ICH E6(R3) Readiness: What Sponsors and CROs Need to Know

The International Council for Harmonisation (ICH) sets global standards for Good Clinical Practice to ensure patient safety and reliable clinical data. The latest update, ICH E6(R3), introduces a shift toward principles-based trial design and stronger data governance. This blog explains what sponsors and CROs need to understand to align with the new expectations.

ICH E6(R3) moves away from rigid instructions and places emphasis on principles and accountability. For sponsors and CROs, this is not just a documentation update. It changes how trials are designed, how oversight is handled, and how data is managed from start to finish

ICH E6 is the global guideline for Good Clinical Practice. With the final version published in January 2025 and regional adoption already underway, sponsors and CROs are now working toward alignment with a revised set of expectations.

ICH E6 exists to ensure two things:

• Protection of trial participants

• Reliability of clinical data

These core objectives remain the same in R3. What has changed is how organizations are expected to meet them.

Instead of prescribing detailed steps, the updated version provides guiding principles. This allows flexibility across different trial types, but it also requires organizations to justify their decisions based on study-specific needs. Compliance is no longer about following a fixed path. It is about demonstrating control and clarity across the trial lifecycle.

The updated guideline introduces several important shifts that affect both operational models and oversight expectations.

Principles-Based Approach

The guideline now focuses on high-level principles rather than detailed instructions. This means:

• Organizations can adapt processes based on study requirements
• Teams must document how decisions are made and why
• Internal alignment becomes more important than procedural consistency

Flexibility increases, but so does responsibility. The difference between "we follow our SOP" and "we follow our SOP because it addresses our study-specific risks" is now material.

Quality by Design

Quality is expected to be built into the study from the beginning, not bolted on during monitoring.

This involves:

• Identifying critical-to-quality factors early in protocol development
• Aligning data collection procedures with study objectives
• Removing unnecessary complexity that creates risk without adding value

The focus shifts from correction to prevention. A poorly designed protocol that requires intensive monitoring later is no longer acceptable. The design should minimize the monitoring burden through smart architecture.

Risk-Based and Proportional Oversight

Not all data points carry the same importance. The guideline reinforces a structured risk-based approach.

Organizations are expected to:

• Identify study-specific risks at the outset
• Assess their impact on data integrity and participant safety
• Allocate monitoring resources according to actual risk, not habit

For example, in a remote diabetes trial with home-collected glucose data, blood glucose readings are high-risk (directly impacts efficacy claims). Patient visit timestamps are low-risk (administrative only). Pharmacy dispensing records are medium-risk (safety-critical but controlled by third parties).

Under R3, monitoring intensity reflects this hierarchy. High-risk data gets continuous automated review with human follow-up. Medium-risk data gets periodic sampling. Low-risk data gets exception-based review. This isn't less rigorous. It's more rigorous because effort concentrates where it matters.

Expanded Data Governance

Data governance is now a central component of the guideline, not an afterthought.

Key expectations include:

• Clear ownership of data at every stage
• Traceability across systems (EDC to LIMS to analysis databases)
• Control over the full data lifecycle, from collection through archival

This applies to both traditional data sources and newer digital inputs like wearables and patient-reported outcomes. Organizations must know where their data lives, who can access it, how it flows between systems, and how its integrity is maintained.

Support for Modern Trial Models

The guideline explicitly acknowledges evolving trial approaches:

• Remote data collection and site-less enrollment
• Wearable devices and continuous monitoring
• Hybrid designs that blend traditional and decentralized elements

Technology is supported, provided that data integrity and participant safety are maintained. There is no hidden preference for paper-based trials. The bar is consistent: demonstrate control and traceability, regardless of method.

ICH E6(R3) introduces a revised structure that makes implementation clearer.

The guideline is divided into core principles plus annexes that address specific contexts.
Annex 1 covers interventional trials (Phase 2-4) and Annex 2 addresses emerging trial designs (decentralized, adaptive, complex). This separation helps users move from general concepts to detailed expectations based on their specific trial type.

New sections include dedicated content on data governance, expanded sponsor responsibilities, and clearer expectations for oversight delegation. For sponsors and CROs, this reduces ambiguity during interpretation.

Sponsors remain fully accountable for trial conduct, even when activities are delegated. Under R3, this accountability becomes more visible and more detailed.

Protocol Design

Sponsors must ensure that quality is embedded from the start. This is not a mandate to complicate protocols. It is a mandate to think through data requirements upfront.

Ask yourself: Which data points drive the study claim? Which supports safety? Which are nice-to-have? A protocol that collects 50 data points, but only 15 are critical, creates an unnecessary monitoring burden and compliance risk. R3 expects sponsors to design lean.

