EMA更新临床试验计算机化系统验证与确认申办者通知（EMA/INS/GCP/467532/2019 Rev.1）

PDF 文字版；图形和原始排版请参阅官方 PDF。

第 1 页

29 October 2026
EMA/INS/GCP/467532/2019 – Rev.1
Quality and Safety of Medicines
Human Medicines Division




Notice to sponsors on validation and qualification of
computerised systems used in clinical trials

This document, first published on 7 April 2020, has been updated to refer to currently applicable
Regulation (EU) No 536/2014 on clinical trials on medicinal products for human use and to the revised
ICH E6 (R3) Guideline for Good Clinical Practice. References to Q&As published on the EMA website
have been replaced with reference to Guideline on computerised systems and electronic data in clinical
trials. These changes are administrative in nature and do not alter requirements.




Introduction
The integrity, reliability and robustness of data generated in clinical trials, e.g. data submitted to
support marketing authorisation applications (MAAs), are essential to regulators. Most clinical trial data
supporting MAAs are now collected through computerised data acquisition tools, e.g. electronic case
report forms (eCRFs) and electronic patient reported outcomes (ePROs). In addition, a wide range of
computerised media and systems are used in the conduct of a trial, such as safety databases, systems
for electronic interactive response technology (eIRT), clinical trial management systems (CTMSs) etc.,
the use of which will increase in the future.

Given recurrent inspection findings and the implications they have had on the integrity, reliability,
robustness and acceptability of data in the context of MAAs, the GCP Inspectors Working Group (IWG)
in cooperation with the Committee for Medicinal Products for Human Use (CHMP) sees the need to
emphasize requirements for sponsors/vendors providing computerised systems or services as well as
for the qualification and validation of computerised systems used to manage clinical trial data.




Legal and regulatory background
•   Regulation (EU) No 536/2014, Recital 51, Articles 2 (30), 2 (31), 47, 71.

•   ICH Guideline for good clinical practice E6(R3), (EMA/CHMP/ICH/135/1995 Revision 3) principle 9,
    annex 1 sections 3.16.1 (d), 3.16.1 (x) (ii), 4 (b), 4.3 (including 4.3.4).



Official address Domenico Scarlattilaan 6 ● 1083 HS Amsterdam ● The Netherlands
Address for visits and deliveries Refer to www.ema.europa.eu/how-to-find-us
Send us a question Go to www.ema.europa.eu/contact    Telephone +31 (0)88 781 6000        An agency of the European Union


              © European Medicines Agency, 2026. Reproduction is authorised provided the source is acknowledged.

第 2 页

Regulation (EU) No 536/2014 contains the provision that, regardless whether a sponsor delegates all
or part of the clinical trial related activities to an individual or an organisation, the ultimate
responsibility with regards to the clinical trial conduct —in particular related to the safety of subjects
and the integrity, reliability and robustness of the data generated in the clinical trial— remains with the
sponsor.

The EU legal framework requires that the sponsor of a clinical trial and the investigator ensure that the
clinical trial is conducted in accordance with the protocol and with the principles of GCP. Furthermore,
the legislation also defines the process of GCP inspection by a competent authority and the coverage of
such inspections. Finally, it contains provisions that the information generated should be recorded,
handled, and stored adequately for the purpose of ensuring effective inspection by Member States.




Validation and qualification of computerised systems
ICH E6(R3) requires that sponsors operating computerised trial data handling or computerised data
systems, amongst others, shall validate these systems, maintain an audit trail for initial entry of data
and any subsequent changes, maintain a security system to protect against unauthorized access and
maintain a list of the individuals authorized to create, access, modify or delete data. Sponsors should
set up these computerised systems in such a way that the blinding of clinical trials, when applicable, is
maintained.

In addition, ICH E6(R3) requires:

•     that “The quality and amount of the information generated in a clinical trial should be fit for
      purpose and sufficient to provide confidence in the trial’s results and support good decision
      making” (principle 9.1),

•     that “Systems and processes that aid in data capture, management and analyses, as well as those
      that help ensure the quality of the information generated from the trial, should be fit for purpose,
      should capture the data required by the protocol and should be implemented in a way that is
      proportionate to the risks to participants and the importance of acquired data” (principle 9.2),

•     and that “Computerised systems used in clinical trials should be fit for purpose (e.g., through risk-
      based validation, if appropriate), and factors critical to their quality should be addressed in their
      design or adaptation for clinical trial purposes to ensure the integrity of relevant trial data”
      (principle 9.3).

