EAEU GCP inspections classify data manipulation and missing source documentation as critical non-conformities
The Rules of Good Clinical Practice of the Eurasian Economic Union (EAEU) were approved by Decision of the Council of the Eurasian Economic Commission (EEC) of 3 November 2016 No. 79 (hereinafter the GCP Rules). As amended by Decision of the EEC Council of 1 August 2025 No. 63 (hereinafter Decision No. 63), they oblige the sponsor to maintain a quality management system (it includes the design of rational protocols and of tools and procedures for collecting and processing data) at all stages of a clinical trial (CT) and to base it on risk assessment. The new edition applies from 10 March 2026.
The data quality requirements in the GCP Rules fall into four groups: the quality management system, the properties of source data and the procedure for correcting them, requirements for electronic systems, and data checks during monitoring.
An inspector checks the quality, integrity and credibility of CT data under the Rules for Conducting Pharmaceutical Inspections for Compliance with the Requirements of the GCP Rules (they form part of Decision of the EEC Council of 3 November 2016 No. 83, hereinafter the GCP Inspection Rules). The GCP Inspection Rules classify data manipulation, intentional distortion of data and the absence of source documentation as critical non-conformities.
What changed in the data requirements on 10 March 2026
The GCP Rules must be followed in any studies of medicinal products whose data are submitted to the authorized bodies (expert organizations) of EAEU member states. The Federal Law «On the Circulation of Medicines» (hereinafter 61-FZ) provides that clinical trials of medicinal products in Russia are conducted under the GCP rules approved by the EEC.
Decision No. 63 restated the GCP Rules in a new edition. It was published on 11 September 2025 and entered into force after 180 calendar days from the date of official publication, that is, on 10 March 2026. The previous edition applied through 9 March 2026 inclusive. There are no transitional provisions either in Decision No. 63 or in the text of the GCP Rules.
Under the Statute of the Eurasian Economic Commission (hereinafter the EEC Statute), decisions of the Commission that worsen the position of natural and legal persons have no retroactive effect. The EEC Statute is part of the Treaty on the Eurasian Economic Union. Decisions that improve the position may have retroactive effect if they expressly provide for it. Decision No. 63 contains no provision on retroactive effect. Decision No. 63 and the GCP Rules do not determine which edition of the GCP Rules applies to a trial that started before 10 March 2026 and continues after that date. The GCP Inspection Rules also do not name the edition of the GCP Rules by which the inspector assesses compliance.
Table 1 shows what changed in the requirements for data and for checking them compared with the previous edition of the GCP Rules.
Table 1. What changed in the GCP Rules on data quality
| Parameter | Previously (GCP Rules before Decision No. 63) | Now (GCP Rules as amended by Decision No. 63) |
|---|---|---|
| Basis of the Rules | ICH GCP E6 (R1) guideline, version 4, of the International Conference on Harmonisation | ICH GCP E6 (R2) guideline of the International Council for Harmonisation |
| Quality management | There was no separate section on quality management. The sponsor was responsible for quality assurance and quality control systems with standard operating procedures (SOPs) | A separate section on quality management was added: a quality management system based on a risk-oriented approach, in seven steps |
| Recording and storage of information | CT information is recorded, transferred and stored so as to ensure the accuracy and correctness of its presentation, interpretation and verification | A paragraph was added to this principle: it applies to all records provided for by the GCP Rules, regardless of the type of medium |
| Source data | There was no separate provision on the properties of source data | Source data must be legible, original, accurate and complete and must be recorded as observations are made, so that they can be attributed; changes must be traceable |
| Electronic systems | There were seven requirements. SOPs and validation were described without detail | There are eight requirements: the validation approach is based on risk assessment, SOPs have a list of required content, and a requirement on data integrity was added |
| Definitions | There were no definitions of validation of computerized systems or of a certified copy | The definitions are given in the GCP Rules |
| Monitoring | The description of the scope and content of monitoring consisted of one paragraph on site visits and statistical sampling. The monitor’s report was drawn up after each visit or contact | The general rule on visiting sites before, during and after the trial is kept. The approach to monitoring is based on an assessment of priorities and risks; the sponsor may choose on-site, combined or (if justified) only centralized monitoring and must document the justification for the chosen strategy. Centralized monitoring is defined, and the GCP Rules list five purposes for which the evaluation of collected data may be used. Reports on on-site and centralized monitoring are submitted to the sponsor, and the requirements for the monitoring plan are described |
