Annex 2 Is Final: Moving from Understanding the Guideline to Applying It in Practice
ICH adopted Annex 2 of E6(R3) at Step 4 on 3 June 2026. The CHMP adopted it on 25 June, and it comes into effect on 15 January 2027. With that, the GCP framework is complete: the principles document, Annex 1 for traditional interventional trials, and now Annex 2 for trials that incorporate decentralised elements, pragmatic elements, or real-world data.
Most teams have already read the summaries. Slide decks have circulated, SOP owners have started gap assessments, and quality functions are mapping clauses to procedures. That work matters. But it addresses the easiest part of the problem. Annex 2 does not hand teams a new set of rules to follow. It hands them a set of questions they are now expected to answer for themselves, study by study, and defend later. This article looks at where that expectation will bite, and what preparing properly actually involves.
The gap between reading the guideline and applying it
Annex 2 is short, readable, and deceptively easy to agree with. Data should be fit for purpose. Remote and in-person elements should be chosen deliberately. Participant safety should not depend on where a visit takes place. Nobody argues with any of it.
The difficulty starts when a specific protocol lands on the desk. Is this particular EHR extract reliable enough to support a secondary endpoint? Does a home nursing visit for this population create a safety gap, or close one? Who is accountable when a wearable stops transmitting for eleven days across four countries? Annex 2 does not answer those questions. It expects the team to answer them, document the reasoning, and stand behind it during an inspection.
That is the shift. Under ICH-GCP E6(R3) Annex 2, compliance is increasingly assessed not only by whether procedures followed a predefined rule, but by whether decisions were risk-based, scientifically justified, and appropriately documented at the time they were made. Compliance depends on evidence of sound decision-making, effective oversight, and contemporaneous documentation of rationale. Teams that treat January 2027 as an SOP update deadline will find they have closed the documentation gap and left the judgement gap wide open.
Where Annex 2 will catch teams out
Across the organisations already working through implementation, a familiar set of pressure points is emerging:
- Real-world data treated as a data source rather than a decision. Annex 2 frames fitness for purpose as two things: reliability, which covers accuracy, completeness, provenance and traceability, and relevance, which covers whether the key data elements are actually there to answer the trial question. It then asks for separate attention to data source variability, potential bias, and generalisability. In practice, many teams can describe where their data came from but cannot yet explain why it is fit for the specific purpose they are using it for.
- Access to source records assumed rather than secured. For higher-criticality RWD uses, such as data supporting key efficacy or safety endpoints, Annex 2 states that assessing the source’s fitness for purpose may not be enough on its own. Sponsors may need access to individual source records to confirm that a clinical event occurred, was assessed, or was documented. Where the hospital, registry holder, or insurer controlling that data will not permit it, the guideline directs sponsors to consult the regulatory authority. That is a contract conversation that needs to happen long before database lock.
- Decentralised elements adopted piecemeal. A remote consent here, a home visit there, a wearable added late in design. Individually reasonable, collectively an unmapped set of data flows and responsibilities that nobody owns end to end.
- Vendor and service-provider oversight. Home healthcare providers, digital health technology suppliers, and local labs sit inside the trial but often outside the sponsor’s usual oversight model. Annex 2 does not accept distance as a reason for reduced accountability.
- Pragmatic designs assessed against traditional assumptions. Broader eligibility and routine-care data collection change what quality control can realistically look like. Applying a conventional monitoring mindset to a pragmatic study produces effort in the wrong places.
- Documented rationale missing. The decisions are often defensible. The record of why they were made, by whom, and on what evidence frequently is not. That gap only becomes visible under inspection, when reconstruction is no longer credible.
None of these are exotic. They are the predictable consequence of a guideline that asks for proportionate judgement rather than prescribed steps, applied by teams whose training has historically rewarded the opposite.
What actually works
Generic readiness checklists are not the fix. Most organisations already have one. What separates teams that will handle January well comes down to a few practical habits.
Start from the trial, not the clause. Take a live or recent protocol with decentralised or RWD elements and work through it against Annex 2. Where does the data come from, who touches it, what could go wrong, and what have you decided to do about it. That exercise surfaces more than any clause-by-clause mapping.
Make data fitness an explicit, written assessment, scaled to criticality. For each RWD source, state the purpose, the known limitations, the bias risk, and why it is acceptable for this endpoint. Then scale the depth of that assessment to how much the endpoint depends on it. Lower-criticality uses can rest on system and process level checks. Higher-criticality uses cannot.
Decide, then justify, then record. The pattern regulators are moving toward rewards teams who can explain reasoning, not just produce outcomes. Build the rationale into the decision, not into a retrospective memo.
Extend oversight to match the trial’s actual footprint. Map every party who generates, handles, or transmits participant data, including those who never appear on a site list. Then check that oversight arrangements cover them in reality, not only in contract.
Train for judgement, not for content. Awareness training tells people what Annex 2 says. That is necessary and insufficient. What teams need is practice applying it to messy, incomplete, realistic situations where the right answer is not obvious.
Done consistently, these habits turn January 2027 from a deadline into a capability. The organisations that get there will not be the ones who read the guideline first. They will be the ones who practised using it.
Build the confidence and judgement to apply Annex 2 in practice
ECCRT’s Annex 2 implementation workshop is built around exactly this challenge. Rather than walking through the guideline clause by clause, it works from real protocols and real decisions: assessing whether real-world data is fit for purpose, designing oversight for decentralised elements, and documenting rationale in a way that holds up under inspection.
Through worked examples drawn from studies that are already running, you will strengthen the reasoning behind data source selection, risk proportionality, and service provider oversight, and leave with a clear view of what your own organisation needs to change before 15 January 2027.
Who it’s for: clinical project and study managers, clinical operations professionals (sponsor or CRO), quality and compliance teams, data management leads, and anyone accountable for GCP readiness ahead of the effective date.
What’s included: course materials and a certificate of completion.
Next session: TBD. Also available as a tailored in-house course delivered to your team.