Inspection-Ready: What FDA, EU and MHRA Inspectors Look For in DHT Evidence
In qointa’s experience the first inspection sets the baseline. What digital-trial evidence inspectors expect, what it is grounded in — and why it must exist before they ask.
REGULATORY OPERATIONSThe evidence an inspector asks for in a digital trial is contemporaneous: it is generated while the trial runs or not at all.
The standard is written down — 21 CFR Part 11 and FDA's Part 11 Q&A, the EMA computerized-systems guideline, ICH E6(R3) — so a sponsor can build to it before the first request. QA / GCP compliance owns a readiness pack, scoped in the RIA before enrollment and kept current through the Trigger Register; the sponsor signs it off.
The inspection baseline is knowable in advance: six evidence areas, each anchored in a published provision
| Area | What is examined | Grounding |
|---|---|---|
| Audit trail | Who did what and when, on the device and at the device–system boundary | 21 CFR 11.10(e); EMA guideline 6.2.1–6.2.2; Part 11 Q&A Q22 |
| Timestamps | Time used for windowed assessments; protection against user-settable clocks | EMA guideline 5.5; Part 11 Q&A Q14; drift monitoring (qointa) |
| Electronic signature | Binding of eConsent and other signatures to person and record | 21 CFR 11.50, 11.70; EMA guideline 4.8, Annex 5 A5.3 |
| Validation | System and specific device configuration validated for their use | EMA guideline Annex 2; ICH E6(R3) 3.9; Part 11 Q&A Q7 |
| Change control | How app and OS updates during the study were assessed | EMA guideline A2.10; Part 11 Q&A Q7; FDA DHT guidance IV.H.4 |
| Source data & access | FDA: the durable repository, devices not inspected. EU: first permanent record, device-side controls | Part 11 Q&A Q23; EMA guideline 4.4, Annex 3, Annex 5 A5.1 |
Four positions: readiness is a property the trial has by inspection day, or does not
Audit trail, time, signatures, validation and change control are grounded in Regulation (EU) 536/2014, 21 CFR Part 11, ICH E6(R3), the EMA guideline and FDA's Part 11 Q&A. EU GMP Annex 11 is not a GCP instrument.
"We believed it was fine" is the weakest answer; documented assessment and validation are the strongest. Records not kept during the trial cannot be produced on request.
In qointa's experience the level of control demonstrated becomes the de facto standard for the study and for later digital trials. A weak showing is harder to walk back than to meet.
Sponsor accountability for data reliability and oversight of service providers persists where the participant owns the device (ICH E6(R3) 3.6; EMA guideline Annex 5, A5.1). Recurring findings cluster here.
Six deployment facts that raise exposure — and how the RIA closes each before the trial runs
- 1Define the electronic source and the capture-to-repository path in the RIA; set audit-trail, timestamp and access controls up front.
- 2Bring BYOD inside the validated perimeter; record the device / OS range and its assessment.
- 3Lock device date, time and time zone (EMA guideline 5.5); use trusted server time; monitor device–server drift; flag user-settable clocks in the Trigger Register.
- 4Validate the signature-to-identity-to-record binding for eConsent and retain the binding evidence.
- 5Log every app or OS update and its assessment under change control (QPP-07) and the Trigger Register (QPP-08).
- 6Assemble and index the readiness pack before any request, and run a mock inspection to test retrieval.
21 CFR Part 11 · FDA Part 11 Q&A (Oct 2024) · FDA BIMO process guidance (Dec 2025) · FDA DHT guidance IV.H.4 · EMA/INS/GCP/112288/2023 · ICH E6(R3) incl. Annex 2 (Step 4, 3 June 2026) · Regulation (EU) 536/2014 · MHRA GCP guidance (ALCOA)
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call