We asked a skeptical site owner to test our AI live. Here’s how it held up
Most AI pitched at clinical research sites falls apart the moment a real site owner
When ICH E6(R3) was finalized in January 2025, it overhauled the global GCP framework for the first time in nearly three decades. But the main guideline and Annex 1 did not fully address a question sponsors had been asking for years: what does GCP mean specifically for trials that incorporate remote visits, digital health technologies, real-world data, or elements of routine clinical practice? ICH E6(R3) Annex 2, adopted on 3 June 2026, provides that answer. It covers GCP considerations for decentralized elements, risk-based pragmatic designs, and real-world data used in interventional studies. Its central message is proportionality: apply the GCP framework in a way that is fit for the specific trial design, recognizing that oversight approaches, consent processes, and data governance requirements may differ from traditional site-based models, but the standards it requires cannot be weaker. Annex 2 can also be read as the operational extension of ICH E8(R1)’s Quality by Design (QbD) framework, specifically its requirement that sponsors proactively identify Critical to Quality (CtQ) factors during trial design.[9] Integrating usual clinical practice into a trial creates new CtQ considerations around data reliability that must be addressed before protocol finalization. Annex 2 introduces the Decentralized Clinical Trial (DCT) and RWD considerations on top of, not in place of, the foundational E6(R3) obligations.
Running standard site-based trials with centralized monitoring and no decentralized or real-world-data elements? Castor’s companion guide, ICH E6(R3): practical approaches and real-world considerations, covers the foundational E6(R3) requirements.
Annex 2 GCP considerations apply if your trial incorporates any of the following. If you check any box, read the relevant sections before finalizing your protocol.
If none of these apply, ICH E6(R3) Principles and Annex 1 remain your complete GCP reference. Annex 2 adds to them, not replaces them.
ICH E6(R3) Annex 2 is an addendum to the ICH E6(R3) Guideline for Good Clinical Practice, providing additional GCP considerations for clinical trials that incorporate one or more of the following:
Annex 2 must be read in conjunction with the E6(R3) Principles and Annex 1. It does not replace them. It does not mandate the use of any particular methodology and is not an endorsement of any specific operational approach. It explicitly acknowledges that the clinical trial ecosystem will continue to evolve and that future methodologies may not be fully captured in the current text.
ICH Step 4 adoption occurred on 3 June 2026. Regional implementation follows each authority’s own administrative process. Neither EMA nor FDA has published a formal adoption timeline for Annex 2 as of the date of this brief. The projected windows below are working estimates based on how each agency handled the core ICH E6(R3) Principles and Annex 1 finalization. They are not confirmed schedules.
EMA (European Union): EMA has not issued a formal Annex 2 adoption announcement as of June 2026. Based on EMA’s precedent with the core guideline (where it established an effective date of 23 July 2025, approximately six months after the January 2025 ICH Step 4 finalization), late 2026 is a reasonable working assumption for sponsors planning EU submissions. Sponsors should monitor official EMA publications for confirmed dates.
FDA (United States): The FDA has not published a finalized Guidance for Industry for Annex 2 as of June 2026. Based on FDA’s timeline for the core guideline (where it published its final guidance on 8 September 2025, approximately eight months after the ICH Step 4 milestone), early 2027 is a reasonable working assumption for US submissions. The FDA made the Annex 2 draft available for public comment during the ICH development process. Sponsors should monitor FDA.gov for official publication.
UK (MHRA): Annex 2 is active in the UK as of its June 3, 2026 international finalization under Regulation 28(1A) of SI 2025/538, which references ICH E6(R3) “as amended.” However, MHRA treats the Annexes as guidance supporting the application of the Principles, not as statutory obligations in their own right. The ICH E6(R3) Principles, including Principle 7 on risk-proportionate approaches, are hard law. The Annexes (including Annex 2) are subject to proportional application. MHRA guidance stipulates that non-MAA trials, including academic studies, may apply, interpret, or disapply specific aspects of the operational Annexes, provided sponsors maintain documented rationales demonstrating that core GCP Principles are satisfied, with departures recorded for potential inspection.[5]
For submissions to any of these authorities, cite Annex 2 as the applicable GCP reference for DCT elements and RWD, and document your specific approach rather than asserting blanket compliance.
