Regulatory Update: ICH E6(R3)

Summary of latest Good Clinical Practice guideline updates

ICH E6(R3) marks a significant evolution of the Good Clinical Practice guidelines, with expanded emphasis on risk-based approaches, technology-enabled oversight, and decentralized trial considerations. This summary highlights the key changes from E6(R2), what they mean in practice for sponsors and sites, and the implementation timeline.

Background: From E6(R2) to E6(R3)

ICH E6(R2) was adopted in 2016 and introduced the concept of risk-based monitoring and quality management systems to the GCP framework. It was a meaningful update, but it was written before decentralized trials, wearables, direct data capture, and AI-assisted data review became operational realities in clinical research.

ICH E6(R3) was finalized in 2023 and represents a more fundamental restructuring of the GCP framework. It is organized around principles and a quality management system (QMS) rather than prescriptive process requirements — which gives sponsors more flexibility in how they meet GCP obligations while holding them to a higher standard of documented justification for every major decision.

Key Change 1: The Quality Management System (QMS) Framework

E6(R3) places a quality management system at the center of the GCP framework. Where E6(R2) described specific monitoring activities that sponsors should perform, E6(R3) describes the QMS outputs that sponsors must achieve. This shift places more responsibility on sponsors to design their quality systems and document the rationale for their design choices.

• Sponsors must document a formal quality management system that addresses risk identification, evaluation, control, communication, and review
• Risk assessment must be performed at the protocol level and documented before the monitoring plan is written
• QMS outputs (risk registers, monitoring plan decisions, CAPA records) become primary evidence in regulatory inspections
• Outsourced functions remain the sponsor's responsibility; QMS must govern CRO oversight as explicitly as internal functions
• QMS documentation must be current and available to inspectors — not reconstructed for an inspection

Key Change 2: Risk-Based Approaches

E6(R3) reinforces and expands the risk-based monitoring provisions introduced in E6(R2). Crucially, it requires that risk-based decisions be documented with explicit rationale — sponsors cannot simply reduce SDV rates without a documented risk assessment justifying the reduction.

The concept of 'critical data' is central to E6(R3). Sponsors must identify which data points are critical to primary endpoint integrity and subject safety, and monitoring intensity for those data points must be proportionate to their criticality.

• Document a protocol-level risk assessment that identifies critical data and critical processes
• Risk assessment outputs must directly inform monitoring plan design — inspectors will check the link
• Central monitoring is explicitly recognized as a primary monitoring method, not just a supplement to on-site visits
• Key risk indicators (KRIs) must be defined, tracked, and reviewed as part of the ongoing QMS
• Monitoring plan adaptations must be triggered by documented risk signals, not by schedule or convenience

Key Change 3: Technology-Enabled Oversight

E6(R3) is the first GCP guideline written with explicit recognition that clinical trials are increasingly conducted using electronic systems for source data capture, remote patient interactions, and real-time data transfer to sponsors. The guideline provides a framework for validating, overseeing, and maintaining records from these systems.

• Electronic systems used in clinical trials must be validated and subject to access controls and audit trails
• Direct data entry into sponsor systems from patient-facing devices (wearables, ePRO) is explicitly addressed
• Remote oversight of site activities via technology is a recognized and acceptable approach when risk-assessed
• System validation documentation must be available to inspectors and must demonstrate fitness for purpose
• Cybersecurity and data privacy obligations are acknowledged as part of electronic data management

Key Change 4: Decentralized Trial Considerations

E6(R3) explicitly addresses decentralized clinical trials (DCTs) — trials conducted partly or entirely outside traditional clinical site settings. This includes home nursing visits, telemedicine consultations, local laboratory visits, and direct-to-patient drug delivery. The guideline provides principles for maintaining GCP compliance in decentralized contexts.

• Informed consent can be obtained remotely using compliant eConsent systems, subject to applicable national regulations
• Oversight of home visits and remote activities remains the sponsor's responsibility and must be addressed in the QMS
• Local healthcare providers performing trial-related activities must be appropriately qualified and trained
• Safety monitoring plans must be adapted for decentralized contexts where site staff may not be the first to learn of adverse events
• TMF documentation requirements apply equally to decentralized activities as to traditional site activities

Implementation Timeline and Practical Steps

E6(R3) was finalized in May 2023. Regulatory authorities began incorporating it into their inspection expectations through 2024 and into 2025. Organizations that have not yet reviewed their QMS, monitoring plans, and SOPs against E6(R3) requirements should treat this as a high-priority compliance activity.

• Gap assessment: compare your current QMS, monitoring SOPs, and risk management practices against E6(R3) principles
• Priority updates: risk assessment documentation process, monitoring plan rationale documentation, KRI design and review
• Training: all QA, monitoring, and clinical operations staff should be trained on E6(R3) key changes
• New studies: all new protocols should incorporate an E6(R3)-aligned risk assessment and monitoring plan from the start
• Ongoing studies: review existing monitoring plans against E6(R3) and document any necessary adaptations before next inspection

Browse all resources or contact us to discuss your QA needs.