| Non-compliance | Non-compliance was to lead to prompt action by the sponsor aimed at ensuring compliance | A paragraph was added: where non-compliance significantly affects, or may significantly affect, the protection of subjects or the credibility of results, the sponsor must conduct a cause analysis, identify the root cause and take corrective and preventive actions |
| Engaging contractors | The transfer of functions to a contract research organization (CRO) was documented. There were no separate provisions on the investigator’s oversight of persons to whom he delegated functions or on confirming the qualifications of the persons engaged | The sponsor oversees all functions performed on its behalf, including those that a CRO transferred to third parties under subcontracts. The investigator oversees the activities of persons to whom he delegated functions. If he uses the services of another person, he obtains documentary confirmation of that person’s qualifications and introduces procedures that ensure that the functions are performed in full and that data are intact |
How the sponsor manages data quality
The sponsor gives priority to activities that ensure the safety of trial subjects and the credibility of results. The methods of quality assurance and quality control must be proportionate to the risk and to the importance of the information collected. Quality control should be carried out at all stages of data handling to ensure that the data are credible and correctly processed.
To build a quality management system, the sponsor must work through seven steps in sequence:
1. Identify the processes and data that are significant for the protection of subjects and the credibility of results, already at the protocol design stage. The GCP Rules call such processes and data critical.
2. Identify the risks to these processes and data at the system level (SOPs, computerized systems, personnel) and at the level of the particular CT (design, data collection, obtaining informed consent).
3. Assess the risks against three features: the likelihood of an error, the possibility of detecting it, and its impact on the protection of subjects and the credibility of results.
4. Decide which risks to minimize and which to accept as tolerable. The measures are proportionate to the significance of the risk.
5. Document the quality management measures and communicate them to those whom they affect.
6. Periodically review the risk control measures and check that they remain effective.
In the CT report, describe the approach to quality management and summarize important deviations from predefined quality tolerance limits, as well as the measures taken.
To identify systemic problems that may affect the safety of subjects and the credibility of results, the sponsor should define in advance quality tolerance limits for the parameters of the trial (boundaries of acceptable values), taking into account the medical and statistical characteristics of the variables. Detecting deviations from these limits should lead to an assessment of whether measures are needed to correct them. The protocol, the case report forms (CRFs, the forms in which data on each subject are entered) and other documents must be clear, concise and internally consistent, and unnecessary procedures and the collection of excessive data should be avoided.
What properties source data must have and how it is corrected
The investigator (the medical organization) keeps source documents and records on the trial in which he reflects all data significant for the trial on each subject at the research center. Source data (information from original medical records and their certified copies) must be:
legible;
original;
accurate;
complete;
recorded as observations are made, so that they can be attributed (so that it can be established who entered them).
Changes to source data must be traceable, must not hide the data originally entered and, where necessary, are subject to explanation, for example by means of an audit trail. An audit trail is defined as documentation that allows the course of events to be reconstructed. The principle of accurate recording, transfer and storage of information applies to all records provided for by the GCP Rules, on any medium.
The investigator ensures that the data he provides to the sponsor in CRFs and reports are correct, complete, legible and timely. The CRF data must correspond to the source documentation, and discrepancies must be explained. Any correction in a CRF must be signed, dated and, where necessary, explained, and must not hide the original entry. This applies to paper and electronic media.
The sponsor gives the investigator an instruction on making corrections and must have written procedures under which corrections made by its authorized representatives are documented, are necessary and are approved by the investigator. The investigator keeps records of these corrections.
If data are transformed during processing, it must always be possible to compare the original data with the processed data. The sponsor must use a unique subject identification code that makes it possible to identify all data on each subject.
What the sponsor must ensure in electronic systems
If the sponsor uses electronic systems to handle data or to provide remote access to them, it meets the requirements of the GCP Rules listed in Table 2. If electronic systems are not used, these requirements do not apply. The requirements for records and corrections remain the same for paper and electronic media. Table 2 shows what was added to these requirements compared with the previous edition.
