Good Clinical Practice (GCP) is an international standard for designing, conducting, recording, and reporting clinical trials that involve human participants. It serves two core purposes: protecting the rights, safety, and well-being of people who volunteer for trials, and ensuring that the data produced are reliable and credible. GCP applies to every clinical trial that generates data intended for submission to regulatory agencies, whether the trial tests a new cancer drug or a reformulated allergy medication.
The standard is maintained by the International Council for Harmonisation (ICH) and published as guideline E6. Regulatory bodies in the United States, European Union, Japan, and dozens of other countries have adopted it, making GCP the closest thing clinical research has to a universal rulebook.
Where GCP Comes From
GCP grew out of a long history of ethical failures in human experimentation. The Nuremberg Code (1947) and the Declaration of Helsinki (1964) established that research on humans requires voluntary consent and a favorable balance of benefits over risks. GCP formalized those ethical principles into a detailed operational framework that regulators could enforce.
The first harmonized version, ICH E6, was finalized in 1996. A second revision (R2) arrived in 2016 and introduced the concept of risk-based quality management, shifting the field away from a one-size-fits-all checklist approach. The most recent version, E6(R3), was finalized in January 2025. It further emphasizes designing quality into a trial from the start, a concept called “quality by design,” and updates the guideline for modern trial methods like decentralized trials and electronic data capture.
Core Principles
GCP rests on a few foundational ideas that run through every section of the guideline. Trials must be scientifically sound and described in a clear, detailed protocol. The rights, safety, and well-being of participants always take priority over the interests of science or commerce. Every person involved in a trial, from the lead physician to the data manager, should be qualified by education, training, and experience to perform their role. And all clinical trial information should be recorded, handled, and stored in a way that allows accurate reporting, interpretation, and verification.
Freely given informed consent is required before any person participates in a trial. That means participants must be told what the study involves, what the risks are, what alternatives exist, and that they can withdraw at any time without penalty. The consent process is not just a signature on a form. It is an ongoing conversation that continues throughout the trial whenever new information emerges that could affect a participant’s willingness to continue.
Who Does What: Key Roles
The Investigator
The investigator is the physician (or qualified professional) at the trial site who is directly responsible for the conduct of the study and the care of participants. All trial-related medical decisions must be made by a qualified physician. If a participant experiences a harmful reaction, the investigator provides or arranges appropriate medical care and, when relevant, notifies the participant’s primary physician about their involvement in the trial.
Investigators must follow the approved protocol. They can only deviate from it with prior agreement from the sponsor and approval from an ethics committee, with one exception: they may act immediately to eliminate a direct hazard to a participant’s safety, then report the deviation afterward. Every deviation must be documented and explained.
The Sponsor
The sponsor is the organization (usually a pharmaceutical or biotech company) that initiates, manages, and finances the trial. Under GCP, the sponsor carries ultimate responsibility for the trial’s quality, even when it outsources day-to-day tasks to contract research organizations (CROs). The sponsor must assess whether any service provider it hires is capable of performing the work, and it must maintain oversight of outsourced activities, including work that gets further subcontracted.
Sponsors are also responsible for building quality assurance and quality control systems. Quality assurance uses risk-based strategies to catch and prevent serious problems. Quality control, which includes monitoring and data management, is applied at each stage of data handling to make sure the information coming out of a trial is reliable.
The Ethics Committee
Every clinical trial requires review and approval by an independent ethics committee (called an Institutional Review Board, or IRB, in the United States). This body reviews the protocol, the consent documents, and the qualifications of the investigator before the trial begins. It also conducts ongoing reviews, typically at least once a year, to confirm that participants remain adequately protected as the study progresses.
Risk-Based Monitoring
Monitoring is one of the main ways a sponsor ensures that a trial is running correctly. Traditionally, monitors would visit every site and verify nearly every data point against source records. The updated GCP guideline replaces that blanket approach with risk-based monitoring, which focuses attention where it matters most.
Before a trial starts, the sponsor identifies risks that could meaningfully affect participant safety or the reliability of results. Each risk is evaluated based on how likely it is to occur, how detectable it would be, and how much damage it could cause. Controls are then designed in proportion to the seriousness of the risk. A complex trial testing a drug with a narrow safety margin will have more intensive monitoring than a low-risk study of a well-characterized treatment.
Monitoring itself can take several forms. Site monitoring happens on location or remotely, with a monitor reviewing records, confirming consent was properly obtained, and checking that the investigational product is stored and dispensed correctly. Centralized monitoring is a newer layer that involves analyzing accumulated data from all sites at once. Statistical methods can flag unusual patterns, such as a site reporting suspiciously uniform lab values or an unexpected lack of adverse events, prompting a closer look. The two approaches are meant to work together, and centralized monitoring can reduce the frequency of on-site visits when risks are well controlled.
Safety Reporting Requirements
When something goes wrong during a trial, GCP and regulatory rules require fast, structured reporting. A serious adverse event is any harmful occurrence that results in death, a life-threatening situation, hospitalization (or extended hospitalization), significant disability, or a birth defect. Events that don’t meet those criteria can still qualify as serious if, in a physician’s judgment, they could jeopardize the participant or require intervention to prevent a serious outcome.
Timelines are strict. If a serious and unexpected adverse event occurs, the sponsor must notify the regulatory agency and all participating investigators in writing within 15 calendar days of learning about it. If the event is fatal or life-threatening and unexpected, the timeline shrinks to 7 calendar days, and the initial report can be made by phone or fax. Investigators at the trial site are typically required to report serious adverse events to the sponsor within 24 hours of becoming aware of them.
Essential Trial Documents
GCP requires a comprehensive paper trail, maintained in what is called a trial master file. These documents serve a practical purpose: they allow the conduct of the trial to be reconstructed and verified at any point, whether during a routine audit or a regulatory inspection years after the trial ends.
Before the trial begins, the file should contain the approved protocol and any amendments, ethics committee approval letters, the investigator’s qualifications and licensure, financial disclosure statements, approved consent forms, laboratory certifications, and documentation of the investigational product (handling instructions, certificates of analysis, labeling). During and after the trial, it expands to include signed consent forms, completed case report forms, records of adverse events, monitoring visit reports, and product accountability logs.
For trials conducted under a U.S. Investigational New Drug (IND) application, additional documents are required, including FDA Form 1572, which formally commits the investigator to following the protocol and GCP requirements.
How GCP Varies by Country
ICH GCP is a guideline, not a law. Each country adopts it through its own regulatory framework, and the degree of alignment varies. The U.S. FDA has incorporated GCP principles into federal regulations, but there are places where domestic rules differ from the ICH text. A review by Dana-Farber/Harvard Cancer Center identified several areas where U.S. institutional practice diverges from strict ICH GCP requirements: some ethics committees conduct reviews every two years instead of annually for minimal-risk studies, consent forms may not include details about payment amounts, and signed case report forms are not always retained for investigator-initiated trials.
These gaps do not mean the trials are unethical or unreliable. They reflect the reality that GCP sets a high bar, and institutions sometimes follow the letter of their national regulations rather than every ICH recommendation. For multinational trials, sponsors generally design their processes to meet the strictest applicable standard so data will be accepted by regulators in every country where they plan to file.
Why GCP Matters Outside the Lab
If you have ever taken a prescription medication, you have benefited from GCP. The standard exists so that the data behind a drug approval are trustworthy, so that the side effects listed on a label were honestly collected and reported, and so that the people who volunteered to test the drug were treated with respect and given real choices about their participation. GCP is not just a regulatory checkbox. It is the framework that connects a clinical trial to the credibility of every treatment decision that follows from its results.