Good clinical practice revision 3: evolution or revolution?

The new ICH E6(R3) (1) Good Clinical Practice (GCP) guidelines represent the most significant update to GCP (2) since its inception more than 25 years ago. Published in its final version in January 2025, these guidelines introduce innovative provisions applicable to various types and contexts of clinical trials, ensuring the continued relevance of GCP in an era of rapid technological and methodological advancements. Specifically, the new version encourages a proportionate, risk-based approach to study conduct, promoting fit-for-purpose solutions. Additionally, it strengthens transparency through the public registration of trials and the dissemination of results, while providing further guidance to improve the informed consent process. The R3 update is a substantial shift from the R2 (3) addendum of 2016 (which introduced initial elements of a risk-based approach and electronic data management): the R3 revision fully embraces the new paradigms of clinical research, from quality by design to the use of digital technologies and decentralized trials, with a stronger focus on the patient.

From a structural perspective, R3 completely replaces the previous R2 version and redefines its architecture. The document is divided into General Principles (11 GCP principles) and specific annexes. Annex 1 applies to traditional interventional clinical trials (and includes practical appendices on Protocol, Investigator’s Brochure, Essential Documents, etc.), while Annex 2 (4), not yet published in its final form, will provide additional considerations for non-traditional trials, such as pragmatic studies, decentralized studies, or those using real-world data.

This modularity is designed to keep GCP principles up-to-date as technologies, methods, and study designs evolve, allowing for streamlined and targeted updates through new annexes. Annex 2, in particular, will address innovative elements such as decentralized trials and the integration of Real World Data sources, ensuring that these approaches are also conducted in compliance with GCP principles and fit-for-purpose. The General Principles and Annex 1 will come into effect in July this year, while Annex 2, already under public consultation, will be finalized and made available later.

Risk-Based Approach and Quality Management

ICH E6(R3) builds on the foundation laid by ICH E8(R1) (General Considerations for Clinical Studies), promoting a culture of quality from the early stages of clinical development. The Quality by Design paradigm is emphasized: quality must be proactively designed into the study, planning from the outset how to prevent deviations that could affect critical data or participant safety. In this context, the new guideline requires the explicit identification of Critical-to-Quality (CtQ) factors for each trial, those aspects of design and conduct whose control is essential to protect participants and ensure the reliability of the data collected. Resources should be concentrated on these critical factors during study planning and management, dedicating proportionate attention to their importance and complexity.

The cornerstone principle of R3 is proportionality to risk: processes, control measures, and monitoring activities must be proportionate to the inherent risks for participants and the impact on critical study data. This extends and strengthens the risk-based approach introduced in R2, embracing a holistic view of risk management throughout the study lifecycle, from protocol design to final analysis. In practice, sponsors are encouraged to simplify where possible; operational procedures, data collection, and quality controls should focus on what is critical and avoid burdening the study with unnecessary complexity that does not add value to participant safety or result robustness. A careful evaluation of CtQ factors and associated risks allows for concentration on elements essential to the study’s objectives, enhancing efficiency and effectiveness.

Operationally, the section on Quality Management has been expanded and clarified. Sponsors must establish a quality management system that includes preventive quality assurance (QA) and quality control (QC) processes, integrated into routine monitoring and study oversight activities. Additionally, the definition of “tolerance limits” for specific key study parameters (the so-called Quality Tolerance Limits introduced in R2) is clarified: R3 specifies that acceptable ranges should be established, beyond which deviations may indicate systemic problems to investigate and correct. In summary, the renewed GCP approach aims to design quality into clinical studies and proactively manage the most relevant risks, rather than simply reacting in a corrective manner. This shift in mindset is expected to result in leaner, more robust trials focused on the most impactful aspects of validity and safety.

Defined Roles and Responsibilities

The R3 revision dedicates one of its fundamental principles to clearly defining roles and responsibilities for all actors involved in the study. It is emphasized that the sponsor and the principal investigator retain ultimate responsibility for their respective activities, even when delegating tasks or functions to third parties. Each delegation of tasks must be documented in written agreements that clearly define roles, activities, and responsibilities. In other words, if the sponsor delegates tasks to a contract research organization (CRO) or other vendors, they remain responsible for the conduct of the study. They must ensure proper oversight of these delegated activities. Similarly, the investigator may delegate certain activities (e.g., to sub-investigators or study personnel) but retains direct responsibility and oversight for everything happening at the clinical site. E6(R3) emphasizes that the level of investigator supervision over delegated activities should be proportionate to their criticality and associated risks, applying the same risk-based logic to the management of the study team.

