ICH E6(R3) Compliance Checklist for Sponsors, CROs, and Sites

When the ICH Assembly formally adopted the new Good Clinical Practice guideline on 6 January 2025, most clinical operations teams recognized the headline: ICH E6(R3) had arrived. Fewer had mapped what "arrival" actually requires of them. The EMA first published the final Principles and Annex 1 in January 2025; both came into effect across the EU/EEA on 23 July 2025 ^[1]. The U.S. FDA followed with its own publication in the Federal Register on September 9, 2025 (Docket No. FDA-2023-D-1955) ^[2], making clear that regulatory or guidance alignment is now expected across the globe's two largest regulatory markets.

ICH E6(R3) is not a light revision. It restructures the entire GCP framework around Quality by Design (QbD), replaces the familiar thirteen principles with eleven more comprehensive ones, and introduces a standalone Data Governance section that did not exist in E6(R2) ^[5]. Sponsors that approach this as a document-refresh exercise will find themselves underprepared when inspectors arrive expecting to see risk assessments, CtQ rationale, and complete data lifecycle documentation.

This checklist is organized by functional area, so clinical operations, QA, data management, and regulatory teams each have a clear view of what "compliant" means in practice under the new guideline.

Why ICH E6(R3) Is a Material Departure from R2

The 2016 revision (E6(R2)) introduced risk-based monitoring and sponsor oversight of delegated tasks. Those were meaningful changes, but the underlying architecture of GCP remained largely intact: quality was demonstrated through exhaustive documentation, frequent on-site verification, and 100% source data verification at many sites, a practice the industry widely acknowledged as resource-intensive relative to its error-detection yield.

ICH E6(R3) shifts the emphasis of that logic. Quality by Design, which ICH E8(R1) introduced at the study planning level, is now a core GCP expectation ^[3]. Rather than inspecting for errors after the fact, sponsors are expected to identify Critical-to-Quality (CtQ) factors before the first patient is enrolled, then design trial processes around protecting those factors specifically.

A second shift is structural. The guideline is now organized as overarching Principles plus Annex 1, which replaces E6(R2) for conventional interventional trials, and Annex 2, which covers decentralized, pragmatic, and real-world data-incorporating trials and was formally adopted by the ICH Assembly on 3 June 2026 ^[4]. This modular architecture means the compliance surface is larger and more granular than R2's single-document model.

ICH E6(R3) describes the quality goal as generating information that is fit for its intended purpose and sufficient to provide confidence in the trial results and to support sound decision-making ^[5]. That framing has direct operational consequences: not every minor data discrepancy demands immediate escalation, but the sponsor must have defined in advance which data fields and processes are critical enough to require it, and documented that definition before the first patient is enrolled.

The ICH E6(R3) Compliance Checklist

1. Quality by Design and CtQ Factor Identification

What E6(R3) requires: ICH E6(R3) Section 3.1.2 requires sponsors to incorporate QbD by identifying Critical-to-Quality factors and implementing proactive risk management during trial planning ^[5]. These factors are defined as the elements that, if they fail, would directly compromise participant safety or the reliability of data supporting regulatory submissions.

Checklist items:

• For each protocol, document a formal CtQ identification exercise before trial startup, covering safety endpoints, primary efficacy data, and critical process steps across the IP supply chain, investigational sites, and third-party vendors
• Distinguish between CtQ factors (which require active risk controls) and lower-priority data fields (which can tolerate proportionate, less intensive oversight)
• Incorporate patient and investigator input into the CtQ identification process per Section 3.1.3 ^[5]
• Where appropriate, establish Quality Tolerance Limits (QTLs) to define pre-specified acceptable ranges for key CtQ risks, consistent with Annex 1 Section 3.10.1.3, which acknowledges QTLs as one tool within an RBQM framework ^[5]
• As a recommended practice, document the CtQ rationale in the Quality Management Plan (QMP), separate from the monitoring plan, so the logical chain from identified risk to chosen control is traceable and auditable
• Revisit CtQ factors at each protocol amendment and update the QMP accordingly

What changes from R2: E6(R2) required sponsors to identify "critical data" and "critical processes." E6(R3) expands this to CtQ factors that span the full operational ecosystem, including vendors, devices, software systems, and the IP supply chain ^[5]. The identification must be documented and defensible, not assumed.

2. Risk-Based Quality Management (RBQM)

What E6(R3) requires: ICH E6(R3) Section 3 places responsibility for implementing risk-proportionate approaches explicitly with the sponsor ^[5]. Risk assessment at startup must drive monitoring priorities, audit strategies, and issue-escalation thresholds across the trial lifecycle.

