GCP has a version number, and the certificate in your file names one. Written for anyone who has just done Good Clinical Practice training and assumed it was a fixed thing.

In this file:

·        Why ICH is not a regulator, and how its guidelines govern anyway

·        Every version of E6 and the date it landed

·        What R2 and R3 each actually changed

·        Why the version you were trained on is already scheduled to be replaced

Marcus finished his GCP training on a Tuesday afternoon, printed the certificate, and put it in the binder Nani keeps for the site's training records. It has his name on it, the date, and a version number in small type near the bottom.

Nobody in the room mentioned the version number. Nobody ever does. It sits on tens of thousands of certificates in tens of thousands of binders, and it’s one of the most informative things on the page.

For most of its life, Good Clinical Practice (GCP) was taught as though it were weather. A permanent condition. You take the course, you get the certificate, you learn the phrase "ICH GCP" and you say it in interviews.

Then the ground moves and nobody sends a notice to the people standing on it. A guideline written when a clinical trial was, in the guideline's own words, "a largely paper-based process" was still the working text in an industry running electronic data capture, central statistical monitoring and remote source review. Sites were trained against one version while sponsors wrote SOPs against another. That gap is not a scandal. It’s just what happens when the thing everyone calls a standard has releases, and almost nobody is told which release they are holding.

Start with the sentence that reframes everything.

The International Council for Harmonisation is not a regulatory agency. It cannot inspect you. It cannot approve or reject a marketing application. It has no enforcement power at all. It was reformed as a non-profit legal entity under Swiss law and formally established as a Council on 23 October 2015, after 25 years as the International Conference on Harmonisation.

So why does everyone behave as though its guidelines are law?

Three mechanisms, and a newcomer who can name them is ahead of most people with 10 years in the field.

Regional adoption. An ICH guideline becomes enforceable only when a regulator adopts it as its own. Health Canada states that once implemented, ICH guidelines become official Health Canada guidance documents. EMA implements finalized ICH guidelines as European guidelines. FDA issues them as FDA guidance.

A hard hook in US regulation. This is the one to show a newcomer. Under 21 CFR 312.120(a), FDA will accept a foreign clinical study not conducted under an IND only if the study "was conducted in accordance with good clinical practice (GCP)," and the regulation then defines GCP in its own text, including review by an independent ethics committee and documented, freely given informed consent. GCP itself is not law. "Conducted in accordance with GCP" is written into law as a condition of whether your data counts.

Market access. Ignore an ICH guideline and nobody fines you. Your data is simply not usable in the 3 largest markets at once, which is a worse outcome than a fine.

From the cover history of the guideline itself.

·        E6, ICH Step 4 on 1 May 1996

·        E6(R1), Step 4 on 10 June 1996

·        E6(R2), Step 4 on 9 November 2016

·        E6(R3) Principles and Annex 1, Step 4 on 6 January 2025

·        E6(R3) Annex 2, Step 4 on 3 June 2026

Regional dates run behind those. E6(R3) took EU legal effect on 23 July 2025. FDA issued E6(R3) as final guidance in September 2025. Annex 2 has an EU effective date of 15 January 2027.

R2 was an addendum, and it was an admission.

The guideline's own introduction says that since the original text "the scale, complexity, and cost of clinical trials have increased," that E6(R1) assumed "a largely paper-based process," and that advances in electronic data recording and reporting "facilitate implementation of other approaches."

What it added, concretely: risk-based quality management. Sponsors identify the critical processes and data, evaluate the risks, apply proportionate controls, set predefined quality tolerance limits, and review those controls periodically. Alongside that came strengthened sponsor oversight of delegated parties, validation expectations for computerized systems, and clearer rules on essential records and certified copies.

The plain reading: for 2 decades the industry verified everything equally and called it quality. R2 is the guideline conceding that checking everything is not the same as controlling risk.

R2 was an addendum bolted onto a 1996 document, and it read like one. R3 rebuilt the house.

E6(R3) restructures GCP into Principles plus annexes rather than one monolithic text. Annex 1 covers the IRB or independent ethics committee, the investigator, the sponsor, and, newly, data governance as a first class section with its own architecture rather than electronic-records language pinned onto a paper-shaped document. The emphasis throughout is risk proportionate conduct, quality by design, identification of critical to quality factors, flexibility across trial types, and the perspectives of interested parties including patients.

