EMA notice on computerised systems in trials: what sponsors should check now

What happened

On 28 October 2026, EMA published a notice to sponsors on the validation and qualification of computerised systems used in clinical trials. The document is hosted in the agency's regulatory and procedural guideline section. Its file name carries a "rev1" label, which suggests a revised version of an earlier text.

The information available to us is limited to the publication itself. It does not describe the notice's specific requirements, any expected implementation timeline, or what changed from a previous version. We therefore do not characterise its content here. Teams should read the primary document before acting on any summary, including this one.

Why it matters even before the details are digested

Computerised systems sit under almost every part of a modern trial: data capture, randomisation, safety reporting, document management and the other platforms sponsors rely on. When EMA addresses how those systems are validated and qualified, it touches both the credibility of trial data and the sponsor's ability to show that credibility to an inspector.

The notice is addressed to sponsors, and the sponsor is ultimately accountable for trial conduct under GCP even when vendors operate the systems. In practice, that makes the notice relevant to quality assurance, clinical operations, data management, IT and pharmacovigilance teams alike. PV matters here because safety data often flows through trial systems before it reaches safety databases, so validation gaps in one place can become reconciliation problems in another.

Regulatory context

Validation and qualification are long-standing GxP concepts. Validation generally means documented evidence that a system does what it is intended to do consistently. Qualification generally refers to demonstrating that infrastructure or components are fit for purpose. Data integrity expectations, such as attributable, accurate and complete records with traceable changes, sit alongside both.

A notice to sponsors is guidance-level communication, not a new law. Even so, inspectors and assessors tend to read such documents as signals of what they will look for. What the notice means for any particular programme depends on its wording, which we have not reviewed in detail.

Who is affected, with one illustration

The most obvious audience is any sponsor running trials that fall under EMA's remit, along with the CROs and technology vendors that operate systems on their behalf. Whether non-EU sponsors are affected depends on whether their trials are conducted in, or submitted to, the EU. The records do not settle that question for any named company.

A concurrent news item shows why data systems matter at the point of decision. On 26 October 2026, Acumen Pharmaceuticals said topline results from its 542-patient Phase 2 ALTITUDE-AD trial of sabirnetug in early Alzheimer's disease are expected in November 2026. The readout will cover the iADRS primary endpoint, secondary endpoints and safety measures including ARIA rates. The company also reported $78.6 million in cash, projected to last into early 2027, and targets an IND filing for its Enhanced Brain Delivery lead candidate in mid-2027.

We draw no link between Acumen and the EMA notice. Nothing in the records says the trial is subject to it or describes the company's systems. The example simply shows the stakes. A trial with a large enrolment, a defined primary endpoint and closely watched safety measures produces a dataset on which a small company's near-term plans rest. Whatever the jurisdiction, trusted data depends on trusted systems, and the cost of discovering a validation weakness late is highest when a readout is close.

What to watch

First, read the notice itself and note whether it sets any transition period or effective date. Our records give none, so teams should not assume one. Second, watch for how it is positioned against the validation and data integrity expectations your organisation already applies, and whether it changes the division of responsibility between sponsors and service providers.

Third, watch inspection feedback. Findings on computerised systems, once they surface in sponsor and CRO discussions, will show which parts of the notice regulators emphasise in practice. Until then, a documented, risk-based gap assessment is the sensible starting point, and it is better done before a database lock than after.