For the purposes of Annex 2, decentralized elements are trial-related activities conducted outside the investigator’s location. This includes trial visits at the participant’s home, at local healthcare centers or mobile units, and remote interactions such as video calls or the use of Digital Health Technologies (DHTs) for visit procedures and data collection. Sponsors submitting to the FDA should also align their operational execution with FDA’s specific guidance on Decentralized Clinical Trials for Drugs, Biological Products, and Devices,[7] which addresses the use of local Healthcare Providers (HCPs) and operational expectations that supplement the Annex 2 GCP framework.
A recurring theme throughout Annex 2 is proportionate oversight. The level of oversight required should depend on the nature and risk of the trial-related activities, not on whether those activities take place at a traditional site. Annex 2 Section 2.4 specifies that oversight may range from direct supervision to remote review of essential records, including source records. What it may not do is fail to ensure the resulting records meet the requirements of the protocol.
Where healthcare professionals conduct trial-related activities as part of usual clinical practice, for example, a community pharmacist managing Investigational Medicinal Product (IMP) dispensing, or a home nurse conducting a remote visit, the investigator must still ensure that appropriate arrangements are in place to receive relevant data and records, maintain data integrity, and protect participant privacy. If those professionals need to know the protocol, investigator’s brochure, or trial-specific procedures, they must be trained and delegated accordingly.
A common operational question Annex 2 does not fully resolve: when a community doctor, home nurse, or local pharmacist performs a trial-related activity as part of usual clinical practice, does that person need to be added to the Delegation of Authority (DoA) log or listed on Form 1572 (for FDA submissions)? The Annex requires that these providers “be trained and delegated accordingly” if they need to know the protocol or investigator’s brochure (Section 2.4). In practice, this means any healthcare professional conducting a trial-specific activity, even if embedded in routine care, should be reflected in your delegation documentation. Confirm your delegation procedures with your regulatory affairs team before FPI, as FDA and EMA interpret this requirement with some variation.
Annex 2 Section 2.3 explicitly addresses the increasingly common practice of shipping investigational medicinal products directly to a participant’s home or to a designee such as a caregiver, home nurse, or local pharmacist. Where this is permitted by applicable regulatory requirements, the sponsor may arrange direct shipment. The investigator retains responsibility for oversight of the process, and the sponsor should ensure:
Annex 2 permits DtP IMP shipment “where permitted by applicable regulatory requirements.” That phrase is doing significant work. The EU has no uniform position. Member State national laws vary considerably on whether drugs can be shipped directly to patients’ homes. Some Member States prohibit it entirely, others permit it for certain product types only. Sponsors planning multi-country trials must conduct a jurisdiction-by-jurisdiction legal review before relying on DtP shipment as a standard operating procedure. The EMA’s recommendation paper on decentralised elements is the starting point for EU submissions.
Section 3.4 of Annex 2 is one of its most consequential provisions for sponsors running trials that incorporate real-world data. It establishes a clear accountability framework: sponsors are ultimately responsible for ensuring that any RWD used in a clinical trial is managed in a manner that ensures participant protection and the reliability of trial results.
Sponsors should have the ability to access individual-level data, as set out in Section 3.4.1 (whether generated by themselves or by other entities, including service providers) and data in source records, as necessary for quality assurance and quality control. This is a GCP expectation regulators will apply at inspection. Regulatory authorities may also require access to individual-level data and source records to support regulatory inspections.
Where RWD is owned or controlled by an external entity such as a hospital, registry, or insurer, sponsors must ensure that appropriate access arrangements are in place before using that data. These arrangements must include documented agreements that define how data will be shared, protected, and accessed, both by the sponsor and by regulatory authorities.
Annex 2 requires individual-level RWD access for sponsors and regulatory authorities. This directly intersects with data privacy frameworks. Under EU GDPR Article 9, health data is special category data with strict processing requirements. Under US HIPAA, protected health information has its own access and disclosure constraints. The GCP obligation to access individual-level data does not override these privacy frameworks. It must be accommodated within them. Access agreements with data holders must address both the GCP access right and the privacy law compliance mechanism (pseudonymisation, data processing agreements, HIPAA Business Associate Agreements) in a single, coherent document. Drafting these agreements requires both regulatory affairs and legal review.
