3  Regulatory Framework

The regulatory framework governs how clinical trials are conducted, who may conduct them, and what evidence is required for drug approval. This chapter focuses on the United States while noting key international considerations.

In the US, the Food and Drug Administration (FDA) regulates drugs, biologics, and medical devices in the United States (U.S. Food and Drug Administration 2024b). Located within the Department of Health and Human Services as part of the Public Health Service (alongside the National Institutes of Health (NIH) and Centers for Disease Control and Prevention (CDC)), the FDA’s mission is to protect public health by ensuring that regulated products are safe, effective, and not adulterated or misbranded.

The agency is organized into scientific centers (Table 3.1), each responsible for specific product categories:

Table 3.1: FDA Scientific Centers

Center	Products Regulated	Key Responsibilities
CDER (Center for Drug Evaluation & Research)	Prescription drugs, over-the-counter drugs, generic drugs	New Drug Applications (NDA), Abbreviated NDAs (ANDA), drug safety surveillance
CBER (Center for Biologics Evaluation & Research)	Vaccines, blood products, gene therapies, cellular therapies, plasma derivatives	Biologics License Applications (BLA), lot-by-lot release for certain products
CDRH (Center for Devices & Radiological Health)	Medical devices (Class I-III), radiation-emitting products	510(k) clearances, Premarket Approvals (PMA), device safety
CFSAN (Center for Food Safety & Applied Nutrition)	Foods, dietary supplements, cosmetics	Food safety standards, nutrition labeling
CVM (Center for Veterinary Medicine)	Animal drugs, animal food	Veterinary product approval

For anyone developing a new therapy, understanding which center has jurisdiction over your product (and what that center requires) is the first step. The FDA works with numerous interagency partners including the Office for Human Research Protections (OHRP) on clinical trial matters, NIH on scientific investigation, CDC on epidemiological matters, and the Department of Homeland Security on bioterrorism and food safety.

3.1 The Code of Federal Regulations

The rules governing clinical research are codified in Title 21 of the Code of Federal Regulations, often abbreviated as 21 CFR. While the full text runs to thousands of pages, several parts are particularly relevant to clinical trials.

Central to clinical trial regulation is the protection of research participants. Part 50 establishes what informed consent must include and how it must be documented (U.S. Food and Drug Administration 2023b). The regulation requires that potential participants be told the purpose of the research, the procedures involved, the foreseeable risks and potential benefits, available alternatives, how their privacy will be protected, and, critically, that participation is entirely voluntary. They must understand that they can withdraw at any time without penalty.

This may seem straightforward, but consider the complexity of explaining a novel gene therapy to a patient with limited scientific background, or obtaining meaningful consent from someone who is seriously ill and may see the trial as their best hope. The regulations provide the framework; their thoughtful implementation requires judgment and care.

Before any research involving human subjects can begin, it must be reviewed and approved by an Institutional Review Board (IRB) (U.S. Food and Drug Administration 2023c). The IRB functions as an independent ethics committee, comprising at least five members with diverse backgrounds including scientific expertise and community representation.

The IRB’s fundamental question is whether the proposed research appropriately balances potential benefits against risks to participants. It examines whether subject selection is equitable, whether the consent process is adequate, and whether appropriate safeguards are in place. The IRB’s authority is broad: it can require modifications to the research design, mandate additional protections, or refuse approval entirely.

The Clinical Trial Stakeholder Framework

Figure 3.1 illustrates the relationships among clinical trial stakeholders.

flowchart TB
    RA[("Regulatory Authority<br/>(FDA, EMA, etc.)")]
    
    subgraph Trial["Clinical Trial"]
        Sponsor["Sponsor / CRO"]
        PI["Principal Investigator<br/>(Sub-Investigators)"]
        Subject["Research Subject"]
        IRB["IRB / Ethics Committee"]
    end
    
