flowchart TB
RA[("Regulatory Authority<br/>(FDA, EMA, etc.)")]
subgraph Trial["Clinical Trial"]
Sponsor["Sponsor / CRO"]
PI["Principal Investigator<br/>(Sub-Investigators)"]
Subject["Research Subject"]
IRB["IRB / Ethics Committee"]
end
RA -->|Oversees| Sponsor
RA -->|Inspects| PI
Sponsor -->|Selects, Monitors| PI
IRB -->|Protects| Subject
PI -->|Obtains Consent,<br/>Provides Care| Subject
Sponsor -->|Responsible for IND| RA
IRB -->|Approves Protocol| PI
class RA authority
class Sponsor sponsor
class PI site
class Subject subject
class IRB ethics
3 Regulatory Framework
The regulatory framework governs how clinical trials are conducted, who may conduct them, and what evidence is required for drug approval. This chapter focuses on the United States while noting key international considerations.
In the US, the Food and Drug Administration (FDA) stands as the gatekeeper for drugs, biologics, and medical devices in the United States (U.S. Food and Drug Administration 2024b). Located within the Department of Health and Human Services as part of the Public Health Service (alongside the National Institutes of Health (NIH) and Centers for Disease Control and Prevention (CDC)), the FDA’s mission is to protect public health by ensuring that regulated products are safe, effective, and not adulterated or misbranded.
The agency is organized into scientific centers (Table 3.1), each responsible for specific product categories:
| Center | Products Regulated | Key Responsibilities |
|---|---|---|
| CDER (Center for Drug Evaluation & Research) | Prescription drugs, over-the-counter drugs, generic drugs | New Drug Applications (NDA), Abbreviated NDAs (ANDA), drug safety surveillance |
| CBER (Center for Biologics Evaluation & Research) | Vaccines, blood products, gene therapies, cellular therapies, plasma derivatives | Biologics License Applications (BLA), lot-by-lot release for certain products |
| CDRH (Center for Devices & Radiological Health) | Medical devices (Class I-III), radiation-emitting products | 510(k) clearances, Premarket Approvals (PMA), device safety |
| CFSAN (Center for Food Safety & Applied Nutrition) | Foods, dietary supplements, cosmetics | Food safety standards, nutrition labeling |
| CVM (Center for Veterinary Medicine) | Animal drugs, animal food | Veterinary product approval |
For anyone developing a new therapy, understanding which center has jurisdiction over your product—and what that center requires—is the first step. The FDA works with numerous interagency partners including the Office for Human Research Protections (OHRP) on clinical trial matters, NIH on scientific investigation, CDC on epidemiological matters, and the Department of Homeland Security on bioterrorism and food safety.
3.1 The Code of Federal Regulations
The rules governing clinical research are codified in Title 21 of the Code of Federal Regulations, often abbreviated as 21 CFR. While the full text runs to thousands of pages, several parts are particularly relevant to clinical trials.
Primary to clinical trial regulation is the protection of research participants. Part 50 establishes what informed consent must include and how it must be documented (U.S. Food and Drug Administration 2023b). The regulation requires that potential participants be told the purpose of the research, the procedures involved, the foreseeable risks and potential benefits, available alternatives, how their privacy will be protected, and—critically—that participation is entirely voluntary. They must understand that they can withdraw at any time without penalty.
This may seem straightforward, but consider the complexity of explaining a novel gene therapy to a patient with limited scientific background, or obtaining meaningful consent from someone who is seriously ill and may see the trial as their best hope. The regulations provide the framework; their thoughtful implementation requires judgment and care.
Before any research involving human subjects can begin, it must be reviewed and approved by an Institutional Review Board (IRB) (U.S. Food and Drug Administration 2023c). The IRB functions as an independent ethics committee, comprising at least five members with diverse backgrounds including scientific expertise and community representation.
The IRB’s fundamental question is whether the proposed research appropriately balances potential benefits against risks to participants. It examines whether subject selection is equitable, whether the consent process is adequate, and whether appropriate safeguards are in place. The IRB’s authority is broad—it can require modifications to the research design, mandate additional protections, or refuse approval entirely.
The Clinical Trial Stakeholder Framework
Figure 3.1 illustrates the relationships among clinical trial stakeholders.
The sponsor (or its contract research organization) bears ultimate responsibility for the conduct of the trial and compliance with regulatory requirements. The principal investigator conducts the research at the clinical site and is responsible for obtaining informed consent and protecting participant safety. The IRB provides independent ethical oversight, reviewing the protocol before research begins and monitoring it throughout. And the regulatory authority maintains oversight of the entire enterprise, with the power to inspect, enforce, and—if necessary—halt research that fails to protect participants adequately.
The IND Application (21 CFR Part 312)
Perhaps no regulation is more central to drug development than Part 312, which governs Investigational New Drug (IND) applications (U.S. Food and Drug Administration 2024a). The IND is the application that permits a sponsor to begin clinical trials in the United States, and it must be in place before the first dose is administered to the first human subject.
