GCP, ICH E6(R3) and the Regulators
Part of Clinical Research Associate (CRA) Training: Foundations for the Monitor.
About 6 minutes. Free, in your language, no account needed.
Why this matters
A monitor is asked "where does that requirement come from?" more than anyone else on a trial. Answer it wrongly and you either impose work that is not required or you miss something that is.
This lesson gives you the layers and the current version of the standard.
Good Clinical Practice
Good Clinical Practice, or GCP, is the international standard for designing, conducting, recording and reporting clinical trials involving people. It has two stated purposes, in this order: protecting the rights, safety and wellbeing of participants, and making the results reliable.
It is written by the International Council for Harmonisation, or ICH. The guideline is E6.
ICH was founded in April 1990 as the International Conference on Harmonization, and was renamed the International Council for Harmonization in 2015 when it became a legal entity under Swiss law. Material still saying "Conference" is out of date by a decade.
ICH E6(R3) is current
- The original E6 reached Step 4, meaning adoption as a harmonized guideline, on 1 May 1996.
- E6(R2) was adopted on 9 November 2016 and is now historical.
- E6(R3), consisting of the Principles and Annex 1, was adopted at Step 4 on 6 January 2025 and became legally effective in the European Union on 23 July 2025.
- Annex 2, covering decentralized elements, pragmatic elements and real-world data, was adopted on 3 June 2026 and becomes legally effective in the European Union on 15 January 2027.
E6(R3) is the operative revision. R2 is history and should only ever be described as such.
R3 has a different shape from R2. It is built from a set of overarching Principles, organized into eleven categories, followed by Annexes. Annex 1 covers interventional trials and is where nearly all of your work sits. Do not quote a count of the individual sub-points beneath the categories; sources count them differently and the number proves nothing.
Two changes matter to monitors directly. R3 contains an explicit treatment of data governance, shared between investigator and sponsor. And "essential documents" became "essential records", because records now expressly include data and relevant metadata such as audit trails.
Guideline, law, contract, protocol
Four layers govern what a site must do. Know which one you are quoting.
| Layer | What it is | Example |
|---|---|---|
| ICH guideline | An internationally harmonized standard | E6(R3), adopted 6 January 2025 |
| Regional or national law | Enforceable where the site is | 21 CFR Part 50; Regulation (EU) No 536/2014 |
| The clinical trial agreement | A contract between sponsor and site | Data entry within five working days |
| The protocol | The rules for this trial | Serious adverse event report within 24 hours; visit windows |
An ICH guideline is not law. It becomes enforceable only when a regulator adopts it into its own framework. This is why requirements differ between countries, and why "ICH requires it" is often the wrong answer.
The regulators
United States Food and Drug Administration. Its rules most relevant to sites include 21 CFR Part 50 on informed consent, Part 56 on institutional review boards, Part 312 on investigational new drug applications, Part 812 on investigational device exemptions, and Part 11 on electronic records and signatures.
European Union. Trials are governed by Regulation (EU) No 536/2014, the Clinical Trials Regulation, applicable since 31 January 2022, replacing the earlier Directive. Applications go through a single EU portal.
Other national authorities include the Medicines and Healthcare products Regulatory Agency in the United Kingdom, Health Canada, the Pharmaceuticals and Medical Devices Agency in Japan, and national agencies across Africa, Asia and Latin America.
Data protection law applies on top: the General Data Protection Regulation in the European Union since 25 May 2018, HIPAA in the United States, and national equivalents elsewhere, some of which restrict transferring health data abroad.
Three corrections worth carrying
These are widely taught wrongly, and a monitor who repeats them loses credibility fast.
ICH E6(R3) never uses the acronym ALCOA. It states the data attributes directly, in words. Its glossary definition of data integrity lists eight: attributable, legible, contemporaneous, original, accurate, complete, secure and reliable. Use ALCOA as a memory aid if you like; never attribute it to the guideline.
E6(R3) states no record retention period in years. Section 3.16.3 defers to applicable regulatory requirements and requires the sponsor to inform the site in writing. Figures like 2, 15 or 25 years come from regional law or from the contract.
E6(R3) gives no number of hours for serious adverse event reporting. Section 2.7.2(b) says immediately after the investigator reasonably becomes aware. The familiar 24 hours is a protocol convention; 7-day and 15-day expedited clocks are regional regulation.
In practice
At one of Leah's VT-301 sites, a coordinator says her previous monitor told her that ICH requires GCP retraining every two years and that all records must be kept for fifteen years.
Leah checks rather than agreeing. Neither statement is in ICH E6(R3). The two-year retraining interval is the sponsor's own policy for this trial, and she can show the coordinator where it is written. The retention requirement comes from the sponsor's written retention instruction, which is in the site file and which for this trial says something different from fifteen years.
The coordinator's practice does not change. Her understanding does, and so does what she will tell an inspector when asked why the site does it.
Knowing which layer a rule comes from is the difference between compliance and folklore.
Key takeaways
- ICH E6(R3) Principles and Annex 1 were adopted on 6 January 2025 and are the operative revision; E6(R2), adopted 9 November 2016, is historical.
- R3 is structured as Principles in eleven categories plus Annexes, adds an explicit data governance treatment, and renames "essential documents" to "essential records".
- Four layers govern site conduct — ICH guideline, regional law, the clinical trial agreement, and the protocol — and a monitor must know which layer a requirement comes from.
- An ICH guideline is not law until a regulator adopts it into its own framework, which is why requirements differ between countries.
- E6(R3) never uses "ALCOA", states no retention period in years, and gives no SAE reporting clock; those come from industry shorthand, regional law and the protocol respectively.