    RA -->|Oversees| Sponsor
    RA -->|Inspects| PI
    Sponsor -->|Selects, Monitors| PI
    IRB -->|Protects| Subject
    PI -->|Obtains Consent,<br/>Provides Care| Subject
    Sponsor -->|Responsible for IND| RA
    IRB -->|Approves Protocol| PI
    
    class RA authority
    class Sponsor sponsor
    class PI site
    class Subject subject
    class IRB ethics

Figure 3.1: Clinical Trial Stakeholder Relationships

The sponsor (or its contract research organization) bears ultimate responsibility for the conduct of the trial and compliance with regulatory requirements. The principal investigator conducts the research at the clinical site and is responsible for obtaining informed consent and protecting participant safety. The IRB provides independent ethical oversight, reviewing the protocol before research begins and monitoring it throughout. The regulatory authority maintains oversight of the entire enterprise, with the power to inspect, enforce, and, if necessary, halt research that fails to protect participants adequately.

The IND Application (21 CFR Part 312)

Perhaps no regulation is more central to drug development than Part 312, which governs Investigational New Drug (IND) applications (U.S. Food and Drug Administration 2024a). The IND is the application that permits a sponsor to begin clinical trials in the United States, and it must be in place before the first dose is administered to the first human subject.

The IND contains three main components. The chemistry, manufacturing, and controls section describes what the drug is and how it is made, information critical to ensuring that every batch is consistent and safe. The pharmacology and toxicology section summarizes the preclinical studies in animals that support the safety of proceeding to human trials. The clinical protocol section details exactly how the proposed study will be conducted.

The FDA has 30 days to review an IND application. If the agency does not place a clinical hold on the application within that period, the sponsor may proceed with the study. This “proceed unless stopped” approach balances the need for regulatory oversight with the urgency of bringing new therapies to patients.

In an era when clinical trial data is captured, stored, and transmitted electronically, Part 11 establishes requirements for electronic records and signatures (U.S. Food and Drug Administration 2023a). The goal is straightforward: ensuring that electronic records are as trustworthy as paper records. This requires validated computer systems, secure audit trails that track every change to the data, controlled access, and electronic signatures that reliably identify the signer.

NoteA Practical Perspective

While Part 11 was issued in 1997, the FDA’s current approach focuses on the controls most directly related to data integrity. The agency recognizes that not every electronic system requires the same level of validation; a risk-based approach guides compliance decisions.

3.2 AI and Automation in a Regulated Trial

The same regulatory logic that motivated Part 11 (data integrity, traceability, and accountability) now shapes how sponsors deploy AI and automation in clinical development. In practice, most “AI in regulatory” activity is not about letting a model make approval decisions; it is about automating processes while keeping the evidence chain auditable.

Many high-volume regulatory deliverables are already partially automated through workflow systems: eTMF filing against the DIA Reference Model, query management, and risk-based quality management (RBQM) signals that support targeted monitoring. These tools are often implemented as rules engines plus machine-learning classifiers (e.g., document type classification, completeness checks) that reduce manual effort while producing an audit trail that can be inspected (TMF Reference Model Initiative 2024; Association of Clinical Research Organizations 2025).

This matters because inspection findings are frequently about process failures (missing essential documents, inconsistent data corrections, and inadequate oversight) rather than about statistical methods. Automation can reduce variance in execution, but only when it is controlled, validated, and monitored like any other regulated computerized system (U.S. Food and Drug Administration 2023a).

Generative AI is increasingly used to draft narratives, summarize deviations, and prepare sections of reports and submission documents. The regulatory risk is that fluent text can obscure uncertainty or introduce untraceable statements that do not faithfully reflect the source record. Empirical work in clinical research document generation has highlighted compliance and factuality issues that require governance, source linking, and review workflows rather than blind acceptance (Wang et al. 2025; Messeri and Crockett 2024).

