Grae SI

Sandbox profile

Trial safety narrative drafts

High intensity

Medical writers draft SAE narratives from the EDC and source packets. The sponsor’s process still files them.

Vertical
CROs
Scale
Enterprise
Organization
Harbor Clinical Research
Shape
Mid-size CRO. A 30-person specialty CRO can run the same profile on one GPU and a thinner QA bench.

The business problem

Writers assemble SAE narratives under a clock, from EDC pages and site documents that are PHI and trial data. Sponsors will not accept a public model in that path. Harbor wants a draft in the writing tool, a medical monitor who can reject it, and a record the sponsor can audit. A smaller specialty CRO uses the same controls with less integration.

What Grae SI recommends

Family

Qwen 2.5 7B by default. BioMistral or Meditron only with an accepted license.

Size

7B LoRA per therapeutic area, not one giant model for every sponsor.

Why this size

Narratives must follow the source packet and the sponsor’s template. A per-area adapter on a 7B base is cheaper to re-validate when a sponsor template changes than a single large model. The small CRO starts with one adapter.

License

Sponsor contracts often add restrictions on top of the model license. Both belong on the card.

Data controls

PHI and trial data

SAE packets are PHI and are the sponsor’s data. The CRO processes them under the clinical agreement and, where needed, a BAA.

De-identification

Training uses sponsor-approved, coded packets. Subject ids in the training extract are study codes, not names. Live drafts run on the identified packet inside the validated environment.

Access

Writers and medical monitors assigned to that study. No cross-sponsor prompts on a shared adapter unless the contract allows a shared base with sponsor-specific adapters isolated.

Residency

Matches the sponsor’s region clause. A US sponsor’s data is not used to train an adapter that serves an EU study.

Retention

Drafts follow the TMF schedule. Adapters are destroyed or returned at study close if the contract says so.

Risk classification

Intensity is a planning tier for evidence. It is not a certification and not a regulatory classification.

  • The narrative can enter a safety submission and describes a subject.
  • A medical monitor reviews it. That review is mandatory in this profile and is recorded.
  • Cross-sponsor mixing of training data would be a separate, higher-risk decision and is excluded.

Compliance requirements to prepare for

ICH E6(R3)

GCP responsibilities stay with the sponsor and the CRO as contracted. A drafting tool does not move medical responsibility.

ICH E2A

Serious-event reporting timelines and content. The model does not start the regulatory clock and does not send the report.

21 CFR Part 11

If the narrative is an electronic record in a Part 11 system. Signatures stay there.

HIPAA

When the CRO is a business associate for a covered entity’s trial. The BAA’s subcontractor terms matter if any host is outside the CRO.

GxP and sponsor audit

The sponsor will ask for the validation packet. Grae SI exports it. The CRO’s QA releases the version.

Grae SI helps assemble the evidence. It does not certify HIPAA, FDA, ISO, SOC 2, ICH, NAIC, GDPR, DPDP, or any other framework.

Validation KPIs

These are targets to lock before go-live. They are not measured outcomes from a customer deployment.

Source fidelity

At least 95% of clinical statements trace to the packet, on 80 SAEs

Same bar as the sponsor safety team, because the sponsor will test it.

Template compliance

Required sponsor headings present in 100% of drafts

A missing heading is a rewrite.

Cross-sponsor isolation

A prompt carrying sponsor B’s id returns no sponsor A facts, on 20 probes

Adapters and logs are separated.

Monitor sign-off

100% of filed narratives have the monitor’s recorded review

High-tier release condition.

Deployment architecture

DeploymentSponsor-region VPC, offline bundle for audits

EDC and the writing tool stay in the CRO’s validated environment. Training reads a sponsor-approved extract. An offline bundle can be shown in an audit room without opening a route to the internet.

  1. 01

    EDC and TMF

    Source of the packet. Access is the study role.

  2. 02

    Approved extract

    Coded, sponsor-signed-off, per study or per area.

  3. 03

    Grae SI

    Adapter, eval, model card, registry entry the auditor can open.

  4. 04

    Writing tool

    Draft only. Filing is the monitor’s action.

  5. 05

    Audit bundle

    Offline runtime plus the report, for a disconnected review.

Each box is a component in the customer’s network. Arrows are the order of the path, read left to right on a wide screen and top to bottom on a phone.