Data integrity, reliability and robustness will depend on the design and the validation status
of the computerised systems used. Failure to document and therefore demonstrate the
validated state of a computerised system is likely to pose a risk to data integrity, reliability
and robustness, which depending on the criticality of the affected data may result in a
recommendation from the GCP inspectors to the CHMP not to use the data within the
context of an MAA.

The term ‘qualification’ is used in this notice to describe verification of system functionality. The term
‘validation’ is used to describe the process of establishing and documenting that the specified
requirements of a computerised system can be consistently fulfilled from design until decommissioning
of the system or transition to a new system, i.e. it operates to defined specifications and defined
procedures (SOPs) by a trained user.




Notice to sponsors on validation and qualification of computerised systems used in clinical trials
                                                                                                         Page 2/4

第 3 页

Lack of documentation (or access to documentation) of qualification
activities

Inspection findings relating to the qualification and validation of computerised systems are of concern,
as some sponsors have not been able to provide adequate documentation of the required qualification
and validation activities for computerised data collection tools/software during inspections.
Computerised systems used in clinical trials can be built by the sponsor but are more typically
purchased from a vendor either under a license to use software or as part of a service purchased,
which could also include e.g. trial specific builds, hosting of trial data, etc. Qualification activities would
consequently be performed by the vendor, by the sponsor or by shared efforts.

The sponsor is ultimately responsible for the validation of the computerised system and for
providing adequate documented evidence on the validation process.

Sponsors shall be able to provide the GCP inspectors of the EU/EEA authorities with access
to the requested documentation regarding the qualification and validation of computerised
systems irrespective of who performed these activities.

The sponsor may rely on qualification documentation provided by the vendor, if the qualification
activities performed by the vendor have been assessed as adequate. However, the sponsor may also
have to perform additional qualification (and validation) activities based on a documented risk
assessment. The conditions for a sponsor to rely on a vendor's qualification documentation are
described in the ‘Guideline on computerised systems and electronic data in clinical trials’
(EMA/INS/GCP/112288/2023) published on the EMA website. If the sponsor chooses to perform its
own full qualification of a system purchased from a vendor, the sponsor should ensure access to the
vendor’s system requirement specifications to perform its own appropriate qualification of the system.
This is necessary, because otherwise the sponsor would not know all the built-in system functionalities
and would consequently risk unknown functionalities/actions with unknown impact on their data.
Considering the relevant version and configuration of a system, qualification and validation activities
should be performed on the basis of all the requirement specifications the system was initially built on
and any updates.

Insufficient contractual arrangements

Clear, written agreements should be in place to document any arrangements between the sponsor and
the vendor with regards to qualification and validation. The sponsor remains responsible for ensuring
that the conduct of the trial and the final data and data that are submitted to support an MAA comply
with relevant legislation.

Guidance regarding contractual arrangements with vendors of computerised systems used in clinical
trials is available in Annex 1 of the ‘Guideline on computerised systems and electronic data in clinical
trials’ mentioned above.

In the framework of a particular MAA, IT vendors could be inspected when they contractually assume
clinical trial sponsor-related duties/activities and/or the contract between the sponsor and the vendor
contains provisions for inspections/audits of duties/functions performed by the vendor.

According to Article 2(31) of Regulation (EU) No 536/2014, inspectors should be able to inspect third
parties who have trial-specific relevant documentation. As qualification documentation of a generic
software (a software without trial-specific functionalities or features) does not necessarily fall into this
category, the sponsor should ensure access for GCP inspectors in case any such activities are




Notice to sponsors on validation and qualification of computerised systems used in clinical trials
                                                                                                         Page 3/4

第 4 页

delegated to the vendor, i.e. if the sponsor relies on the vendor for documentation of system
requirement specifications, test documentation, etc.

It is not acceptable to use computerised systems in clinical trials for which the validation
status is not confirmed or for which appropriate documentation on system validation cannot
be made available to GCP inspectors.

If appropriate contracts cannot be put in place, e.g. because a vendor does not allow
provision of adequate measures as listed above (access to system requirements
specifications, pre-qualification audits, access for GCP inspectors, etc.), systems from such a
vendor shall not be used in clinical trials. This is irrespective of the number of sponsors
making use of or having used the systems, the number of years such systems have been on
the market etc., as serious GCP non-compliances and risks to data integrity, reliability and
robustness could exist unnoticed if auditors and GCP inspectors are not allowed access as
well as if potential serious breaches are not escalated appropriately by the vendor.




Notice to sponsors on validation and qualification of computerised systems used in clinical trials
                                                                                                     Page 4/4