Regulatory landscape
The norms the core is designed for
Requirements for computerized systems in EAEU clinical trials — and the Anglo-Saxon canon at the same time. One core, no regional editions.
EAEU
EAEU Rules of Good Clinical Practice
EEC Council Decision No. 79 of 03.11.2016; the current edition (Decision No. 63 of 01.08.2025) entered into force on 10.03.2026 and is aligned with ICH E6(R2). It is the edition that first brought into Union law: validation of computerized systems (cl. 1.4), the ALCOA requirement for source data (cl. 4.9.0), data integrity across software updates and migrations (cl. 5.5.3), and the ban on the sponsor's exclusive control over site data (cl. 8.1).
EAEU GMP Rules, Annex No. 11 “Computerised systems”
EEC Council Decision No. 77 of 03.11.2016 (as amended 04.07.2023): audit trail, electronic signatures inseparably linked to the record and carrying date and time, access control, incident management, backups and continuity, archiving, double entry of critical data.
Norm → core mechanism
| Norm | Core mechanism |
|---|---|
| EAEU GCP cl. 1.4 — validation of computerized systems | Traceability matrix “invariant → test”, change control, signed attestation of the revision |
| EAEU GCP cl. 4.9.0 — ALCOA | Attribution, moment of entry stored separately from event time, immutability, reason for change, canonical data types |
| EAEU GCP cl. 5.5.3 — requirements for the electronic system | Audit trail, access segregation, backups, integrity across updates, expanding migrations only |
| EAEU GCP cl. 8.1 — investigator's control over the data | Site data is never deleted or taken away by the sponsor; access is computed from policies, not from a “superuser” role |
| EAEU GMP Annex 11 cl. 9 — audit trail | Unconditional, with no risk grading |
| EAEU GMP Annex 11 cl. 14 — electronic signatures | Re-authentication, scope, snapshot hash, date and time, auto-invalidation |
An honest caveat: EAEU norms contain no rules on time zones or clock synchronisation. Storing time in UTC with the site's time zone as a property of presentation is our engineering decision, not a quotation of a norm.
The Anglo-Saxon canon
21 CFR Part 11
Electronic records and electronic signatures. The core's scheme — re-authentication on every signature, an inseparable link between signature and record, an unconditional audit trail — is designed for its requirements too.
EU GMP Annex 11 · ICH E6
We design to ICH E6(R3) as the superset of requirements; the relaxations of R3 cannot be used within the EAEU — and we do not use them.
ALCOA++
Data-integrity principles — from attribution and contemporaneous recording to endurance; the core's audit trail and record model are built around them.
CDISC
The data model is aligned with ODM and Dataset-JSON, with SDTM and CDASH in view.
Inspection readiness
What the system can show an inspector:
- the full history of a specific field — who, when, what it was, what it became, why;
- the gap between the event time and the time of entry;
- read audit where reading is itself a risk;
- the unblinding log;
- the meaning and scope of every signature;
- the state of locks;
- an “as of date” export.
How it works — in the documentation: Audit trailElectronic signaturesInspection packet
We will walk you through the product on a demo study and answer your questions.
Request a demo