Annex 2 Section 3.5.1 sets out the considerations that inform whether a given RWD source is fit for purpose for its intended use in a trial. Sponsors should assess each of these systematically and reflect the assessment in their protocol or protocol-related documents:
Data quality and comparability
System validation and coding consistency
Privacy and de-identification
The degree of rigor applied to this assessment should be proportionate to the criticality of the RWD use case. Where RWD is used to support key efficacy or safety endpoints, system- and process-level assessments alone may be insufficient. The sponsor may need to confirm that individual clinical events were assessed or documented. For a tactical methodology for conducting and documenting EHR fitness-for-purpose assessments, the FDA’s guidance on Assessing Electronic Health Records and Medical Claims Data as Real-World Data[8] provides the step-by-step framework Annex 2 mandates but does not prescribe.
Trials incorporating EHR data, registries, or claims databases need documented access agreements with data holders, individual-level data access capabilities for QA/QC, source record access rights for regulatory inspection purposes, and a prospective fitness-for-purpose assessment for each RWD source. These are not post-hoc documentation activities. They must be in place before data are ingested into the trial.
Most data sharing agreements between sponsors and EHR holders or registries were written before Annex 2 defined the individual-level access standard. Three provisions that are most commonly absent: (1) an explicit right for the sponsor to access individual-level source data for QA and QC purposes (not just aggregate reports), (2) a provision allowing regulatory authority inspection access to those same records, and (3) a clause requiring the data holder to maintain audit-trail documentation that satisfies the sponsor’s regulatory obligations. If your existing data access agreement does not address all three, it does not meet the Annex 2 Section 3.4 standard.
Annex 2 Section 2.2 addresses informed consent considerations for trials incorporating decentralized elements. Several provisions provide explicit GCP backing for approaches that sponsors had been implementing without a clear global standard.
Informed consent may be obtained remotely where appropriate. When it is, the investigator must assure themselves of the identity of the participant (or their legally acceptable representative). The Annex gives an example: verification via an official identification document during a video call. The verification method, and the measures in place to safeguard data privacy, must be pre-specified in the protocol.
Annex 2 supports remote consent and electronic signature capture, but the software system capturing that signature must independently comply with applicable electronic record regulations. In the US, FDA 21 CFR Part 11 governs the validation and audit trail requirements for electronic signatures in clinical trials. In the EU, EU Annex 11 of the GMP guidelines and the eIDAS regulation govern qualified and advanced electronic signatures. These requirements apply to the software system regardless of what Annex 2 permits at the GCP level. A sponsor using a remote eConsent platform must ensure that platform meets Part 11 or Annex 11/eIDAS requirements, and document that validation, before using it in a regulated submission.
Where computerized systems or remote methods are used to support the consent process, participants must be given the option to use a paper-based or in-person approach if they prefer it. Sponsors using digital consent tools must build in an accessible fallback, and the characteristics of the trial (including digital literacy, physical ability, and access to technology) must be considered when designing consent materials.
Annex 2 Section 2.2.3 requires that informed consent materials describe what participant-related data will be collected, how those data may be used, and which parties will have access to the trial participant’s personal information. This is particularly relevant when trial-related activities are conducted at the participant’s home, at a local healthcare center, or when data are collected remotely via DHTs. The consent form must reflect the actual data flows of the trial design.
Pragmatic elements are those that integrate aspects of usual clinical practice into the design and conduct of a clinical trial. This includes eligibility criteria that reflect the populations receiving care in real settings, data collection limited to what is routinely available, and procedures carried out by primary physicians or community healthcare providers rather than dedicated research staff.
Annex 2 Section 3.2.2 establishes that where sponsors incorporate trial-related activities that are part of usual clinical practice, they must assess whether such activities are fit for purpose in the trial context and comply with applicable regulatory requirements. Where they are incorporated, the protocol must clearly describe how, by whom, and under what circumstances these activities will be performed.