Oversight of CROs and Vendors

Delegation is allowed and necessary. Responsibility remains with the sponsor.

Sponsors are expected to:

• Define roles clearly in contracts and delegation agreements
• Monitor CRO performance based on study-specific risk, not on a universal schedule
• Maintain visibility into key activities, especially around data governance

The shift here is from "we check in quarterly" to "we monitor in proportion to risk." A high-risk CRO activity gets continuous oversight. A low-risk activity gets periodic sampling. This requires sponsors to articulate their risk profile clearly upfront.

Risk Management

Structured risk management is now essential, not optional.

Sponsors need to:

• Identify risks early (during protocol development, not after issues arise)
• Document mitigation plans specific to each risk
• Review risks throughout the study as new information emerges

Most organizations have risk registers. The gap is usually in how dynamic they are. R3 expects risk to be a living process, not a one-time exercise.

Data Governance

Sponsors are responsible for data integrity across all systems, whether they manage systems directly or delegate to vendors.

This involves:

• Ensuring data traceability from source through analysis
• Validating systems against study requirements
• Managing data flow between platforms clearly

A common failure point: sponsor assumes "CRO manages our EDC" means "CRO owns data governance." Reality: sponsor owns governance framework; CRO executes within it. Without explicit agreements, both assume the other is responsible for something, and accountability gaps emerge.

Sponsor Responsibilities: Then vs Now

CROs continue to play a central role in trial execution. Under ICH E6(R3), expectations around accountability and alignment are more defined.

Operational Flexibility

Standard workflows may no longer apply across all studies. One sponsor's risk threshold differs from another's. One protocol design needs intensive data review; another doesn't.

CROs need to:

• Adjust processes based on study-specific requirements
• Support different trial formats without forcing all trials into one mold
• Integrate with sponsor governance frameworks, not impose their own

This creates operational complexity. A CRO with ten active studies might have ten different monitoring approaches. Without systematic process design, this becomes chaotic. The organizations that handle it well build flexibility into their core processes, not as exceptions.

Accountability in Delegated Work

CROs are responsible for the quality of activities they perform, and sponsors remain responsible for oversight.

CROs must:

• Maintain clear documentation of decisions and actions
• Support audits with full data trails
• Ensure consistency in execution across all studies

Where this often breaks down: CROs assume that providing data to a sponsor absolves them of accountability for data quality. R3 makes clear that both parties are accountable. The CRO is accountable for execution quality; the sponsor is accountable for oversight.

Common CRO Misconceptions

Three misunderstandings typically emerge when CROs implement R3.

Misconception 1: Flexible SOPs mean we can vary execution.

Reality: Flexibility applies to approach, not rigor. A CRO might monitor high-risk data weekly versus daily, depending on risk profile. But those weeks still require documented review, clear escalation criteria, and maintained audit trails. Less frequent doesn't mean less rigorous.

Misconception 2: Sponsors will now own data governance completely.

Reality: Sponsors' own governance framework and accountability. CROs own execution. Both are responsible for collaboration and clarity. Assuming clean separation creates gaps that auditors will find.

Misconception 3: R3 means less monitoring work.

Reality: It means targeted monitoring. A study with a tighter risk focus might have less routine data review but more rigorous analysis of high-risk data. Workload often stays similar; the distribution changes.

CRO Responsibilities: Then vs Now

As teams assess their current state, several gaps typically appear.

SOP Misalignment:

Many SOPs describe fixed steps rather than principles. This limits flexibility and over-relies on checklists.

Fragmented Systems:

Data across multiple platforms creates visibility issues and complicates audits.

Reactive Monitoring:

Traditional monitoring identifies issues after they occur. R3 expects proactive, continuous review.

Protocol-Level Gaps:

Risk planning is not always built into protocol design, creating misalignment between design and execution.

Inconsistent Technology:

Tools may exist but operate in silos, creating duplicate work and data gaps.

Understanding what R3 requires and implementing it are two different things. Most organizations recognize the need for change. What they underestimate is the friction that emerges when change collides with existing infrastructure and organizational politics.

Systems Legacy

Data is rarely built on a single platform. Sponsors use EDC software for patient data, LIMS for lab results, and separate systems for recruitment metrics. CROs may operate their own case management layers. This fragmentation isn't accidental. It reflects years of vendor contracts, departmental preferences, and incremental decisions.

Under R3, these silos become a compliance risk. Yet connecting them requires more than API calls. It requires renegotiating contracts, changing vendor relationships, and sometimes replacing systems entirely. Organizations often discover this too late. The budget isn't available. Timelines are constrained. The result is a partial implementation where data governance exists on paper but not in practice.

