ICH E6(R3) Annex 2: What Changes for Your Trials on 15 January 2027

ICH E6(R3) Annex 2 adds Good Clinical Practice rules specific to trials that include decentralised elements, pragmatic elements or real-world data. ICH adopted it on 3 June 2026, the CHMP on 25 June 2026, and the EMA sets its EU effective date at 15 January 2027.

Does your next protocol plan a home visit, a consent signed over video, or a control arm drawn from a registry? From 15 January 2027, the ethics committee and the inspector will read it with this text in hand. You have under four months to update your protocols, your information sheets and your agreements with data holders, and to check what your collection system records.

What is ICH E6(R3) Annex 2 and when does it apply?

ICH E6(R3) Annex 2 is a Good Clinical Practice supplement devoted to interventional trials described as non-traditional. It replaces neither the Principles nor Annex 1, in force in the EU since 23 July 2025. It sets out how to apply them when your trial moves outside the investigator's site, builds on routine care, or reuses data collected outside the trial.

| Step | Date |

| Version released for public consultation by ICH | 6 November 2024 |

| ICH adoption (Step 4) | 3 June 2026 |

| Final CHMP adoption | 25 June 2026 |

| EU effective date | 15 January 2027 |

These dates appear on the EMA document (reference EMA/CHMP/ICH/495903/2024, dated 13 July 2026). Until 15 January 2027 the Principles and Annex 1 remain the reference text, and Annex 2 does not apply yet. ICH also states that the Annex should not be read as an endorsement of any specific methodologies: it frames the methods you choose. The other ICH regions set their own timetables, so check the one that applies in each country of your trial.

Which trials fall within the scope of Annex 2?

Annex 2 covers any interventional trial that includes at least one of three methods: decentralised elements, pragmatic elements or real-world data. One trial can combine several. Academic trials fall within it as soon as they build on routine care or on the hospital record.

• Decentralised elements: activities carried out away from the investigator's site, at the participant's home, in a local health centre or a mobile unit, plus video visits and digital health technologies (apps, connected devices, sensors).
• Pragmatic elements: activities that build on routine care, with eligibility criteria close to practice and collection reduced to what the question needs, at the pace of ordinary consultations or through an export of the electronic health record.
• Real-world data: health data collected outside the trial, in patient records, registries or reimbursement databases, then used as an endpoint or as an external control.

A university hospital that compares two care strategies already in use, and records events in the hospital file, combines pragmatic elements and real-world data. A sponsor that ships treatment to the home and follows patients through remote visits relies on decentralised elements. If you are still weighing the format of your study, start by comparing decentralised and hybrid trial models.

What do you have to describe in the protocol?

The protocol has to describe each method used and justify it: how it answers the question asked, and why it can work at your sites. Annex 2 adds four points to cover in the protocol or its related documents, from the variability of data sources to the chain that carries safety information to the investigator.

• Routine care procedures: who performs them, how, and in which circumstances, when health professionals outside the trial team take part (section 3.2.2).
• Variability of sources: its effect on the results, discussed in the protocol or in the statistical analysis plan (section 3.2.3).
• The safety chain: how you collect information through a remote visit or a connected device, how a signal reaches the investigator in time, and what action follows (section 3.2.5).
• Consent arrangements, remote or on site (section 3.2.6).

The safety chain calls for the most preparation when you use connected devices. A watch that records heart rate every minute produces more data than any investigator can read. The Annex asks that the information reach them in a form that lets them decide on the participant's care (section 3.9.1). Set the thresholds that trigger an alert in the protocol, and name the person who receives it.

How do you obtain remote consent under Annex 2?

You can obtain informed consent remotely where appropriate and where local regulation allows it. Section 2.2 asks you to verify the participant's identity through a method described in advance, and to state in the information sheet which data you collect and who accesses it. It also recommends offering paper or an on-site visit to anyone who prefers it, as far as possible.

The Annex gives one example of identity verification: checking an official document during a video call. The method and the confidentiality measures have to appear in your documents before the first enrolment. The information sheet also has to name the personal data third parties will access, such as the home address when a nurse travels there or when treatment is delivered. For the reuse of real-world data, section 3.4.2 refers to local rules: depending on the region, the sponsor can rely on broad consent obtained earlier or on an ethics committee authorisation, without obtaining new consent for the trial. Our guide on how to collect electronic informed consent sets out the method step by step.

Real-world data: what do you have to prove?

You have to prove that the real-world data are fit for the intended purpose: reliable, meaning accurate, complete, of known origin and traceable, and relevant, meaning they carry the exposure, the endpoints and the covariates your question needs. The more a data point weighs on the result, the more access you need to its source.

Section 3.4.1 scales the effort to criticality. When real-world data carry a primary efficacy or safety endpoint, assessing the source can fall short: you have to be able to check in the source document that an event took place. For an exploratory endpoint, an assessment of the holder's systems and processes can suffice, provided you justify it in the protocol. If the holder does not allow access to the sources, the Annex asks you to consult the competent authority.

A disease registry supplies you with an external control arm. Your agreement with it has to provide, before signature, that your quality team and the inspector can trace one row of the dataset back to the original record. If you link that registry with another database, the protocol has to explain how you match patients and how you settle a discrepancy between the two (section 3.5.1). When a service provider performs the extraction, you remain responsible for oversight of the extraction, the linkage and the transformation (section 3.4.1). Our article on choosing patient registry software covers the criteria for the registry's own collection tool.

Which questions should you put to your EDC vendor before 15 January 2027?

Your collection system has to answer three Annex 2 requirements: traceability of imported data, delivery of safety information to the investigator, and proof of consent. Put these five questions to your vendor before you freeze the protocol of your first trial submitted after that date.

| Question to ask | Annex 2 section |

| Does the system record the origin of every data point: site entry, patient questionnaire, connected device, hospital record import? | 3.5.1 |

| Does an API import leave a trace in the audit trail, with its date, its origin and the data concerned? | 3.4.1 and 3.5.1 |

| Does an out-of-range value recorded remotely trigger an alert the investigator sees? | 2.5 and 3.9.1 |

| Does the system keep the signed consent version, its modality and the identity verification method? | 2.2.1 and 3.2.6 |

| When a service provider works at the participant's home, does access to the address and the health data stay limited to authorised people? | 3.7 |

Ask for a written answer on each line and file it in your validation dossier. Our article on computerised system validation explains how to document each answer.

[[cta]]

How Datacapt handles trials covered by Annex 2

On the Datacapt platform, the eCRF, ePRO, eConsent, randomisation and trial supply share one database. Your participants sign their electronic consent remotely, with identity verification, timestamping and an electronic signature under the eIDAS regulation. You manage versions by country and by site, and you publish a new version when a substantial protocol amendment calls for consent to be obtained again. Each participant has secure access to their own copy of the consent, signed by both parties, and can withdraw consent at any time. For decentralised and hybrid trials, remote visits and follow-up feed the eCRF, and treatment delivered to the home keeps its traceability. With the eConsult module, the investigator runs the visit over video and fills in the eCRF during the exchange; that video call is neither recorded nor written to the audit trail. The REST API, with role-based access control and logging, receives data from other systems, and a test environment lets you validate an integration before production.

From 15 January 2027, decentralised and pragmatic trials and trials fed by real-world data will share one reference text across the EU. Until then, take the protocol of your next affected trial and check that it justifies each method and describes how safety alerts reach the investigator. Write an information sheet that states clearly who accesses which data. Have every agreement with a data holder grant your quality team and the inspector access to the source documents.

Frequently asked questions

[[faq]]