Case study: The Triage Layer a Biotech Put in Front of Its Safety Database

On 14 June 2017 ArisGlobal published a case study about a mid-tier biotechnology company that already ran Oracle Argus for safety case processing but had nothing in front of it. Reports of suspected adverse events arrived by email, phone and electronic fax. The page says companies have typically handled triaged documents by hand, in "Excel spreadsheets or even paper binders".

That page contains no artificial intelligence and not one number. It is still one of the clearest public accounts of what adverse event intake automation is for. It shows the step where an inbound message becomes a case, a duplicate, a request for more information or a documented non-case. AI intake products sell into that step. So does the regulatory clock, which is already running before anyone has triaged anything.

The situation: a safety database with no front door

According to ArisGlobal, the client had products in several therapeutic areas and a large volume of inbound reports to collect, organise, triage and archive. Argus handled case processing, but it had no triage capability, so source documents were hard to triage and organise. The page gives no volume, no headcount and no product names.

That gap matters more than it sounds. Triage decides whether a message is a valid report that needs processing, or whether more information is needed first. Those decisions are regulated records. In the US, 21 CFR 314.80(b) requires written procedures covering surveillance, receipt, evaluation and reporting of postmarketing adverse drug experiences. Receipt is named in the rule. In the EU, Article 12(1) of Implementing Regulation (EU) No 520/2012 requires a record management system that keeps decisions on safety concerns traceable, with their dates and the way they were made.

A spreadsheet can hold a decision. It rarely holds who changed it, and when. That is the gap an inspector finds.

What ArisGlobal built: a triage layer in front of Argus

ArisGlobal integrated its triage tool, agXchange Inbound Receipt and Triage (IRT), with the client's Argus system. The flow, as the vendor describes it:

The client also standardised its SOPs and workflow steps for new cases and follow-ups. That line is easy to skip, and it probably did as much work as the software. A tool can only enforce a process somebody has written down.

Two design choices stand out. First, the duplicate search ran against both the triage store and the safety database. Searching only one misses the report that arrived twice, by different routes, before either was processed. Second, core data entry moved to the earliest point, before the case reached Argus. The vendor frames this as efficiency. Its bigger effect is that the receipt date and the four validity elements are captured by the people closest to the source.

That receipt date is where your compliance figure starts. EMA computes ICSR timeliness per report from the E2B(R3) field C.1.5, the date of receipt of the most recent information, as our analysis of EudraVigilance compliance notifications explains. If triage records that date late or wrongly, every downstream metric inherits the error.

The planned next step was an upgrade to agTracker, ArisGlobal's newer triage tool, with optical character recognition, E2B(R2) and E2B(R3) support, more case automation and better metrics. The client also planned a call-centre form to capture information at first contact.

What it achieved, and what the numbers actually measure

ArisGlobal lists its results as capabilities: automated duplicate checks, recorded triage decisions, comparison against the global safety database, submission to Argus by E2B or ETL, searchable correspondence logs, archived inbound documents and an audit trail for case decisions. These describe what the system can do. None is an outcome. There is no before-and-after time, no error rate and no inspection result.

Two claims need care. The page calls the integration a breakthrough for the company and the industry. That is the vendor's own view. It also describes the tool as compliant with 21 CFR Part 11. But Part 11 places its controls on the persons who use a system, starting with validation for intended use. A product can support compliance. Only the company using it can be compliant.

The other intake cases in our library carry numbers, and each number needs reading:

Camurus is the most concrete. Its QPPV is quoted on Veeva's page saying the company "reduced case processing time by at least 30 minutes per case". The page frames that as the result of bringing the safety system in-house, so the tool and the change of operating model are tangled together. ArisGlobal's BMS page puts 25% in its title and gives nothing to test it against. Qinecsa's Aurinia page is candid on one point: the 70% rests on "consolidated Qinecsa metrics", not on Aurinia's own data. Aurinia reports a strong return without a number.

None of this makes the claims false. It makes them unusable as a forecast for your own case mix.

What makes intake automation work, and where AI fits

The 2017 case shows the order of work: one front door, one log, one decision record, one set of SOPs. Extraction, translation and OCR speed up whatever sits underneath them. On top of a spreadsheet, they speed up the confusion.

