Regulatory Impact Assessment (RIA) for Devices and Systems in Clinical Trials
Why a device’s role and triggers — not the hardware — determine whether an RIA is required
REGULATORY OPERATIONSEvery device and system a trial relies on needs a Regulatory Impact Assessment — and for most deployments that assessment is short and returns minimal controls.
"It's just a phone", "just the modem", "already a cleared device" are conclusions the assessment can reach; none is an exemption from performing one. Assess rather than assume: place each device on the role scale, test the triggers, record the controls decision per stakeholder, and re-run it on every material change.
Regulatory weight rises with the device's role, not with its hardware
Four principles that turn "no RIA needed" from an assumption into a finding
"Merely carries the study" is itself a classification. Only an assessment of the deployment's role and triggers can confirm it; skipping it leaves the risk undetermined and the decision undocumented.
The same smartphone is a passive carrier in one study and a measurement instrument or MDSW host in another. One device can sit inside several perimeters at once — obligations stack, they do not substitute.
FDA's 2023 DHT guidance expects verification and validation regardless of whether the DHT meets the device definition; ICH E6(R3) expects computerized systems to be fit for purpose and recorded.
Effort scales to the risk found; a sponsor's RIA does not discharge its eCOA, connectivity or MDM vendor's; and the assessment is re-run on material change, not signed off once.
Recorded steps first, then the practical next steps
- 1Identify every device and system the trial relies on in a non-investigational capacity — phones, gateways, wearables, platforms.
- 2Establish the role of each on the five-rung scale and test the nine triggers — own-sensor measurement, endpoint feed, medical purpose, eConsent, GCP source data, updates.
- 3Record the controls decision — minimal, standard or full device and GxP controls — with its rationale and the owning stakeholder.
- 4Enter the material-change triggers in a Trigger Register (QPP-08) and re-assess at each one: updates, new endpoints, new vendor, route or country.
- 5Keep the sponsor accountable throughout: under ICH E6(R3) s.3.6 ultimate responsibility for data reliability stays with the sponsor, however much is transferred.
ICH E6(R3) and Annex 2 · FDA DHT guidance (Dec 2023) · FDA decentralized elements (Sept 2024) · HMA/EC/EMA DCT paper v02 · EU MDR 2017/745 Arts 10–16, 22 · IVDR 2017/746 · MDCG 2019-11 Rev. 1 · AI Act 2024/1689 · Reg. 2026/1744 · 21 CFR Part 11 · EMA/INS/GCP/112288/2023 · GDPR
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call