Regulators and the Rules They Set
Part of Clinical Research Coordinator (CRC) Training: The Regulatory Framework.
About 5 minutes. Free, in your language, no account needed.
Why this matters
An ICH guideline is not law. It becomes enforceable only when a regulator adopts it into its own framework. That single sentence explains why the rules differ between countries and why you must know which ones apply to your site.
This lesson gives you the map. It does not replace local regulatory training, which you will need.
Guideline, regulation, protocol: three different things
Sites confuse these constantly, and the confusion produces both over-compliance and under-compliance.
| Layer | What it is | Example |
|---|---|---|
| ICH guideline | An internationally harmonized standard | ICH E6(R3), adopted 6 January 2025 |
| Regional or national regulation | Enforceable law where you work | 21 CFR Part 50 in the United States; Regulation (EU) No 536/2014 in the European Union |
| The protocol | The sponsor's rules for this specific trial | The 24-hour serious adverse event deadline; the visit windows |
When you are told a requirement, ask which layer it comes from. "Because ICH says so" is often wrong, and being wrong in an inspection is expensive.
The main regulators you will hear about
United States Food and Drug Administration (FDA). Regulates drugs, biological products and medical devices in the United States. Its rules for clinical research include:
- 21 CFR Part 50 — protection of human subjects, including informed consent.
- 21 CFR Part 56 — institutional review boards.
- 21 CFR Part 312 — investigational new drug applications, the route by which a drug may be given to people before approval.
- 21 CFR Part 812 — investigational device exemptions, the equivalent route for devices.
- 21 CFR Part 11 — electronic records and electronic signatures.
European Union. Clinical trials in the EU are governed by Regulation (EU) No 536/2014, the Clinical Trials Regulation, which became applicable on 31 January 2022 and replaced the earlier Clinical Trials Directive. Applications are made through a single EU portal. The European Medicines Agency and national competent authorities both have roles.
Other national authorities include the Medicines and Healthcare products Regulatory Agency in the United Kingdom, Health Canada, the Pharmaceuticals and Medical Devices Agency in Japan, and national agencies across Africa, Asia and Latin America. The World Health Organization publishes guidance and maintains a trial registry platform, but it does not license medicines for member states.
Data protection law sits on top
Clinical research handles some of the most sensitive information about a person. Separate law governs that, and it applies in addition to the research rules.
- The General Data Protection Regulation (GDPR) has applied in the European Union since 25 May 2018 and governs the processing of personal data, including health data.
- HIPAA, the Health Insurance Portability and Accountability Act, governs protected health information in the United States.
- Many other countries have their own equivalents, and some restrict sending health data abroad.
For a coordinator this becomes practical rules: minimum necessary access, coded rather than named data leaving the site, secure storage, and immediate reporting of a suspected breach.
Institutional rules are real rules too
Your hospital or clinic will have its own requirements: research governance approval, contracting rules, documentation standards, training requirements, policies on who may access medical records. An inspector may ask whether you followed your own institution's policy. "It was not required by the sponsor" is not an answer.
The registry obligation
Most jurisdictions and most journals require interventional trials to be registered in a public registry before enrollment begins. ClinicalTrials.gov is the largest; the EU has its own public register, and the World Health Organization operates a platform that draws registries together. The sponsor normally registers the study, but a site may be asked to confirm details such as its recruitment status.
In practice
VT-201 runs at Northside Clinic and at sites in three countries. Nadia joins a study call where another site says its ethics committee is asking for something Nadia has never been asked for.
She does not conclude that the other site is wrong, and she does not adopt their requirement. She asks which layer it comes from. It turns out to be a national requirement in that country. It does not apply at Northside.
Later in the same call, the sponsor mentions that data entry should be completed within five days. Nadia checks: that is a contract and protocol expectation for this study, not a legal requirement. She still follows it, because she agreed to, but she now knows what it is.
Three months on, an inspector asks Nadia why the site keeps a particular log. She answers in one sentence: it is required by the institution's research governance policy, and here it is.
Always know which layer your rule comes from. It is the difference between compliance and folklore.
Key takeaways
- An ICH guideline is not law; it becomes enforceable only when a regulator adopts it into its own framework, which is why requirements differ between countries.
- Three layers govern your work — international guideline, regional or national regulation, and the protocol for this trial — and you should always know which layer a requirement comes from.
- FDA regulations most relevant to sites include 21 CFR Parts 50, 56, 312, 812 and 11; the European Union operates under Regulation (EU) No 536/2014, applicable since 31 January 2022.
- Data protection law applies in addition to research rules, including the GDPR in the European Union since 25 May 2018 and HIPAA in the United States.
- Institutional policies are enforceable at your site, and interventional trials generally must be publicly registered before enrollment begins.