Table 2. Sponsor’s obligations when using electronic systems
| What the sponsor must do | What is new compared with the previous edition |
|---|---|
| Ensure and document that the systems meet the sponsor’s requirements for the completeness, accuracy and reliability of data and for consistent results (validation) | The validation approach is based on risk assessment, taking into account the purpose of the system and its impact on the protection of subjects and the credibility of results |
| Have SOPs on the use of the systems | The SOPs describe installation, setup and use, validation and testing, data collection and handling, maintenance, security, change control, backup and recovery, actions in emergencies and decommissioning of the systems. The responsibilities of the parties are clear to them, and users are trained |
| Ensure that data are changed in such a way that changes are documented, previously entered data are not deleted and an audit trail remains | The requirement was in the previous edition |
| Have a system that protects data against unauthorized access | The requirement was in the previous edition |
| Define the list of persons who are permitted to make changes to data, taking into account the rules on persons to whom the investigator assigns activities and the rules on corrections | The requirement was in the previous edition |
| Ensure adequate backup | The requirement was in the previous edition |
| Maintain blinding in blinded studies during data entry and processing | The requirement was in the previous edition |
| Ensure data integrity, including data on the context, content and structure of information, especially when software is updated and data are transferred | The requirement was added |
Validation of computerized systems is defined as the process of establishing and documenting that the user’s requirements for the system are continuously met from design to decommissioning of the system or transition to a new system. The validation approach must be based on risk assessment. A certified copy contains the same information, including data on context, content and structure, as the original record and is confirmed, for example, by a dated signature or by a validated process of creating the copy.
How data are checked during monitoring
Monitoring checks that the data submitted are accurate and complete and are supported by source documentation. The sponsor determines the scope and content of monitoring according to the objectives, tasks, methodology, complexity, blinding, size and endpoints of the trial. As a general rule, centers are visited before the trial, during it and after its completion.
There are three types of monitoring: on-site, combined (on-site together with centralized), and only centralized, which is permitted if justified. The type of monitoring is chosen on the basis of an assessment of priorities and risks. The justification for the chosen strategy must be documented, for example in the monitoring plan.
On-site monitoring is carried out at research centers. Centralized monitoring is a remote evaluation of the data being collected, performed in a timely manner by qualified and trained persons, for example data management specialists and biostatisticians.
Such an evaluation, which may include statistical analysis, may be used to:
identify missing and inconsistent data, outliers, unexpected lack of variability and deviations from the protocol;
check trends in the data, such as ranges, consistency and variability within and between centers;
detect systematic and significant errors in data collection and reporting, as well as potential data manipulation and data integrity problems;
analyze the characteristics and performance indicators of a center;
select centers and processes for targeted monitoring with site visits.
Centralized monitoring offers capabilities that can complement on-site monitoring and reduce its scope and (or) frequency. It also helps to distinguish reliable data from potentially unreliable data.
The monitoring plan is drawn up taking into account the risks specific to the protection of subjects and the integrity of data. It describes the monitoring strategy, the allocation of responsibilities between the parties, and the methods and their justification. The plan describes in detail the monitoring of critical data and processes and identifies aspects that are outside routine clinical practice and require additional staff training.
Reports on on-site and centralized monitoring are submitted promptly to the sponsor, including the management and staff responsible for the trial. The results of monitoring are documented in detail so that compliance with the plan can be verified. Reporting on centralized monitoring is regular and may be independent of monitoring visits.
What the sponsor does on non-compliance and how it answers for contractors
Non-compliance with the protocol, SOPs, the GCP Rules and applicable requirements by the investigator (the medical organization) or by a sponsor employee must lead to prompt action by the sponsor aimed at compliance with these requirements. If non-compliance significantly affects, or may significantly affect, the protection of subjects or the credibility of results, a cause analysis must be conducted, the root cause identified and corrective and preventive actions (CAPA) taken.
In serious or repeated cases of non-compliance by the investigator (the medical organization) found during monitoring or audit, the sponsor must end the participation of the investigator (the medical organization) in the trial and promptly notify the authorized bodies.
Functions may be transferred to a CRO, but responsibility for the quality and completeness of the data obtained remains with the sponsor. The CRO must carry out quality assurance and quality control measures. The transfer of functions is documented, and the performance of all functions on behalf of the sponsor, including those transferred by the CRO to third parties under subcontracts, remains under the sponsor’s oversight. Functions that have not been transferred to the CRO remain with the sponsor.
