Understanding Annex 2 and Updates

In an earlier post, we looked at how ICH E6(R3) is pushing Good Clinical Practice from being prescriptive and site-based to being a flexible, risk-based framework built around Quality by Design. At the time, the guideline explicitly supported decentralized models but detailed guidance for those methods was still to come; that update has now been published. On June 3, 2026, the ICH Assembly adopted Annex 2 at Step 4, and consolidated E6(R3) into a single unified guideline. This is the piece of guidance that gives sponsors a harmonized reference for how GCP applies when trial activities happen outside the investigator’s site and how to treat trial data coming from different sources.

Where Annex 2 Fits

Annex 2 is not a standalone document and should be read alongside the rest of E6(R3), extending the proportionate, risk-based logic to non-traditional methods. ICH is making it available separately only until the end of 2026, after which the consolidated guideline will be the only reference. It is also deliberately not a checklist of approved technologies. The guidance states that trial ecosystems will keep evolving and is written to apply to future methods too, so it functions as a way of thinking about risk and oversight.

It addresses three methodologies, and a single trial may use one, two, or all three:

• Decentralized elements — activities conducted outside the investigator’s location: home or local-clinic visits, mobile medical units, video visits, direct-to-participant drug shipment, and digital health technologies (DHTs) such as wearables and apps.
• Pragmatic elements — designs that integrate usual clinical practice, with eligibility criteria and procedures that mirror routine care, streamlined data capture, and automated export from EHRs.
• Real-world data (RWD) — health data collected outside the trial and used in it, from electronic health records (EHRs), disease registries, claims and mortality databases, etc.

Updates in Annex 2

Remote informed consent. Where permitted, consent can now be obtained remotely, with participant identity verified by methods such as an official document check over video, and/or methods and privacy safeguards pre-specified in the trial protocol. Participants who prefer a paper or in-person process must be offered that option where feasible. When deploying home devices and DHTs, consent materials must describe exactly what data they will collect, who accesses it, and how it is used.

Off-site investigational products. Investigational products can be shipped directly to a participant’s home and administered by the participant, a caregiver, a home nurse, or a local pharmacist. The sponsor must ensure that the investigator authorizes any shipment before it happens with responsible roles being documented, protecting blinding during the shipping process, and proving participants access to support when needed. A keynote here is that the investigator remains responsible for safe and appropriate use of the product.

Proportionate oversight. Annex 2 states that oversight can range from direct real-time supervision down to only reviewing essential records; however this is dependent on the activity, the criticality of the data, and the risk to participants. In pragmatic trials, healthcare professionals who haven’t been trained on the trial protocol may perform trial-related activities, as long as those activities are a part of routine clinical care.

Multi-source safety data. Safety information may be collected from home nursing, DHT alerts, remote visits, and EHRs. These data should be brought together and presented to the investigator in a form that is relevant, meaningful, and manageable.

A GCP Framework for RWD

A large portion of the update contains the RWD framework, which provides guidance on incorporating EHR, registry, or claims data into an interventional trial. It allows for data based on their fitness-for-purpose and proportionality. In certain cases, such as when RWD underpins a primary efficacy or safety endpoint, the sponsor must have access to individual-level source data for quality assurance and quality control; this access should be documented in written agreements with the entities that own the data, along with access for regulatory inspection.

DHTs get similar treatment, since Annex 2 defines wearables, apps, and sensors as data acquisition tools, which means the same fitness-for-purpose and validation expectations apply. An additional consideration for DHT is early patient involvement in DHT selection to ensure digital-literacy and remove access barriers.

What This Means for ACE Users

Remote consent and off-site documentation. The new consent and direct-to-participant requirements will generate records that must be version-controlled and attributable, from pre-specified verification methods to shipment authorizations. ACE Docs holds documents under version control with role-based access and 21 CFR Part 11–compliant audit trails, so that the most recent copy of each document is always available. Plus, ACE Sign enables trial participants and team members to remotely sign off on documentation, ensuing that each consent and approval is traceable.

RWD provenance and source-record access. As we covered in our look at the FDA’s Advancing RWE Program, data governance has effectively become a submission attribute, and the same controls that make RWD acceptable, such as provable provenance, audit-trail and raw-data review, access controls, and Quality Unit oversight, are key provisions in an eQMS. Furthermore, ACE embeds those reviews into workflows rather than relying on manual execution and supports integration with other systems.

Inspection readiness. Inspectors applying E6(R3) will expect documented, risk-proportionate oversight of every decentralized, pragmatic, and RWD element. Because ACE keeps the protocol, risk assessments, vendor records, and other trial documentation connected and traceable, a sponsor can easily present audit-ready records to inspectors when requested.

Practical Steps

ICH E6(R3) Annex 2 is a part of the regulatory framework catching up to modern clinical research, where participants may never enter a hospital and wearable tech generates more data in a day than a site visit ever did.

The initial preparation work for Annex 2 follows directly from their outlined requirements:

1. If decentralized, pragmatic, and RWD elements are used trials, they should each be risk assessed and operated accordingly.
2. Update SOPs for remote consent and chain of custody requirements to ship investigational products to patients.
3. Ensure that the RWD used meets fitness-for-purpose criteria.

Teams already running ACE and ACE Clinical have a head start, because the configurable workflows, connected records, and audit-ready documentation those steps depend on are already in place; the task becomes configuring them to the new methodologies rather than building from scratch.