Where the Evidence Is Actually Made
A companion reading from the CRO and site seat — which duties are yours, which are the sponsor’s, and which control belongs to neither of you
REGULATORY OPERATIONSA CRO and an investigator site are two different parties under GCP: the duties divide between them, and one control here belongs to neither.
Inspectors do not examine the device; they examine what the site did around it — consent versions, delegation and training, and whether device and app problems were escalated and recorded. You cannot build an audit trail on a participant's own phone: that control belongs to the sponsor and the system vendor.
Five duties concentrate at the site, each with an owner — except one
| Perimeter | What it means for you | CRO / site action / evidence |
|---|---|---|
| Data integrity | Using the study systems as designed; recording when they are not | Escalate device and app problems; never build a BYOD audit trail |
| Inspection | Producing the site-side record an inspection actually asks for | Keep consent versions, delegation, training and issue records current |
| Human factors / consent | Catching use problems; administering eConsent and re-consent | Log usability issues; control eConsent versions and re-consent process |
| Change control | Receiving and escalating app / OS change notifications | Route every change notice to the sponsor and the Trigger Register |
| Oversight | Performing vendor oversight as a delegated, overseen activity | Evidence the oversight you perform — it is itself overseen |
Four facts about your seat — and one control that is not yours
Consent, delegation and the record of what happened are the site's; data management and monitoring are usually the CRO's.
Where the sponsor transfers vendor oversight to the CRO, ICH E6(R3) s.3.6.9 keeps it inside the sponsor's accountability — and expects evidence.
Usability problems, confusion and device failures reach you before anyone else — and only if you record them do they reach the sponsor at all.
It is generated by the application and held in the repository; the sponsor and the system vendor own it, on BYOD as on provisioned devices.
Five records make your operations defensible
- 1Confirm who owns the device-side controls — get the sponsor's written statement that audit trail, access and time are system-generated.
- 2Control consent versions — tie every consent and re-consent to the approved version in force; a superseded version is a serious deficiency.
- 3Run a standing escalation routine — a named path for app, device and OS change notices into the sponsor and the Trigger Register.
- 4Evidence the oversight the CRO performs — record the transferred vendor oversight, because it is itself overseen.
- 5Keep the site-side record current — consent versions, delegation and training, issue and deviation records, ready when asked for.
ICH E6(R3) s.2 (s.2.8), s.3.6 (ss.3.6.6–3.6.9) · FDA Electronic Systems Q&A (Oct 2024), Q23 · FDA DHT guidance (Dec 2023), s.IV.G · FDA Decentralized Elements (2024) · EMA/INS/GCP/112288/2023 · HMA/EC/EMA DCT paper v02
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call