Protocol deviation management that classifies every deviation the same way, at every site and every CRO
Every deviation classified in minutes, the same way at every site
See one case, screen by screen ↓Software that takes a protocol deviation from the moment a site or CRA reports it to a classification the sponsor stands behind: logged, assessed for importance, acted on and reported in the clinical study report. Protocol Deviation Management adds six agents that read each deviation from CTMS, EDC, IRT and visit reports, classify it against the study's spec, flag its impact and trend sites, for the medical monitor to decide and sign.
How to choose AI solutions for life sciences →
Updated
A Phase 3 study runs through a CRO and an in-house team, and each logs and classifies protocol deviations its own way. The CRA writes up what happened after the monitoring visit, proposes important or not important, and the deviation waits in CTMS for the monthly deviation review meeting. There the medical monitor reads the description, opens the protocol, finds the matching row in the classification specification and decides — about nine days after the deviation was reported.
The risk is in what nobody sees in time. A CRO calls a Week 16 PASI by an untrained assessor not important because the visit was inside the window. A site's staffing gap shows up as 19 out-of-window visits and three untrained-assessor deviations, and none of them stands out on its own. The statistician needs to hear about every participant who may leave the per-protocol set, a possible serious breach has a 7-day clock, and at lock the ICH E3 §10.2 text and the Appendix 16.2.2 listing are rebuilt by hand.
Estimated split for one deviation on a Phase 3 study, by hand at the monthly review and with the solution.
Six agents read, classify, compare, assess, watch and list; the medical monitor decides where a team and the classifier differ.
Northwind Bio runs VLT-302 — Veltrimab in plaque psoriasis, Phase 3, 64 sites and 612 participants. Ashgrove Research runs 40 sites and 24 are in-house. Here is how one deviation at Site 114 is classified and signed, screen by screen, in the working solution.
Maya opens the cause map for VLT-302: 418 deviations, 57 important, touching 196 of 612 participants. Eight causes are drawn as bones, from informed consent to prohibited medicines, with each sub-cause, its count and the important ones in amber. Red rings mark the sub-causes that carry a site alert, and 5 decisions are waiting for her.
“Every deviation classified against one spec, whichever team logged it — CRO or in-house.”
She clicks Visit out of window: 118 deviations, none important, filtered in place under spec row VS-01. The by-site bars light up Site 114, Hillcrest Dermatology in Austin, with 19 of the 118. None of these visits is important on its own; together they are a site problem.
“Site 114 — 19 of the 118 out-of-window visits, 10 of them since Sep 28. That is when Dr. A. Brooks, the site's only trained sub-investigator, went on leave.”
Sync and classify now: the deviation reader takes 3 new records from CTMS, EDC and IRT, the classifier matches each to its spec row, and the precedent finder finds 11 signed decisions, all in agreement. Two are not important at 0.93 and 0.95 and confirm on their own. DV-302-0421 — a site dispensed kit 4417 instead of assigned kit 4471 — is important and goes to Maya, and participant 188-0014 is flagged for per-protocol review.
“3 deviations classified in 21 s. Two confirmed automatically; DV-302-0421 — a wrong kit — needs your decision.”
The deviation log holds every deviation across 3 studies, CRO and in-house in one place. Each row shows the cause and sub-cause, the team's proposal against the classifier's with its confidence, the stage and the status: needs you, disagreement, confirmed or confirmed automatically. Per-protocol flags sit next to the participant.
At the Week 16 visit on 1 Oct the PASI and sPGA were done by the study coordinator, J. Moreno, who is not on the site's assessor training log. Ashgrove proposed not important: the visit was on Day 113, inside the ±3-day window. The classifier says important at 0.94: a primary endpoint visit, not on the training log, spec row EA-03, 3 of 3 precedents. The deviation record, Dana Okafor's visit report and the training log sit beside the scale, each finding highlighted where it came from.
Protocol VLT-302 v5.0, §8.1.2: PASI and sPGA “must be performed by an assessor who has completed the sponsor's PASI/sPGA training and is listed on the site's assessor training log”.
