ALCOA+ on the Device: Device-Side Data Integrity in GCP
When a device captures trial data — a handset, a wearable, a home instrument or the gateway that relays them — attribution, time and protection against alteration are decided on the device, and no validated database can decide them later.
REGULATORY OPERATIONSIntegrity is decided at the point of capture on the device — attribution, time and protection against alteration are fixed there, and no validated database can restore them later.
"Our EDC is validated, so data integrity is handled" stops one system too late: the record was captured upstream. Engineer and validate the ALCOA++ controls on the device — on-device audit trail, trusted time, attributed entry, signature binding and integrity across the sync seam — and feed the timing and offline-capture triggers into the Trigger Register.
Integrity is decided at capture, but FDA and the EMA guideline look for it in different places
FDA — source data sit in the repository
- Part 11 Q&A (Q23) and DHT guidance (s.IV.G): DHT electronic source data are located in the durable electronic data repository
- FDA does not intend to inspect individual DHTs for source data verification
- It asks instead for a validated, prompt transfer whose date and time enter the audit trail (Q22)
- System clock must be controlled (Q14)
EMA guideline — controls on the device itself
- No user-modifiable date, time or time zone on the data-entry device where it is the timestamp (s.5.5)
- Locally held data must not change without the originator's knowledge before saving (s.6.2.1)
- ePRO devices and BYOD apps are within scope (Annex 5, A5.1)
- The sponsor must never hold exclusive control of the data (s.6.6)
Four positions that move integrity from the database to the device
Once the device captures regulated data, the record's attribution, timestamp and protection against alteration are set there, before any upload — on two devices in sequence where a wearable hands off to a gateway.
A user-modifiable device clock used as the timestamp is an integrity weakness wherever timing matters; the achievable control is trusted server or network time plus discrepancy detection.
The back-end can be flawless while the device-side record is not trustworthy. Integrity lost at capture cannot be reconstructed afterwards — the loss is irrecoverable.
Part 11 §11.10(d)-(e), §§11.50 and 11.70; EMA s.4.5, 5.5, 6.2.1, 6.6 and Annex 5; ICH E6(R3) Section 4 and s.3.16. EU GMP Annex 11 is a manufacturing instrument, not the reference.
Six questions to answer on the device before enrollment
- 1Build an on-device audit trail of entries and changes before sync — without it, a change at capture is invisible (EMA s.6.2.1; Part 11 §11.10(e)).
- 2Use trusted server or network time; lock the device clock where it is the timestamp and detect and log discrepancies (EMA s.5.5; FDA Q14).
- 3Attribute every entry to the authenticated participant or user — an unattributable record cannot support the endpoint.
- 4Bind each electronic signature to the person and record, manifesting signer, date and time, and meaning (§§11.50, 11.70).
- 5Protect the offline window and the sync seam with a tamper-evident local store and integrity checks; validate across the BYOD fleet, not one reference device.
- 6Retain the original record and metadata through to decommissioning (QPP-13); CTR Art. 58 sets 25 years for the trial master file.
21 CFR Part 11 (§§11.10, 11.50, 11.70) · FDA Part 11 Q&A guidance (2024, Q14, Q22–Q23) · FDA DHT guidance (s.IV.G) · EMA/INS/GCP/112288/2023 (s.4.5, 5.5, 6.2.1, 6.6, Annex 5) · ICH E6(R3) Section 4 and Annex 2 · CTR Art. 58
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call