AI in Clinical Trials and GDPR: Legal Basis, Data and Compliance

Updated: October 2026

When a clinical trial uses AI to select patients, analyse results or review data, the AI tool processes health data about trial participants. That data falls under a special category under Article 9 of the GDPR, so processing requires a legal basis under Article 6 and a separate condition under Article 9.

The rules that apply have moved since this article was first published in 2024. The EDPB adopted an opinion on AI models in December 2024, EMA and FDA published joint AI principles in January 2026, and the EDPB issued draft guidelines on scientific research in April 2026. The European Commission has also proposed new AI obligations for trial sponsors.

This guide sets out what each of those documents says and what it means for sponsors, CROs and research sites.

Key Takeaways

• The GDPR and the Clinical Trials Regulation (CTR) apply at the same time. The EDPB says the CTR is a sectoral law with no derogations from the GDPR.

• Legal basis depends on the purpose. Safety reporting and archiving rest on legal obligation. Research activities need a separate basis, and the EDPB says consent will not be appropriate in most cases.

• Training or fine-tuning an AI model on trial data is a separate processing purpose that needs its own legal footing. The EDPB says a model trained on personal data cannot always be treated as anonymous.

• The AI Act exempts AI built for the sole purpose of scientific research, and the exemption is narrow. The European Biotech Act, still a proposal, would add AI obligations for sponsors on top of the AI Act.

The GDPR and the Clinical Trials Regulation Apply Together

The CTR sets the rules for running trials across the EU. It contains data protection provisions, but it does not replace the GDPR. In Opinion 3/2019, the EDPB states that both laws apply simultaneously and that the CTR is “a sectoral law containing specific provisions relevant from a data protection viewpoint but no derogations to the GDPR.”

Any AI tool added to a trial inherits that position. The sponsor and investigator still have to name a legal basis, meet the transparency rules and protect participants’ rights, whatever the tool does.

Legal Basis Depends on What the Data Is Used For

The EDPB’s Opinion 3/2019 splits trial processing into two groups, and each has a different legal basis.

Safety reporting, archiving and inspections rest on legal obligation.

Processing that the CTR itself requires counts as a legal obligation under Article 6(1)(c) GDPR. The EDPB names safety reporting under Articles 41 to 43 CTR, archiving of the trial master file for 25 years under Article 58 CTR, and disclosure to national authorities during an inspection. The matching Article 9 condition is public interest in public health under Article 9(2)(i).

Research activities need a separate legal basis

Processing that serves the research itself cannot rest on a legal obligation. The EDPB lists three options depending on the trial: a task in the public interest under Article 6(1)(e), the controller’s legitimate interests under Article 6(1)(f), or explicit consent under Article 6(1)(a) and 9(2)(a). For health data, the Article 9 condition is either 9(2)(i) or 9(2)(j), the scientific research condition.

Consent to take part in a trial is not GDPR consent

The EDPB is direct on this point. Informed consent under the CTR is an ethical safeguard and “not conceived as an instrument for data protection compliance.” It also warns that where an imbalance of power exists between sponsor and participant, GDPR consent is not freely given. Its example includes participants who are not in good health. It concludes that consent “will not be the appropriate legal basis in most cases.”

An AI tool therefore needs a place on this map. A tool that supports safety monitoring sits with the legal obligation group. A tool used to analyse data for research sits with the research group and needs one of the three bases above.

The EDPB’s 2026 Research Guidelines Add Detail

On 15 April 2026, the EDPB adopted Guidelines 1/2026 on processing personal data for scientific research. The guidelines are a version for public consultation, so that the final text may change.

Several points matter for AI in trials:

• Six factors define scientific research. These are a methodical and systematic approach, adherence to ethical standards, verifiability and transparency, autonomy and independence, a research objective that contributes to society’s knowledge, and potential to add to scientific knowledge. If all six are met, the activity can be presumed to be scientific research. Otherwise, the controller has to justify the claim.

• Commercial research can qualify. The guidelines state that research may also aim to further commercial interests. Their first worked example is a pharmaceutical company’s clinical trial run to GCP standards, which they treat as scientific research.

