Updates on Good Clinical Practice Guidelines (ICH E6 R3)

Clinical trials are the gold standard for determining the efficacy and safety of medicinal products. Their conduct must follow strict quality requirements to ensure participant safety, and the reliability of the data generated. In the European Union, sponsors must ensure that trials are conducted in accordance with the GCP guidelines issued by the International Council for Harmonisation (ICH).

The GCP guidelines are considered the international benchmark for ensuring data quality and participant safety, while also facilitating mutual recognition of clinical data across regulatory agencies. In January 2025, the ICH adopted the third revision of its GCP guidelines (“ICH E6 R3”), which are now structured into a set of general principles and an Annex I on implementation. These will come into effect in the EU on 23 July 2025. A second annex, focused on decentralised elements, is currently under review and is expected to take effect in early 2026.

Changes in risk assessment and management

Not all clinical trials involve the same level of intervention or carry the same degree of risk for participants. While some clinical trials investigate authorised medicines, others involve unauthorised products using more complex designs, including data collection devices or artificial intelligence (AI) tools for participant monitoring and data analysis.

Recognising this, the new GCP revision introduces a more flexible, risk-based approach tailored to the specific features of each trial. Sponsors must now anticipate potential risks and design the study in proportion to the level of risk expected. Clinical trial designs should avoid unnecessary complexity, excessive data collection, and undue burdens on participants and investigators.

Use of new technologies and decentralised clinical trials

The new version of the GCP guidelines reflect the growing digitalisation of clinical trials and include a dedicated section on data management (covering everything from collection to deletion). The use of technological solutions (e.g., digital tools, AI, remote monitoring, etc.) must be validated in advance, used transparently, and justified based on their purpose in the trial.

This shift is also reflected in the replacement of the term “CRO” (Contract Research Organisation) with the broader term “service providers.” This acknowledges that sponsors now outsource not only traditional functions like monitoring and data analysis, but also the implementation of innovative technological solutions. The GCP guidelines require any outsourcing to be properly documented and emphasise the sponsor’s responsibility to supervise all service providers involved in the trial.

Of note is Annex II, expected to enter into force in early 2026. It sets specific requirements for the use of decentralized elements and real-world data (RWD) in trial design. In line with the proactive risk-based approach, sponsors must justify their use and ensure participants are informed. These requirements are consistent with guidance already issued by various European regulatory agencies, including the Spanish Agency of Medicines and Medical Devices (AEMPS).

Practical recommendations for sponsors and CROs

The third revision of the GCP rules makes it necessary for sponsors to review and update their internal procedures and strengthen coordination with service providers.

A key aspect of GCP compliance is being prepared for inspections by national authorities. In Spain, the responsibility for GCP inspections is shared between the AEMPS and the regional health authorities. According to its 2024 activity report, the AEMPS is one of the most active European agencies in GCP inspections requested by the European Medicines Agency (EMA).

Therefore, sponsors are advised to pay close attention to the requirements under the new GCP revision, especially for complex, multicentre, or technology-driven clinical trials. In such cases, it will be essential to: (i) justify the use of digital tools or AI in line with the trial design; (ii) properly document their validation; and (iii) ensure transparent implementation. Moreover, active supervision of all involved service providers and CROs will also be essential to ensuring full compliance with GCP requirements.