At the research center, the investigator oversees the activities of staff and other persons to whom he has delegated functions. If he uses the services of another person, he obtains documentary confirmation of that person’s qualifications and introduces procedures that ensure that the functions are performed in full and that the data obtained are intact.
How the inspector checks data and what follows violations
Under 61-FZ, inspection for compliance with the GCP rules approved by the EEC is within the powers of federal executive authorities. An inspection is conducted to determine whether the CT complies with the GCP Rules, including the reliability and credibility of the data. Inspections are conducted before the start, during and after completion of the CT, during review of the registration dossier and after registration of the medicinal product. Scheduled inspections are conducted under the inspectorate’s plan, including within 3 years from the date of registration of the medicinal product.
When the scope of documents to be submitted for inspection, including electronic ones, is determined, account is taken of the authorization to conduct the CT, the GCP Rules, the legislation of the member states and the list of mandatory documents. The forms of inspection are on-site, remote and documentary. By decision of the inspectorate, a remote inspection with audio or video communication is permitted in cases of an emergency, a threat of the spread of diseases, force majeure and following a risk assessment.
Inspectors may check documents, records, documentation on individual patients, quality assurance measures and trial data, obtain access to centers and to trial data, copy documents and photograph premises and equipment, and interview employees of the inspected entity and of other parties to the trial.
The sponsor is responsible for the consent of all parties involved to direct access to all source data, documents and reports for monitoring, audit and inspection. Direct access means permission to examine, analyze, verify and copy any records and reports needed to assess the CT. A refusal of access to records or systems or to the areas being inspected must be documented and included in the observations of the inspection.
The authorized bodies should not routinely request the reports of sponsor audits, but may request them where there is evidence of serious non-compliance with the GCP Rules or in the case of legal proceedings.
Table 3 shows which data-related elements the inspector checks at the research center and at the sponsor or CRO.
Table 3. What the inspector checks in CT data
| Object of the check | Where it is checked | What is checked |
|---|---|---|
| Source records and CRFs at the center | At the center | Organization, completeness and legibility of source records. Corrections in CRFs are signed and dated by an authorized person, contain a justification and comply with the acts of the Union and the legislation of the member states on data integrity |
| Efficacy and safety data | At the center | Correspondence of CRF data to source data, sufficiency of data management procedures, comparison of endpoint data with source documents, if this is justified by the scope of the inspection |
| Existence of subjects | At the center | The subjects existed and took part in the CT, their participation is recorded in their medical records, the subjects met the inclusion criteria |
| Document flow and computerized systems at the center | At the center | Dated and signed documents of subjects. Computers provided by the sponsor or forming part of the center’s equipment (medical records, online laboratory data, ECG recording) |
| Quality systems of the sponsor or CRO | At the sponsor or CRO | Facilities and equipment, with special attention to computerized systems: their validation status and sufficiency for the needs of the trial. Procedures for validating computerized systems |
| Monitoring | At the sponsor or CRO | The monitoring plan or SOP, frequency and scope, qualifications of monitors, visit reports and their review by the sponsor, centralized monitoring activities, corrective actions |
| CRF sample | At the sponsor or CRO | A number of CRFs determined in advance: compliance with the protocol, correctness, completeness, legibility and timeliness of data, identification of corrections, whether the dates of inclusion of the first and last patient match the dates of the start and completion of the trial and of delivery of the product |
| Data handling | At the sponsor or CRO | Tracing data from the CRF to the summary clinical database, validation of systems, data management, statistical analysis, quality control, a log recording the chronology of events for paper and computerized systems |
| Significant non-compliance | At the sponsor or CRO | Analysis and reporting of potential and actual serious violations, the log, justifications of decisions on each violation, results and CAPA plans |
The non-conformities found are divided into three types:
critical non-conformities adversely affect the quality, integrity and credibility of CT data or the rights, safety and well-being of subjects. They include, among others, unacceptable data quality, manipulation and intentional distortion of data, and the absence of source documentation. The GCP Inspection Rules call this type of non-conformity unacceptable;
major non-conformities are not critical but may adversely affect the quality and integrity or the quality and credibility of data, or the rights, safety and well-being of subjects;
minor (other) non-conformities do not affect the quality and integrity of data and do not adversely affect the rights, safety and well-being of subjects. A large number of such violations taken together may be classified as major.
