Data no longer arrives from one place. A single study visit may generate an entry made at the site, a diary completed on a participant’s phone, a reading from a wearable, a local laboratory result, and a note from a home nursing visit. Maintaining ICH GCP compliance in clinical trials therefore requires teams to apply the same quality principles across more systems, locations, and users. This article looks at where decentralized elements change the compliance picture, what E6(R3) asks for in practical terms, and how Medigen Suite, Catchtrial EDC+ and Maptrial CTMS+ are built to support that work.

ICH E6(R3), adopted on January 6, 2025, reflects this changing environment. The guideline is media neutral. It does not prescribe a particular technology or establish a separate rulebook for decentralized clinical trials. Instead, it asks sponsors and investigators to use processes and systems that are fit for purpose, proportionate to the risks, and documented well enough to support appropriate evaluation of trial conduct.

For sponsors and CROs, this makes early data flow planning increasingly important. Mapping how information will be captured, transferred, reviewed, corrected, and retained is generally more effective than reconstructing the full data history shortly before database lock or inspection.

The challenge is largely one of scale. Every additional data source may introduce another system to validate, another user group to manage, another interface to reconcile, and another audit trail to review.
A decentralized study may involve:

• Site-entered electronic case report forms
• Electronic patient-reported outcomes and/or clinical outcome assessments
• Wearables and connected devices
• Central laboratory data
• Centrally reviewed medical imaging
• Home healthcare records
• Remote consent and telemedicine activities

ICH E6(R3) recognizes participant-entered data and information generated by automated instruments as potential source records. It also uses the broader concept of a data acquisition tool, which may include case report forms, interactive response technologies, and clinical outcome assessments.

Two provisions are particularly relevant when data are collected outside the investigator site. First, sponsors must not be able to alter data entered by investigators or participants without the change being detectable and documented. Second, investigators should receive timely access to relevant trial data, including data from central laboratories, imaging providers, and ePRO systems, when those data may affect participant eligibility, treatment, or safety.

In a decentralized trial, timely investigator access is therefore more than an administrative requirement. It is central to maintaining the oversight assigned to the investigator.

Section 4 of Annex 1 addresses data governance throughout the data lifecycle, from initial capture to retention and destruction. Its computerized system requirements cover procedures, training, security, validation, system release, failure management, technical support, and user management.
Several expectations are stated directly:

• Audit trails, reports, and logs should not be disabled.
• Audit trails should only be modified in rare circumstances, with the action and justification recorded.
• Audit trails and logs must be interpretable and capable of supporting review.
• Date and time capture for data entries and transfers should be unambiguous.
• Data corrections must remain attributable and traceable.
• Validation should cover standard functionality, protocol-specific configurations, automated checks, calculations, and relevant interfaces.
• Access permissions should correspond to user duties, functions, organizations, and blinding arrangements.
• Permissions should be reviewed periodically and revoked when no longer required.

ICH E6(R3) also expects trial-specific systems and updates introduced through protocol amendments to be released only after the required approvals have been received.

These provisions make system configuration part of the compliance strategy. An electronic data capture system must support more than data entry. Study teams also need controlled corrections, user management, query workflows, audit trail review, data finalization, and documented exports.

Decentralized elements also change the participant-facing side of trial conduct.

ICH E6(R3) states that informed consent may use text, images, videos, and other interactive methods. Remote consent may be considered where appropriate. When computerized systems are used, participants may be offered a paper-based alternative.

Whether consent takes place remotely or in person, the investigator should confirm the identity of the participant or legally acceptable representative in accordance with applicable regulatory requirements. The process must also account for ethics committee approval, consent versions, signatures, participant copies, and re-consent when new information becomes relevant.

The guideline takes a similarly flexible approach to investigational product management. An investigational product may be shipped to the participant or dispensed closer to their location, subject to applicable requirements and safeguards. Where equipment is supplied for data acquisition, traceability should be maintained and participants should receive appropriate training.

The underlying principle is proportionality. Trial processes should focus on what is important to participant safety and reliable results while avoiding unnecessary complexity and burden.

ICH E6(R3) recognizes on-site monitoring, remote site monitoring, and centralized monitoring. The appropriate combination depends on the trial design, data sources, and identified risks.

Centralized monitoring may complement and reduce the extent or frequency of site monitoring, or it may be used independently where justified. It does not automatically replace on-site activities.

Most decentralized programs use a combination of methods, with the balance changing over the study lifecycle. The monitoring plan should explain the selected approach, responsibilities, tools, and rationale.

