Validate the system before you need the data: computerised systems are now a trial-design issue

The notice most teams will skim

On 28 October EMA published a notice to sponsors on the validation and qualification of computerised systems used in clinical trials. The information available to us does not set out what the notice requires, and I will not guess. But the subject is enough to make a point. Validation of the systems that capture, hold and transmit trial data is no longer a back-office hygiene item. It is part of whether a trial's results can be trusted.

The same week's news shows why. Acumen Pharmaceuticals expects topline results next month from its 542-patient Phase 2 ALTITUDE-AD trial of sabirnetug in early Alzheimer's disease, with ARIA rates among the safety measures. Viking Therapeutics has started Phase 3 trials of oral VK2735 in obesity and type 2 diabetes, while its subcutaneous VANQUISH studies remain on track to complete in 2027, and it reports $960m in cash. These are different companies at different stages. Both depend on trial data that must stand up to scrutiny.

Why the system is part of the evidence

Consider what a safety endpoint such as ARIA asks of a trial. ARIA is a imaging-detected finding, so the rate a sponsor reports depends on how the data are collected, transmitted, reconciled and locked. A headline safety figure is only as credible as the systems behind it. I am not suggesting anything is wrong at Acumen. The records say nothing about its systems. The point is general: when a readout turns on safety measures, the questions that follow concern data provenance as much as the numbers.

Viking illustrates a second pressure: concurrency. An oral Phase 3 programme running alongside subcutaneous studies that are still on track to complete in 2027 means more sites, more data flows and more system configurations operating at once. Every new programme multiplies the validation surface. Teams that treat validation as a one-off project per study will find it does not scale.

The strongest counter-argument

The fair objection is that we do not yet know what the notice says. A notice to sponsors is not new legislation, and teams already operate under established good clinical practice expectations. Why reorganise around a document whose content we have not been able to assess? There is also a resource argument. A company with $960m in cash can fund validation depth that a smaller sponsor cannot, and for the latter the money may do more good in enrolment than in documentation.

I accept both points, and they argue for reading the notice carefully, not for ignoring it. Validation shortfalls are cheapest to fix before a database lock and most expensive after a topline release, when regulators and investors alike ask how the numbers were produced. The resource argument also cuts the other way: smaller sponsors rely more heavily on vendors, and a vendor's system is still the sponsor's responsibility to oversee.

My position

Clinical operations and regulatory teams should stop treating computerised-system validation as a downstream QA exercise and make it a design-stage decision, signed off alongside the protocol. If a trial's value rests on a particular safety or efficacy measure, the systems that capture that measure should be named, qualified and documented before first patient in, not reconstructed before submission.

The notice is the prompt. Read it as soon as you can, and compare it against your current practice rather than waiting for an inspection finding to do the comparison for you.