Many life sciences organizations have revised standard operating procedures (SOPs), updated templates and trained their teams. Those steps matter, but documentation alone does not demonstrate control when critical trial data passes through systems, vendors and algorithms that no one can fully trace. 

Increasingly, trial information moves among sites, contract research organizations (CROs), laboratories, electronic clinical outcome assessment (eCOA) and electronic patient-reported outcome (ePRO) platforms, wearables and cloud providers. Readiness means explaining where critical data goes, who is accountable and whether safeguards work in practice.

What Is ICH E6(R3)? 

Developed through the International Council for Harmonisation (ICH), E6(R3) is the latest revision of the guideline underpinning ethical, scientifically sound trials. Its overarching principles are supported by Annex 1 for interventional trials and Annex 2 for additional considerations involving decentralized or pragmatic elements and real-world data sources. It makes a quality-by-design approach more explicit: focus effort where risks could affect participants or the credibility of the evidence. 

ICH finalized Annex 2 in June 2026, but implementation dates differ by region. For example, the European Medicines Agency lists January 15, 2027, as its EU effective date. Sponsors running global studies need to distinguish ICH finalization from local regulatory adoption.

ICH E6(R2) vs. E6(R3): What Has Changed?  

R3 builds on R2’s foundations and more explicitly calls for fit-for-purpose oversight across complex data ecosystems. 

Focus How R3 builds on R2 A sponsor should ask 
Quality by design and risk R2 reinforced risk-based quality management. R3 more explicitly integrates proportionality and critical-to-quality factors across trial planning, conduct and oversight. Are our controls focused on the risks that matter most? 
Data integrity R2 addressed trustworthy records and computerized systems. R3 places more explicit emphasis on data governance, provenance and end-to-end traceability. Can we reconstruct a critical data point, including changes? 
Technology-enabled trials R2 addressed electronic systems. R3 more directly accommodates decentralized elements, digital health technologies and external data sources. Can we show that a technology is fit for its intended use? 
Vendor oversight R2 retained sponsor accountability for delegated work. R3 reinforces proportionate oversight of service providers and their critical activities. Do we know who performs and monitors each critical activity? 

Data Governance: Can You Trace Critical Trial Data?  

Clinical trial data governance begins with practical questions: Where does a critical data point originate? Which systems and organizations does it pass through? Who is responsible for it? What happens when it is corrected, linked to another source, transformed or used to calculate a derived value? 

Those questions become harder in technology-enabled trials. A wearable may collect sensor readings that a vendor algorithm converts into a metric before it enters a clinical data platform. If that metric supports an endpoint, the team should be able to explain how it was generated, how changes are controlled and whether the underlying information can be traced. The same principle applies when AI classifies or summarizes trial data. 

Strong ICH E6(R3) data integrity practices therefore extend beyond having clean datasets. They require clarity around provenance, data lineage, roles, validation where appropriate, review of exceptions and records that can be retrieved when questions arise. Clinical data traceability is not merely a technical diagram; it is evidence that decisions made about trial data can be understood and justified. 

Not every field or system deserves identical scrutiny. Risk-based quality management means prioritizing data and processes that could materially affect participant rights, safety or the reliability of results. 

Data Protection: Do You Know Where Participant Information Goes?  

Participant information may be collected through visits, apps, ePRO tools, sensors and other data sources, then processed by multiple parties. A privacy notice or vendor agreement does not, by itself, show what happens once the information leaves the original collection point. 

Follow the flow: What information is collected and for which purpose? Where is it stored and processed? Who can access it? Does it cross borders? How long is it retained, and how is it deleted or archived? If a dataset is combined with other information, who assesses the implications for participants and consistency with stated uses? 

AI adds questions that are easy to overlook. Can a service provider use participant information to train or improve a model? Does the system generate new inferences about an individual? Are those activities covered by the applicable notices, permissions, agreements and privacy requirements? 

ICH E6(R3) is a GCP guideline, not a privacy law. Depending on the study and jurisdiction, separate data protection obligations, including the GDPR where applicable, may also apply. Meeting a GCP expectation does not automatically demonstrate privacy compliance. Connecting documented procedures with actual data flows is central to a workable data privacy program. 

Vendor Oversight: Who Is Really Handling Your Trial Data? 

Clinical trials depend on CROs, central laboratories, cloud platforms, software suppliers and specialized technology providers. Delegating an activity does not remove the sponsor’s responsibility for appropriate oversight. 

The issue is visibility, not just procurement. A signed agreement may describe a service, but can the sponsor identify which vendor processes critical information, which system hosts it, who can change it and which records demonstrate that required checks have been performed? 

That visibility must extend beyond direct contracts. Does the CRO rely on subcontractors? Does a technology vendor engage a cloud provider or external analytics service? Has an AI-enabled tool been introduced within a product upgrade or service workflow, even though AI was not part of the original purchase? 

Effective ICH E6(R3) vendor oversight should be proportionate to risk and supported by retrievable evidence: clearly assigned responsibilities, fit-for-purpose assessments, data-handling arrangements, relevant performance indicators, issue escalation and follow-up when something changes. The objective is not to audit every supplier equally. It is to know which third parties affect critical data or trial activities and verify that the controls around them work. 

AI-Enabled Trials: Where Does Oversight Get Harder? 

AI in clinical trials is not a separate governance issue. It cuts across data integrity, participant information and vendor accountability, and it may be embedded in systems that are not marketed as AI products. 

Organizations should be able to establish what inputs a model receives, whether it creates derived values or participant-level inferences, and what happens to outputs downstream. They should understand whether vendor agreements permit model training on trial data, whether an AI-enabled process has been assessed for its intended use, and how changes in algorithms or model versions are evaluated and documented. 

A routine drafting tool may need less oversight than a model producing endpoint data. Oversight should match the potential effect on participant rights, safety and trial reliability. Kirke’s AI Governance and Readiness approach starts with that alignment between use case, data, accountability and risk. 

Annex 2 is not an AI-specific rulebook. Its focus on varied technologies and data sources reinforces the need for reliable oversight. 

Three Actions Organizations Can Take Now 

1. Identify what is critical. 

Start with the trial’s critical-to-quality factors. Determine which datasets, endpoints, systems, AI-enabled processes and external providers could meaningfully affect participant rights, safety or the reliability of results. Agree on accountable owners and use that prioritization to determine where stronger controls and oversight are needed. This is more useful than applying identical checks to everything. 

2. Map the clinical data ecosystem. 

Select one important trial-data flow and follow it end to end, from collection to final use. Record where the data is stored, transferred, corrected, combined or transformed, including points managed by CROs, subcontractors, digital health technology providers and AI-enabled tools. Note each handoff, the responsible party and the evidence that should exist. A focused map often reveals gaps faster than a high-level system inventory. 

3. Test oversight in practice. 

Choose a few critical data points or vendor-supported activities and ask teams to produce the actual supporting records: assessments, approvals, access and change logs, monitoring results, deviations, issue resolution and follow-up actions, as relevant. Can the people responsible reconstruct what happened without repeated requests across departments and suppliers? If not, the priority may be clearer ownership or a more reliable process, rather than another policy. 

ICH E6(R3) is not an invitation to create more documentation for every dataset and vendor. It is a reason to make the controls that matter measurable, understandable and reliable. As Annex 2 brings newer trial models and data sources into focus, the organizations best prepared will be those that can trace their critical information and demonstrate meaningful oversight. 

If tracing one critical trial-data flow would require several teams and vendors to reconstruct the answer, it may be time to assess how governance works in practice. Explore Kirke’s Data Strategy and Insights approach.