Checklist items:

• Prepare a formal Risk Management Plan (RMP) at the start of each study, documenting identified risks, their probability and impact on CtQ factors, and the mitigations selected
• Consider centralized statistical monitoring to detect systematic data anomalies early; where adopted, document the methodology and the personnel accountable for review
• Align on-site visit frequency and scope with risk level, not with a fixed schedule inherited from E6(R2) practice
• Document the rationale for each monitoring strategy decision; inspection readiness should include documentation of why a particular approach was chosen, not just what was done ^[5]
• Establish trigger thresholds for escalating issues identified through centralized monitoring to site-level action
• Conduct periodic risk reassessment (at minimum at each protocol amendment and after any significant operational change)
• Confirm the RBQM framework covers CRO and vendor activities, not only investigator sites

What changes from R2: E6(R3) requires sponsors to document not only what their monitoring strategy is, but why it was selected given the specific risk profile of the study. ICH E6(R3) explicitly recognizes centralized monitoring as an acceptable risk-based approach that can complement or, where justified by the risk assessment, substitute for on-site verification ^[5].

3. Sponsor Oversight and CRO/Vendor Governance

What E6(R3) requires: Even when all operational tasks are delegated to a CRO or vendor, the sponsor retains ultimate accountability for trial conduct ^[5]. ICH E6(R3) reinforces this explicitly. The sponsor cannot discharge its responsibility by pointing to a CRO contract.

Checklist items:

• Review and update all CRO and vendor contracts to define ownership, access rights, and retention obligations for essential records throughout the trial lifecycle ^[5]
• Confirm that each CRO and vendor agreement specifies the obligation to report system incidents that affect participant safety or data reliability (Annex 1 Section 3.6.6) ^[5]
• Maintain sponsor-accessible oversight records and systems adequate to document continuous oversight of delegated activities separately from CRO-held records; an eTMF and CTMS are common ways sponsors satisfy this obligation ^[6]
• Verify that service provider quality management systems are fit-for-purpose; the guideline clarifies they need not be designed for full GCP compliance, but must be appropriate to their delegated function ^[5]
• Conduct periodic oversight audits of CRO and vendor operations against the risk profile of delegated tasks
• Document all oversight decisions, including the rationale, not merely status updates; E6(R3) requires traceability of decision-making, not just outcomes ^[5]
• Consider establishing a regular oversight cadence (such as monthly or bi-weekly cross-functional meetings) with documented minutes to support continuous governance of delegated activities

4. Investigator Responsibilities and Site Readiness

What E6(R3) requires: Investigators are no longer positioned as passive recipients of a monitoring plan. ICH E6(R3) Annex 1 requires investigators to be active participants in risk assessment and quality planning, and to maintain documented oversight of delegated tasks ^[5].

Checklist items:

• Confirm that each investigator site has updated its delegation log to remove individuals who perform activities "as part of clinical practice" (this explicit carve-out is new in E6(R3)) per Annex 1 Section 2.3.3 ^[5]
• Verify that training documentation for all delegated site staff reflects the specific activities delegated, as required by Annex 1 Section 2.3.2 ^[5]
• Verify that investigators understand their obligation to report unfavourable medical events occurring before IP administration, per Annex 1 Section 2.7.2a ^[5]
• Confirm that site staff have completed updated GCP training aligned with E6(R3); CITI Program GCP training has been updated for R3 compliance ^[7]
• Establish site-level data controls (backups, confidentiality safeguards, access controls) consistent with the new Data Governance requirements in Annex 1 Section 4 ^[5]
• Identify a named person responsible for maintaining essential records during the retention period and notify the sponsor of their identity, per Annex 1 Section 2.12.13 ^[5]
• Review whether health professionals other than physicians and dentists are appropriately authorized to take on overall responsibility for trial-related medical decisions under local regulation, per Annex 1 Section 2.7.1 ^[5]

5. Data Governance

What E6(R3) requires: Data Governance is introduced as a new, standalone section (Annex 1, Section 4), covering both sponsor and investigator obligations across the complete data lifecycle from capture through archiving ^[5]. This is the most architecturally novel element of E6(R3).

