ICH E6(R3): The 2025 GCP Overhaul
ICH E6(R3) is the first ground-up rewrite of Good Clinical Practice in a generation. It replaces the flat, checklist-shaped E6(R2) with an overarching set of Principles plus annexes, embeds quality-by-design and risk-based quality management as the operating model rather than an add-on, and modernises GCP for data-driven and decentralised trials. The overarching Principles and Annex 1 came into effect in the EU on 23 July 2025; the FDA adopted the guideline on 9 September 2025.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 21 LINKSICH E6(R3) is the first ground-up GCP rewrite in a generation — Principles plus Annex 1, quality-by-design and RBQM as the operating model, technology-neutral. In force in the EU 23 Jul 2025; FDA-adopted 9 Sep 2025.
06 · QUALITY MATURITY — ICH E6(R3): THE 2025 GCP OVERHAUL, REACTIVE TO ADAPTIVE
GCP is run as exhaustive checklist compliance and 100% source-data verification, with quality inspected in at the end.
An RBQM SOP exists on paper, but monitoring is still uniform and critical-to-quality factors are not defined.
Quality is designed into the protocol; critical-to-quality factors, quality tolerance limits, and risk-based monitoring are operational.
Centralised and risk-based monitoring surface issues from the data; oversight of vendors follows the risk each activity carries.
Quality-by-design and proportionate oversight are the default operating model across the portfolio, refined trial to trial.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 1
Derived from the 1 standard SPEQ maps to this subject, across 1 regulatory body: ICH.
RECORDS & OBJECTIVE EVIDENCE
- Defined critical-to-quality factors and quality tolerance limits for the trial
- A risk assessment justifying the monitoring plan and its intensity
- Vendor-oversight documentation proportionate to each activity's risk
- Data-governance records establishing attributable, complete, traceable trial data
- SOPs mapped to the E6(R3) Principles and Annex 1
COMMON INSPECTION FINDINGS
- Uniform 100% source-data verification with no risk-based rationale
- No defined critical-to-quality factors or quality tolerance limits
- Sponsor oversight of delegated activities not commensurate with their risk
- Data governance across distributed systems and vendors not demonstrated
- SOPs still built on the E6(R2) checklist model
What changed structurally
E6(R3) is organised as an overarching Principles document plus annexes, not a single linear list of responsibilities. Annex 1 covers interventional clinical trials (the ground E6(R2) used to cover); Annex 2, which reached ICH Step 4 on 3 June 2026 and comes into effect on 15 January 2027, adds considerations for non-traditional designs including decentralised and pragmatic trials. The restructure lets the guideline flex to trial types the 1996/2016 text never anticipated without rewriting the core each time.
The reorganisation is not cosmetic. The Principles are written to be durable and technology-agnostic — they state what GCP is trying to achieve (participant rights, safety and wellbeing; reliable results) so that the annexes can carry the how, and the how can evolve. Read the Principles first: they are the interpretive frame for everything in the annexes.
Quality by design and RBQM become the model
Building on ICH E8(R1), E6(R3) asks sponsors to design quality into a trial from the protocol outward rather than inspect it in afterward. That means identifying the factors critical to the quality of the trial — the data and processes that actually protect participants and the reliability of the result — and focusing effort there, proportionately, using a risk-based approach.
Risk-based quality management (RBQM) — critical-to-quality factors, risk assessment, quality tolerance limits, and centralised/risk-based monitoring — is the expected way of working, not an optional enhancement. Effort follows risk: the trivial is not monitored to the same depth as the safety-critical. This is the same shift GxP has made elsewhere (CSA over exhaustive CSV, ICH Q9 risk-proportionality) applied to clinical operations.
Data governance and modern trial conduct
E6(R3) treats data governance as a first-class GCP concern: the reliability of trial results depends on data being attributable, complete, and traceable across an increasingly distributed set of systems and vendors. It accommodates decentralised elements — remote data capture, electronic informed consent, direct-to-participant supply, sensors and eSource — provided the controls over data integrity and participant safety hold.
The guideline is deliberately media- and technology-neutral: it does not prescribe a particular platform, it states the outcome the platform must deliver. That places the burden on the sponsor to justify, for each system, that the E6(R3) principles are met — the same computerised-systems and data-integrity discipline that GMP applies, now explicit in GCP.
Sponsor and investigator responsibilities
Sponsor oversight is framed as proportionate and risk-based rather than uniform. Where activities are delegated to service providers (CROs, vendors, central labs), the sponsor retains accountability and must have oversight commensurate with the risk the activity carries — not a fixed monitoring cadence applied identically everywhere. Investigator responsibilities are clarified around informed consent, medical decisions, and appropriate delegation with retained oversight.
The practical effect for a sponsor is a shift in where effort goes: less exhaustive source-data verification of everything, more attention to the critical data and processes, the risk assessment that justifies the plan, and the documented rationale behind delegation and oversight decisions.
Transition — what to do now
Principles + Annex 1 are in force in the EU (23 July 2025) and adopted by the FDA (9 September 2025); Annex 2 follows on 15 January 2027. Sponsors and sites should map current SOPs, monitoring plans, and quality-management practices to the E6(R3) Principles, stand up (or mature) an RBQM approach with defined critical-to-quality factors and quality tolerance limits, and update vendor-oversight and data-governance documentation to the risk-based, technology-neutral posture the guideline expects.
SPEQ synthesis: treat E6(R3) as the clinical arm of the same risk-proportionality doctrine running through modern GxP — the trials that adopt it well will look like the manufacturing sites that adopted ICH Q9(R1) well, spending their assurance effort where the risk actually is.
FREQUENTLY ASKED
When does ICH E6(R3) take effect?
The overarching Principles and Annex 1 came into effect in the EU on 23 July 2025 (ICH Step 4, 6 January 2025), and the FDA adopted the guideline on 9 September 2025. Annex 2, covering non-traditional and decentralised trial designs, reached ICH Step 4 on 3 June 2026 and comes into effect on 15 January 2027.
How is E6(R3) different from E6(R2)?
E6(R3) restructures GCP into an overarching Principles document plus annexes instead of one flat list of responsibilities, and it makes quality-by-design and risk-based quality management the operating model rather than an add-on. It is media- and technology-neutral, so it accommodates decentralised and data-driven trials, and it treats data governance and proportionate, risk-based oversight as central GCP concerns.
What is the difference between Annex 1 and Annex 2?
Annex 1 covers interventional clinical trials — the ground E6(R2) used to cover — and is in effect now. Annex 2 adds considerations for non-traditional designs, including decentralised and pragmatic trials, and comes into effect on 15 January 2027. The overarching Principles apply to both.
What should sponsors do to prepare for E6(R3)?
Map SOPs, monitoring plans, and quality practices to the E6(R3) Principles; implement or mature a risk-based quality management approach with defined critical-to-quality factors and quality tolerance limits; and update vendor-oversight and data-governance documentation to a risk-proportionate, technology-neutral posture. In practice this shifts effort away from exhaustive source-data verification toward the critical data and processes and the documented rationale behind oversight decisions.