The new EAEU GCP Rules — what they mean for an EDC
Since 10 March 2026 a revision aligned with ICH E6(R2) applies. For the first time, Union rules require validation of computerised systems and ALCOA for source data.
- 03.11.2016EEC Council Decision No. 79 — EAEU GCP Rules
- 01.08.2025Decision No. 63 — the new revision
- 10.03.2026The revision enters into force
The essentials
What changed
EEC Council Decision No. 79 as revised by Decision No. 63: validation of computerised systems, ALCOA for source data, integrity across software updates and migration, no exclusive sponsor control over site data.
What it means for an EDC
The system must demonstrably keep an audit trail, separate access, preserve integrity across updates and not give the sponsor sole control over a site’s data.
What stays with the customer
Validation for their own processes, SOPs, training and access management. The vendor provides a validation package for every release.
Requirement → mechanism → evidence
| Requirement | Mechanism | Evidence |
|---|---|---|
| Validation of computerised systems | Requirement catalogue and traceability to tests; a release only after gates and a signed test run | URS-27 · RTM |
| ALCOA for source data | Author, role and organisation; entry time apart from the event; before/after and reason; UTC time | URS-01 · URS-02 · URS-12 · URS-32 |
| Integrity across software updates | The schema only expands, models match migrations; destructive changes to clinical tables are forbidden | URS-27 |
| Investigator control over the data | Nobody deletes site data; a copy of a site’s data at any moment, without a lock | URS-08 · URS-36 |
URS is a requirement from the vendor catalogue. The automated tests for each requirement are listed in the traceability matrix (RTM), which ships in the per-release vendor package.
Questions
Related regulations
How to set it up — in the documentation
Does this mean the system “complies with the Rules”?
Compliance of a study is confirmed by the customer, including by validating the system for their processes. We say “designed for the requirements” and show the mechanisms.
Do you rely on ICH E6(R3) relaxations?
No. The design reference is R3 as a superset of requirements, but R3 relaxations cannot be used within the EAEU.
See also
See the system on your own scenario
We walk through the full cycle on a demo study and answer your validation and hosting questions.