Competing Priorities

Risk management, quality by design, and data governance are important. They're also abstract. In organizations where trials are running on aggressive timelines, "reviewing risk early" loses to "enrolling the next patient."

Sponsors face this tension acutely. CROs face it differently. A CRO with ten active sponsors each defines risk tolerance differently. Flexibility, which R3 demands, can mean ten different monitoring approaches in parallel. This creates operational cost. Training becomes complex. Quality control becomes difficult. CROs that don't address this systematically will find themselves stretched.

Role Ambiguity

In theory, R3 creates clarity around accountability. In practice, it creates gray zones that organizations haven't navigated before.

When a sponsor delegates data governance to a CRO, who owns traceability? If the sponsor defines risk but the CRO manages monitoring, who is accountable if risk assumptions prove wrong? If systems fail, is it the sponsor's problem or the vendor's?

These questions aren't answered by the guidelines. They require explicit agreements, documented decision-making, and often uncomfortable conversations between organizations that haven't needed them before.

Resource Constraints

True readiness requires investment. SOPs need rewriting. Staff needs training. Systems need updates or replacement. Monitoring plans need redesign. This happens while teams are running existing trials.

Budget committees often view this as overhead. There's no direct revenue impact. The benefit (avoiding audit findings) is invisible until too late. Organizations that delay readiness often find themselves rushing implementation under inspection pressure. That's more expensive and more prone to gaps than planned adoption.

Readiness doesn't happen overnight. Organizations that treat it as a project with phases, dependencies, and clear ownership tend to avoid last-minute scrambling.

A realistic timeline spans 6 to 12 months for mid-sized organizations with moderate complexity. This assumes some systems exist and staff have baseline compliance knowledge.

Phase 1: Assessment and Governance Setup

Start by mapping your current state.

For Sponsors:

Review protocols for quality-by-design approach. Map data flows and identify system gaps. Assess whether monitoring is risk-informed or reactive.

For CROs:

Audit processes against R3 principles. Identify inflexible workflows. Review vendor contracts for data governance clarity.

Deliverable:

A readiness scorecard identifying your three biggest gaps.

Phase 2: Design and Systems

With gaps identified, move to design.

For Sponsors:

Develop a risk management framework. Create protocol templates with quality by design. Design risk-based monitoring plans. Map data governance ownership.

For CROs:

Update SOPs for flexibility within principles. Renegotiate vendor contracts if data governance responsibility has changed. Identify system integration points.

Critical conversation:

Sponsors often want one monitoring approach for all trials. CROs often want standardized SOPs. R3 requires accepting flexibility. Have this conversation early.

Deliverable:

Updated SOPs, protocols, and vendor agreements.

Phase 3: Validation and Training

Pilot new approaches before full deployment. Test data flows. Run training sessions. Gather feedback.

Training is often underestimated. Expect 4-6 hours per staff member minimum.

Deliverable: Validated processes and trained staff.

Phase 4: Ongoing 

Once launched, readiness isn't static. Ongoing activities include:

• Regular risk review (quarterly minimum)
• Continuous training for new hires
• Annual SOP review and refresh
• Vendor performance monitoring against new expectations

Use this checklist to evaluate readiness.

Governance and Oversight:

Are roles clearly defined? Is oversight aligned with risk? Are decisions documented?

Protocol Design:

Are critical-to-quality factors identified early? Is the protocol aligned with the study objectives? Are unnecessary procedures removed?

Data and Systems:

Is data traceable across all systems? Are systems validated? Is data ownership defined?

Monitoring Approach:

Is monitoring risk-based? Are reviews continuous? Are high-risk issues identified early?

Vendor and CRO Alignment:

Are expectations clearly defined in contracts? Is performance monitored? Are responsibilities documented?

ICH E6(R3) changes how clinical trials are approached. It emphasizes thoughtful design, focused oversight, and clear data control. For sponsors and CROs, readiness means building quality into studies from the beginning, focusing monitoring on what matters, and ensuring control across systems.

Readiness depends on alignment across teams and workflows. Organizations that start early adapt more easily as expectations evolve. Those that move first will set standards for their region. Those that delay will spend more effort retrofitting compliance.

GUIDELINE FOR GOOD CLINICAL PRACTICE E6(R3) 
ICH E6 Good clinical practice - Scientific guideline | European Medicines Agency (EMA) 
FDA Publishes ICH E6(R3): What it Means for U.S. Clinical Trials - ACRP 
ICH E6 Asset Library - TransCelerat