinated clinical claim in prose) rather than numerical (a wrong dose-response prediction) (^[35]). Sponsors experimenting with generative narrative drafting for filed documents should expect to need bespoke validation packages, and EMA's advice to seek early scientific dialogue for any AI use that could plausibly move a benefit-risk assessment applies with particular force here (^[6]).

The vendor landscape itself is likely to consolidate around the data layer rather than the writing layer. Metadata-repository and automation platforms that already sit inside the SDTM/ADaM pipeline, Formedix, Certara's Pinnacle 21, and comparable tools, have a structural advantage over pure drafting assistants, because they can ground any generative output in the same validated, traceable dataset that a reviewer will eventually check against (^[19]). Agentic, multi-tool orchestration of the kind IQVIA and NVIDIA have announced, where a data-review agent, a coding agent, and a summarization agent hand off to each other under human supervision, looks like the more probable near-term architecture for CSR-adjacent automation than a single end-to-end model asked to produce a finished report (^[29]).

AI-assisted CSR automation in 2026 is real, commercially available, and already producing measurable time savings on specific, well-bounded sub-tasks: first-draft table and narrative generation, regulatory-intelligence lookup, data-review triage, and consistency checking between datasets and text. It is not, and does not yet claim to be, a replacement for the ICH E3 structure, the SDTM-to-ADaM traceability chain, or the human medical writer, biostatistician, and regulatory reviewer who sign off on a submission. The FDA's and EMA's parallel frameworks make clear that any AI output feeding a Module 5 filing has to earn its credibility against a documented, risk-based standard, not just against a vendor's efficiency benchmark (^[5]). For sponsors, the more durable investment is probably in the boring half of this problem, clean, well-governed SDTM and ADaM pipelines with real Define-XML and ARM traceability, since that is the substrate every credible drafting or checking tool, generative or otherwise, ultimately has to sit on top of (^[17]).