Regulators do not require sponsors to avoid AI; they require sponsors to manage risk. A pragmatic governance approach for AI-enabled workflows mirrors general risk management frameworks: define intended use, identify hazards (e.g., hallucinated facts, biased triage, missed signals), implement controls (retrieval with provenance, checklists, dual-review, monitoring), and document residual risk and responsibilities (National Institute of Standards and Technology 2023). For AI/ML used as part of products (e.g., medical devices), regulators and partner agencies have articulated Good Machine Learning Practice (GMLP) principles that emphasize lifecycle management and transparency, concepts that translate well to internal clinical operations tooling (U.S. Food and Drug Administration, Health Canada, and UK Medicines and Healthcare products Regulatory Agency 2021).

In short, the regulatory posture toward AI is less “ban or bless” and more “show your work”: keep the decision trace, keep the data lineage, and make it clear where humans remain accountable.

3.3 The IND Process in Practice

The process from laboratory to clinical trial begins with the IND application (Figure 3.2), a process often preceded by a Pre-IND Meeting where sponsors align development plans with FDA expectations. The Food and Drug Omnibus Reform Act (FDORA), enacted in 2022, directs the FDA to require Diversity Action Plans for pivotal and Phase III studies; under the FDA’s implementing guidance, these plans call on sponsors to set enrollment goals for underrepresented populations (defined by race, ethnicity, sex, and age) and to describe how those goals will be met, moving diverse recruitment from an ethical best practice toward a matter of regulatory compliance. The 21st Century Cures Act (2016) directed the FDA to establish a framework for using real-world evidence (RWE); subsequent guidance has expanded the role of data from electronic health records, registries, and wearables in supporting new indications and post-marketing safety studies, and, in some rare-disease programs, external or synthetic control arms.

flowchart LR
    subgraph Submit["Submission"]
        A["Pre-IND<br/>Meeting"] --> B["IND<br/>Submission"] --> C{"30-day<br/>FDA review"}
    end
    
    subgraph Hold["If Clinical Hold"]
        E["Address<br/>Concerns"] --> F["Respond"]
    end
    
    D["Trial"]
    
    C -->|Hold| E
    F -.-> C
    C -->|Clear| D

Figure 3.2: The IND Application Process

IND applications are categorized based on their intent and the nature of the development program. A Commercial IND supports research aimed at securing marketing approval, whereas a Research IND is typically submitted by academic institutions for non-commercial study. In urgent circumstances, an Emergency IND permits the use of an investigational drug when time is of the essence, while a Treatment IND provides broad access to promising therapies for patients with serious conditions who lack alternative options before formal approval is granted.

3.4 International Considerations

Drug development has become a global enterprise, with trials conducted across multiple countries and regulatory submissions made to agencies around the world. To enable this global development, the International Council for Harmonisation (ICH) brings together regulatory authorities and pharmaceutical industries from the United States, European Union, Japan, and beyond to develop harmonized guidelines. Though not legally binding in themselves, ICH guidelines are adopted by member countries and have become the de facto international standards.

Key guidelines (Table 3.2) include E6 on Good Clinical Practice, E8 on general considerations for clinical trials, E9 on statistical principles, and M4 on the Common Technical Document format for regulatory submissions. Together, these guidelines enable sponsors to conduct trials that will be acceptable to regulators in multiple jurisdictions.

Table 3.2: Key ICH Guidelines for Clinical Trials

Guideline	Topic
E6	Good Clinical Practice (R3 updates focus on Quality by Design & Data Governance)
E8	General Considerations for Clinical Trials
E9	Statistical Principles (R1 adds “Estimands” framework)
E2A	Clinical Safety Data Management
E3	Structure and Content of Clinical Study Reports

Regional Regulatory Frameworks

While ICH provides common standards, regional regulatory frameworks govern how trials are conducted and approved in each jurisdiction. In the European Union, clinical trials are governed by the EU Clinical Trials Regulation 536/2014, which became fully applicable in January 2022. This regulation introduced a single submission portal (the Clinical Trials Information System or CTIS), harmonized assessment timelines across member states, and enhanced transparency with public access to trial information. For sponsors conducting multinational trials, the EU CTR significantly simplifies what was previously a fragmented approval process requiring separate submissions to each country.

