Insights: February 2025

February 2025: From Guidance to SOPs — What ACT EU Revealed About ICH E6(R3) and the New Baseline for Risk-Based Oversight

February 2025 was the month ICH E6(R3) stopped being a document to interpret and started becoming an operating model to implement. The ACT EU workshop held on 19–20 February was not framed as a theoretical review. Its stated purpose was to explain the major changes in ICH E6(R3), connect those changes to modern trial design, organisation, and technology, and open practical discussion on implementation. For sponsor quality leaders, that framing matters. Europe is treating E6(R3) as a live transformation agenda, not a passive read-and-file revision.

That message was reinforced by the broader ACT EU program itself. The workshop report describes the event as the first step in implementing the revised GCP guideline in the EU, and the report identifies 23 July 2025 as the date E6(R3) comes into effect in Europe. At the same time, ACT EU’s 2025–2026 workplan places good clinical practice modernisation alongside consolidated advice on clinical trials and clinical trial methodologies under the larger objective of maximising the impact of clinical trials. This is not a narrow inspectorate issue. It is part of a wider redesign of how Europe expects clinical trials to be governed and run.

From guidance to SOPs

One of the clearest signals from February was that implementation should not wait for July. The ACT EU workshop report states that many E6(R2) concepts are already in place, that preparation can begin before the EU effective date, and that the transition should be handled through fit-for-purpose change control, training, and gap analysis. It also notes that this is especially important for sponsors using decentralised or pragmatic designs, or novel tools and technologies. For quality organizations, that is the point where interpretation ends and controlled implementation begins.

In practical terms, that means E6(R3) has to move out of the theory of slide decks and into the quality system. The guideline requires sponsors to apply a proportionate, risk-based quality management approach, build quality into trial design, and identify the factors most likely to affect participant rights, safety, well-being, and the reliability of results. The workshop translated those principles into operational language: clarity of research question, collection of essential data only, operational feasibility, early stakeholder input, and deliberate reduction of unnecessary burden on sites and participants. SOPs, templates, and oversight practices built around legacy habits rather than critical-to-quality thinking will not be sufficient.

What the ACT EU workshop revealed about GCP modernization in Europe

The European message was not that GCP is being softened. The message was that GCP is being modernised to match the way contemporary trials are actually designed and conducted. ACT EU’s GCP modernisation program states that the revised E6 guideline is meant to address increasingly diverse trial types and data sources, while allowing appropriate flexibility for technological innovation. The workshop objectives mirrored that directly by focusing on how GCP should adapt to modern trial design, organisation, and technology.

More importantly, the workshop made clear what modernization means in practice. The discussion centered on quality by design, operational feasibility, and avoiding unnecessary complexity. It also emphasized that sponsor oversight requirements are more explicit: sponsors are expected to ensure sufficient resources for oversight, define critical-to-quality factors early, align trial-related documents, and involve patients and other interested parties during design rather than after avoidable operational problems appear. For sponsor companies, that is a materially different expectation from treating QA as an outsourced or downstream function.

Risk-based oversight is now the baseline

If there was one operating principle that ran through the February discussion, it was proportionality. E6(R3) states that sponsor responsibility includes the implementation of risk-proportionate approaches across the clinical trial lifecycle. It also requires sponsors to identify risks to critical-to-quality factors before trial initiation and throughout trial conduct, and where relevant to define pre-specified acceptable ranges such as quality tolerance limits. The ACT EU workshop Q&A echoed that position by identifying proportionate oversight and a clearly justified risk-based approach as central themes, especially in the context of audits and inspections.

That changes the monitoring conversation. Under E6(R3), monitoring is expected to verify protocol-required and higher-criticality data against source, identify missing or inconsistent data and protocol deviations, and examine trends within and across sites. The workshop report then connected that expectation to trial reality by stating that monitoring strategy should take into account the trial’s purpose, design, blinding, safety profile, and endpoints with the greatest potential to affect participant protection and result reliability. In 2025, monitoring is no longer primarily a frequency question. It is a criticality question first.

The same is true for vendor oversight. E6(R3) is explicit that sponsors may transfer activities, but ultimate responsibility remains with the sponsor. The sponsor must assess provider suitability, obtain relevant information for selection and oversight, and maintain oversight of important transferred activities, including subcontracted work. The ACT EU workshop added practical texture to that point by highlighting blurred accountability when tasks are delegated to external providers such as home nurses, and by stressing the need for clear agreements, training, pre-qualification, and defined expectations for investigator oversight. For sponsor companies built on outsourced operating models, this is where weak governance will become visible very quickly.

Data review and data governance are no longer side discussions either. The workshop emphasized that the new data governance section should be read together with the rewritten investigator and sponsor responsibilities, and that it spans the full data and system lifecycle, including data integrity, metadata, audit trails, randomisation, blinding, and correction procedures. The ICH guideline reinforces that by requiring fit-for-purpose systems and planned, risk-based review of relevant metadata. For QA leadership, that means computerized system governance, data review strategy, and statistical traceability now sit much closer to core GCP oversight than many sponsors have historically allowed.

What biotech QA leaders should do with February’s signal

The immediate priority is to treat E6(R3) implementation as a governed change program, not a training campaign. February’s regulatory discussion pointed toward change control, targeted gap assessment, document impact review, and role clarification well before the July applicability date in the EU. That is the work of a sponsor quality system, not just a learning and development function.

The second priority is to rewrite oversight around critical-to-quality factors. Monitoring plans, vendor governance, protocol deviation management, TMF expectations, and escalation pathways should all map back to what most affects participant protection and data reliability, rather than to exhaustive legacy checklists. That is the operating logic E6(R3) expects, and it is the same logic the ACT EU workshop repeatedly reinforced.

The third priority is to re-underwrite the sponsor’s control of data and service-provider governance. If external platforms, home-health vendors, laboratories, imaging providers, or site-facing technologies materially influence trial quality, the sponsor should be able to show why those systems are fit for purpose, how responsibilities are documented, how oversight is executed, and how data review and escalation function in practice. That is where E6(R3) moves from policy language to inspection reality.

February 2025 made the next phase of GCP reform unmistakable. January gave the industry the revised text. February showed how Europe expects that text to be operationalized: through proportionate oversight, tighter sponsor control, fit-for-purpose systems, stronger data governance, and protocols designed around what truly matters. For sponsor quality leaders, that is the real lesson from ACT EU. E6(R3) implementation is not a documentation exercise. It is an operating model decision.