CRLN-CERT-001 — Certification protocol for clinical research AI (v1.0)

An AI system sold into clinical research makes an accuracy claim. Procurement asks compared to what, and there is no published answer. This protocol supplies one. A CRLN certificate asserts exactly this: on a fixed set of clinical research judgement items the system had no opportunity to train on, it scored X on a four-point behavioural rubric anchored to ICH E6(R3), on a stated date at a stated version. It does not assert safety, fitness for a deployment, or any regulatory approval. It is a measurement, not a warranty. Two tiers. Tier 1 (Uncontaminated) asserts only that the items were never published. Tier 2 (Human-referenced) scores against a human denominator on the same items. Tier 2 is the real product and Tier 1 is honest about not being it: as of v1.0 only Tier 1 can be issued, because the 57 held-out items carry no human baseline yet. A certification body that overstates its own instrument in v1.0 has nothing to sell in v2.0. Held-out integrity. The train/eval assignment is immutable in the database: items cannot be moved between halves and registry rows cannot be deleted, because delete-and-reinsert is the obvious way around an immutable column. A daily canary checks the three surfaces a leak travels through: the sanctioned export view, the public sitemap, and the prerendered HTML. Items are retired after two published releases. Residual exposure is stated rather than glossed. Scoring. Randomised option order, because order was previously a cue (the first-listed option reached the standard on 83.1% of steps against 24.6% for a random guess). Refusals and unparseable answers are scored zero rather than dropped, since excluding them inflates the score of a model that declines the hard items. Mean rubric and pass rate are always reported together. Conflict of interest is stated, not hidden. CRLN authors the items, holds the baseline, runs the scoring and issues the certificate: four roles certification bodies normally separate. The protocol names this as a weakness, lists the three constraints a sceptical buyer should check, and states that independent administration is the correct end state and is not claimed today. The register is public: a certificate is meaningful only while it appears there as valid. Licensed CC BY 4.0.