For sponsors designing pragmatic elements, this creates a practical documentation obligation: the protocol must justify the use of each pragmatic element, explain how data quality and integrity will be maintained, and address how safety information will be collected from the variety of data sources involved. Safety monitoring in a pragmatic trial (where data may arrive from home nursing visits, DHTs, EHRs, and in-person visits simultaneously) must be designed to provide the investigator with a coherent, timely picture of each participant’s status.
Section 3.2.2 sets out two requirements for every trial-related activity that is part of usual clinical practice, and Section 3.2.5 adds a third. First, an assessment that it is fit for purpose in the trial context and complies with applicable requirements. Second, a clear protocol description of how, by whom, and under what circumstances it will be performed. Third, an account of how safety information from these varied routine care settings will be collected and integrated into the investigator’s overview, as required by Section 3.2.5. Justifying the design decision is not enough. The execution and safety pathways must be documented too.
Section 3.8 of Annex 2 acknowledges what clinical operations teams already know: oversight becomes more complex when a trial incorporates multiple methodologies, multiple data sources, and a large number of service providers. The Annex provides the GCP framework for managing that complexity.
Sponsors must ensure that processes are in place (including clear lines of communication) to provide an appropriate level of oversight such that participant rights, safety, and well-being are protected, and the reliability of trial results is ensured. This oversight extends explicitly to service providers: sponsors are responsible for ensuring service providers maintain their essential records, and must maintain appropriate oversight of all data processing steps, including extraction, linkage, and transformation, regardless of which entity performs them.
The practical implication is that contracts with technology vendors, data access providers, home nursing services, and local healthcare providers must reflect both sponsor oversight rights and the data access rights required for regulatory inspection. A vendor agreement that restricts the sponsor’s ability to access source records or audit data processing would not satisfy the Annex 2 standard.
Before signing any service provider agreement for a trial incorporating Annex 2 methodologies, confirm it answers yes to both: (1) Does the sponsor retain the right to access source records and audit data processing steps, including extraction, linkage, and transformation? (2) Do the terms allow regulatory authorities to access individual-level data and source records for inspection purposes? If either answer is no, the contract does not meet the Annex 2 oversight standard.
In trials with decentralized or pragmatic elements, safety information may arrive through multiple channels simultaneously: remote visits, DHTs, EHRs, in-person visits, home nursing reports, and participant self-reporting. Annex 2 Section 3.9 addresses this directly.
The sponsor must ensure that appropriate processes and procedures are in place to make safety information from all these sources accessible to the investigator in a timely manner. Where DHTs are used to collect data, the sponsor must ensure that information will be provided to the investigator in a way that is relevant, meaningful, and manageable, enabling an effective overview of the participant’s health status and timely appropriate medical decisions.
A trial that collects wearable data, EHR-sourced endpoints, and participant-reported outcomes cannot treat those data streams as independent monitoring obligations. The safety management plan must address how data from each source will be aggregated, reviewed, and acted upon by the investigator. Sponsors are also directed to consider ICH E19 on selective safety data collection for late-stage pre-approval or post-approval trials where applicable.[6] ICH E19 specifically addresses how to reduce the volume of non-essential safety data collected from each participant without compromising the ability to detect meaningful safety signals, a critical tool when a trial generates simultaneous data streams from wearables, home nursing, and ePRO that risk overwhelming investigators with noise rather than meaningful signal.
For any trial where safety information arrives from more than one source (remote visits, DHTs, EHRs, in-person, home nursing), the safety management plan must explicitly describe which sources contribute safety-relevant data, how that data will be aggregated and made accessible to the investigator in a timely way, what process ensures the investigator receives information in a relevant, meaningful, and manageable format, and what mitigating actions apply for each safety scenario. Section 3.9.2 requires this plan to also reference applicable ICH E19 considerations for late-stage or post-approval trials.
Given the scope of Annex 2’s coverage, it is worth being equally clear about its limitations. The Annex:
The standard of care for participants, the integrity of trial data, and the traceability of data from source to submission must meet the same level of rigor in a decentralized or pragmatic trial as in a traditional site-based study. The adaptations Annex 2 permits are operational. The standards it requires are not relaxed.