• Further processing is presumed compatible. Using data for further scientific research does not require a purpose compatibility test, but the controller still has to check that the processing is lawful.

• Consent can be broad or dynamic. Where research purposes are not fully known at collection, broad consent is possible with ethical safeguards. Dynamic consent lets participants agree to individual projects as they become defined.

• Safeguards are expected. Use anonymised or pseudonymised data where the research purpose allows. Directly identifying data is permitted only where strictly necessary and proportionate. Other safeguards include secure processing environments, privacy-enhancing technologies and independent ethical oversight.

• Roles must be documented. Where several entities take part, such as a sponsor, a CRO, and an AI vendor, the guidelines say responsibility must be assessed and documented.

Reusing Trial Data to Train AI Needs Its Own Legal Footing

Reusing participants’ data to develop an AI model goes beyond running the trial. Opinion 3/2019 says that further use of trial data for scientific purposes outside the protocol needs another specific legal ground, which may or may not differ from the one used for the trial. It adds that the presumption of compatibility in Article 5(1)(b) GDPR should not be excluded in all circumstances, and that all other data protection obligations still apply.

Whether a given AI development project counts as scientific research depends on those six factors; the 2026 guidelines include an example of a start-up and a university studying bias in generative AI that meets them. They also include a retailer’s marketing analysis of customer data as an example that does not qualify.

AI Models Trained on Personal Data May Not Be Anonymous

In Opinion 28/2024, adopted in December 2024, the EDPB addresses AI models trained on personal data. It holds that such models cannot, in all cases, be considered anonymous. Anonymity has to be assessed case by case. For a model to be anonymous, both the likelihood of extracting personal data from the model and the likelihood of obtaining such data through queries must be insignificant.

For trial data, this affects any model trained or fine-tuned on participant records. A vendor’s claim that its model is anonymous is not enough on its own. Supervisory authorities can review the supporting documentation.

The opinion also covers legitimate interest. It sets a three-step test: identify a legitimate interest, show the processing is necessary, and show that data subjects’ rights do not override the interest. It treats data subjects’ reasonable expectations as part of the balance. For a deployer using a model built by someone else, it says the deployer should assess whether the model was developed through unlawful processing, as part of its accountability obligations.

The AI Act Research Exemption Is Narrow

The AI Act applies alongside data protection law. Two exclusions in Article 2 are relevant to research. Article 2(6) excludes AI systems and models, including their output, “specifically developed and put into service for the sole purpose of scientific research and development.” Article 2(8) excludes research, testing and development activity before a system is placed on the market, but states that that exclusion does not cover testing in real-world conditions.

An AI tool built for a single research project can fall outside the Act. A commercial tool that a sponsor buys and uses in a trial is a different case, and the answer depends on how the tool is classified.

Timing has also moved. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. According to Sidley, the high-risk obligations for stand-alone systems under Annex III now apply from 2 December 2027. High-risk systems embedded in regulated products, such as AI-enabled medical devices, apply from 2 August 2028.

Regulators Expect Documented, Risk-Based Use of AI in Drug Development

Two sets of guidance apply directly to medicines development, and neither is legally binding.

EMA’s reflection paper on AI in the medicinal product lifecycle, published in September 2024, recommends a risk-based approach. It introduces the terms “high patient risk” and “high regulatory impact” and stresses data governance and bias control. Sidley summarises its main principles.

In January 2026, EMA and the FDA published ten joint guiding principles of good AI practice in drug development. They include a risk-based approach, a clearly defined context of use, and data governance and documentation. The sixth principle says data source provenance and processing steps must be documented, and that “privacy and protection for sensitive data” must be maintained throughout the technology’s life cycle.

The European Biotech Act Would Add AI Obligations for Sponsors

On 16 December 2025, the European Commission proposed the European Biotech Act. It would amend the CTR in several ways, including a new Article 27e on using AI in clinical trials.

According to the EDPB and EDPS Joint Opinion 3/2026, the proposed Article 27e would require a sponsor to evaluate the benefits and risks to patient safety and data robustness arising from AI, and to describe in the protocol the purpose of the AI tool and the process in which it is used. The proposal would also amend CTR Article 93 to set a single legal basis for sponsors’ and investigators’ processing.

