Regulatory Requirements

GCP: What Good Clinical Practice Means and How Software Supports Compliance

Last updated: 5 November 2026

Short answer: Good Clinical Practice (GCP) is an international ethical and scientific quality standard for designing, conducting, recording and reporting clinical trials; it protects the rights, safety and well-being of participants and ensures that results are reliable.[2] The current reference is ICH E6(R3), effective in the EU since 23 July 2025.[3] Validated software for quality management, documentation, data capture and monitoring makes compliance easier but does not replace the sponsor’s responsibility.[12]

What does GCP mean and how did it develop?

The ethical foundation is the World Medical Association’s Declaration of Helsinki, adopted in 1964 and most recently revised in Helsinki in October 2024.[1] ICH harmonised GCP in 1996 with guideline E6(R1); the E6(R2) addendum followed in 2016 with risk-based monitoring, and on 6 January 2025 E6(R3), comprising the principles and Annex 1, reached Step 4.[2][3]

What does ICH E6(R3) cover?

E6(R3) consists of overarching principles, Annex 1 for interventional clinical trials, and Annex 2 with additional considerations for, among other things, decentralised elements, pragmatic designs and real-world data.[2][3] Its eleven principles emphasise, among other things, quality by design, that is, focusing on factors critical to trial quality from the outset, and risk-proportionate approaches.[2] Annex 1 sets out the sponsor’s risk-based quality management and contains a dedicated data governance section for investigator and sponsor covering audit trails, metadata and validation of computerised systems.[2]

Effective dates of ICH E6(R3)
RegionPrinciples and Annex 1Annex 2
ICHStep 4 on 6 January 2025Step 4 on 3 June 2026
EU (EMA)Effective since 23 July 2025CHMP adoption 25 June 2026, effective from 15 January 2027
US (FDA)Final guidance, announced in the Federal Register on 9 September 2025No final FDA guidance identified at the time of retrieval
United Kingdom (MHRA)Compliance with the GCP principles a legal requirement since 28 April 2026No separate date identified

Sources for the table: ICH and EMA[2][3], FDA[4], MHRA[5].

In the EU, Regulation (EU) No 536/2014 (CTR) has applied since 31 January 2022; it requires trials to be conducted in line with GCP and governs authorisation via the Clinical Trials Information System, ethical review, safety reporting and inspections by Member States.[6] In Germany, the Medicinal Products Act (AMG) supplements the CTR, in particular in sections 40 et seq.; under section 77 AMG the competent federal authorities are BfArM and, for certain product groups such as vaccines, blood products and advanced therapy medicinal products, the Paul-Ehrlich-Institut.[7][8] Ethical review is carried out by ethics committees registered with BfArM (section 41a AMG).[7] The EMA coordinates GCP inspections in the centralised procedure.[11] In the US, 21 CFR 50 (informed consent), 21 CFR 56 (institutional review boards) and 21 CFR 312 (IND) form the framework; the FDA oversees compliance through its Bioresearch Monitoring (BIMO) programme.[9][10]

Which roles and responsibilities exist?

  • Sponsor: holds overall responsibility for initiating, managing, quality-managing and financing the trial.[2][6]
  • Investigator: responsible for conduct at the trial site, medical care of participants and oversight of delegated tasks.[2]
  • Monitor: oversees the progress of the trial on behalf of the sponsor, on site, centrally or both.[2]
  • CRO: performs delegated sponsor tasks; responsibility remains with the sponsor (Article 71 CTR).[6]
  • Ethics committee: reviews participant protection before and during the trial.[2][6]

On delegation: tasks may be transferred, responsibility may not. E6(R3) requires documented delegation and appropriate oversight by sponsor and investigator.[2]

How do GCP inspections work and what is cited most often?

