The norms the core is designed for
Requirements for computerized systems in EAEU clinical trials — and the Anglo-Saxon canon at the same time. One core, no regional editions.
EAEU
EAEU Rules of Good Clinical Practice
EEC Council Decision No. 79 of 03.11.2016; the current edition (Decision No. 63 of 01.08.2025) entered into force on 10.03.2026 and is aligned with ICH E6(R2). It is the edition that first brought into Union law: validation of computerized systems, the ALCOA requirement for source data, data integrity across software updates and migrations, and the ban on the sponsor's exclusive control over site data.
EAEU GMP Rules, Annex No. 11 “Computerised systems”
EEC Council Decision No. 77 of 03.11.2016 (as amended 04.07.2023): audit trail, electronic signatures inseparably linked to the record and carrying date and time, access control, incident management, backups and continuity, archiving, double entry of critical data.
Norm → core mechanism
| Requirement | Mechanism | Evidence |
|---|---|---|
| EAEU GCP — validation of computerized systems | Traceability matrix “requirement → test”, change control, signed attestation of the revision | URS-27 · RTM |
| EAEU GCP — ALCOA | Attribution, moment of entry stored separately from event time, immutability, reason for change, canonical data types | URS-01 · URS-02 · URS-12 · URS-32 |
| EAEU GCP — requirements for the electronic system | Audit trail, access segregation, backups, integrity across updates, expanding migrations only | URS-01 · URS-06 · URS-25 · URS-27 |
| EAEU GCP — investigator's control over the data | Site data is never deleted — not even by the sponsor; access is computed from policies, not from a “superuser” role. Contractual assurance of the site's rights to its data remains the operator's responsibility: the platform imposes no technical bar on revoking a site's access | URS-08 · URS-36 |
| EAEU GMP Annex 11 cl. 9 — audit trail | Unconditional, with no risk grading | URS-01 · URS-02 |
| EAEU GMP Annex 11 cl. 14 — electronic signatures | Re-authentication, scope, snapshot hash, date and time, auto-invalidation | URS-03 · URS-04 |
URS is a requirement from the vendor catalogue. The automated tests for each requirement are listed in the traceability matrix (RTM), which ships in the per-release vendor package.
An honest caveat: EAEU norms contain no rules on time zones or clock synchronisation. Storing time in UTC with the site's time zone as a property of presentation is our engineering decision, not a quotation of a norm.
The Anglo-Saxon canon
21 CFR Part 11
Electronic records and electronic signatures. The core's scheme — re-authentication on every signature, an inseparable link between signature and record, an unconditional audit trail — is designed for its requirements too.
EU GMP Annex 11 · ICH E6
Our design reference is ICH E6(R3) as the superset of requirements; the relaxations of R3 cannot be used within the EAEU — and we do not use them. A clause-by-clause traceability of requirements is provided on request as part of a validation project.
ALCOA++
Data-integrity principles — from attribution and contemporaneous recording to endurance; the core's audit trail and record model are built around them.
CDISC
The data model is aligned with ODM and Dataset-JSON, with SDTM and CDASH in view.
Inspection readiness
What the system can show an inspector:
- the full history of a specific field — who, when, what it was, what it became, why;
- the gap between the visit date and the moment a value was entered;
- read audit where reading is itself a risk;
- the unblinding log;
- the meaning and scope of every signature;
- the state of locks;
- an “as of date” export.
How it works — in the documentation:
See also
See the system on your own scenario
We walk through the full cycle on a demo study and answer your validation and hosting questions.