# Regulatory Research

> Research and summarize FDA guidance documents, ICH guidelines, 21 CFR Part 11, EU Annex 11, and GDPR for clinical trials with impact analysis on Talosix product features.

- Skill: `nroze22/regulatory-research` (Agent Skill)
- Install (CLI): `npx skillmds@latest add nroze22/regulatory-research`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nroze22/regulatory-research/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- Author: nroze22 (https://skillmd.com/u/nroze22)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nroze22/regulatory-research

---


# Regulatory Research

## Purpose

Research, summarize, and cross-reference regulatory requirements applicable to Talosix clinical trial EDC systems. Provide impact analysis of regulations on product features and operational processes.

## When to Use

- Evaluating regulatory requirements for new features
- Responding to regulatory questions from clients or auditors
- Preparing regulatory compliance documentation
- Assessing impact of new or updated regulations
- Supporting pre-submission planning
- Training content development

## Core Regulatory Framework

### Tier 1: Directly Applicable Regulations

#### 21 CFR Part 11 - Electronic Records; Electronic Signatures (FDA)

**Scope**: Applies to records required by FDA predicate rules that are created, modified, maintained, archived, retrieved, or transmitted in electronic form.

**Key Requirements for EDC Systems:**

| Subpart | Section | Requirement | EDC Impact |
|---------|---------|-------------|------------|
| B | 11.10(a) | System validation | Full validation lifecycle required |
| B | 11.10(b) | Record legibility and retrieval | Records must be exportable and printable |
| B | 11.10(c) | Record protection | Backup, recovery, retention controls |
| B | 11.10(d) | Access limitation | Role-based access, unique user IDs |
| B | 11.10(e) | Audit trails | Computer-generated, timestamped, reason for change |
| B | 11.10(f) | Operational system checks | Sequence enforcement for workflows |
| B | 11.10(g) | Authority checks | Prevent unauthorized actions |
| B | 11.10(h) | Device checks | Source data verification capabilities |
| B | 11.10(i) | Training | Documented training for all users |
| B | 11.10(j) | Written policies | SOPs for system use and e-sig accountability |
| B | 11.10(k) | Documentation controls | Distribution, access, revision controls |
| C | 11.50 | Signature manifestations | Display signer name, date/time, meaning |
| C | 11.70 | Signature/record linking | Signatures inseparable from records |
| C | 11.100 | General e-sig requirements | Each signature unique to one individual |
| C | 11.200 | Components and controls | At minimum user ID + password |

**Key FDA Guidance Documents:**

1. Part 11, Electronic Records; Electronic Signatures -- Scope and Application (2003)
   - Clarifies FDA enforcement discretion
   - Narrowed scope to predicate rule records
   - Audit trails and record retention remain enforced

2. Guidance for Industry: Computerized Systems Used in Clinical Investigations (2007)
   - Source data at investigator sites
   - Sponsor responsibilities for electronic systems
   - Audit trail requirements for clinical data

3. Data Integrity and Compliance With Drug CGMP (2018)
   - ALCOA+ principles
   - Data governance expectations
   - Applicable concepts extend to clinical data

4. Use of Electronic Records and Electronic Signatures in Clinical Investigations Under 21 CFR Part 11 (2017)
   - Specific to clinical investigations
   - Remote access and electronic consent
   - Expectations for EDC systems

#### EU Annex 11 - Computerised Systems (EMA)

**Scope**: Applies to all forms of computerised systems used as part of GMP regulated activities.

**Key Sections and EDC Impact:**

| Section | Requirement | EDC Impact |
|---------|-------------|------------|
| 1 | Risk management applied throughout lifecycle | Risk-based validation approach |
| 2 | Personnel with appropriate qualifications | Training documentation required |
| 3 | Suppliers and service providers assessed | Vendor qualification needed |
| 4 | Validation proportionate to risk | GAMP 5 methodology |
| 5 | Data accuracy, integrity checks | Edit checks, data validation |
| 6 | Accuracy checks on data input | Input validation controls |
| 7 | Data storage with backup and recovery | Data retention and backup |
| 8 | Printouts of electronically stored data | Print and export capabilities |
| 9 | Audit trails for GMP relevant changes | Comprehensive audit trail |
| 10 | Change management procedures | Formal change control |
| 11 | Periodic evaluation of systems | Periodic review process |
| 12 | Security controls | Access management, encryption |
| 13 | Incident management | Issue tracking and CAPA |
| 14 | Electronic signatures | E-signature controls |
| 16 | Business continuity | DR and continuity plans |
| 17 | Archiving | Long-term data archiving |

#### ICH E6(R2) - Good Clinical Practice

**Scope**: International standard for design, conduct, recording, and reporting of clinical trials.

**Key Sections for EDC:**

- 1.11: Documentation definition includes electronic records
- 4.9: Records and reports requirements
- 5.5: Trial management, data handling, record keeping
- 5.5.3: Electronic data handling systems require validation
- 5.18.4(n): Monitoring includes computerized systems verification
- 8.1: Essential documents in electronic format