Where this sits in the stack

The same ten layers appear on every profile. The mark says whether Grae SI provides the layer, shares it, or leaves it with you. Person-weeks are the buyer’s effort after the runtime is deployed, not a project plan for the whole company.

  • Grae SI providesGrae SI provides the layer
  • SharedShared. Grae SI supports part of it.
  • You ownYou own the layer after install

  1. Layer 1

    Infrastructure and compute

    You own

    A private VPC or an air-gapped quality zone. No training call to a public API.

    Buyer effort after the runtime is up: 1–3 person-weeks

  2. Layer 2

    Data ingestion and prep

    Shared

    Grae SI shows what the safety or labeling corpus needs. Your RIM or safety database produces the extract.

    Buyer effort after the runtime is up: 2–5 person-weeks

  3. Layer 3

    Data controls and governance

    Shared

    Sponsor data is isolated. Contractual destruction at study close is the CRO’s obligation. Grae SI records the version so they know what to destroy.

    Buyer effort after the runtime is up: 1–3 person-weeks

  4. Layer 4

    Model selection and training

    Grae SI provides

    One 7B base, an adapter per therapeutic area. A small CRO stops at one adapter.

    Buyer effort after the runtime is up: 0.5–1.5 person-weeks

  5. Layer 5

    Evaluation and validation

    Shared

    A tier-matched suite, thresholds, and an exportable report. The labeled set, the acceptance call, and any statistics your quality system requires on top.

    Buyer effort after the runtime is up: 1–3 person-weeks

  6. Layer 6

    Agents and orchestration

    Shared

    Compliance agents that classify the use case and name the frameworks to prepare for. Any production agent that calls tools inside your applications.

    Buyer effort after the runtime is up: 1–2 person-weeks

  7. Layer 7

    Deployment and serving

    Grae SI provides

    Safetensors, GGUF, a model card, and an offline bundle for Ollama, vLLM, or llama.cpp. Moving that bundle into the zone and keeping the host patched.

    Buyer effort after the runtime is up: 0.5–1.5 person-weeks

  8. Layer 8

    Monitoring and drift

    Shared

    Registry lineage: version, dataset, eval result, and the package that was released. Live traffic checks, drift alarms, and the decision to pull a version.

    Buyer effort after the runtime is up: 1–3 person-weeks

  9. Layer 9

    Application and integration

    You own

    Mid-size CRO: hook the writing tool. Specialty CRO: a monitored paste into the template is an acceptable first release.

    Buyer effort after the runtime is up: 5–10 person-weeks

  10. Layer 10

    Organizational validation and sign-off

    You own

    CRO QA, and the sponsor if the contract requires sponsor approval of the tool.

    Buyer effort after the runtime is up: 4–8 person-weeks

Buyer effort for this profile

14–22 person-weeks at Harbor. A 30-person specialty CRO should plan 8–12.

The specialty CRO skips the multi-sponsor isolation work because it has one live sponsor program.

  • Medical writing
  • QA
  • Privacy
  • Clinical systems
  • Sponsor contact when the contract requires it

Quantitative benefits

Illustrative estimate for this sandbox. It is not a measured customer result. Assumptions for this profile are listed under the figures.

Time to a reviewable package

8–12 weeks at Harbor, 5–8 weeks at a specialty CRO

Sponsor approval, if required, is the item that pushes the long end.

Cost versus a cloud API

Out of policy

Sponsor contracts and BAAs are the constraint. Illustrative API spend if it were allowed: $6k–$15k a month at 8,000 narratives. It is not allowed in this profile.

Compute

$1.5k–$3k a month

One GPU node in the study region. A second region is a second node.

Writer first draft

25–40% less time on the first narrative draft

Illustrative, if source fidelity holds. Monitor review time is not reduced in this estimate.

Validation writing

About 3–5 person-weeks saved

The packet a sponsor auditor asks for. The SOP change is extra.

Assumptions

  • Illustrative estimate for this sandbox. It is not a measured customer result.
  • No cross-sponsor training. A shared base model with isolated adapters is allowed. A shared training set is not.
  • The CRO does not submit to regulators. The sponsor’s process does.
  • Small-company effort is the specialty-CRO range above.

All sandbox profiles · The full stack