Clinical Trial Sponsor Responsibilities: The Non-Delegable Oversight System Under ICH E6(R3)

At a glance

• A sponsor can transfer almost any clinical-trial task to a CRO, but under ICH E6(R3) §3.6.6 the ultimate responsibility for participant safety and data reliability stays with the sponsor, always.
• E6(R3) reframes sponsor duties as a designed-in quality management system (quality by design, critical-to-quality factors, quality tolerance limits), not an after-the-fact checklist of duties.
• Anything you do not explicitly write into a transfer agreement, you are deemed to have kept: this is true under both ICH E6(R3) §3.6.4 and FDA 21 CFR 312.52.
• The non-delegable core is the oversight itself: selecting and qualifying investigators and service providers, running the quality system, assessing safety, and standing behind final data integrity.
• In a GCP inspection, “we outsourced it to the CRO” is not an answer. Inspectors ask to see the oversight plan, the vendor-oversight trail, QTL excursions, and the escalation/CAPA record that prove the sponsor stayed in control.
• The US adds a parallel statutory layer: 21 CFR Part 312 obligations (IND maintenance, monitoring, 312.32 safety reporting) sit on top of ICH GCP, and a CRO that assumes a sponsor obligation becomes subject to the same regulatory action as the sponsor.

If you run trials through a contract research organization (CRO), the single most expensive misunderstanding you can carry is this one: that outsourcing a task also outsources the accountability for it. It does not. This guide is built for sponsor-side clinical-ops, QA, and small-biotech teams who need to know exactly which responsibilities they keep when they hand work to a vendor, and how to prove that oversight when an inspector arrives. We treat sponsor responsibilities the way ICH E6(R3) now does: as a non-delegable oversight system, not a glossary of duties.

What a clinical trial sponsor actually is (the accountable entity, not a vendor)

A sponsor is the entity that takes responsibility for a clinical trial, the accountable owner of the study, not one vendor among several. The duties are codified in the Sponsor section of ICH E6(R3) and, for US INDs, in 21 CFR Part 312. Under FDA 21 CFR 312.50, sponsors are responsible for selecting qualified investigators, providing them the information needed to conduct the investigation properly, ensuring proper monitoring, ensuring the trial is conducted in accordance with the general investigational plan and protocols in the IND, maintaining an effective IND, and ensuring FDA and all investigators are promptly informed of significant new risks. That single sentence is the legal spine of the US sponsor role, and notice every verb in it is an “ensuring” verb. The sponsor does not have to perform each task personally, but it has to ensure each task gets done.

The one rule that governs everything: you can transfer the task, never the accountability

This is the rule the ranking glossary pages never operationalize, so let us state it plainly. ICH E6(R3) §3.6.6 provides that a sponsor may transfer any or all of its trial-related activities to a service provider, however the ultimate responsibility for those activities, including protection of participants’ rights, safety and well-being and the reliability of the trial data, resides with the sponsor. The CRO does the work; the sponsor owns the outcome.

A corollary follows directly, and it is the one teams most often get wrong on paper. ICH E6(R3) §3.6.4 states that any sponsor activity transferred to and assumed by a service provider must be documented in an agreement, and that any activity not specifically transferred is retained by the sponsor. There is no silent transfer. The US rule is identical in shape and arguably blunter: 21 CFR 312.52 allows a sponsor to transfer responsibility for any or all of its obligations to a CRO in writing, and any obligation not covered by the written description is deemed not to have been transferred. So the gaps in your contract are not neutral. Whatever you forgot to assign, you kept.

There is one more US-specific consequence worth knowing. Under 21 CFR 312.52, a CRO that assumes a sponsor obligation must comply with the regulations applicable to that obligation and is subject to the same regulatory action as a sponsor for failing to meet it. The CRO takes on real liability for what it assumed, but that does not subtract the sponsor’s own ultimate responsibility under E6(R3); it adds a second accountable party, it does not relieve the first.

The R2-to-R3 shift: from a duty checklist to a designed-in quality system

The older mental model treated sponsor quality as something you check after the fact: monitor, audit, find errors, fix them. ICH E8(R1) §3.1 is explicit that this is not enough. It states that activities such as document and data review and monitoring, when conducted retrospectively, are an important part of quality assurance, but even combined with audits they are not sufficient to ensure the quality of a clinical study. Quality has to be built in, not inspected in.

So R3 pushes the work upstream. ICH E6(R3) §3.10 requires the sponsor to implement a system to manage quality throughout all stages of the trial, to adopt a proportionate and risk-based approach, to incorporate quality into the design of the trial (quality by design), and to identify the factors likely to have a meaningful impact on participants and on result reliability, the critical-to-quality factors described in ICH E8(R1). That cross-reference is the hinge between the two guidelines. ICH E8(R1) §3.2 defines critical-to-quality factors as the attributes of a study whose integrity is fundamental to the protection of participants and the reliability of results, and §3.2 also places the duty to identify them on the sponsor and other parties designing quality into the study.