The IND contains three main components. The chemistry, manufacturing, and controls section describes what the drug is and how it is made—information critical to ensuring that every batch is consistent and safe. The pharmacology and toxicology section summarizes the preclinical studies in animals that support the safety of proceeding to human trials. The clinical protocol section details exactly how the proposed study will be conducted.
The FDA has 30 days to review an IND application. If the agency does not place a clinical hold on the application within that period, the sponsor may proceed with the study. This “proceed unless stopped” approach balances the need for regulatory oversight with the urgency of bringing new therapies to patients.
In an era when clinical trial data is captured, stored, and transmitted electronically, Part 11 establishes requirements for electronic records and signatures (U.S. Food and Drug Administration 2023a). The goal is straightforward: ensuring that electronic records are as trustworthy as paper records. This requires validated computer systems, secure audit trails that track every change to the data, controlled access, and electronic signatures that reliably identify the signer.
NoteA Practical Perspective
While Part 11 was issued in 1997, the FDA’s current approach focuses on the controls most directly related to data integrity. The agency recognizes that not every electronic system requires the same level of validation—a risk-based approach guides compliance decisions.
3.2 AI and Automation in a Regulated Trial
The same regulatory logic that motivated Part 11—data integrity, traceability, and accountability—now shapes how sponsors deploy AI and automation in clinical development. In practice, most “AI in regulatory” activity is not about letting a model make approval decisions; it is about automating processes while keeping the evidence chain auditable.
Many high-volume regulatory deliverables are already partially automated through workflow systems: eTMF filing against the DIA Reference Model, query management, and risk-based quality management (RBQM) signals that support targeted monitoring. These tools are often implemented as rules engines plus machine-learning classifiers (e.g., document type classification, completeness checks) that reduce manual effort while producing an audit trail that can be inspected (TMF Reference Model Initiative 2024; Association of Clinical Research Organizations 2024).
This matters because inspection findings are frequently about process failures—missing essential documents, inconsistent data corrections, and inadequate oversight—rather than about statistical methods. Automation can reduce variance in execution, but only when it is controlled, validated, and monitored like any other regulated computerized system (U.S. Food and Drug Administration 2023a).
Generative AI is increasingly used to draft narratives, summarize deviations, and prepare sections of reports and submission documents. The regulatory risk is that fluent text can obscure uncertainty or introduce untraceable statements that do not faithfully reflect the source record. Empirical work in clinical research document generation has highlighted compliance and factuality issues that require governance, source linking, and review workflows rather than blind acceptance (Wang et al. 2025; Messeri and Crockett 2024).
Regulators do not require sponsors to avoid AI; they require sponsors to manage risk. A pragmatic governance approach for AI-enabled workflows mirrors general risk management frameworks: define intended use, identify hazards (e.g., hallucinated facts, biased triage, missed signals), implement controls (retrieval with provenance, checklists, dual-review, monitoring), and document residual risk and responsibilities (National Institute of Standards and Technology 2023). For AI/ML used as part of products (e.g., medical devices), regulators and partner agencies have articulated Good Machine Learning Practice (GMLP) principles that emphasize lifecycle management and transparency—concepts that translate well to internal clinical operations tooling (U.S. Food and Drug Administration, Health Canada, and UK Medicines and Healthcare products Regulatory Agency 2021).
In short, the regulatory posture toward AI is less “ban or bless” and more “show your work”: keep the decision trace, keep the data lineage, and make it clear where humans remain accountable.
3.3 The IND Process in Practice
The process from laboratory to clinical trial begins with the IND application (Figure 3.2), a process often preceded by a Pre-IND Meeting where sponsors align development plans with FDA expectations. As of 2024, the Food and Drug Omnibus Reform Act (FDORA) also requires the submission of Diversity Action Plans for all Phase III and pivotal studies. These plans mandate specific enrollment goals for underrepresented populations—defined by race, ethnicity, sex, and age—making diverse recruitment a matter of regulatory compliance rather than just an ethical best practice. Furthermore, the 21st Century Cures Act has expanded the role of Real-World Evidence (RWE), allowing data from electronic health records, registries, and wearables to support new indications, safety studies, and even synthetic control arms in rare disease research.
flowchart LR
subgraph Submit["Submission"]
A["Pre-IND<br/>Meeting"] --> B["IND<br/>Submission"] --> C{"30-day<br/>FDA review"}
end
subgraph Hold["If Clinical Hold"]
E["Address<br/>Concerns"] --> F["Respond"]
end
D["Trial"]
C -->|Hold| E
F -.-> C
C -->|Clear| D
IND applications are categorized based on their intent and the nature of the development program. A Commercial IND supports research aimed at securing marketing approval, whereas a Research IND is typically submitted by academic institutions for non-commercial study. In urgent circumstances, an Emergency IND permits the use of an investigational drug when time is of the essence, while a Treatment IND provides broad access to promising therapies for patients with serious conditions who lack alternative options before formal approval is granted.