Each non-conformity in an inspection report must contain a reference to the provisions of the acts of the Union whose violation has been established. The report should include an assessment of the effect of the non-conformities (if applicable) and an overall conclusion on whether the trial complies with the GCP Rules, and on the effect of the non-conformities found on data quality and on the results of the CT. For inspections related to registration or to completed trials, the report must conclude whether the quality of the data allows them to be used in assessing the application for registration. Where necessary, the report specifies the part of the CT whose data may be regarded as not credible. Observations that were not recorded during the inspection may not be used later to classify non-conformities.
The lead inspector draws up the report no later than 20 working days after the inspection is completed. The inspected entity sends its response to the report no later than 20 working days after receiving it. If critical and (or) major non-conformities are found, a CAPA plan and a report on its implementation, or data on the elimination of the non-conformities (if applicable), are attached to the response. For minor non-conformities, a CAPA plan is not submitted unless the report states otherwise. The inspection team evaluates the response no later than 15 working days after receiving it and gives recommendations on further action, including a conclusion on whether re-inspection is needed.
Under 61-FZ, if the federal executive authority that exercises the functions of control and supervision in healthcare finds violations of the GCP rules that affect the completeness and (or) credibility of the CT, it suspends the CT and issues the medical organization in which the CT is conducted an order to eliminate the violations. If the medical organization has not eliminated the violations by the deadline stated in the order, the authority decides to terminate the CT. The authority sends to the federal executive authority that exercises the functions of developing and implementing state policy and of legal regulation in healthcare an opinion for a decision on revoking the authorization to organize the conduct of the CT as of the date of the decision to suspend.
Violation of the GCP rules and falsification of CT results entail liability under the legislation of the Russian Federation. Neither the GCP Rules nor 61-FZ names specific provisions on liability.
A general provision of the Code of the Russian Federation on Administrative Offenses (hereinafter the CAO RF) sets, for failure to comply within the established time limit with a lawful order of a body exercising state supervision (control) to eliminate violations of legislation, a fine of 1,000 to 2,000 rubles or disqualification for up to three years for officials, and a fine of 10,000 to 20,000 rubles for legal entities. The CAO RF has no article that would directly establish liability for violating the GCP rules or for falsifying CT results. The article of the CAO RF «Circulation of falsified, counterfeit, substandard and unregistered medicines, medical devices and circulation of falsified dietary supplements» does not mention CT data.
Can EEC Recommendation No. 25 on data integrity be applied in clinical trials?
By Recommendation of the EEC Board of 19 September 2023 No. 25 «On the Guideline on Data Integrity and Validation of Computerized Systems» (hereinafter Recommendation No. 25), the Board recommended that EAEU member states, after 180 calendar days from the date of publication of the Recommendation on the official website of the Union (that is, from 19 March 2024), take into account the Guideline in its annex (hereinafter the Guideline) when creating (obtaining), recording, organizing the storage of and changing information on the safety, efficacy and quality of manufactured medicinal products, and also for the comparability of expert assessments in the study and registration of medicinal products and in pharmaceutical inspections.
The aims of the Guideline are linked to the Rules of Good Manufacturing Practice (GMP): it gives instructions on checking data integrity for compliance with the requirements of the GMP Rules, and its provisions apply to records that support GMP processes. In the clinical field, the Guideline may be used on a voluntary basis. The GCP Rules and the GCP Inspection Rules do not name Recommendation No. 25. When the GCP Inspection Rules provide for checking corrections in CRFs, they require compliance with the acts of the bodies of the Union on ensuring data integrity and do not list those acts.
The Guideline gives more detail on controlling data in electronic systems than the requirements of the GCP Rules for electronic systems. Table 4 shows this detail by the topics of Table 2. For the audit trail, the Guideline uses the term «control trail» (контрольный след).