Quality by design is not an R3 invention. It arrived in ICH E8(R1), Step 4 on 6 October 2021, which states that quality by design "sets out to ensure that the quality of a study is driven proactively by designing quality into the study protocol and processes." E8(R1) is the conceptual parent of E6(R3), and the lesson underneath both is the same: you cannot monitor your way out of a badly designed protocol.

Change Control. Current: ICH E6(R3), Principles and Annex 1, ICH Step 4 on 6 January 2025, EU effective 23 July 2025, issued by FDA as final guidance in September 2025. Supersedes: E6(R2) of 9 November 2016. Next: E6(R3) Annex 2, ICH Step 4 on 3 June 2026, EU effective 15 January 2027. An FDA adoption date for Annex 2 was not found in preparing this issue, so treat the US position on Annex 2 as unconfirmed rather than assuming it matches Europe.

Three things, and the third is the reason this series exists.

Harmonized does not mean simultaneous. E6(R3) reached ICH Step 4 on 6 January 2025, took EU legal effect on 23 July 2025, and was issued by FDA in September 2025. Annex 2 reached Step 4 on 3 June 2026 and does not take effect in the EU until 15 January 2027. A sponsor running a global trial therefore operates under different in-force versions in different regions for months at a time, by design, not by failure.

Guidance is still not binding. Every FDA guidance document carries non-binding recommendations. The binding hooks are the regulations, 21 CFR Parts 11, 50, 56 and 312, and 45 CFR Part 46. Those move far more slowly than the guidelines that get taught as though they were the rules.

Annex 2 has no track record. It was adopted 3 months before this issue was written. Anyone telling you it solves decentralized trials is making a claim about a document, not about evidence.

Note to File. The version number on your GCP certificate is not decoration and it is not a formality. It tells a reader which text you were taught against, which means it tells them what you may not have been taught. Look at yours. If it names R2, you were trained against a guideline that has been superseded since January 2025. That does not invalidate the training and it is not your fault. It is simply a fact with a date on it, which is the only kind of fact worth carrying into an interview.

Three concrete things, and they take about 10 minutes total.

Read your own certificate. Find the version. If it does not name one, that is worth knowing too, and it is a fair question to put to whoever provided the training.

Work out which version your site's SOPs were written against. Look at the revision date on the SOP, not the print date on the copy in the binder. An SOP last revised in 2019 was written against R2, whatever the training deck says.

Have the interview answer ready. "R3 restructured GCP around principles and data governance, and Annex 2 lands in Europe in January 2027" is 2 sentences, it is checkable, and it marks you as someone who reads primary sources rather than someone who repeats a phrase from a slide. Very few candidates can say it.

Good Clinical Practice has a version number. ICH E6 has moved from the 1996 original through R1 in June 1996, R2 in November 2016, and R3's Principles and Annex 1 at ICH Step 4 on 6 January 2025, with Annex 2 adopted 3 June 2026 and taking EU effect on 15 January 2027. ICH is not a regulator, so none of that is law by itself. It governs because regulators adopt it and because 21 CFR 312.120(a) makes conducting a study in accordance with GCP a condition of FDA accepting the data. The practical consequence for anyone entering the field is simple. The standard you are being trained on is a release, that release has a date, and the next one is already scheduled.

Good Clinical Practice has a version number. It went to R3 in January 2025, and Annex 2 lands in Europe in January 2027. If your training deck does not say which version it teaches, that is worth asking about.

·        Previous in the site file: Issue 12, answering a data query

·        Next in the site file: Issue 14, what counts as a protocol deviation

·        The whole file: roottorx.com/t/open-site-file

·        The dated log this series feeds: Version History

·        Root to Rx: the newsletter and The Root Room, the patient facing side of the same story, at roottorx.com

·        ICH E6(R3) Good Clinical Practice, FDA guidance for industry

·        ICH E6(R2) Good Clinical Practice, integrated addendum, including the version history table and introduction

·        ICH E8(R1) General Considerations for Clinical Studies

·        21 CFR 312.120 — Foreign clinical studies not conducted under an IND (eCFR)

·        EMA — ICH E6 Good Clinical Practice, regional implementation dates

·        ICH — About the Council, legal status and history

•  •  •

The Open Site File is general education about how clinical research sites work. It is not regulatory, legal, or medical advice, and it is not tied to any specific study, sponsor, or employer. Study OLS-114 and all names are invented. Always follow your own site's SOPs, your protocol, and your PI and QA team. Characters are composites.

Filed by Justin Yamashita, MSc., Open Label Media

Next in the file: Issue 14, the visit that happened two days outside the window, and what the site did about it.