Beyond the EU, major regulatory authorities include the Pharmaceuticals and Medical Devices Agency (PMDA) (Japan), National Medical Products Administration (NMPA) (China), Health Canada, and Therapeutic Goods Administration (TGA) (Australia). Specific requirements differ across these regions, reflecting different healthcare systems, patient populations, and regulatory traditions, but the ICH guidelines provide a common foundation that facilitates global development programs and enables sponsors to use clinical data across multiple regulatory submissions.

3.5 Good Clinical Practice

ICH E6 GCP is the international ethical and scientific quality standard for clinical trials (International Council for Harmonisation 2025b). The 2025 revision (R3) marks a substantial shift in GCP, moving from a primarily reactive quality control model to a proactive Quality by Design (QbD) approach. Under QbD, quality is built into trial design from the outset through systematic identification of critical factors, risk assessment, and implementation of appropriate controls, rather than relying solely on retrospective monitoring and correction.

E6(R3) also introduces enhanced requirements for data governance, recognizing that modern trials generate data from diverse sources (electronic health records, wearables, patient-reported outcomes, central laboratories) that must be managed with appropriate controls throughout the data lifecycle. The guideline emphasizes risk-proportionate approaches, allowing sponsors to tailor oversight intensity to the complexity and risk profile of each trial, and explicitly addresses technology-enabled trial designs including decentralized trials, electronic consent, and digital health technologies.

The guideline establishes responsibilities for the three key parties in any trial.

The IRB or Independent Ethics Committee reviews and approves trial documents before research begins, conducts continuing review throughout the trial, and receives reports of safety events and protocol deviations.

The Investigator (typically a physician) is responsible for conducting the trial according to GCP and the approved protocol, obtaining informed consent from each participant, reporting adverse events, and maintaining accurate records.

The Sponsor (whether a pharmaceutical company, academic institution, or government agency) is responsible for the overall design and conduct of the trial, including selecting qualified investigators, providing the investigational product, ensuring proper monitoring, and reporting safety information to regulatory authorities.

Throughout a clinical trial, investigators and sponsors must maintain essential documents to demonstrate GCP compliance and enable independent verification of data. These records are organized chronologically, beginning with the protocol and investigator’s brochure during startup, followed by consent forms and monitoring reports during the conduct phase, and concluding with final study reports and treatment allocation records upon study completion.

TipThe Trial Master File

All essential documents should be organized in a Trial Master File (TMF). The sponsor maintains a central file, while each investigator site maintains a site file. These records must be retained for years after the trial concludes, typically for periods defined by regional regulations. While historically ICH E6(R2) specified a minimum of two years following marketing approval or program discontinuation, the updated ICH E6(R3) (2025) framework defers entirely to applicable regional regulatory requirements; in the United States, FDA 21 CFR 312.62 requires sponsors to retain records for a minimum of two years.

3.6 Adaptive and Bayesian Trial Design: Regulatory Guidance

The past decade has seen substantial regulatory development on adaptive and Bayesian trial designs, moving from individual product approvals negotiated case by case to published guidance documents that define what sponsors must provide to use these approaches.

FDA Adaptive Design Guidance (2019)

FDA’s 2019 guidance on adaptive designs for drugs and biologics establishes the general framework under which adaptive modifications to clinical trials are evaluated (U.S. Food and Drug Administration 2019). The guidance makes a critical distinction between well-understood adaptations (sample size re-estimation based on blinded nuisance parameters, pre-specified dose dropping, pre-specified adaptive randomization) and less well-understood adaptations (modifications to primary endpoints, changes to treatment definition, borrowing across subpopulations). Well-understood adaptations are generally acceptable when pre-specified; less well-understood adaptations require more extensive justification and regulatory agreement in advance.

Three requirements recur throughout the guidance:

1. Pre-specification. Adaptation rules must be written into the protocol and statistical analysis plan before enrollment begins. Post-hoc adaptations, even beneficial-seeming ones, are unacceptable because they create the opportunity for bias.

