ICH E6(R3) Is Here. Is Your EDC Ready?
What updated GCP guidance means for electronic data capture in clinical research
Clinical research is changing, and Good Clinical Practice is changing with it.
Health Canada implemented ICH E6(R3) on April 1, 2026, following implementation of the updated guideline in the United States and European Union. The updated guideline reflects the realities of modern clinical research, including increased use of technology, diverse data sources, and more complex trial designs. For research teams, one of the clearest messages is that the computerized systems supporting a trial need to be fit for purpose, proportionate to risk, and supported by appropriate controls and documentation.
If your EDC is being used for clinical trials subject to GCP requirements, here are six areas of ICH E6(R3) worth reviewing.
1) Is your EDC fit for purpose and appropriately validated?
ICH E6(R3) states that computerized systems used in clinical trials should be fit for purpose, with validation based on the intended use of the system, the importance of the data, and potential risks to participants and trial results.
Health Canada further states that electronic systems used to capture, process, manage, or archive clinical trial information should be adequately validated, following a risk-based approach, with evidence of validation retained and available for inspection.
For EDCs, this means looking beyond the underlying software. Study-specific configurations, customizations, interfaces, and changes may also need to be considered as part of your validation approach.
Ask: Can we demonstrate that our EDC and the way we have configured it for our study perform as intended?
2) Can you trace what happens to your data?
ICH E6(R3) puts significant emphasis on data governance and the data lifecycle, including relevant metadata and audit trails.
Health Canada’s guidance states that changes to source records should be traceable and should not obscure the original entry. It also identifies audit trails as an important requirement for computerized systems.
For your EDC, that means maintaining appropriate audit trails and metadata so you can reconstruct the history, context, and evolution of trial data throughout its lifecycle.
Ask: Can we determine what changed, when it changed, who made the change, and, when applicable, why?
3) Do the right people have the right access?
ICH E6(R3) specifically addresses security and user management for computerized systems.
Health Canada’s guidance calls for trial data to be protected from unauthorized access, disclosure, alteration, inappropriate destruction, or accidental loss. It also expects records describing access controls and internal and external security measures for important computerized systems.
Your EDC processes should therefore address authentication, permissions, user roles, periodic review, changes to access, and removal of access when it is no longer required.
Ask: Can we demonstrate who has access to our EDC and what each user is authorized to do?
4) Are you managing data throughout its entire lifecycle?
ICH E6(R3) expands the focus beyond data capture to data governance across the full data lifecycle.
That includes data capture, relevant metadata, review, corrections, transfer and migration, finalization, retention, access, and eventual destruction.
Health Canada also calls for documented processes to ensure data integrity throughout the full data lifecycle.
For research teams, this means EDC readiness isn’t just about entering data correctly. You need to consider what happens to that data before, during, and after collection.
Ask: Do our systems and processes protect the integrity of our data throughout its lifecycle?
5) Do you maintain the EDC’s validated state as things change?
Health Canada’s guidance specifically notes that software upgrades and data migrations can affect validated systems. Protocol amendments, CRF revisions, and changes to study procedures may require system changes as well. Validating a system at the start of a study may not be enough. The impact of changes should be evaluated and documented, and additional validation may be necessary.
Ask: Can we demonstrate that changes to our study systems are assessed, controlled, and verified before they are available for use?
6) Can you demonstrate compliance?
Documentation is a critical part of demonstrating compliance: SOPs, records, validation reports, and vendor documentation.
Health Canada states that evidence of computerized-system validation should be retained for the required record-retention period and be readily available for inspection.
Its guidance also calls for documented procedures covering areas such as system validation, functionality testing, data handling, maintenance, security, change control, backup, recovery, contingency planning, and decommissioning.
Ask: If an inspector asked us today to demonstrate how our EDC is validated, secured, controlled, and maintained, could we provide the evidence?
This Isn’t Just a Canadian Change
Regulatory expectations around these systems are increasingly consistent across regions.
Canada | Health Canada
Health Canada implemented ICH E6(R3) on April 1, 2026. Its updated clinical trial guidance provides detailed direction on electronic records and computerized systems, including validation, audit trails, security, user management, backup and recovery, change control, training, and data governance.
United States | FDA
The FDA issued its final E6(R3) Good Clinical Practice guidance in September 2025. The guidance incorporates flexible, risk-based approaches and reflects the increasing role of technology and diverse data sources in clinical research.
For computerized systems, E6(R3) addresses areas including validation, data governance, metadata and audit trails, security, and user management.
European Union | EMA
ICH E6(R3) Principles and Annex 1 became effective in the EU in July 2025.
More recently, in April 2026, EMA issued a notice specifically addressing the validation and qualification of computerized systems used in clinical trials. EMA noted inspection findings in which some sponsors were unable to provide adequate documentation of required qualification and validation activities for computerized data collection tools and software.
The message across regions is increasingly consistent: computerized systems used for important clinical trial activities need to be fit for purpose, appropriately controlled, and supported by documentation.
What If You’re Using an Open-Source EDC?
ICH E6(R3) does not say that an EDC must be commercial.
The question is whether the system and the processes surrounding it meet the requirements of your study.
In fact, Health Canada’s guidance specifically says the risk assessment for computerized systems should consider factors such as whether research is commercial or non-commercial and whether the study is intended for publication or a drug submission.
For academic, investigator-led, and early-stage research teams using open-source EDCs, this distinction is important.
As research moves toward regulatory submissions, larger multi-site trials, or more complex data environments, the risk and importance of the systems and data may change. That can require a more rigorous approach to validation, documentation, security, auditability, and ongoing oversight.
When Research Evolves, EDC Requirements Can Too
An EDC that was well suited to an earlier stage of your research may not be the right fit forever. As studies grow in size, complexity, or regulatory significance, expectations around validation, documentation, auditability, security, and oversight can grow with them.The question isn’t whether your current EDC is “good” or “bad.” It’s whether your current system, processes, and documentation are appropriate for the research you’re conducting today — and the research you’re planning next.
That makes ICH E6(R3) a useful checkpoint. Research teams can use the updated guidance to identify where their current environment is working well, where additional controls may be needed, and where the operational burden of maintaining those controls may signal that it’s time to consider a different approach.
For organizations that determine their current environment no longer provides the level of control, documentation or oversight their studies require, moving to an EDC designed for regulated clinical research may be the next step. DFdiscover provides flexible online and offline data capture, configurable validation and workflows, and capabilities designed to support research conducted under frameworks such as ICH GCP and 21 CFR Part 11.
Your EDC worked for where your research started. Make sure it’s ready for where your research is going.
Ready to evaluate your next step?
Sources & Guidance
International Council for Harmonisation (ICH)
ICH E6(R3) Guideline for Good Clinical Practice
[View the Guideline]
Health Canada
Guidance for Clinical Trial Sponsors: Clinical Trial Applications
[View Health Canada Guidance]
U.S. Food and Drug Administration (FDA)
E6(R3) Good Clinical Practice: Guidance for Industry
[View FDA Guidance]
European Medicines Agency (EMA)
ICH E6(R3) Good Clinical Practice
[View EMA Guidance]