Inspections involve notification, document requests, an opening meeting, review of records and systems, interviews, a closing meeting and a report; in the EU, findings are graded as critical, major or minor, while the FDA may issue a Form FDA 483 and classifies inspections as NAI, VAI or OAI.[11][12][13]

In the 67 EMA-coordinated inspections of 2024, 335 critical and major findings were recorded, 11 of them critical.[11] The most affected categories were “General” (137, including essential documents 41, source documentation 38, SOPs 22), “Trial Management” (86, including monitoring 35, data management 27) and “Investigational Site” (37); 14 findings concerned computer systems.[11] In fiscal year 2024 the FDA gave final classifications to 609 clinical investigator inspections: 484 NAI, 110 VAI and 15 OAI.[13] An analysis by FDA authors of 2,836 routine GCP inspections for CDER marketing applications from 2017 to 2023 (Therapeutic Innovation & Regulatory Science, 2025) found final classifications of 81.2% NAI, 18.5% VAI and 0.3% OAI.[14]

How does software support GCP compliance?

The inspection findings show where software can help: documentation, SOPs, training, monitoring and data management are the most frequent deficiency areas.[11]

  • eQMS: controlled SOPs with version control, training records, and deviation and CAPA management address the finding categories SOPs (22) and qualification/training (10), such as missing version control or late training.[11] Examples: Cognidox, Docuply.
  • eTMF: a structured, measurable TMF with an audit trail and logged inspector access addresses findings on essential documents and lack of system access; see the article on TMF and eTMF.[11] Examples: Agatha Clinical, Docuply, SureClinical.
  • EDC and CTMS: electronic data capture with edit checks and trial management support timely, complete data. The EMA guideline on computerised systems in clinical trials (effective since September 2023) cites automatic checks and workflow control as means of achieving completeness and consistency.[12] Examples: Harbor (EDC), Veeva (Vault EDC and Vault CTMS).
  • Audit trails and data integrity: the EMA guideline describes ALCOA++ as a requirement for data throughout its life cycle and requires changes to be traceable through audit trails.[12] Rules for electronic signatures are covered in the article on 21 CFR Part 11.
  • Risk-based monitoring: the cluster-randomised ADAMON study (Brosteanu et al., Clinical Trials 2017) randomised 213 sites from 11 academic trials. Risk-adapted monitoring was non-inferior to extensive on-site monitoring and required less than 50% of the monitoring resources.[15] A retrospective TransCelerate analysis of 1,168 trials (Sheetz et al., 2014) found that only 3.7% of eCRF data were corrected after initial entry, with only 1.1% attributable to source data verification; this underlines the limited value of full source data verification.[16]

Prerequisites: The EMA considers it unacceptable to use computerised systems whose validation status is not confirmed or for which validation documentation cannot be made available.[12] Responsibility stays with the sponsor, including for outsourced services, and users must be trained.[2][12] Software without processes and oversight merely shifts findings: 14 of the EMA findings in 2024 concerned computer systems themselves.[11]

GCP, GMP and GLP compared

GCP, GMP and GLP: subject, regulations, authorities
FeatureGCPGMPGLP
SubjectClinical trials in humansManufacture and quality control of medicinal productsNon-clinical safety studies
Regulations (selection)ICH E6(R3), Reg. (EU) 536/2014, AMG, 21 CFR 50/56/312EudraLex Vol. 4, 21 CFR 210/211OECD GLP Principles, Directive 2004/10/EC, 21 CFR 58
Authorities (selection)BfArM, PEI, ethics committees, EMA, FDARegional (Länder) authorities in Germany, EMA, FDARegional (Länder) authorities in Germany, FDA

Sources: [2][6][7][9][17][18]. More on manufacturing in the article on Good Manufacturing Practice (GMP).

Frequently asked questions (FAQ)

What does GCP mean?

Good Clinical Practice, an international ethical and scientific quality standard for clinical trials that protects participants and ensures reliable results.[2]

What is new in ICH E6(R3)?

A principles-based structure with annexes, quality by design, risk-proportionate quality management, a data governance section and the term “essential records” instead of “essential documents”.[2]

Who must comply with GCP?

Everyone involved in clinical trials, in particular sponsors, CROs, investigators and trial sites, and ethics committees within their remit.[2][6]

What is the difference between GCP and GMP?

GCP governs clinical trials in humans, GMP the manufacture and quality control of medicinal products; investigational products must be manufactured in line with GMP.[2][17]

Which software helps with GCP compliance?