The following checklist is organized by trial lifecycle stage. Actions are not sequential, and some items in later stages may need to be anticipated during protocol design. It is not a substitute for a full review of the Annex 2 text.
Annex 2 turns real-world data, multi-source safety oversight, and remote consent into governance obligations a sponsor has to evidence at inspection, not operational choices. Those obligations are infrastructure questions before they are documentation questions. Castor Catalyst is the engine for the real-world-data side: it turns uploaded EHR and EMR source documents and exports into structured trial data, AI-assisted with human review and confirmation by your team, with traceable lineage from source to record. Catalyst and Castor’s unified clinical data management system give a sponsor the individual-level data access, unified investigator oversight, and audit-ready governance the Annex requires, in one governed system with one audit trail.
Castor Catalyst for traceable RWD extraction and mapping (Sections 3.4 and 3.5)
Castor Catalyst is the real-world-data engine. It supports traceable data extraction from EHR and EMR source documents and exports, turning them into structured trial data. The extraction is AI-assisted, with human review and confirmation by your team, and it maps that real-world data alongside primary trial data with a full audit trail and individual-level access aligned with the Section 3.4 accountability framework. Castor’s open API supports the underlying data linkage between those records and the EDC.
Unified investigator dashboard for multi-source safety data (Sections 2.4 and 3.9)
When safety data arrives from wearables, home nursing, ePRO, and EHR simultaneously, investigators need a coherent, timely picture across all sources. Fragmented data access is not proportionate oversight under Section 3.9. Castor’s integrated clinical data management system and eCOA unify remote patient data, wearables, home nursing reports, ePRO, and EHR-sourced endpoints into a single, auditable dashboard. Investigators review and confirm in one place. Inspectors see a clean audit trail.
Remote consent with built-in identity verification (Section 2.2)
Castor eConsent supports the remote consent approach Annex 2 Section 2.2 describes. It supports remote signature capture, secure identity verification, and a paper-based fallback option for participants who prefer it, so sponsors can meet the Section 2.2 consent standard without slowing down enrollment.
No. Annex 2 explicitly states that it is not an endorsement of any specific methodology. It provides GCP considerations for sponsors who choose to incorporate decentralized elements, pragmatic design features, or real-world data. The decision to use any of these approaches remains with the sponsor, subject to local regulatory requirements and scientific appropriateness for the specific trial. In the UK specifically, MHRA treats Annex 2 as guidance supporting the ICH E6(R3) Principles rather than as a standalone statutory requirement. Sponsors running academic studies or trials not intended for a Marketing Authorisation Application have flexibility to adapt or disapply specific Annex provisions, provided the overarching GCP Principles are satisfied.
Annex 1 (adopted with the main E6(R3) guideline in January 2025) covers the core GCP obligations for sponsors, investigators, and ethics committees in clinical trials. It covers monitoring, data governance, record-keeping, and oversight. Annex 2 (adopted June 2026) is an addendum specifically addressing trials that incorporate decentralized elements, pragmatic elements, and real-world data. Annex 2 supplements and must be read alongside the E6(R3) Principles and Annex 1. It does not replace them.
Two Annex 2 sections address this. Section 3.4 establishes the accountability framework: sponsors are ultimately responsible for ensuring RWD is managed to protect participants and ensure trial reliability. Sponsors must have the ability to access individual-level data for quality assurance and control, and regulatory authorities may require access to individual-level data and source records during inspections. Where RWD is owned by external entities, documented access agreements must be in place. Section 3.5.1 then sets out the fitness-for-purpose criteria: seven considerations sponsors must assess for each RWD source, covering data variability, timing, comparability, missing data, overall quality, de-identification, and validation status of collection systems.
Most AI pitched at clinical research sites falls apart the moment a real site owner
Most clinical sites still capture protocol visit data on paper, and most AI pitched at
Electronic consent is now approved or conditionally approved in 27 of 33 countries assessed in
Discover all the features offered by Castor EDC
Discover Now