On June 2, 2025, the FDA officially launched Elsa, a generative AI tool built on a large language model (LLM) platform. Elsa is deployed agency-wide to assist FDA employees, from scientific reviewers to field investigators, in working more efficiently.¹

The FDA described the rollout as the beginning of the agency’s AI era, noting that tasks that previously took days could now be completed in minutes.² Elsa is already being used to expedite clinical protocol reviews, summarize adverse events, perform label comparisons, and identify high-priority inspection targets.^{1, 2, 3}

Most clinical data management (CDM) teams, however, are not optimizing their data infrastructure with AI-assisted workflows in mind. The question is no longer whether clinical trial data will face AI-assisted review; it is whether that data will hold up under it. CDM organizations that invest now in documentation hygiene, audit trail integrity, and consistent metadata practices will be better positioned when regulators arrive, whether human, AI-assisted, or both.

This paper examines what Elsa does and does not do, identifies what these capabilities mean for clinical data teams specifically, connects these developments to the emerging regulatory governance framework, and proposes actionable steps for 2026 and beyond.

Elsa is a LLM-powered AI tool operating within Amazon Web Services’ secure GovCloud environment.³ The FDA has emphasized that Elsa does not train on confidential data submitted by regulated industry; it queries only internal FDA data stores, which include adverse event databases such as the FDA Adverse Event Reporting System (FAERS) and Manufacturer and User Facility Device Experience (MAUDE), inspection histories, and clinical study records.^{1, 3, 4}

At launch, the tool’s capabilities included accelerating clinical protocol reviews and shortening the time needed for scientific evaluations, summarizing adverse events to support safety profile assessments, identifying high-priority inspection targets by analyzing patterns across regulatory data, performing faster drug label comparisons, and generating code for internal database development.^{1, 2, 5} In December 2025, the FDA expanded its AI strategy further with an agency-wide agentic AI platform designed to support more complex, multi-step regulatory workflows while maintaining human oversight.⁶

It is important to understand Elsa’s limitations. The tool has experienced accuracy challenges, including generating references to studies that do not exist, a well-documented hallucination risk inherent to large language models.^{3, 7} Anonymous FDA staffers have reported that Elsa cannot yet reliably assist with substantive review work, and external observers, including the law firm Hogan Lovells, have raised questions about what oversight governs the tool’s outputs and whether benchmarks exist for evaluating its performance.^{3, 8} These limitations mean that Elsa’s outputs function as investigative signals for FDA reviewers, not as final regulatory determinations. However, those signals will increasingly shape where and how deeply human reviewers focus their attention.

Based on the developments outlined above, we recommend the following actions for CDM organizations in 2026 and beyond:

Conduct an internal review of adverse event coding consistency, protocol deviation documentation, and metadata completeness across active studies. Identify patterns that an AI summarization tool would flag as anomalies and remediate them proactively.

Consider a multi-site oncology trial where Site A documents neutropenia-related dose modifications as protocol deviations using the term “dose reduction due to hematologic toxicity,” Site B records the same clinical scenario as “dose held – ANC below threshold,” and Site C logs it as a free-text narrative referencing the lab value without categorizing it as a deviation at all. Each site is documenting the same clinical event, but the inconsistent terminology, categorization, and completeness across the three records means that an AI tool scanning deviation logs and adverse event narratives in aggregate would identify these as potentially different safety patterns rather than a single, well-managed clinical scenario. The result is a flag, not because something went wrong clinically, but because the documentation does not tell a coherent story across sites.

This kind of terminology drift is common in multi-site and multi-regional trials, particularly where sites are working from different institutional templates or where CRF completion guidelines lack specificity on preferred terminology. A proactive audit should examine adverse event preferred term consistency across sites and coding dictionaries; deviation categorization alignment (ensuring comparable clinical events are classified using harmonized terminology); free-text narrative fields for undercoded or inconsistently described events; and metadata completeness in audit trails, particularly timestamps, user attribution, and reason-for-change entries. Table 2 provides a practical audit checklist mapping common CDM data elements to the types of inconsistencies that AI summarization tools are designed to detect.

Every SOP governing a process that incorporates AI, whether for data cleaning, coding, signal detection, or report generation, should specify the point at which a qualified professional reviews the output before it is acted upon. As Ghosh and Huang recommend, organizations should develop scoring guidelines from test prompts to categorize AI responses and clearly specify which tasks require human intervention.¹⁴

For each AI tool in use or under evaluation, document its intended context of use, the risk classification based on the ten FDA–EMA principles, the validation approach aligned with GAMP 5 and the ISPE AI Guide, and the human oversight controls in place. This mapping exercise creates an auditable record that demonstrates governance maturity.

Elsa’s ability to scan across submissions means that inconsistencies between a sponsor’s data and a CRO’s documentation will surface together. Proactive alignment meetings with counterparts to harmonize coding conventions, audit trail standards, and deviation documentation practices can reduce inspection risk for all parties.

Building internal understanding of how AI-assisted review works, and which signals it may elevate, benefits not only CDM teams but also regulatory, clinical operations, and quality assurance functions.¹⁰ Cross-functional teams that understand the interaction between their data, AI review tools, and regulatory expectations can identify and resolve issues earlier in the submission lifecycle.

Elsa is the most prominent AI tool announcement by a regulatory body, but certainly not the last one. The FDA has already expanded beyond Elsa to agentic AI platforms capable of multi-step regulatory workflows,⁶ and the EMA is advancing its own AI strategy aligned with the joint guiding principles.¹¹ The regulatory AI landscape will continue to evolve, and it would be prudent for CDM teams to assume that the scrutiny enabled by tools like Elsa will deepen, not diminish.

Organizations that build inspection-ready data infrastructure that is characterized by consistent documentation, explicit human oversight protocols, and validated AI governance frameworks will be better positioned as regulatory AI capabilities mature. The convergence of the FDA–EMA principles, GAMP 5, and the emergence of tools like Elsa creates a clear signal: the era of AI-assisted regulatory oversight has arrived, and clinical data teams should prepare accordingly.

The author acknowledges the use of Claude, an AI assistant developed by Anthropic, to support research, source identification, and drafting during the preparation of this manuscript. All content was subsequently reviewed, verified for factual accuracy, and edited by the author to ensure alignment with professional standards and the author’s own analysis and opinions. The use of AI-assisted tools in the preparation of this work is consistent with the principles of human oversight discussed within the paper itself.