EMA clarifies Computer Validation and Data Integrity responsibilities in Clinical Trials

The European Medicines Agency (EMA) has published a notice for sponsors of clinical trials (CTs) to highlight the requirements for the qualification and validation of computer systems used for managing CT data. This is based on recent inspection findings and takes into account implications on the integrity, reliability, robustness and acceptability of data. In line with this notice, the EMA has also updated questions 8 and 9 on EMA´s GCP Q&A website, which provide further guidance on computerised systems.

GCP responsibilities regarding Qualification and Validation of Computer Systems & Data Integrity

In clinical trials (CTs), large amounts of data are collected and this data is electronically recorded and processed to a growing extent. Checking Data Integrity (DI) is mandatory and is usually performed by the clinical monitor, who, in the past, preferentially reviewed only the documentation, but not the history of data entries. In addition, sponsors contract out an increasing number of tasks in CTs. During inspections of clinical trials, a growing number of deviations from GCP standards related to contractual arrangements with vendors of electronic systems and related procedures have been identified by the GCP inspectors.
In order to clarify these issues, the EMA has recently published a "Notice to sponsors on validation and qualification of computerised systems used in clinical trials". In this Notice, the EMA clearly states:

• The sponsor is ultimately responsible for the validation of the computer system and for providing adequate documented evidence on the validation process,
• Failure to document the validated state of a computer system is likely to pose a risk to Data Integrity,
• It is not acceptable to use computer systems in CTs for which the validation status is not confirmed or for which appropriate documentation on validation cannot be made available to GCP inspectors (for example during GCP inspections).

In addition the Q&As 8 and 9 on EMA´s GCP Q&A website have been updated on the basis of recent GCP inspection findings.

Q&A 8 - Qualification and Validation of Computer Systems used in CTs

Sponsors should contractually ensure

• that sponsor pre-qualification audits can take place. These audits should include an in-depth review of the vendor qualification documentation,
• that GCP inspections can take place at the vendor in case the vendor is performing services for the sponsor,
• that any qualification documentation prepared by the vendor in relation to the computer system is available for GCP inspection,
• that the sponsor has access to the vendor’s system requirement specifications,
• that the vendor escalates any potential serious breaches to the sponsor in a timely manner, including security breaches.

Q&A 9 - What can be done in Case Documentation of Qualification Activities and Access for Inspectors is not ensured contractually?

The sponsor should make sure that the vendor qualification documentation is readily available for GCP inspection. Failure to provide access to the documentation is likely to result in critical findings. A sponsor should amend any contract with vendors to ensure availability of qualification documentation. If a vendor is not willing to amend the contract, the sponsor is responsible to demonstrate that the system is validated and qualified (based on documentation provided by the vendor) or for requalification of the system.

Requalification by the Sponsor:

• In case the trial is ongoing, this should be done without delay. If the trial is completed, this should be undertaken prior to the submission of the Marketing Authorization Application.
• A documented Risk Assessment is required to assess integrity risks to data captured and held by a computer system that was not in a confirmed qualified / validated state following the retrospective qualification / validation activity.
• Depending on the outcome of the requalification, the sponsor may need to change to a new vendor / system. The required migration of previously captured CT data should be validated.

More information can be found online in EMA´s GCP (Good Clinical Practice) Q&As.