Draft guideline on computerised systems and electronic ...

1 Official address Domenico Scarlattilaan 6 1083 HS Amsterdam The Netherlands An agency of the European Union Address for visits and deliveries Refer to Send us a question Go to Telephone +31 (0)88 781 6000 European Medicines Agency, 2021. Reproduction is authorised provided the source is acknowledged. 10 June 2021 1 EMA/226170/2021 2 Good Clinical Practice Inspectors Working Group (GCP IWG) 3 guideline on computerised systems and electronic data in 4 clinical trials 5 Draft 6 Adopted by GCP IWG for release for consultation 4 March 2021 Start of public consultation 18 June 2021 End of consultation (deadline for comments) 17 December 2021 Date for coming into effect TBC 7 8 This guideline replaces Reflection paper on expectations for electronic source data and data 9 transcribed to electronic data collection tools in clinical trials (EMA/INS/GCP/454280/2010).

2 10 11 12 13 Comments should be provided using this template. The completed comments form should be sent to 14 15 16 Keywords computerised systems , electronic data, validation, qualification, audit trail, user management, security, electronic clinical outcome assessment (eCOA), Interactive response technology (IRT), case report form (CRF), electronic signatures, artificial intelligence 17 guideline on computerised systems and electronic data in clinical trials EMA/226170/2021 Page 2/47 guideline on computerised systems and electronic data in 18 clinical trials 19 Table of contents 20 Glossary and abbreviations .. 5 21 Executive summary.

3 8 22 1. Introduction .. 8 23 2. Scope .. 8 24 3. Legal and regulatory background .. 9 25 4. Principles and definition of key concepts .. 10 26 Data integrity .. 10 27 Responsibilities .. 10 28 electronic data and documents .. 11 29 Source data .. 11 30 ALCOA(++) principles .. 13 31 Criticality and risks .. 14 32 Performing data capture in clinical trials .. 14 33 electronic signatures .. 15 34 Data protection .. 16 35 Validation of systems .. 16 36 Direct access to computerised systems .. 17 37 5. computerised systems .. 17 38 Keeping a description of computerised systems .. 17 39 Maintaining written procedures for the use of computerised systems .

4 17 40 Training requirements for computerised systems .. 17 41 Security .. 17 42 6. electronic data .. 18 43 Data capture and location .. 18 44 Transcription from paper to electronic format .. 18 45 Transfer from electronic sources .. 18 46 Direct data capture .. 18 47 Data entry checks .. 19 48 Audit trail and audit trail review .. 19 49 Audit trail .. 19 50 Audit trail review .. 20 51 Sign-off of data .. 20 52 Copying data .. 21 53 Certified copies .. 21 54 Hosting and control of data .. 22 55 Cloud solutions .. 22 56 Adequate back-up of data .. 23 57 Migration of data .. 23 58 guideline on computerised systems and electronic data in clinical trials EMA/226170/2021 Page 3/47 Archiving.

5 24 59 Database decommissioning .. 24 60 Annex 1 Contracts .. 26 61 Annex 2 computerised systems validation .. 28 62 Establishing requirements and ensuring documenting consistent intended performance 63 (validation) .. 28 64 Requirements documentation (URS, trial specific, edit check specifications) .. 29 65 Requirements traceability matrix .. 29 66 Validation plans and test plans/scripts/cases .. 30 67 Test execution and reporting .. 30 68 Release into production .. 31 69 Periodic review (maintenance of the validated state) .. 31 70 Change control .. 31 71 Annex 3 User management .. 33 72 User management .. 33 73 User reviews.

6 33 74 Segregation of duties .. 33 75 Least-privilege rule .. 33 76 Individual accounts .. 33 77 Unique user names .. 33 78 Annex 4 Security .. 34 79 Ongoing security measures, including management of firewalls, patching management, 80 penetration testing etc.. 34 81 Physical security .. 34 82 Firewalls .. 34 83 Vulnerability management .. 34 84 Platform management .. 35 85 Use of bi-directional devices ( USB devices) .. 35 86 Anti-virus software .. 35 87 Penetration testing .. 35 88 Intrusion detection system .. 35 89 Internal activity monitoring .. 36 90 Security incident management .. 36 91 Authentication method.

7 36 92 Remote authentication and password managers Remote authentication .. 36 93 Password 36 94 Password confidentiality .. 37 95 Inactivity logout .. 37 96 Date and time .. 37 97 Remote connection .. 37 98 Annex 5 Requirements related to specific types of systems , processes and 99 data.. 38 100 electronic clinical outcome assessment (eCOA) .. 38 101 Interactive response technology (IRT) system .. 43 102 Testing of functionalities .. 43 103 guideline on computerised systems and electronic data in clinical trials EMA/226170/2021 Page 4/47 Dosage calculations .. 43 104 Stratified randomisation .. 43 105 Blinding and unblinding.

8 43 106 Emergency unblinding .. 43 107 IRT used for collection of clinical data from the trial site .. 44 108 Web-based randomisation .. 44 109 electronic informed consent .. 44 110 Provision of information about the clinical trial .. 45 111 Written informed consent .. 45 112 Trial participant identity .. 46 113 Sponsor notification on the consent process .. 46 114 Trial participant confidentiality .. 46 115 Trial participant access to the informed consent documentation .. 46 116 Investigator responsibilities .. 46 117 Version control and availability to sites .. 47 118 Availability in the investigator TMF.

9 47 119 Withdrawal from the trial .. 47 120 121 guideline on computerised systems and electronic data in clinical trials EMA/226170/2021 Page 5/47 Glossary and abbreviations 122 Generally used terms 123 Unless otherwise specified ( source data or source document ) and in order to simplify the text, 124 data will be used in this guideline in a broad meaning which may include documents ( in electronic 125 trial master files (eTMF)), records or any form of information. 126 All references to a sponsor in this guideline also apply to a contract research organisation (CRO) to the 127 extent that a CRO has assumed the trial related duties and functions of a sponsor (ICH-GCP ).

10 128 When a computerised system is implemented by the institution where the investigator is conducting a 129 clinical trial, any reference to the investigator in this guideline also includes that institution, as provided 130 for by ICH-GCP (investigator / institution: An expression meaning "the investigator and/or 131 institution, where required by the applicable regulatory requirements"), except for those responsibilities 132 assigned by ICH-GCP to the investigator personally and not to the investigator / institution. 133 The word "trial participant" is used in this text as a synonym for the term subject , defined in Directive 134 2001/20/EC as an individual who participates in a clinical trial as a recipient of the investigational 135 medicinal product (IMP) or a control.