Checklist items:

Sponsor-side:

• Establish and document a Data Governance Policy covering data capture, transfer, validation, storage, and archiving for each trial
• Maintain end-to-end data lineage traceability across sponsor, CRO, and vendor systems, with audit trails and relevant metadata accessible when needed for review, oversight, audit, or inspection ^[5]
• Implement computerized system validation or qualification for sponsor-owned or sponsor-deployed systems used in trial conduct; document each system's purpose, validation status, access controls, security measures, interfaces, and management responsibilities in a system inventory ^[5]
• Confirm electronic records are stored with metadata that preserves their context, including the timing and identity of entries, consistent with audit trail requirements under 21 CFR Part 11, EU Annex 11, and ICH E6(R3) Annex 1 Section 4 ^[5]
• Define and document a data retention policy aligned with applicable regulatory and contractual requirements; unlike E6(R2), the guideline defers fixed retention periods to regional regulatory and contractual obligations ^[5]

Investigator-side:

• Implement site-level access controls so that system access for sponsor or CRO personnel is traceable and remains visible to the investigator
• Confirm that all e-sourced data (wearables, ePRO submissions, remote monitoring outputs) are treated as source records with equivalent integrity controls to paper-based records, consistent with ICH E6(R3) Annex 1 Section 4 ^[5]
• Back up all essential electronic records at defined intervals, with recovery procedures documented and tested

6. Computerized Systems and Electronic Records

What E6(R3) requires: ICH E6(R3) Annex 1 Section 4 establishes expectations for computerized system governance, requiring that systems used in trial conduct are fit for purpose, appropriately validated, and operated with documented access controls and audit trails aligned with 21 CFR Part 11 and EU Annex 11 ^[5].

Checklist items:

• Prepare a system inventory for all critical trial systems covering: purpose, validation or qualification status, access controls, security measures, system interfaces, and designated management responsibilities ^[5]
• Confirm systems handling critical trial data include appropriate audit trails and metadata controls, proportionate to the system's role and applicable regulatory requirements ^[5]
• Apply role-based access controls with documented user roles and permissions; any access granted to site staff must reflect the investigator's delegation
• Implement a formal process for managing system defects that affect data reliability, including reporting obligations to the sponsor
• Confirm disaster recovery and backup procedures are in place and tested periodically
• For electronic informed consent platforms, validate the system and document that consent processes preserve voluntariness and comprehension in remote or electronic formats ^[5]
• Verify that electronic signatures comply with applicable regional requirements and are attributable to the individual who applied them

7. Informed Consent

What E6(R3) requires: Informed consent processes must remain aligned with the Declaration of Helsinki and be adaptable to remote or electronic delivery while safeguarding the voluntariness and comprehension of the participant ^[5].

Checklist items:

• Review and update ICF templates to reflect concise, plain-language presentation of risk, benefit, and alternatives
• If using electronic informed consent (eIC), confirm the platform is validated and supports the complete consent workflow including documentation, version control, and re-consent tracking
• Establish a re-consent procedure for protocol amendments that materially affect the participant's ongoing participation
• Confirm that assent materials are in place for trials involving minors, consistent with Annex 1 Section 1.1 ^[5]
• For trials with decentralized elements, document how remote consent will preserve the participant's ability to ask questions and withdraw freely

8. Essential Records

What E6(R3) requires: The guideline moves from the "essential documents" list familiar from E6(R2) Annex 6 to "essential records," a broader category that encompasses electronic data, communication logs, and operational process records beyond formal trial documents, as described in ICH E6(R3) Appendix C ^[5].

Checklist items:

• Conduct a gap analysis between your current eTMF index (typically based on the E6(R2) TMF Reference Model) and the expanded definition of essential records under R3
• Update the eTMF structure and filing index to capture communication logs, decision rationale documents, computerized system records, and oversight activity documentation
• Confirm that investigators have direct access to all essential records in their custody, and that sponsors have equivalent access regardless of the format or location of the records ^[5]
• Verify that all essential records are retained in an accessible, readable format throughout the defined retention period
• For outsourced studies, confirm contracts explicitly state that the sponsor retains the right to access all essential records held by the CRO or vendor at any time

9. SOP and Training Infrastructure

What E6(R3) requires: Implementation of R3 requires systematic SOP revision and training across sponsor organizations, CROs, and investigator sites. Sponsors that have not begun updating SOPs are already behind the curve: the guideline has been in effect in the EU/EEA since 23 July 2025 ^[1] and was published by the FDA in September 2025 ^[2].

