ICH E6(R3): Good Clinical Practice

Context and history

ICH E6(R3) is the revised guideline on good clinical practice. FDA published it as final guidance on 8 September 2025, and FDA says it adds flexible, risk-based approaches and embraces innovations in trial design, conduct and technology. It is included here because it deals with computerised systems and data in trials. GCP is a planned area on this site.

Who and what it applies to

Sponsors, investigators, ethics bodies and others involved in clinical trials.

What it contains

Principles

Eleven principles: ethics, informed consent, independent review, sound science, qualified people, quality by design, proportionate processes, clear protocols, reliable results, clear roles, and properly made investigational products.

Annex 1: IRB/IEC

Composition, functions, procedures and records of ethics bodies.

Annex 1: Investigator

Qualifications, resources, consent, safety reporting and more.

Annex 1: Sponsor

Design, resources, agreements, oversight, quality management and more.

Annex 1: Data governance

Safeguarding blinding, the data life cycle (capture, metadata including audit trails, review and more), and computerised systems (procedures, training, security, validation and more).

Appendices

Investigator's brochure, trial protocol, and essential records.

Annex 2

Additional considerations for non-traditional trials, published separately by FDA on 30 December 2024.

Key points

• Quality should be built in by design, and focus on what matters most.
• Data governance now has its own section.
• Procedures should cover the full data life cycle.
• Metadata and audit trails are addressed for data of higher criticality.
• Security controls include user management, patching and system monitoring, and they should be tested as appropriate.
• The responsible party is responsible for validation status throughout the life cycle, with a risk-based approach.

In practice

General reading, not advice. This is drafted with AI and may not fit your situation. It does not replace the official text, your own quality system or qualified advice, and an inspector may take a different view.

• Check that responsibilities for each clinical system are clear and written down between sponsor, investigator and vendors.
• Use data criticality to decide where audit trail review effort goes.
• Ask vendors for evidence on security, backup and disaster recovery, not only on functional validation.

Read from the source document on 1 Nov 2026. This is our own description, not the official text. Check the full dated history in the change log below.