AI in Statistical SAS Programming: Driving Efficiency While Maintaining Compliance and Responsibility

The Non-Negotiable: Confidential Data

From a statistical programmer’s perspective, the most critical constraint on AI adoption is maintaining strict confidentiality of client and clinical trial data.

Clinical trials contain some of the most sensitive types of data available. Generally speaking, uploading any subject-level clinical trial (CT) data, or any other type of information that can identify a Sponsor or participant to third party AI tools is prohibited without written permission from the sponsor. Realistically, obtaining permission is usually challenging, time-consuming and/or infeasible.

In addition, although using AI with private AI deployments (where the organisation owns the AI) is possible, Sponsors and their organisations still have to comply with several key items relating to the security of  the data and regulatory compliance with respect to client data. Therefore, in practical terms, when using AI within statistical programming:

• it is not acceptable to upload standardised clinical trial datasets to public third parties or AI tools
• study identifiers, protocol numbers, Sponsor names and study-specific metadata must be treated as confidential;
• verbal permission from a Sponsor is not acceptable without written consent.

As a result, the areas in which statistical programmers can leverage AI effectively are those that do not include any clinical (trial) data.

Where AI Excels: Knowledge, Not Data

One of the strongest and safest applications of AI in this space is the use of Retrieval Augmented Generation (RAG), models to support standards and documentation.

AI Chatbots for Study Data Tabulation Model (SDTM) and Analysis Data Model (ADaM) Standards

The implementation guides (IG) for the SDTM and ADaM standards can be complicated, lengthy, and not always easy to use when pressed for time. To help solve this problem, a RAG based chatbot that is trained on the following items:

• SDTM IG
• ADaM IG
• CDISC Controlled Terminology
• Sponsor Specific Standards

can act as an always available subject matter assistant.

Instead of searching for answers in various PDF documents or using SharePoint folders, programmers can ask direct questions about how to derive a variable from raw data, how to handle a specific edge case,  or what controlled terminology applies to a specific study. Because this chatbot is only referencing publicly available standards and any internal documentation approved by the Sponsor, no confidential information will be included in the answers provided to you.

This ultimately increases productivity, while remaining compliant.

Internal Documentation: Standard Operating Procedures (SOPs), Good Programming Practices (GPP), and Process Knowledge

RAG models become even more powerful when applied to internal documentation.

Many organisations struggle with knowledge fragmentation. SOPs, GPP documents, work instructions, and training materials often exist across multiple repositories. New hires and even experienced programmers can lose time searching for the right document or interpreting outdated guidance.

By creating a RAG model for your company and indexing your internal documentation into the RAG model, you could create a controlled internal chatbot that:

• Answer questions about SOP expectations
• Clearly describes GPPs and why they are in place
• Describes the company workflow and escalation paths that exist within your company
• Minimises informal knowledge transfer

As the RAG model only uses approved internal documentation, there is significantly less ‘risk’ associated with using the RAG model than with using a data driven AI solution.

Using AI on SAS Code, Not SAS Data

Another practical and relatively safe application of AI is working with SAS programs themselves rather than the datasets they process.

SAS code typically contains logic, structure, and programming patterns that can be reviewed without needing any clinical data. As long as certain precautions are taken, this opens the door to valuable AI assisted workflows.

Key Safeguards

Before uploading SAS programs into a Large Language Model (LLM), it is important to ensure that:

• All Sponsor names, protocol numbers, and study identifiers are removed
• SAS program headers referencing Sponsors or projects are redacted
• File paths do not show internal infrastructure or study specific locations
• Comments do not include confidential context

Once anonymised, the code can be treated as generic SAS logic.

AI Assisted Code Review Against GPP

The automated/semi-automated review of codes is perhaps one of the most effective use cases. An AI model can be programmed as follows, by combining anonymised SAS programs and an internal GPP document and be instructed to:

• Ensure that naming standards (conventions) have been followed
• Identify any missing error management/validation
• Identify whether readability properties have been considered
• Identify instances where the program does not conform to appropriate internal standard

This process does not eliminate the need for human review, but provides an initial level of review that is consistent and can help reduce overall effort and increase general quality of review.

In addition, this method eliminates the need for any clinical data, while still providing measurable efficiencies.

AI in SAS Programming is a Tool, Not a Shortcut

AI has a clear role to play in the future of statistical SAS programming, but it must be used as a support tool rather than a shortcut. The most successful implementations focus on:

• Knowledge access rather than data processing
• Internal standards rather than client deliverables
• Automation of checks rather than replacement of judgment

When used thoughtfully, AI can enhance compliance, consistency, and productivity without compromising confidentiality or regulatory expectations.

In highly regulated clinical trial environments, careful design is not a limitation. It is what makes sustainable AI adoption possible.

---