The run shows each step. The deviation reader read the visit report for participant 114-0087. The classifier matched spec row EA-03 and cited protocol §8.1.2. The precedent finder found 3 signed decisions on similar deviations. Because Ashgrove proposed not important, the deviation went to Maya, and the impact assessor flagged 114-0087 for the Week 16 PASI 75 and sPGA analyses — Sam Patel notified.
The classifier must answer both ICH E3 questions — reliability of key data, and participant safety, rights and well-being — and below 0.90 confidence a person decides.
Maya signs important. The reason is drafted from the evidence: the primary efficacy assessment was done by a coordinator not on the training log, and the visit timing does not change that. She signs with her password, and the signature states its meaning.
Meaning: “I confirm the classification of this protocol deviation.”
The decision and its reason go back to Ashgrove Research and Dana Okafor is notified, so she can train the site on it. The per-protocol flag for 114-0087 is confirmed to Sam Patel, and the decision joins the precedent library that the next team's proposals are measured against.
“Signed important · Ashgrove Research log updated · Sam Patel notified.”
The trend watcher recalculates important deviations per 100 participant-visits each night. Site 114 is at 3.1, above the 2.0 threshold: three assessments by staff not on the training log in 58 days, and two more participants reach Week 16 before Oct 30. Each alert proposes one action for Lena — a retraining action for Site 114, a fridge check for Site 131, and a question to Ashgrove, whose sites miss pre-dose pregnancy tests 2.4× as often per site as in-house sites.
“Site 114 — untrained assessor, third time in 58 days.”
The CSR listing writer builds the Appendix 16.2.2 listing by site, then participant, from confirmed decisions only, with the per-protocol status of each: excluded, kept or flagged. 52 of 57 important deviations are confirmed and 5 await a decision. The Section 10.2 draft and the DV domain tabulation sit in the next tabs.
The CSR listing writer uses confirmed decisions only, and every sentence cites the log.
The same deviation, seen by the people who log it, decide it, act on it and report it — what their month looked like, and what it looks like now.
Six agents read, classify, compare, assess, watch and list; the medical monitor decides where a team and the classifier differ.
Reads each deviation from CTMS, EDC, IRT and visit reports and writes one clean record: participant, visit, dates and what happened, in the site's own words, marked with the system it came from.
Assigns cause, sub-cause and importance against the study's classification spec, citing the spec row and the protocol section breached, with a confidence.
Finds the closest signed decisions on similar deviations in the same study and programme, from any CRO, and says how many agree with the proposed classification.
Flags per-protocol set impact, possible serious breaches at EU and UK sites with their 7-day clock, and site alerts.
Recalculates important deviations per 100 participant-visits by site, cause and team each night, and raises an alert with one proposed action when a rule in Settings fires.
Builds the Appendix 16.2.2 listing by site and participant, drafts the Section 10.2 summary with citations and prepares the DV domain tabulation.
Signs where opinions differ. The agents propose; a named person decides.
Ask why something was classified the way it was, which sites are trending, or set a new alert in plain words. Every answer points back to the record.
Why does the agent say DV-302-0412 is important?
Because the Week 16 PASI — the primary efficacy assessment — was done by a study coordinator who is not on the assessor training log. Protocol §8.1.2 requires a trained assessor, and spec row EA-03 classifies this as important. All 3 earlier signed decisions on the same rule were important. Ashgrove called it not important because the visit was inside the window — timing is fine, but it does not fix who assessed. Confidence 0.94. The decision is yours.
What is happening at Site 114?
Site 114 (Hillcrest Dermatology, Austin) has had 3 assessments by staff not on the training log in 58 days — Week 8, Week 12 and Week 16. Its important-deviation rate rose from 0.8 to 3.1 per 100 visits since May, the highest in VLT-302. Two more participants reach Week 16 before Oct 30, so retraining now protects the primary endpoint.
Any possible serious breaches?
One open: DV-302-0410 at Site 163, Valencia — the Week 8 dose was given without the pre-dose pregnancy test. As an EU site it went to Omar Haddad for a serious breach assessment on Oct 2; the 7-day clock ends Oct 9. Importance is agreed: important under CK-01.