Checklist items:

• Conduct a gap assessment comparing current SOPs against E6(R3) requirements, prioritizing QMP, RBQM, data governance, and computerized system validation procedures ^[5]
• Revise monitoring SOPs to reflect a risk-calibrated monitoring strategy, with defined triggers for on-site visits
• Update CRO and vendor oversight SOPs to document continuous governance expectations and escalation paths
• Verify that all sponsor staff, CRO monitors, and site staff have completed GCP training aligned with E6(R3) before initiating R3-governed activities
• Establish competency frameworks that clarify roles across the research lifecycle, not merely task-level training completion ^[7]
• Archive training completion records and confirm traceability of individual training to their specific delegated activities

10. Annex 2 Readiness (Decentralized and Non-Traditional Trials)

What E6(R3) requires: ICH E6(R3) Annex 2, covering decentralized clinical trials (DCTs), pragmatic trials, and studies incorporating real-world data, was formally adopted by the ICH Assembly at Step 4 on 3 June 2026 ^[4]. Regional coming-into-effect dates are subject to individual regulatory authority decisions; EMA and FDA have not yet announced implementation timelines for Annex 2 as of this writing. Organizations planning these trial types should treat Annex 2 as an active planning consideration now and monitor their regional authorities for effective dates.

Checklist items:

• Identify all ongoing or planned studies that incorporate any decentralized element (remote consent, home nursing, wearables, ePRO, remote source data verification)
• Map current processes for remote consent, digital data capture, and remote monitoring against the Annex 2 GCP considerations for non-traditional trial designs ^[4]
• Validate or qualify digital tools used in DCT operations (wearable devices, patient-facing apps, remote monitoring platforms) according to their intended use, data criticality, and risk, as part of the broader system inventory ^[5]
• Confirm that data governance processes account for real-world data sources and e-sourced records as primary data, not supplementary
• Review site staffing models to determine whether hybrid monitoring plans are appropriate given the decentralized footprint of specific studies
• Monitor the EMA and FDA for regional implementation dates and any accompanying Q&A documents for Annex 2

Regulatory and Documentation Considerations

Several overlapping regulatory frameworks bear directly on E6(R3) compliance. 21 CFR Part 11 and EU Annex 11 set the baseline for electronic records and signatures in clinical research. ICH E8(R1), finalized in 2021, provides the quality culture and CtQ framework that R3 explicitly builds on ^[3]. Regulation (EU) 2024/1689, the EU Artificial Intelligence Act, entered into force on 1 August 2024, with a phased compliance timeline: prohibited AI practices applied from February 2025; governance rules for general-purpose AI models from August 2025; and, following the AI Omnibus political agreement of May 2026, obligations for high-risk AI systems embedded in products regulated under the EU MDR or IVDR apply from 2 August 2028 ^[8]. Sponsors deploying AI-assisted tools in trial operations should assess whether those systems fall within the Act's high-risk classification and plan accordingly.

The FDA's Federal Register notice of September 2025 clarifies that E6(R3) "represents the current thinking" of the agency and is not binding on the FDA or the public ^[2], echoing the non-binding status of E6(R2). However, agencies evaluate GCP compliance against the current industry standard, and R3 is now that standard in the EU/EEA. Sponsors operating in both markets should note that inspectors may reference E6(R3) expectations regardless of the technical non-binding status in the United States.

Documentation of decision rationale receives particular emphasis. Under E6(R2), a monitoring plan recording that 50% of sites would receive on-site visits satisfied the documentation standard. Under E6(R3), the rationale for why that percentage was chosen, grounded in the CtQ risk assessment and site risk profile, must also be on file.

How AI and Automation Support E6(R3) Compliance

Automating compliance checklists is one thing. Sustaining the documented evidence that inspectors will examine is another. The operational burden of R3 falls primarily on documentation quality, data traceability, and audit-trail completeness, areas where AI-assisted tools can provide genuine support.

Centralized monitoring platforms that flag statistical deviations in real time against predefined QTL thresholds align with the risk-control framework in Annex 1 Section 3.10.1.3 ^[5]. AI-supported analysis of site performance data can identify early signals of systematic data quality issues before they compromise CtQ factors. Automated eTMF indexing tools can help classify the expanded category of essential records under R3.

Document generation platforms that maintain cross-document consistency are particularly relevant to the Protocol, QMP, and Monitoring Plan, which must now share a coherent CtQ narrative. When the protocol defines a safety endpoint as a CtQ factor, the monitoring plan must reflect heightened scrutiny of that endpoint and the QMP must document any associated QTL. Inconsistencies across these documents will be visible to inspectors. Where those documents are generated and maintained in disconnected systems, the risk of internal inconsistency grows.

AI tools that operate in validated, audit-trailed environments and support human review rather than replace it are best positioned to help sponsors meet E6(R3)'s data governance expectations. Systems that generate outputs without traceable provenance or that lack validated change-control processes create compliance exposure rather than reducing it.

