HHS, FDA and ICH: Which Rules Apply to Your Study

Part of Human Subjects Protection for Clinical Research Staff: Who Protects Participants.

About 6 minutes. Free, in your language, no account needed.

Why this matters

New staff often ask, "Which rule is this?" Several sets of rules can apply to one study at once. Knowing the three main sources helps you ask your regulatory office the right question instead of guessing.

ICH E6(R3) is the international baseline for IRB/IEC review, investigator duties and consent, and its IRB/IEC requirements are read together with local requirements. Outside the United States, your site follows its national law and ethics committee requirements. This course teaches the US rules (HHS 45 CFR 46, FDA 21 CFR 50 and 56, HIPAA 45 CFR 164) as the detailed worked example. Every section below marked "In the United States" is US law, not a universal rule.

In the United States: the Common Rule (HHS, 45 CFR 46)

The Common Rule applies to research that is conducted, supported or otherwise subject to regulation by a Federal department or agency that has adopted the policy (45 CFR 46.101(a)). Institutions engaged in such research, and the IRBs that review it, must comply.

An institution engaged in non-exempt research that a federal agency conducts or supports must give a written assurance that it will comply. Agencies may accept a current assurance on file with OHRP, the Office for Human Research Protections in HHS (46.103(a)). That assurance is the Federalwide Assurance (FWA). The institution also certifies to the funding agency that each study was reviewed and approved by an IRB, and the research may not start before that certification (46.103(d)).

OHRP also receives reports of unanticipated problems, serious or continuing noncompliance, and suspensions or terminations of IRB approval (46.108(a)(4)).

In the United States: which version of the Common Rule?

The "2018 Requirements" apply to research initially approved by an IRB on or after January 21, 2019. Research approved earlier stays under the "pre-2018 Requirements" unless the institution documented a transition (46.101(l)). The versions differ on consent, exemptions and continuing review. Key information, broad consent, limited IRB review, the current exemption categories and the continuing review exceptions taught in this course are 2018 Requirements features. Ask your IRB office which version your study is under.

In the United States: FDA rules (21 CFR 50 and 56)

An FDA-regulated clinical investigation that must meet the prior submission requirements, such as for an IND or an IDE, must be reviewed and approved by an IRB that meets FDA's rule before it starts. It must also remain subject to continuing review by that IRB. FDA may decide not to consider data from an investigation that did not have this IRB review (21 CFR 56.103(a), (b)).

IRBs that review FDA-regulated investigations in the US must register with HHS and renew every three years (56.106(a), (c)).

Which rules apply: FDA, Common Rule or both

OHRP's foundational training gives the examples:

• A trial funded by a private company to test a new drug must follow FDA's rules because the drug is FDA-regulated, but not the Common Rule, because there is no HHS support. Many institutions apply the Common Rule to all their research by institutional policy, so ask your IRB office.
• An NIH-funded study of an FDA-regulated drug may need to follow both: FDA's rules because of the drug, and the Common Rule because NIH, part of HHS, funds it.

Under FDA's rules alone, the 2018-only features do not apply: the current FDA text has no key information requirement, no broad consent, no limited IRB review and no single IRB mandate, and continuing review stays at least annual (21 CFR 50.25; 56.109(f); 56.114). When both rule sets apply, your IRB office tells you how they are being handled. Do not pick one and ignore the other.

In the United States: single IRB and joint review

• Under the Common Rule, for cooperative research that a federal department or agency conducts or supports, each US institution engaged in the research must rely on a single IRB for the US portion. The supporting agency identifies the IRB or accepts the lead institution's proposal. There are exceptions: when law requires more than single IRB review, or when the agency determines and documents that a single IRB is not appropriate. Other cooperative research may use joint review, reliance on another IRB or similar arrangements. The compliance date was January 20, 2020, and the reliance must be documented in writing (46.114(b), (c); 46.101(l); 46.103(e)).
• NIH has its own single IRB policy for the domestic sites of NIH-funded multi-site studies that run the same non-exempt protocol (NOT-OD-16-094, effective January 25, 2018).
• FDA's rule allows joint review, reliance on another qualified IRB, or similar arrangements (56.114). The FDA text current on October 23, 2026 contains no single IRB mandate.

Find out which IRB covers your study and who your local contact is.

Other laws still apply

Compliance with the Common Rule also requires compliance with other pertinent federal laws that provide additional protections. The policy does not affect state, local or foreign laws that provide additional protections (46.101(e), (f), (g)).

If your study is overseas or your state has its own rule, the local rule may add to what you read here.

In practice

A coordinator at a US university hospital is setting up a federally funded study of an investigational drug. She asks her regulatory office three questions. Which IRB reviews this study, our own or an outside single IRB? Is the study subject to FDA regulation as well as the Common Rule? Does our state or the sponsor's country add anything? She records the answers in a short note so the whole team knows which rules apply and who to call.

What this looks like when it goes wrong

A site assumes that because the study is federally funded, only HHS rules apply. The investigational drug triggers FDA requirements, but nobody checked. Nobody confirmed that the reviewing IRB meets FDA's rule.

The risk is serious: FDA may decide not to consider data from an investigation that lacked IRB review meeting its rule.

Key takeaways

• In the United States, the Common Rule applies to research conducted, supported or regulated by a Federal agency that adopted it. Institutions engaged in federally supported research hold an FWA.
• Studies approved before January 21, 2019 may still follow the pre-2018 Common Rule.
• FDA rules require IRB review before an IND or IDE investigation starts, and FDA may not consider data without it.
• IRBs reviewing FDA-regulated investigations must register with HHS and renew every three years.
• An industry-funded drug trial follows FDA's rules and falls under the Common Rule only through federal support or institutional policy. An NIH-funded drug trial can fall under both.
• Under the Common Rule, federally conducted or supported US cooperative research must use a single IRB for the US portion, with exceptions. FDA allows joint review or reliance.
• ICH E6(R3) is the international baseline, read together with local requirements. Outside the United States, national law and ethics committee requirements apply; state, local or foreign laws may add protections.