Industry News | CDE New Regulation Implementation: Key Compliance Points for Computerized Systems and Electronic Data in Clinical Trials

On September 22, the Center for Drug Evaluation (CDE) of the National Medical Products Administration officially issued the implementation notice of the Guidelines for Computerized Systems and Electronic Data in Drug Clinical Trials. This document was formulated to support the implementation of China's Good Clinical Practice (2026 Revision) and will further advance the regulatory requirements for clinical trial electronicization from the level of principles to an executable and verifiable operational level.

For sponsors, investigators, and clinical trial institutions that are using or planning to deploy computerized systems for clinical trials, understanding the core changes of the new regulation, assessing the compliance level of existing systems, and establishing a quality management system that meets the requirements have become important tasks at this stage.

As an industry leader in AI-driven full-cycle digital solutions and related professional services for clinical trials, Clinflash, leveraging its deep experience in over 10,000 clinical trial projects, provides an in-depth interpretation of the core orientation of the new regulation and industrial implementation practices from the perspective of an industry service provider.

What changes in the new regulation need attention?

1. Responsibility subjects expanded to sponsors and clinical trial institutions

The new regulation clarifies that responsible parties include not only sponsors and investigators but also clinical trial institutions; if a supplier is entrusted, the entrusting party shall bear ultimate responsibility. This means that systems can be procured, but responsibility cannot be outsourced. For sponsors, selecting a system supplier is only the first step. More importantly, they need to truly understand the system's validation status, data flow, and risk control points, and incorporate supplier activities into their own quality system through written agreements, oversight mechanisms, and validation documentation. In future inspections, sponsors need to be able to demonstrate: who selected the system, who performed the validation, whether the data flow is clear, and whether risks are controlled.

2. From "one-time go-live" to "continuous validated state"

The new regulation requires responsible parties to ensure that computerized systems remain in a validated state at all times, establish validation processes based on risk assessment, cover general validation and trial-specific configurations, and oversee the supplier's validation process. For sponsors, system go-live is no longer the compliance endpoint. System upgrades, configuration changes, and new feature releases all require assessment of whether re-validation is triggered; user requirements, test plans, test evidence, and validation reports also need to be controlled and managed throughout the full lifecycle. In other words, what sponsors need is not just a usable system, but a system that can continuously demonstrate its compliance.

3. Electronic data management incorporated into full lifecycle and ALCOA++ standards

The new regulation requires data to satisfy attributability, legibility, contemporaneity, originality, accuracy, completeness, consistency, endurance, availability, and traceability, and sets requirements for collection, audit trails, review, correction, transmission/exchange/migration, backup, archiving, database decommissioning, and destruction. For sponsors, compliance focus must shift from "whether functions exist" to "whether evidence is complete and whether the process is traceable." Whether audit trails are unmodifiable, whether timestamps are accurate, whether cloud environments meet data security requirements, whether archive formats are standard, and whether data remains readable after database decommissioning will all become unavoidable questions in inspections.

How should we respond as the new regulation is about to take effect?

Facing the new regulation, sponsors and clinical trial institutions need to proceed from four aspects to better fulfill their primary responsibility for data governance and build a compliance system covering system validation, data full lifecycle, and inspection response.

1. Establish a responsibility ledger

As the responsible entity, sponsors need to establish ledgers for system account governance, permission review, and independent data retention, clarifying account activation, deactivation, and administrator permission ownership. Clinflash systems support refined configuration of accounts and permissions, helping sponsors clearly record and manage the account status of each center, fully meeting responsibility traceability requirements.

2. Focus on continuous validated state

System go-live is not the compliance endpoint. After system upgrades and configuration changes, whether re-validation is needed should be assessed, and validation documents need to be controlled, managed, and updated in a timely manner. Clinflash has established a validation system based on GAMP 5, covering general validation and trial-specific configurations, and provides change control and release validation support, providing validation evidence with each release to reduce customers' repeated validation workload. At the same time, Clinflash periodically conducts regular reviews of the system to confirm that the system's validated state is maintained.

3. Value audit trails

During inspections, sponsors are often asked whether audit trails are unmodifiable, whether timestamps are accurate, and whether permissions are reviewed periodically. In response to these important audit concerns, the Clinflash series systems under Clinflash have enabled robust, non-disableable audit trail functions, which completely record the operator, operation time, operation type, operation reason, and old and new values; and support retrieval, sorting, and marking within the system, facilitating sponsors in conducting audit trail reviews.

4. Do not neglect database decommissioning

Whether archive formats are standard, whether data is readable after decommissioning, and whether there are migration and destruction SOPs are all explicitly required by the new regulation. Clinflash supports archiving in standard formats such as CDISC ODM, and can assist customers in formulating migration, archiving, and destruction processes, ensuring that data remains readable and traceable after database decommissioning.

In addition, Clinflash has obtained ISO 9001, 27001, 20000, 27701, and 42001 certifications, and its core systems have passed Level 3 of the Multi-Level Protection Scheme (MLPS). It also possesses experience supporting over 100 CFDI inspections, 4 FDA inspections, and overseas inspections by PMDA, EMA, and others. The system's compliance has been fully verified in multiple countries and regions worldwide.

The release of this new regulation marks that China's regulation of computerized systems and electronic data in clinical trials has entered a more refined and operational stage. For sponsors, investigators, and clinical trial institutions, understanding the new regulation is only the first step. Establishing a quality management system that meets the requirements, selecting system suppliers with continuous compliance capabilities, and integrating compliance requirements into daily operations are the fundamentals for responding to inspections.

In the future, Clinflash will continue to track the iterative updates of domestic and international regulatory policies, take compliance as the foundation, and continuously refine its digital products and supporting service capabilities, helping customers achieve steady and long-term success in clinical trial operations in China and globally.