How Kitsa Supports E6(R3) Compliance Workflows

Kitsa's KScribe platform is designed to generate regulatory and clinical documents within a consistent, cross-document framework. For sponsors managing the QMP, protocol, and monitoring plan as a coherent CtQ package, KScribe describes maintaining the narrative consistency that E6(R3) now makes a documented requirement. Kitsa describes its infrastructure as designed to enterprise security and access-control standards (see kitsa.ai/regulatory-document-generation for details). GCP validation, 21 CFR Part 11 alignment, and Annex 1 data governance compliance are each sponsor-specific determinations that depend on how a given system is implemented and qualified within a trial's technical infrastructure.

Key Takeaways

• ICH E6(R3) Principles and Annex 1 came into effect in the EU/EEA on 23 July 2025 and in Switzerland on 15 August 2025; the FDA published its aligned guidance in September 2025. For EU/EEA- and Swissmedic-regulated trials, compliance preparation that has not started is already delayed. For FDA-regulated trials, the guidance is non-binding, but inspectors may reference R3 as the current GCP standard.
• Annex 2, covering decentralized, pragmatic, and real-world data-incorporating trials, was formally adopted by the ICH Assembly on 3 June 2026. Organizations running non-traditional trial designs should begin mapping current processes against it now.
• Quality by Design is now a GCP requirement, not an option. Sponsors must document CtQ factors at protocol inception and design operational processes to protect them.
• Proportionality replaces uniformity. Monitoring intensity, audit frequency, and data verification scope must be calibrated to the actual risk profile of each trial, with the calibration documented and defensible.
• Data Governance is a new, distinct obligation. Both sponsors and investigators must implement policies covering the full data lifecycle, from capture to archiving, with audit trails and access controls that satisfy Annex 1 Section 4.
• Essential records expand beyond documents. Communication logs, system records, and decision rationale materials are now within scope of the eTMF and regulatory inspection.
• Sponsors remain ultimately accountable when they outsource. CRO and vendor contracts must reflect R3's oversight requirements, and sponsors must maintain independent oversight documentation.

Frequently Asked Questions

References

1. [1]European Medicines Agency. "ICH E6 Good Clinical Practice: Scientific Guideline." EMA/CHMP/ICH/135/1995. First published January 2025; effective 23 July 2025. https://www.ema.europa.eu/en/ich-e6-good-clinical-practice-scientific-guideline
2. [2]U.S. Food and Drug Administration. "E6(R3) Good Clinical Practice; International Council for Harmonisation; Guidance for Industry; Availability." Federal Register, September 9, 2025. Docket No. FDA-2023-D-1955. https://www.federalregister.gov/documents/2025/09/09/2025-17311/e6r3-good-clinical-practice-international-council-for-harmonisation-guidance-for-industry
3. [3]International Council for Harmonisation. "ICH E8(R1): General Considerations for Clinical Studies." ICH, 2021. https://www.ich.org/page/efficacy-guidelines
4. [4]International Council for Harmonisation. "ICH E6(R3) Annex 2: Guideline for Good Clinical Practice." ICH Step 4 Final, adopted 3 June 2026. https://database.ich.org/sites/default/files/ICH_E6(R3)_Annex%202_Guideline_Step%204_2026_0603_0.pdf
5. [5]International Council for Harmonisation. "ICH E6(R3) Guideline for Good Clinical Practice: Principles and Annex 1." ICH Step 4, adopted 6 January 2025. https://www.ema.europa.eu/en/documents/scientific-guideline/ich-e6-r3-guideline-good-clinical-practice-gcp-step-5_en.pdf
6. [6]Veeva Systems. "ICH GCP E6(R3) Compliance: 6 Key Changes for Clinical Trial Teams." Veeva Systems Europe, February 2026. https://www.veeva.com/eu/blog/ich-gcp-e6r3-compliance-6-key-changes-for-clinical-trial-teams/
7. [7]ACRP. "ICH E6(R3): Delivering Quality Outcomes Through Compliance." ACRP, March 2026. https://acrpnet.org/2026/03/25/ich-e6r3-delivering-quality-outcomes-through-compliance
8. [8]European Commission. "AI Act." Digital Strategy. Regulation (EU) 2024/1689; entered into force 1 August 2024. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
9. [9]Swissmedic. "Adoption of ICH GCP Guideline E6(R3)." Swissmedic, 2025. Principles and Annex 1 effective in Switzerland 15 August 2025. https://www.swissmedic.ch/swissmedic/en/home/news/mitteilungen/einfuehrung-leitlinie-ich-gcp-e6-r3.html