2. Type I error control. The overall probability of a false-positive result across all adaptation points must be maintained at the pre-specified level, typically 5% (two-sided) or 2.5% (one-sided). The guidance requires sponsors to demonstrate this control analytically or through simulation.

3. Operational integrity. The independence of the unblinded interim analyses from the sponsor must be maintained through firewalled statistical teams and procedures that prevent adaptive information from reaching people who can influence trial conduct.

FDA Bayesian Guidance

FDA guidance on Bayesian statistical methodology addresses the specific challenges of trials that use prior information. For medical devices, a 2010 guidance applies (U.S. Food and Drug Administration 2010). For drugs and biologics, FDA issued a draft guidance in January 2026 covering Bayesian methods in drug and biologic trials (U.S. Food and Drug Administration 2026); prior to that guidance, the adaptive design guidance and Complex Innovative Design meeting interactions had established operating norms (U.S. Food and Drug Administration 2019). The January 2026 draft distinguishes between Bayesian approaches used with Type I error control (calibrating the trial to achieve a pre-specified frequentist error rate, with Bayesian machinery used for computational convenience) and those used without Type I error control (where an informative prior from prior studies or related evidence reduces the required evidence from the current trial, and the combined posterior probability is the decision criterion).

For the “without control” category, the January 2026 draft requires that the prior be robust, relevant, and reliable: based on patient-level data from comparable populations, pre-specified and agreed with FDA before enrollment, and subjected to sensitivity analyses that demonstrate the trial’s conclusions are not entirely driven by the prior (U.S. Food and Drug Administration 2026). The draft notes that evaluating Type I error in this setting by conditioning on the null hypothesis is philosophically inconsistent with an informative prior that assumes a nonzero effect, and does not require that the error be controlled below a fixed threshold, provided the prior evidence is adequately justified.

The draft also addresses discounting: when borrowing from historical or prior studies, the borrowed information should be discounted to account for the possibility that the historical and current populations differ (U.S. Food and Drug Administration 2026). Dynamic discounting, which automatically reduces borrowing when the current trial data diverge from the prior, is preferred over static discounting (a fixed fraction) because it mitigates the risk of drawing incorrect conclusions when populations differ.

ICH E20: International Harmonization

ICH E20, the first international harmonized guideline specifically addressing adaptive clinical trials, was in Step 2 draft as of 2025 (International Council for Harmonisation 2025a). E20 provides a common framework across FDA, EMA, and other ICH regions for what constitutes an acceptable adaptive design: pre-specification of decision rules, simulation to characterize operating characteristics, and appropriate error control. For sponsors conducting global trials, E20 alignment means that an adaptive design acceptable to FDA will generally be acceptable to EMA and PMDA as well, reducing the risk of region-specific redesign.

ImportantRegulatory engagement for adaptive designs

Sponsors should engage with regulators before finalizing the protocol for any novel adaptive design. For FDA, this typically means a Type C meeting or similar interaction at which the agency reviews the proposed adaptation rules, the simulation package, and the decision thresholds. For designs that intend to use Bayesian methods with informative priors or borrowing, agreement on the prior and discounting scheme should be reached before enrollment. Retroactive negotiation over adaptive design choices is very unlikely to succeed.

Simulation as Regulatory Evidence

Both the FDA adaptive design guidance and ICH E20 treat simulation as the primary tool for demonstrating that a proposed adaptive design has acceptable operating characteristics. A simulation package for an adaptive trial should characterize:

• Type I error rate: the probability of a false positive across a range of null scenarios, including scenarios where the adaptation rule might inflate error
• Power: the probability of correctly concluding efficacy across a range of true effect sizes and interim trajectories
• Sample size distribution: the expected and worst-case sample sizes under both null and alternative scenarios, including scenarios where adaptation causes substantial expansion
• Bias: whether adaptive allocation or early stopping produces estimated effect sizes that systematically differ from the true treatment effect

FDA reviewers examine simulation packages as they would examine statistical analysis code: for correctness, completeness, and reproducibility. Sponsors should plan to submit simulation code and seed values that allow FDA to reproduce results independently.