Terminologically, the new version introduces the concept of a “service provider” to refer to any individual or organization external to the sponsor or investigator that provides a service related to the clinical trial. This expands the scope compared to R2 (which mainly referred to Contract Research Organizations - CROs), acknowledging the variety of partners involved in modern trials: centralized laboratories, technology vendors, external committees, and other specialized services. R3 further clarifies that agreements with these service providers or external parties must be finalized before the study begins, clearly defining tasks and responsibilities. It also includes a specific mention of the need for the sponsor to extend its quality oversight to structures or activities outside the traditional experimental site: for example, centralized laboratories, imaging diagnostic services, or other vendors entrusted with study data must be integrated into the sponsor’s quality assurance/quality control strategies. This is also reflected in the role of the Principal Investigator, who is required to extend oversight to any activities performed outside the experimental site (e.g., home nursing services). Ultimately, R3 emphasizes a more structured and transparent governance model: who does what in the clinical trial must be clear and documented, with the sponsor and investigators remaining responsible and actively involved in overseeing all delegated aspects of the trial. This helps avoid gaps in responsibility and ensures that the quality and integrity of the study are maintained throughout the operational chain.

Revised Essential Documentation

A significant change in R3 concerns the management of essential clinical trial documentation (formerly known as essential documents, section 8.1 of R2). In Annex 1 of R3, Appendix C redefines the concept of Essential Records and provides detailed operational guidance. The approach shifts from a static list of documents to be stored (as in E6(R2)) to a more flexible, principle-based view. It provides guidance on what constitutes an “essential” record, stating that the nature and extent of documents to be generated and maintained depend on the design and conduct of the trial, the application of proportionate risk approaches, and the importance and relevance of each record to the study’s objectives. In other words, the essential nature of a document is linked to its contribution to participant safety or data validity: essential records are those that “enable the current management of the study and reconstruction of the trial” and document critical aspects such as compliance with the protocol, GCP, and regulations.

R3 clarifies the content, maintenance, and storage of these essential records. For example, it emphasizes maintaining the integrity and accessibility of these documents throughout their lifecycle (in line with data integrity requirements). The updated guidelines present a single table of examples of essential records (replacing the separate “before/during/after the study” lists in R2). This table includes, for example, essential documents such as the study protocol, the Investigator’s Brochure (or basic product information if the drug is already marketed), approved informed consent forms, various approvals, and ethical opinions, etc. However, the focus is not so much on the list itself, but on the principle that each trial must identify its essential documents based on relevance and risk criteria. For smaller or simpler trials, fewer documents may be essential compared to large and complex trials, though certain elements (protocol, consents, and key data) remain fundamental in every case.

Another conceptual innovation is the reciprocity of access to essential documentation between sponsor and investigator. R3 clarifies that the sponsor and investigator/institution must have mutual access to each other’s essential records, to the extent necessary to fulfil their responsibilities. This means, for example, that the sponsor should be able to access certain essential documents stored at the site (e.g., relevant source data, training certificates, etc.), and vice versa, the investigator should receive the sponsor’s essential documents (e.g., product brochures, updated protocol, relevant SOPs, study reports, etc.). This approach promotes greater transparency and alignment between the study site and sponsor in managing the Trial Master File and Investigator Site File, ensuring that both parties have the necessary documentation to ensure the study’s quality and compliance. Finally, R3 strengthens the guidelines on record retention: all essential data and documents (including electronic records) must be retained for the period required by regulations, accessible for inspections, with adequate integrity and protection controls (backup, IT security), and any planned destruction of records at the end of the retention period must be carried out according to documented procedures.

Digital Innovations and Decentralized Trials

The E6(R3) guidelines reflect the growing impact of digital technologies and new study models on clinical research, incorporating them into GCP principles. A crosscutting aspect of the document is its “media-neutral” approach, which is neutral to both paper and electronic media. This ensures that GCP requirements can be met whether traditional methods or advanced electronic systems are used in the trial, fostering technological innovation in clinical trials without losing sight of the basic principles. For example, R3 explicitly recognizes the use of digital health technologies (DHT), such as wearable devices, sensors, medical apps, etc., which can be integrated into trials to expand data collection and participant monitoring. These tools—possibly integrated into existing healthcare infrastructures—open new approaches for conducting studies, provided their use is appropriate for participant characteristics and trial design. The guidelines encourage sponsors to explore these digital innovations to make trials more efficient, for example, by facilitating patient recruitment and retention, collecting real-time data from diverse and complementary sources, and reducing site operational burden.