The EDPB and EDPS support harmonising the rules. Their recommendations include:

• Requiring pseudonymisation whenever direct identification is not necessary.

• Clarifying whether sponsors and investigators are sole or joint controllers.

• Limiting the 25-year retention period to personal data in the trial master file.

• Stating that the Article 27e obligations apply in addition to the AI Act.

• Requiring EMA to work with the EDPB on AI guidelines for trials where personal data is involved.

The proposal has not been adopted. Sponsors should treat it as a directional indication.

The European Health Data Space Will Open Trial Data for Secondary Use From 2029

The European Health Data Space Regulation, Regulation (EU) 2025/327, entered into force on 26 March 2025. According to McCann FitzGerald, most secondary-use provisions apply from March 2029.

Data from completed clinical trials, investigations and studies is one of the listed categories that health data holders must make available through a health data access body. Permitted purposes include scientific research, defined broadly enough to cover the training, testing, and evaluation of algorithms in AI systems.

Individuals will have the right to opt out of secondary use. Applicants requesting pseudonymised data must justify why anonymised data would not suffice and describe how the processing complies with the GDPR.

Sponsors Can Take Practical Steps Now

None of this requires waiting for the final text of the Biotech Act or the 2026 guidelines. These steps follow directly from the sources above:

• List every AI tool used in each trial and record its purpose. Match each purpose to a legal basis and an Article 9 condition.

• Separate the use of trial data for the protocol from reuse for model development, and document the legal ground for each.

• Run a data protection impact assessment. Article 35(3)(b) GDPR requires one for large-scale processing of special category data.

• Record who is controller and who is processor among the sponsor, investigators, CROs and AI vendors, and put Article 28 contracts in place.

• Ask vendors for evidence behind any anonymity claim for a model, and for details of the data it was trained on.

• Use pseudonymised data by default and keep direct identifiers out of AI workflows unless they are strictly needed.

• Update participant information to cover AI use and any planned reuse of data.

Conclusion

AI in clinical trials sits under several overlapping regimes. The GDPR and the CTR apply to every trial. The EDPB has set out how legal bases work for trial data, how AI models should be assessed, and how it defines scientific research. EMA and FDA have set expectations for documenting AI use in drug development. The AI Act, the Biotech Act proposal, and the EHDS add further layers that arrive on different dates.

The consistent starting point across these sources is purpose. Each use of participant data, including each AI tool, needs a defined purpose, a legal basis and a record showing how both were chosen.

If you need help mapping AI tools in your trials against these requirements, our AI governance services and data protection consultants work with sponsors and CROs.

Frequently Asked Questions

Does the GDPR apply to AI used in clinical trials?

Yes. The EDPB confirms that the GDPR and the Clinical Trials Regulation apply simultaneously. Any AI tool that processes participants’ personal data falls under the GDPR, and health and genetic data are special category data under Article 9.

Is consent the right legal basis for processing trial data?

Usually not. The EDPB says informed consent under the CTR is not the same as GDPR consent, and that an imbalance of power between sponsor and participant can mean consent is not freely given. It lists public interest, legitimate interest and, in specific circumstances, explicit consent as the options for research processing.

Can trial data be used to train an AI model?

It needs its own legal footing. Using trial data outside the protocol for scientific purposes requires a specific legal ground, and the controller must still meet the GDPR’s other obligations. The EDPB’s draft 2026 guidelines presume that further scientific research is compatible with the original purpose, but the processing must still be lawful.

Is an AI model trained on trial data anonymous?

Not automatically. In Opinion 28/2024, the EDPB says anonymity has to be assessed case by case. The likelihood of extracting personal data from the model, directly or through queries, must be insignificant.

Does the AI Act exempt AI used in clinical research?

Only partly. Article 2(6) excludes AI developed and put into service solely for scientific research and development. Article 2(8) excludes pre-market research and testing but not testing in real-world conditions. Commercial AI tools used in a trial need a separate assessment.

What does the European Biotech Act propose for AI in clinical trials?

It would add Article 27e to the CTR. Sponsors would have to evaluate the benefits and risks of AI for patient safety and data robustness and describe the AI tool’s purpose in the protocol. The proposal has not been adopted.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.