3.7 Inspections and Enforcement

The regulatory framework has teeth. The FDA conducts inspections of clinical trial sites to verify compliance and data integrity. These may be routine inspections as part of a marketing application review, for-cause inspections triggered by specific concerns, or directed inspections focused on particular issues identified during application review.

Following an inspection, the FDA classifies findings as NAI (no action indicated) when no significant problems are found, VAI (voluntary action indicated) when minor deviations should be corrected, or OAI (official action indicated) when significant violations require regulatory action.

Serious violations can result in rejection of trial data from regulatory submissions, clinical holds on ongoing trials, and even debarment of investigators from conducting FDA-regulated research. Criminal penalties are possible in extreme cases involving fraud or egregious misconduct.

Association of Clinical Research Organizations. 2025. “2025 Risk-Based Quality Management (RBQM) Summary Report.” https://www.acrohealth.org/wp-content/uploads/2025/06/ACRO_2025-RBQM-Report_Final-062425.pdf.

International Council for Harmonisation. 2025a. “E20 Adaptive Designs for Clinical Trials.” https://www.ema.europa.eu/en/ich-e20-adaptive-designs-clinical-trials-scientific-guideline.

———. 2025b. “ICH E6(R3): Guideline for Good Clinical Practice (GCP).” https://database.ich.org/sites/default/files/ICH_E6%28R3%29_Step4_FinalGuideline_2025_0106.pdf.

Messeri, Lisa, and M. J. Crockett. 2024. “Artificial Intelligence and Illusions of Understanding in Scientific Research.” Nature. https://www.nature.com/articles/s41586-024-07146-0.

National Institute of Standards and Technology. 2023. “Artificial Intelligence Risk Management Framework (AI RMF 1.0).” https://www.nist.gov/itl/ai-risk-management-framework.

TMF Reference Model Initiative. 2024. “Trial Master File Reference Model.” https://tmfrefmodel.com/.

U.S. Food and Drug Administration. 2010. “Guidance for the Use of Bayesian Statistics in Medical Device Clinical Trials.” U.S. Food; Drug Administration. https://www.fda.gov/media/71512/download.

———. 2019. “Adaptive Designs for Clinical Trials of Drugs and Biologics: Guidance for Industry.” https://www.fda.gov/regulatory-information/search-fda-guidance-documents/adaptive-design-clinical-trials-drugs-and-biologics-guidance-industry.

———. 2023a. “21 CFR Part 11: Electronic Records; Electronic Signatures.” https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11.

———. 2023b. “21 CFR Part 50: Protection of Human Subjects.” https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-50.

———. 2023c. “21 CFR Part 56: Institutional Review Boards.” https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-56.

———. 2024a. “21 CFR Part 312: Investigational New Drug Application.” https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312.

———. 2024b. “FDA Organization.” https://www.fda.gov/about-fda/fda-organization.

———. 2026. “Use of Bayesian Methodology in Clinical Trials of Drug and Biological Products.” U.S. Food; Drug Administration. https://www.fda.gov/media/190505/download.

U.S. Food and Drug Administration, Health Canada, and UK Medicines and Healthcare products Regulatory Agency. 2021. “Good Machine Learning Practice for Medical Device Development: Guiding Principles.” https://www.fda.gov/medical-devices/software-medical-device-samd/good-machine-learning-practice-medical-device-development-guiding-principles.

Wang, Zifeng, Junyi Gao, Benjamin Danek, Brandon Theodorou, Ruba Shaik, Shivashankar Thati, Seunghyun Won, and Jimeng Sun. 2025. “Compliance and Factuality of Large Language Models for Clinical Research Document Generation.” Journal of the American Medical Informatics Association. https://doi.org/10.1093/jamia/ocaf174.