At the same time, R3 imposes stricter requirements for the governance of electronic data and cybersecurity. A new chapter dedicated to Data Governance highlights the importance of ensuring data integrity throughout its lifecycle, from initial collection to final analysis. Measures are required, such as appropriate validation of computerized systems used in the study (data collection software, eCRFs, clinical databases, eSource tools, etc.), controlled management of system accounts and access, the use of audit trails to track any changes to data, and adequate backup, security, and data protection plans to prevent unauthorized access or data loss. In practice, data integrity—that has been at the center of many regulatory inspections in recent years—is fully integrated into GCP: electronic data must be as reliable and verifiable as paper data. The guidelines urge sponsors and researchers to assess cybersecurity risks and implement proportionate measures to ensure the confidentiality of participant data and the availability of systems even in the event of failures or cyberattacks. This focus on electronic systems reflects the current reality, where much of the clinical data is managed digitally. It aims to ensure that technology is used responsibly without compromising patient rights or data quality.

A chapter of R3 is dedicated to decentralized trials and the use of “remote” study methods. Annex 1 redefines the concept of an investigator site more flexibly to include decentralized and virtual contexts. It is recognized that some study activities can take place outside traditional clinical sites, for example, at participants’ homes or in peripheral healthcare facilities, without compromising GCP compliance. The guidelines provide guidance on how to manage such elements: for example, the sponsor must include in the monitoring plan and quality control strategies oversight of remote laboratories, pharmacies, or services involved in the study. Furthermore, R3 elevates the profile of centralized and remote monitoring: it is clarified that monitoring visits to sites can be conducted either on-site or remotely, and that a combination of centralized monitoring (e.g., remote analysis of accumulated data) and on-site monitoring can improve the effectiveness of controls. It is required that a study’s monitoring strategy consider various factors (study objectives and phase, design complexity, blinding, product safety profile, etc.) and apply a risk-based approach to determine the frequency and intensity of visits, whether on-site or virtual. This codifies Risk-Based Monitoring into GCP, which was suggested in R2 but is now an integral part of the quality expectations in R3.

In general, R3 embraces innovative trial models. It is recognized that adaptive designs, decentralized or hybrid studies, pragmatic approaches, and the use of real-world data can bring benefits (e.g., greater inclusivity and more applicable results). At the same time, the guidelines provide a framework for implementing these innovations while maintaining ethical and quality standards. For example, the use of telemedicine tools, remote visits, or remote data collection must always occur with the participant’s informed consent and under the researcher’s oversight, ensuring the validity of remotely collected data as if it were collected on-site. Practical considerations are suggested, such as ensuring patients have the skills and resources to use any electronic devices provided by the study, planning technical support channels, and guaranteeing the protection of data transmitted to/from the patient. In essence, R3 normalizes decentralization as part of GCP, integrating it with principles of proportionality and a focus on quality: sponsors can leverage technologies and agile models to conduct studies, provided they assess and mitigate associated risks (e.g., device reliability, data security, training needs) and always keep participant protection and scientific data robustness at the center.

Patient-Centricity and Informed Consent

A crosscutting theme in R3 is the strengthening of patient orientation in the conduct of clinical trials. The revised guidelines explicitly promote patient inclusion and consideration of their viewpoints in various aspects of the process. It is stated, for example, that the use of innovative study designs and decentralized technologies can facilitate the participation of broader and more diverse patient populations, enhancing the representativeness and applicability of study results. Excluding specific participant categories without scientific justification should be discouraged: eligibility criteria should be scientifically justified to avoid unnecessarily limiting access to the study for subgroups (elderly, pregnant women, minorities, etc.) when not required by safety or scientific objectives. In line with the global focus on trial diversity, R3 pushes for more inclusive study designs to increase the results’ generalizability and clinical impact.

Another significant change is the emphasis on active involvement of patients and other stakeholders (e.g., patient associations, caregivers, general practitioners) in the design and conduct of studies. Sponsors are encouraged to gather feedback from potential participants during the development of the protocol and informational materials to identify aspects that may be too burdensome or complex, potentially hindering study participation. Integrating the patient’s perspective can help simplify unnecessarily complicated procedures, adopt more flexible visit schedules, reduce the burden of redundant exams or questionnaires, and generally optimize the feasibility of the study while maintaining focus on important endpoints. This participatory approach aligns with the principles of patient centricity, now recognized as key factors for the success of modern clinical trials.