Table 4. What the Guideline from Recommendation No. 25 contains on the topics of the requirements for electronic systems
| Topic | What the Guideline says |
|---|---|
| Quality criteria for records | Data used for decisions meet the ALCOA+ criteria: attributable to a person, legible, contemporaneous, original, accurate, and also complete, consistent, enduring and available |
| Access | Individual logins and passwords, a ban on shared passwords, control of administrator access, segregation of duties |
| Backup | Documenting, testing and validating the backup and recovery processes, keeping copies at a remote location |
| Data transfer | Transfer procedures are developed and verified so as to preserve data integrity throughout the life cycle |
| Control trail | Automatic recording, the content of the record (who made the change, what was changed, when and why), a function that is always on, synchronized time |
| Review of the control trail | An audit by an authorized user, inclusion of the review in routine data review, frequency based on risk assessment, a documented procedure |
| Vendor data | Using the vendor’s validation data in isolation from the configuration and purpose of the system is unacceptable |
| Outsourcing | An organization that outsources a critical process is responsible for the integrity of all reported results, including the outsourcer’s results, and for the third party’s compliance with the Guideline. The Guideline provides for an audit at the vendor’s site and for quality agreements with data integrity provisions |
What to do
Identify the critical processes and data and fix the tolerance limits. In the quality management plan, describe the processes and data that are significant for the protection of subjects and the credibility of results, the risks to them and the tolerance limits for the quality of parameters. Plan for the CT report to describe the approach and the deviations from the tolerance limits.
Check the SOPs on electronic systems against the requirements of the GCP Rules. Check all eight requirements against Table 2, including the content of SOPs, risk-based validation and data integrity when software is updated and data are transferred. Define the list of persons who are permitted to make changes. Decide whether you apply the Guideline from Recommendation No. 25 on a voluntary basis, and record the decision in the SOP.
Set out the strategy and reporting in the monitoring plan, and the root cause analysis in the SOP. Justify the chosen strategy, describe the methods, the responsibilities of the parties, the monitoring of critical data and the procedure for reporting on centralized monitoring. Add to the SOP a procedure for root cause analysis and CAPA in the event of significant non-compliance.
Check the contracts and the oversight of contractors. Make sure that the transfer of functions to the CRO is documented and that the sponsor oversees subcontractors. Check that the investigator has put in place oversight of the persons to whom he delegated functions and has confirmed their qualifications. Make sure that all parties have given consent to direct access for inspection.
Run a trial check against Table 3. Go through all the rows of the table for one center: the CRF sample, comparison with source records, the justification of corrections, tracing data to the database, the log of the chronology of events, CAPA procedures. Prepare the procedure for responding to an inspection report within 20 working days, with a CAPA plan for critical and major non-conformities. If the trial started before 10 March 2026, divide its actions and documents by date into those before and after this date. Decision No. 63 and the GCP Inspection Rules do not name the edition of the GCP Rules by which such a trial is assessed.
Regulatory framework:
1. Federal Law of 12 April 2010 No. 61-FZ «On the Circulation of Medicines» (version of 4 August 2026)
2. Code of the Russian Federation on Administrative Offenses of 30 December 2001 No. 195-FZ (version of 4 August 2026)
3. Decision of the EEC Council of 3 November 2016 No. 79 «On Approval of the Rules of Good Clinical Practice of the Eurasian Economic Union» (as amended by Decision of the EEC Council of 1 August 2025 No. 63, applicable from 10 March 2026)
4. Decision of the EEC Council of 1 August 2025 No. 63 «On Amendments to the Rules of Good Clinical Practice of the Eurasian Economic Union» (published 11 September 2025)
5. Decision of the EEC Council of 3 November 2016 No. 83 «On Approval of the Rules for Conducting Pharmaceutical Inspections» (version of 1 August 2025): Rules for Conducting Pharmaceutical Inspections for Compliance with the Requirements of the Rules of Good Clinical Practice of the Eurasian Economic Union (introduced by Decision of the EEC Council of 6 September 2024 No. 66)
6. Treaty on the Eurasian Economic Union of 29 May 2014 (version of 25 May 2023, with amendments in force from 24 June 2024): Statute of the Eurasian Economic Commission
7. Recommendation of the EEC Board of 19 September 2023 No. 25 «On the Guideline on Data Integrity and Validation of Computerized Systems»
8. For comparison («Previously»): the GCP Rules before the amendments by Decision No. 63 (the version of Decision No. 79 of 3 November 2016 before the amendments by Decision No. 63)