Where National Law Overrides the Baseline

Part of Regulatory Affairs and the Jurisdiction Map: The Global GCP Baseline.

About 5 minutes. Free, in your language, no account needed.

Why this matters

The baseline is a floor, and a floor can be built on. Every jurisdiction adds something, and the additions are where trials actually go wrong, because a team trained on the baseline does not know to look for them.

The additions are not random. They cluster in a small number of areas, and once you know the categories you can interrogate any new jurisdiction efficiently instead of reading its entire legal code.

The seven places national law reliably adds something

One: who may consent for someone who cannot consent for themselves. Whether a legal representative may consent, who qualifies, what documentation of that authority is required, and what happens when capacity returns. Regulation (EU) No 536/2014 addresses this in Article 31 for incapacitated subjects and Article 32 for minors. Many jurisdictions answer it differently, and some have not answered parts of it at all.

Two: emergency and deferred consent. Whether a participant may be enrolled before consent in a genuine emergency, and on what conditions. EU CTR Article 35 permits this in defined circumstances. Some jurisdictions do not permit it at all, which makes an entire category of trial impossible there.

Three: safety reporting clocks and recipients. Who must be told about a suspected unexpected serious adverse reaction, in how many days, and in what format. Both the clock and the list of recipients vary, and the ethics committee's requirement is frequently separate from the authority's.

Four: the import and handling of investigational product. Import licenses, customs procedures, requirements for a local qualified person to release product, and rules about what happens to unused product at the end. This is often administered by a different body from the one that authorized the trial.

Five: data protection and where data may go. Whether personal data may leave the country, on what legal basis, and what a participant must be told about it. This is a body of law entirely separate from medicines regulation, with its own regulator and its own penalties.

Six: insurance, indemnity and compensation. Several jurisdictions set a minimum level of cover and will not authorize without evidence of it. Some specify a no-fault compensation scheme for trial injury.

Seven: obligations after the trial ends. Whether participants who benefited must continue to receive the product, whether results must be published locally, and whether the product must be made available in that country.

Interrogate a new jurisdiction against these seven and you will find most of what differs.

The hierarchy that decides which text binds

When sources conflict, the order is stable:

  1. National law and regulation. Binding, enforceable, and the text an inspector cites.
  2. National guidance from the authority. Usually binding in practice even where it is formally advisory, and sometimes explicitly compulsory. The South African Good Clinical Practice guidelines are recorded as compulsory, which makes them functionally regulation.
  3. International guidance such as ICH E6(R3). Binding only through national implementation.
  4. Sponsor procedures. Bind the sponsor and nobody else. A sponsor procedure cannot lower a national requirement, though it may exceed it.
  5. Secondary sources, including consultancy summaries, conference slides, and our own notes. Useful for orientation. Never citable as the basis for a decision.

That last line is the one worth internalizing. A summary of a regulation is not the regulation, and the summary is frequently a year behind.

In practice

A sponsor plans a trial in stroke, where participants are often unable to consent at the moment treatment must begin. The protocol relies on deferred consent.

The regulatory lead works the seven categories across the intended countries and finds three distinct answers. In several, deferred consent is expressly permitted subject to conditions, and the protocol as written satisfies them. In one, it is permitted but requires the ethics committee to approve the specific deferral procedure in advance as a separate submission. In one, it is not available at all.

That third finding is the valuable one, and it arrives in month one rather than month six. The country is removed from the plan, and the enrollment forecast is rebuilt on the remaining sites.

The cost of finding this late would not have been a delay. It would have been either abandoning a country after site contracts were signed, or, far worse, running a deferred consent procedure in a jurisdiction that does not permit it.

What this looks like when it goes wrong

A sponsor's data management platform is hosted in one region, and participant data from every country flows to it. Nobody asked, in one particular country, whether that transfer had a lawful basis, because the question is not a medicines question and the regulatory team reads medicines law.

The trial is authorized. The ethics committee approved a consent form that describes data being shared with the sponsor. The transfer is nonetheless unlawful under that country's data protection regime, which requires a specific mechanism that nobody put in place.

The remedy is expensive and public. The transfers already happened, the participants were told something that was not accurate about where their data would go, and the regulator with authority here is not the one the sponsor has a relationship with.

The failure is categorical rather than careless. The seven categories exist precisely because the fifth one lives outside the body of law a regulatory professional reads by default.

Key takeaways