R3 also updates the Informed Consent process, adapting it to new practices and ethical expectations. Electronic consent (eConsent) and remote consent procedures are explicitly recognized and legitimized, provided that requirements for comprehensibility, voluntariness, and documentation are met. The guidelines encourage using technologies (tablets, video calls, and electronic signatures) to obtain consent when appropriate—for example, in fully decentralized trials—while ensuring the participant has the opportunity to ask questions and fully understand the study. In addition to the format, certain mandatory content of the information sheet and consent form has changed. R3 now requires the inclusion of information on the possible use of data and samples collected (e.g., biobanks, future research), explanations of how personal data will be protected, and a new mention of potential risks for third parties associated with the participant’s involvement (e.g., risks to a sexual partner in the case of a teratogenic experimental treatment). Informed consent now also requires informing the participant about the existence of public study registries and offering the participant the possibility to be informed of the overall study results at the end (if desired). This marks a significant shift towards transparency and respect for study volunteers: participants are no longer seen simply as “subjects,” but as partners in the study, deserving the right to know the outcome of the research to which they have contributed. In this sense, R3 prefers the term “participant.”

R3 pays particular attention to vulnerable participants. Protections are strengthened for individuals who cannot give autonomous consent, for minors, and for groups potentially subject to coercion or exploitation. For example, the guidelines suggest additional safeguarding and ethical monitoring measures when involving vulnerable populations and reaffirm the need for consent from a legally acceptable representative when appropriate, along with the minor’s assent when possible, in accordance with local regulations. Overall, the changes to the informed consent process aim to modernize and humanize it: leveraging technological tools and new information to make it more complete and convenient while ensuring the participant remains at the center, truly aware and respected in their rights and dignity.

Pros and cons

One of the main strengths of R3 is its flexible and proportionate approach. Unlike previous versions, it is no longer rigidly prescriptive, but encourages application proportionate to the risks for participants and the value of the data. This orientation should lead to a reduction of unnecessary bureaucratic burdens, allowing resources to be concentrated on critical quality aspects.

Linked to this aspect is the introduction of the quality by design concept. It is not only about conducting the study correctly but also about designing it from the outset with quality as an intrinsic objective, anticipating risks, and preventing errors that could compromise safety and data integrity.

Another positive novelty is the greater attention to data governance. Today, with growing digitalization and the use of real-world data, control over the entire data lifecycle—from collection to maintenance of blinding—becomes central. This also relates to the willingness to make the guidelines media-neutral, i.e., applicable regardless of paper or electronic format.

On the ethical level, R3 strengthens some fundamental aspects: informed consent is increasingly understood as a communication process rather than a simple signature, and greater commitment toward inclusivity is promoted in order to avoid unnecessary exclusions of categories of participants.

On the practical side, another clear strength is the opening to decentralized trials, the use of digital technologies, and the integration of real-world data. This represents a step forward to make clinical trials more agile and closer to the reality of medical practice.

Certainly, there are also critical issues. The first relates to the transition: adoption will not be uniform globally, and it is expected that some countries will move more quickly than others. For centers and sponsors, this means living, at least initially, with possible differences in interpretation and regulatory frameworks that are not fully harmonized.

A second limitation concerns costs and training commitments. The new structure, although clearer, introduces new concepts (e.g., data governance, delegated roles, and more detailed agreements), which will require significant investments in training, SOP updates, and contractual adjustments, as well as efforts in digitalization and validation of electronic systems that will not be easy to implement in clinical sites.

Finally, somewhat paradoxically, the very flexibility of R3 could become a double-edged sword: without equally detailed operational guidance, there is a risk of heterogeneity among sponsors, CROs, and regulatory authorities, with consequent differences in practical application.

In our view, these pros and cons should also be interpreted through the lens of the title of this article: evolution or revolution. Many of the changes—such as the risk-based approach, Quality Tolerance Limits, and clearer definitions of roles and responsibilities—are best considered evolutionary, representing a logical continuation and maturation of principles already anticipated in R2. These adjustments improve clarity and applicability but do not radically alter the framework of GCP.