Validated eQMS, eTMF, EDC and CTMS, and tools for risk-based monitoring, provided that validation, training and sponsor oversight are in place.[12][15]

Further reading

References

  1. World Medical Association. Declaration of Helsinki – Ethical Principles for Medical Research Involving Human Participants (revision October 2024). https://www.wma.net/policies-post/wma-declaration-of-helsinki/ (accessed 5 November 2026)
  2. ICH. E6(R3) Guideline for Good Clinical Practice (Principles and Annex 1; Annex 2). https://www.ich.org/page/efficacy-guidelines (accessed 5 November 2026)
  3. EMA. ICH E6 Good clinical practice – Scientific guideline. https://www.ema.europa.eu/en/ich-e6-good-clinical-practice-scientific-guideline (accessed 5 November 2026)
  4. Federal Register. E6(R3) Good Clinical Practice; Guidance for Industry; Availability, document 2025-17311, 9 September 2025. https://www.federalregister.gov/documents/2025/09/09/2025-17311/e6r3-good-clinical-practice-international-council-for-harmonisation-guidance-for-industry (accessed 5 November 2026)
  5. MHRA. Clinical trials for medicines: compliance with ICH E6 GCP in the United Kingdom. https://www.gov.uk/guidance/clinical-trials-for-medicines-compliance-with-ich-e6-gcp (accessed 5 November 2026)
  6. Regulation (EU) No 536/2014. https://eur-lex.europa.eu/eli/reg/2014/536/oj (accessed 5 November 2026)
  7. Arzneimittelgesetz (German Medicinal Products Act, AMG). https://www.gesetze-im-internet.de/amg_1976/ (accessed 5 November 2026)
  8. BfArM. Clinical trials. https://www.bfarm.de (accessed 5 November 2026)
  9. 21 CFR Parts 50, 56 and 312. eCFR. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A (Parts 50, 56) and https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312 (accessed 5 November 2026)
  10. FDA. Bioresearch Monitoring Program (BIMO) Compliance Programs. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/compliance-program-manual/bioresearch-monitoring-program-bimo-compliance-programs (accessed 5 November 2026)
  11. EMA. Annual Report of the Good Clinical Practice Inspectors’ Working Group 2024, EMA/INS/GCP/37608/2025. https://www.ema.europa.eu/en/documents/report/annual-report-good-clinical-practice-inspectors-working-group-2024_en.pdf (accessed 5 November 2026)
  12. EMA. Guideline on computerised systems and electronic data in clinical trials, EMA/INS/GCP/112288/2023. https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/guideline-computerised-systems-electronic-data-clinical-trials_en.pdf (accessed 5 November 2026)
  13. FDA. Bioresearch Monitoring (BIMO) Fiscal Year 2024 Metrics. https://www.fda.gov/media/192870/download (accessed 5 November 2026)
  14. A 7-Year Analysis of the U.S. FDA Good Clinical Practice Inspection Outcomes for Marketing Applications. PMC12579704. https://pmc.ncbi.nlm.nih.gov/articles/PMC12579704/ (accessed 5 November 2026)
  15. Brosteanu O, et al. Risk-adapted monitoring is not inferior to extensive on-site monitoring: Results of the ADAMON cluster-randomised study. Clin Trials. 2017;14(6):584–596. https://pubmed.ncbi.nlm.nih.gov/28786330/ (accessed 5 November 2026)
  16. Sheetz N, et al. Evaluating Source Data Verification as a Quality Control Measure in Clinical Trials. Ther Innov Regul Sci. 2014;48(6):671–680. https://doi.org/10.1177/2168479014554400 (accessed 5 November 2026)
  17. European Commission. EudraLex Volume 4 – Good Manufacturing Practice guidelines. https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en (accessed 5 November 2026)
  18. 21 CFR Part 58 – Good Laboratory Practice for Nonclinical Laboratory Studies; Directive 2004/10/EC. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-58 and https://eur-lex.europa.eu/eli/dir/2004/10/oj (accessed 5 November 2026)