Alert me when a site has 3 assessor deviations in 60 days
Done — a trend rule: “Assessor not on the training log: 3 at one site within 60 days”. It alerts you and Lena Ortiz and proposes retraining. It would already fire for Site 114 (3 in 58 days). You can switch it off in Settings.
12 screens from the working solution, on its sample data. Pick one to see it large.
The spec each study is classified against, who decides what, and when a person must look are settings, versioned and on the activity trail.
| Setting | Default | Choose from |
|---|---|---|
| Classification specification | VLT-302 v3.0 · 46 rows, approved Sep 12, 2026 | One versioned spec per study · upload a new version |
| CRO and agent disagree | Dr. Maya Chen | Dr. Maya Chen · Lena Ortiz |
| Eligibility and dosing questions | Dr. Maya Chen | Dr. Maya Chen · Dr. Ravi Menon (back-up monitor) |
| Possible serious breach (EU and UK sites, 7-day clock) | Omar Haddad | Omar Haddad · Lena Ortiz |
| Per-protocol impact | Sam Patel | Sam Patel · Priya Raman |
| Confirm when CRO and agent agree on “not important” | On | On · Off — important deviations always go to a person |
| Minimum agent confidence | 0.90 | Step up or down by 0.01, from 0.80 to 0.99 |
| Quality sample | 10% of automatic confirmations each week | 5% · 10% · 20% |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample study data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (Tufts CSDD, Getz et al., Ther Innov Regul Sci 2022 — 119 deviations on an average Phase 3 protocol, touching about a third of participants; EU Regulation 536/2014 Art. 52 — serious breach notification within 7 days; ICH E3 and its Q&A (R1) on important protocol deviations; FDA draft guidance on protocol deviations, Dec 2024). People, the sponsor, studies, sites and CROs named on this page are fictional — characters and sample data in the working solution.
Software that takes a protocol deviation from the moment a site or CRA reports it to a classification the sponsor stands behind: logged, assessed for importance, acted on and reported in the clinical study report. Protocol Deviation Management adds six agents that read each deviation from CTMS, EDC, IRT and visit reports, classify it against the study's spec, flag its impact and trend sites, for the medical monitor to decide and sign.
The classifier answers the two ICH E3 questions for every deviation — could it significantly affect the reliability of key data, and could it significantly affect the participant's rights, safety or well-being — then matches the study's classification spec row and cites the protocol section breached. It gives a confidence and the closest signed precedents. Every important deviation goes to a person.
Yes. Each team still proposes a classification, but every deviation is read against the same spec row and protocol section whichever CRO logged it. The solution shows each team's agreement with the medical monitor's final call — in the sample data over the last 30 days the classifier is at 96%, the in-house team 91% and the two CROs 86% and 79% — and each signed reason goes back to the team's log.
Yes. The trend watcher recalculates important deviations per 100 participant-visits by site, cause and team each night and raises alerts on your rules: the same cause at a site 3 times in 60 days, a site above 2.0 important deviations per 100 participant-visits, or a team's missed pre-dose tests above twice the study rate. Each alert proposes one action; people decide.
It flags them; it does not decide them. The impact assessor sends a possible serious breach at an EU or UK site to clinical quality with its 7-day due date, and sends every participant who may leave the per-protocol set to the statistician as soon as the deviation is classified.
Yes. The CSR listing writer builds the ICH E3 Appendix 16.2.2 listing grouped by site, drafts the Section 10.2 summary and prepares the DV domain tabulation, from confirmed decisions only, with every sentence citing the log.
Yes. Where a team and the classifier differ, and for every important deviation, the medical monitor signs a decision with a reason and a stated meaning. Automatic confirmation applies only when both sides say not important at 0.90 confidence or higher, 10% of those are re-checked each week, and reopening a signed decision needs a reason.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your protocols, classification specifications and a sample of past deviation logs — and it goes live once every quality gate has passed. We will walk you through it on your own deviations first.
A checked first-draft protocol in days, in your approved language.
1-min demoeTMF Quality CheckAn inspection-ready trial master file every day, each site scored on what is due today.
1-min demoClinical Study Report AuthoringResults drafted within days of database lock, linked to tables.
1-min demoWe'll run Protocol Deviation Management on a sample of your own deviation logs and classification specs.