#### ICH E6(R3) - GCP Renovation (Emerging)

Key changes relevant to EDC:
- Proportionality principle for quality management
- Enhanced focus on risk-based approaches
- Technology-agnostic language
- Expanded guidance on electronic systems
- Greater emphasis on data governance

### Tier 2: Data Privacy Regulations

#### GDPR (EU General Data Protection Regulation)

**Applicability to Clinical Trials:**

| Article | Requirement | EDC Impact |
|---------|-------------|------------|
| 5 | Data processing principles | Lawfulness, purpose limitation, minimization |
| 6 | Lawful basis for processing | Consent or legitimate interest documentation |
| 9 | Special category data (health) | Explicit consent or regulatory basis needed |
| 15-22 | Data subject rights | Right of access, rectification, erasure considerations |
| 25 | Data protection by design | Privacy built into system architecture |
| 28 | Processor requirements | Data processing agreements with vendors |
| 30 | Records of processing | Processing activity documentation |
| 32 | Security of processing | Encryption, pseudonymization, access controls |
| 33-34 | Breach notification | 72-hour notification capability |
| 35 | Data Protection Impact Assessment | DPIA for clinical trial data processing |
| 44-49 | International transfers | Standard contractual clauses, adequacy decisions |

**Clinical Trial Regulation (EU) 536/2014 Interaction:**
- Article 28(2): GDPR rights vs. clinical data integrity
- Erasure right limited by data retention requirements
- Pseudonymization requirements for clinical data

### Tier 3: Regional and Supplementary Standards

#### MHRA (UK Post-Brexit)

- UK GDPR and Data Protection Act 2018
- MHRA GXP Data Integrity Guidance (2018)
- UK clinical trial regulation alignment

#### PMDA (Japan)

- ERES Guidelines (Electronic Records, Electronic Signatures)
- J-GCP requirements

#### TGA (Australia)

- Australian Privacy Act
- TGA GCP inspection requirements

#### Health Canada

- Division 5 of the Food and Drug Regulations
- Data integrity expectations per GAMP 5

## Research Methodology

### When Researching a Regulatory Question

1. **Identify the question scope**: Which regulations, which jurisdictions, which product features
2. **Primary source review**: Read the actual regulation text, not summaries
3. **Guidance document review**: Check FDA guidance, EMA Q&A documents, ICH guidelines
4. **Industry interpretation**: Review ISPE GAMP, DIA publications, regulatory authority presentations
5. **Cross-reference**: Identify conflicts or gaps between jurisdictions
6. **Impact assessment**: Map findings to specific Talosix features and processes

### Impact Analysis Template

```
Regulatory Finding Impact Assessment

Regulation: [Name and section]
Jurisdiction: [FDA/EMA/ICH/etc.]
Requirement Summary: [Plain language summary]

Impact on Talosix EDC:
- Feature(s) Affected: [List specific features]
- Current Compliance Status: Compliant / Partially Compliant / Gap
- Gap Description: [If applicable]
- Remediation Required: [Yes/No]
- Remediation Approach: [Brief description]
- Estimated Effort: [T-shirt size]
- Priority: [Based on regulatory risk]
- Timeline: [Recommended completion]

Cross-Reference:
- Related requirements from other regulations: [List]
- Existing URS items addressing this: [List]
- Existing test cases verifying this: [List]
```

### Regulatory Change Monitoring

Track regulatory updates relevant to clinical trial EDC:

```
| Date | Source | Change Description | Impact Level | Action Required | Owner | Status |
```

**Sources to Monitor:**
- FDA Federal Register notices
- EMA guideline publications
- ICH guideline updates
- ISPE GAMP publications
- DIA regulatory intelligence
- National competent authority publications

## Common Regulatory Questions for EDC

Maintain a knowledge base of frequently asked regulatory questions:

1. What constitutes an electronic record under Part 11?
2. When is an audit trail entry required?
3. What metadata must be captured with an electronic signature?
4. How long must clinical trial data be retained?
5. What are the requirements for data migration between systems?
6. When does a PDF constitute a "true copy" of an electronic record?
7. What are the expectations for cloud-hosted GxP systems?
8. How do GDPR subject access requests interact with clinical data?
9. What validation evidence is required for COTS vs custom software?
10. What are the expectations for mobile/ePRO data capture?

## Output Format

When performing regulatory research, deliver:

1. **Executive summary**: Key findings in plain language
2. **Regulatory citations**: Exact regulation text with section numbers
3. **Cross-reference table**: How requirements align across jurisdictions
4. **Impact assessment**: Specific impact on Talosix features
5. **Recommendations**: Prioritized action items
6. **References**: Complete list of sources consulted

## Regulatory References

- 21 CFR Part 11 (FDA)
- EU Annex 11 (EMA)
- ICH E6(R2) and E6(R3) (ICH)
- EU GDPR (Regulation 2016/679)
- EU Clinical Trials Regulation 536/2014
- ISPE GAMP 5 (Second Edition)
- FDA Guidance Documents (see individual citations above)
- MHRA GXP Data Integrity Guidance (2018)
- PIC/S Good Practices for Data Management (2021)