This makes operational visibility an important software consideration. Monitors and data managers need efficient ways to review missing data, unresolved queries, protocol deviations, source data verification, data manager review, signatures, and lock or freeze status.

Medigen Suite is built around the principle that oversight evidence should be generated through normal study operations rather than assembled separately at the end.
Catchtrial EDC+ is designed to support clinical data capture, validation, access control, corrections, and traceability. Maptrial Monitoring is built to support monitoring oversight across sites and study data. Catchtrial Data Validator and Report Builder extend these workflows through targeted review reports and controlled data exports.

For imaging studies, the Catchtrial DICOM Uploader supports automated clearance of protected health information tags, AI-assisted detection of visible identifiers, and manual masking where required

ICH GCP, FDA 21 CFR Part 11, and the General Data Protection Regulation (GDPR) address different but overlapping parts of digital trial conduct.
ICH GCP establishes the ethical, scientific, and quality standard for clinical trials. FDA 21 CFR Part 11 addresses electronic records and electronic signatures within its scope. GDPR governs the processing and protection of personal data in the European Union.

A decentralized trial may engage all three frameworks because participant-facing tools collect personal information, create electronic records, and transfer data through sponsor-selected systems.
Mapping every system, user group, signature, transfer, and retention requirement during study setup can help teams identify gaps before the study enters production.

A practical starting point is to list every data source described in the protocol, including participant devices and external data feeds. For each source, define:

• Who captures the data
• Which system receives them
• Who reviews them
• How corrections are recorded
• Which audit trail requires review
• Who retains the final records
• How investigators receive timely access

The validation and monitoring approach should then reflect the criticality of each data source rather than applying the same level of control everywhere.

An integrated eClinical environment cannot replace documented responsibilities, risk assessment, or qualified oversight. What it can do is support ICH GCP compliance in clinical trials through connected workflows, controlled access, traceable actions, and reviewable reporting.

For studies with decentralized elements, visit the Catchtrial EDC+ and Maptrial CTMS+ product pages or request a Medigen Suite demo to review how audit trails, user management, eConsent, monitoring, and data finalization can be configured around your study design.

Does ICH E6(R3) allow fully decentralized clinical trials?
ICH E6(R3) does not authorize or prohibit a specific trial model. It is media neutral and applies the same principles across different settings and technologies.
Processes and systems must be fit for purpose and proportionate to the risks. A decentralized design is therefore assessed according to how it protects participants and supports reliable results, not simply by how many activities take place away from the site.

What does ICH E6(R3) require for audit trails?
Audit trails, reports, and logs should not be disabled. They should only be modified in rare circumstances, with the action and justification recorded.
Audit trails must also be interpretable and capable of supporting review. Automatic capture of dates and times should be unambiguous, for example through Coordinated Universal Time.

Can informed consent be obtained remotely?
Yes. ICH E6(R3) states that remote consent may be considered where appropriate.
Text, images, videos, and interactive methods may be used during the consent process. Participants may be offered a paper-based alternative when computerized systems are used. The investigator must confirm the identity of the participant or legally acceptable representative in accordance with applicable requirements.

Does centralized monitoring replace site monitoring?
Not automatically. Centralized monitoring may complement site monitoring, reduce its frequency or extent, or be used independently where justified.
The sponsor determines the appropriate monitoring methods based on identified risks and explains the chosen approach in the monitoring plan.

Who is responsible for validating computerized systems?
Responsibility depends on who deploys the system. The sponsor or investigator should maintain its validation status throughout the system lifecycle.
Validation should be risk-based and should cover standard functionality, protocol-specific configurations, customizations, automated checks, calculations, and relevant interfaces. A vendor may conduct validation activities, but responsibility for determining fitness for purpose remains with the responsible party.

• ICH Harmonised Guideline, Guideline for Good Clinical Practice E6(R3), Step 4 final version, January 6, 2025
• European Medicines Agency, ICH E6 Good Clinical Practice scientific guideline
• US Food and Drug Administration, Conducting Clinical Trials With Decentralized Elements, final guidance, September 2024
• European Commission, Heads of Medicines Agencies and European Medicines Agency, Recommendation Paper on Decentralised Elements in Clinical Trials, December 13, 2022
• US Code of Federal Regulations, Title 21 Part 11, Electronic Records and Electronic Signatures
• Regulation (EU) 2016/679, General Data Protection Regulation