Reference:EU EMA/INS/GCP/112288/2023 - Guideline on computerised systems and electronic data in clinical trials 2023 4.8

Document information
Reference	EU EMA/INS/GCP/112288/2023 - Guideline on computerised systems and electronic data in clinical trials 2023
Validity area	EU
Scope(s)	G
Document name	EMA/INS/GCP/112288/2023 - Guideline on computerised systems and electronic data in clinical trials
Version / Revision	2023
Status	Current
Document type	Official guideline
Language(s)	EN
Description	EMA/INS/GCP/112288/2023 Good Clinical Practice Inspectors Working Group (GCP IWG) Guideline on computerised systems and electronic data in clinical trials
Official source	Official link
Restricted access	No
Submitted by	Florian Adragna
Contributors

Reference Details
Module	Module 4 — Unit 4.2.4
Scope	G
Document part	4.8
Language	EN
Original entry by	Florian Adragna
Contributors
Tags	Electronic signature, Signature, Requirements, Device system

Content

4.8. Electronic signatures Whenever ICH E6 requires a document to be signed and an electronic signature is used for that purpose, the electronic signature functionality should meet the expectations stated below regarding authentication, non-repudiation, unbreakable link, and timestamp of the signature.

The system should thus include functionality to: • authenticate the signatory, i.e. establish a high degree of certainty that a record was signed by the claimed signatory; • ensure non-repudiation, i.e. that the signatory cannot later deny having signed the record; • ensure an unbreakable link between the electronic record and its signature, i.e. that the contents of a signed (approved) version of a record cannot later be changed by anyone without the signature being rendered visibly invalid; • provide a timestamp, i.e. that the date, time, and time zone when the signature was applied is recorded.

Electronic signatures can further be divided into two groups depending on whether the identity of the signatory is known in advance, i.e. signatures executed in 'closed' and in 'open' systems.

For 'closed' systems, which constitute the majority of systems used in clinical trials and which are typically provided by the responsible party or by their respective service provider, the system owner knows the identity of all users and signatories and grants and controls their access rights to the system. Regulation (EU) No 910/2014 ('eIDAS') on electronic identification and trust services for electronic transactions is not applicable for 'closed' systems ('eIDAS' article 2.2). The electronic signature functionality in these systems should be proven during system validation to meet the expectations mentioned above.

For 'open' systems, the signatories (and users) are not known in advance. For sites located in the EU, electronic signatures should meet the requirements defined in the 'eIDAS' regulation. Sites located in third countries should use electronic or digital signature solutions compliant with local regulations and proven to meet the expectations mentioned above.