3.4 International Considerations
Drug development has become a global enterprise, with trials conducted across multiple countries and regulatory submissions made to agencies around the world. To enable this global development, the International Council for Harmonisation (ICH) brings together regulatory authorities and pharmaceutical industries from the United States, European Union, Japan, and beyond to develop harmonized guidelines. Though not legally binding in themselves, ICH guidelines are adopted by member countries and have become the de facto international standards.
Key guidelines (Table 3.2) include E6 on Good Clinical Practice, E8 on general considerations for clinical trials, E9 on statistical principles, and M4 on the Common Technical Document format for regulatory submissions. Together, these guidelines enable sponsors to conduct trials that will be acceptable to regulators in multiple jurisdictions.
| Guideline | Topic |
|---|---|
| E6 | Good Clinical Practice (R3 updates focus on Quality by Design & Data Governance) |
| E8 | General Considerations for Clinical Trials |
| E9 | Statistical Principles (R1 adds “Estimands” framework) |
| E2A | Clinical Safety Data Management |
| E3 | Structure and Content of Clinical Study Reports |
Regional Regulatory Frameworks
While ICH provides common standards, regional regulatory frameworks govern how trials are conducted and approved in each jurisdiction. In the European Union, clinical trials are governed by the EU Clinical Trials Regulation 536/2014, which became fully applicable in January 2022. This regulation introduced a single submission portal (the Clinical Trials Information System or CTIS), harmonized assessment timelines across member states, and enhanced transparency with public access to trial information. For sponsors conducting multinational trials, the EU CTR significantly simplifies what was previously a fragmented approval process requiring separate submissions to each country.
Beyond the EU, major regulatory authorities include the Pharmaceuticals and Medical Devices Agency (PMDA) (Japan), National Medical Products Administration (NMPA) (China), Health Canada, and Therapeutic Goods Administration (TGA) (Australia). While specific requirements differ across these regions—reflecting different healthcare systems, patient populations, and regulatory traditions—the ICH guidelines provide a common foundation that facilitates global development programs and enables sponsors to use clinical data across multiple regulatory submissions.
3.5 Good Clinical Practice
ICH E6 GCP is the international ethical and scientific quality standard for clinical trials (International Council for Harmonisation 2025). The 2025 revision (R3) represents a significant evolution in GCP, shifting from a primarily reactive quality control model to a proactive Quality by Design (QbD) approach. Under QbD, quality is built into trial design from the outset through systematic identification of critical factors, risk assessment, and implementation of appropriate controls—rather than relying solely on retrospective monitoring and correction.
E6(R3) also introduces enhanced requirements for data governance, recognizing that modern trials generate data from diverse sources (electronic health records, wearables, patient-reported outcomes, central laboratories) that must be managed with appropriate controls throughout the data lifecycle. The guideline emphasizes risk-proportionate approaches, allowing sponsors to tailor oversight intensity to the complexity and risk profile of each trial, and explicitly addresses technology-enabled trial designs including decentralized trials, electronic consent, and digital health technologies.
The guideline establishes responsibilities for the three key parties in any trial.
The IRB or Independent Ethics Committee reviews and approves trial documents before research begins, conducts continuing review throughout the trial, and receives reports of safety events and protocol deviations.
The Investigator—typically a physician—is responsible for conducting the trial according to GCP and the approved protocol, obtaining informed consent from each participant, reporting adverse events, and maintaining accurate records.
The Sponsor—whether a pharmaceutical company, academic institution, or government agency—is responsible for the overall design and conduct of the trial, including selecting qualified investigators, providing the investigational product, ensuring proper monitoring, and reporting safety information to regulatory authorities.
Throughout a clinical trial, investigators and sponsors must maintain essential documents to demonstrate GCP compliance and enable independent verification of data. These records are organized chronologically, beginning with the protocol and investigator’s brochure during startup, followed by consent forms and monitoring reports during the conduct phase, and concluding with final study reports and treatment allocation records upon study completion.
TipThe Trial Master File
All essential documents should be organized in a Trial Master File (TMF). The sponsor maintains a central file, while each investigator site maintains a site file. These records must be retained for years after the trial concludes—typically at least two years following marketing approval or formal discontinuation of the development program.
3.6 Compliance and Enforcement
The regulatory framework has teeth. The FDA conducts inspections of clinical trial sites to verify compliance and data integrity. These may be routine inspections as part of a marketing application review, for-cause inspections triggered by specific concerns, or directed inspections focused on particular issues identified during application review.
Following an inspection, the FDA classifies findings as NAI (no action indicated) when no significant problems are found, VAI (voluntary action indicated) when minor deviations should be corrected, or OAI (official action indicated) when significant violations require regulatory action.
Serious violations can result in rejection of trial data from regulatory submissions, clinical holds on ongoing trials, and even debarment of investigators from conducting FDA-regulated research. Criminal penalties are possible in extreme cases involving fraud or egregious misconduct.