The most useful independent evidence on AI extraction is older than any vendor page above. In a peer-reviewed Pfizer pilot published in Clinical Pharmacology & Therapeutics in 2019, three commercial vendors trained on about 50,000 case source documents with their safety database records, with a further 50,000 added in a second cycle. They were then tested on 5,000 documents. Composite F1 scores for extraction were 0.72, 0.52 and 0.74, against 0.69 for Pfizer's own AI team. The share of cases with eight or nine of nine fields right was 34%, 31% and 13%. The authors concluded that AI could support extraction and validity assessment. They did not claim it could run unattended.

That study predates today's large language models, so treat it as a floor, not a ceiling. Its method is the part to copy. Train on your own historical cases, test on documents the model has never seen, and score at case level, not field level. A case with eight right fields and the wrong suspect product is a wrong case.

The design that follows is simple. The model proposes values. A trained person confirms validity, seriousness and expectedness, and the record shows who confirmed what. The numbers that show the review is real are the override rate and the time spent per review, as our piece on qualifying the human in the loop sets out.

Do not throw away what triage rejects. GVP Module VI says reports missing minimum information should still be recorded for ongoing safety evaluation. Non-cases and incomplete reports are part of the data your signal work draws on, and every marketing authorisation holder now owes a EudraVigilance monitoring duty under Implementing Regulation 2025/1466.

The reporting clocks triage cannot move

Position current at 12 October 2026.

In the EU, the legal clock sits in Article 107(3) of the Directive. It counts from the day the holder "gained knowledge of the event". GVP Module VI, section VI.B.7, says what knowledge means. The clock starts when information meeting the minimum criteria reaches "any personnel of the marketing authorisation holder, including medical representatives and contractors". Weekends and public holidays count.

In the US, 21 CFR 314.80(c)(1)(i) requires each serious and unexpected adverse drug experience to be reported "no later than 15 calendar days from initial receipt". Other reports go into periodic reports, quarterly for three years after approval and annually after that. A manufacturer, packer or distributor named on the label but not holding the application may instead pass serious reports to the applicant within 5 calendar days. Expectedness is judged against the current labelling, so a triage tool working from a stale label routes reports to the wrong clock.

So what does triage change? Not day zero. A report sitting in an affiliate inbox, a call-centre queue or a sales representative's notes is already ageing. Triage changes three things:

• Evidence. A timestamp at the true point of receipt, not when someone got round to logging it.
• Elapsed time. The gap between receipt and case creation is the part of the 15 days a tool can actually shorten.
• The record of non-cases. In the EU an incomplete report becomes valid when the missing element arrives, and its clock starts then. Call a valid report invalid and it becomes late. Call an invalid one valid and you have a report to nullify later.

Two binding changes in 2026 land directly on intake. The new subcontracting clause reaches every call centre and outsourcing partner that receives reports for you. And the E2B(R3) support ArisGlobal's client planned as an upgrade in 2017 is now a condition of submitting to FDA at all.

What this means in practice

These steps run in lead-time order, longest first.

1. Contracts. List every party that can receive an adverse event on your behalf: affiliates, call centres, patient programmes, distributors, partners. Check each contract carries the Article 6(3) elements and a hand-over time that fits inside your 15 days. Renegotiation takes months, and the clause has applied since 12 February 2026.
2. Baseline. From your own data, measure receipt-to-case-creation time by channel, the share of inbound items that are non-AE, invalid or duplicates, and the late cases in EMA's monthly notifications. That is your before picture. No vendor percentage substitutes for it.
3. Decision record. Define the triage outcomes, such as valid, invalid pending follow-up, duplicate and non-AE. Require who, when and why for each. Validate the system that holds them, because these are records you must keep for years.
4. Format. Capture E2B(R3) fields at intake, not at submission. For FDA this is no longer optional.
5. Automation. Only now pilot extraction, translation or duplicate scoring, on your own historical cases. Copy the Pfizer design: a held-out test set, case-level scoring, a person confirming validity and seriousness, and the override rate tracked from day one.
6. Rejects. Route invalid and non-case records to signal review rather than to an archive nobody reads.