By contrast, other provisions go well beyond incremental improvement and can be seen as revolutionary. The introduction of a modular architecture with annexes makes GCP a “living” guideline rather than a static one, fundamentally changing its nature. The explicit recognition of decentralized and hybrid trials, the integration of digital health technologies, and the central role of data governance and cybersecurity are disruptive elements that redefine what a clinical trial is and how it should be conducted. Perhaps most transformative is the emphasis on patient centricity: by re-framing the participant as a partner, encouraging inclusivity, and requiring return of results, R3 introduces a cultural shift as well as a technical one.

Therefore, the balance of pros and cons reflects this duality: R3 is evolutionary, where it consolidates and clarifies, but revolutionary, where it embraces new paradigms that will require significant adaptation by all stakeholders. This dual character is both a strength—allowing continuity with the past—and a challenge, as it demands readiness to embrace innovation while maintaining rigorous standards.

Table 1 lists the major differences between the R2 and R3 versions, as well as their impact.

TABLE 1 -. Comparison between ICH E6(R2) and ICH E6(R3)

Area	R2	R3 (novelty)	Expected impact
Regulatory approach	Prescriptive guidelines, checklist-oriented	Flexible and proportionate, risk-based approach	↓ Administrative burden; ↑ Focus on critical aspects
Quality	Quality mainly, as compliance with processes and documents	Introduction of Quality by Design: quality embedded in study design	↑ Data robustness; ↓ Systematic errors
Data governance	Limited focus, mainly on source data verification and archiving	Dedicated section on data governance: data integrity, lifecycle, metadata, audit trail, blinding	↑ Data reliability; ↑ Digital compliance
Cybersecurity	Not specifically addressed	Explicit requirements for system validation, access control, audit trails, backup, and protection against cyber risks	↑ Data protection; ↑ System resilience
Document structure	Single text with sections on Sponsor and Investigator	Modular architecture: Principles, Annexes, Glossary, Appendices	↑ Clarity; ↑ Easier future updates
Ethics and consent	Strong focus on consent, mainly as a signed document	Consent as a communication process; emphasis on inclusivity and diversity	↑ Participant rights; ↑ Representativeness
Patient centricity	Participant seen as “subject” with a passive role	Participant as “partner”; inclusivity, return of results, engagement in design	↑ Transparency; ↑ Trust; ↑ Recruitment and retention
Study types	Focus on traditional interventional trials	Integration of decentralized trials, RWD, and digital tools	↑ Innovation; ↑ Access to trials
Monitoring and oversight	Predominantly on-site monitoring, document verification	Risk-based monitoring, integration of centralized and remote strategies	↑ Efficiency; ↓ Costs; ↑ Early detection of deviations
Roles and responsibilities	Delegations are possible, but with a limited focus on oversight	Clearer agreements, qualifications, and responsibilities (even if delegated)	↑ Accountability; ↑ Contractual complexity
Documentation	“Essential documents” are defined in a relatively static way	Updated appendices, media-neutral (paper/electronic)	↑ Flexibility; ↑ Use of digital systems
Global implementation	More uniform adoption, though gradual	Phased adoption, with possible regional differences	↑ Risk of initial heterogeneity
Training and quality culture	Focus on formal compliance	Emphasis on quality culture and continuous improvement	↑ Training investment; ↑ Sustainable improvement

Conclusion

Version R3 marks a new era for Good Clinical Practice, introducing concepts and flexibility that respond to transformations in recent years in the field of clinical trials. The key innovations—from the proportionate risk-based approach, quality by design, and better-defined roles to the embrace of digital technology, decentralized trials, and patient centricity—are all aimed at making clinical trials more efficient, ethical, and focused on truly critical aspects. For researchers, sponsors, clinical monitors, and all professionals in the clinical-regulatory field, the practical implementation of R3 will require an effort to update procedures, training, and mindsets. It will be crucial to adopt proactive quality systems, rethink monitoring and data management plans in a risk-based framework, engage patients early in study design, and ensure continuous technological compliance with GCP. The transition is already underway: version E6(R2) will remain applicable until July 22, 2025, after which R3 provisions will become the new international standard. Ultimately, ICH E6(R3) strengthens the reliability and ethics of clinical research by introducing greater operational flexibility and a focus on quality. It is hoped that these changes will contribute to safer clinical trials for participants and more robust results, while fostering innovation and openness to modern experimental approaches.

Other information

Corresponding author:

Celeste Cagnazzo

email: celeste.cagnazzo@unito.it

Disclosures

Conflict of interest: The authors declare no conflict of interest.

Financial support: This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.

Authors’ contribution: Conceptualization: CC; Writing – original draft: CC, FR; Writing – review & editing: LP; Supervision: FF.