The risk machinery is spelled out too. ICH E6(R3) §3.10.1.3 directs the sponsor, where relevant, to set pre-specified acceptable ranges (such as quality tolerance limits at the trial level), and provides that where a deviation beyond those ranges is detected, an evaluation should be performed to determine whether there is a possible systemic issue and whether action is needed. This is the operational difference R3 introduces: QTLs are not a reporting nicety, they are tripwires that obligate the sponsor to investigate.

R2-vs-R3 contrast, in one line each:

• R2 mindset: a flat enumeration of sponsor duties, quality demonstrated mainly through monitoring and audit after data exist.
• R3 mindset (§3.10, §3.10.1): a designed-in quality management system, risk-proportionate, anchored on critical-to-quality factors (per ICH E8(R1) §3.2) with quality tolerance limits and a duty to evaluate excursions.

The non-delegable core

You can hand out tasks; you cannot hand out the following accountabilities. Each is grounded in a current provision.

• Selecting and qualifying investigators and service providers. ICH E6(R3) §3.6.7 makes the sponsor responsible for assessing the suitability of and selecting the service provider so they can adequately undertake the transferred activities. FDA 21 CFR 312.53 requires the sponsor to select only investigators qualified by training and experience as appropriate experts to investigate the drug.
• Ongoing oversight of transferred work. ICH E6(R3) §3.6.9 requires the sponsor to ensure appropriate oversight of important trial-related activities transferred to service providers, including activities the service provider further subcontracts. Outsourcing does not stop at the first vendor; the oversight reaches down the chain.
• The quality system itself. Per ICH E6(R3) §3.10, the sponsor implements and owns the quality management system; that duty is not on the list of things a CRO can simply absorb on the sponsor’s behalf.
• Safety assessment and expedited reporting. ICH E6(R3) §3.13 makes the sponsor responsible for the ongoing safety evaluation of the investigational product. We expand on this below.
• Standing behind final data reliability. The reliability of trial data is named explicitly in §3.6.6 as part of the ultimate responsibility that resides with the sponsor.

Sponsor vs CRO: a transfer-of-responsibility decision table

The table maps major duties to three columns: can the task be transferred to a CRO, what accountability the sponsor retains regardless, and the document that records the arrangement. Every regulatory claim below is grounded in the provisions already cited.

Duty	CRO-transferable (the task)?	Sponsor-retained accountability	Document that records it
Investigator/site selection	Yes, the legwork can be transferred	Sponsor stays responsible for selecting qualified investigators (E6(R3) §3.6.7; 21 CFR 312.53)	Transfer-of-obligations agreement (E6(R3) §3.6.4; 21 CFR 312.52)
Monitoring (site and centralized)	Yes, execution is routinely outsourced	Sponsor must ensure proper monitoring and owns the monitoring plan (21 CFR 312.50; E6(R3) §3.11.4.3)	Monitoring plan; transfer agreement
Quality management system	Tasks within it, yes; the system, no	Sponsor implements and owns the QMS, QbD and critical-to-quality factors (E6(R3) §3.10; E8(R1) §3.2)	Quality/risk management plan
Safety assessment and expedited reporting	Operational handling, yes	Sponsor is responsible for ongoing safety evaluation and expedited SUSAR reporting (E6(R3) §3.13, §3.13.2; 21 CFR 312.32)	Safety management plan; transfer agreement
Ongoing oversight of vendors	No, this is the oversight itself	Sponsor ensures oversight of transferred and subcontracted activities (E6(R3) §3.6.9)	Oversight plan; vendor-oversight log
Final data integrity / reliability	No	Reliability of trial data resides with the sponsor (E6(R3) §3.6.6)	Clinical trial report; data-handling records

The pattern is consistent: the doing moves to the CRO, the ensuring stays with the sponsor, and an agreement records the line between them.

Sponsor quality-management and safety-reporting duties

On quality, the chain runs E8(R1) into E6(R3): identify critical-to-quality factors (E8(R1) §3.2), design quality in rather than inspect it in (E8(R1) §3.1), then operate the risk-proportionate QMS with quality tolerance limits and excursion evaluation (E6(R3) §3.10, §3.10.1.3).

On safety, two layers apply, and here it is worth naming a point of tension between the in-scope regs rather than smoothing it over. ICH E6(R3) §3.13.2(b) requires the sponsor to expedite reporting to regulatory authorities of all suspected, unexpected and serious adverse reactions (SUSARs), in accordance with applicable regulatory requirements and ICH E2A, but E6(R3) deliberately defers the concrete clock to those regional requirements rather than stating a single global deadline. FDA 21 CFR 312.32 supplies the US clock directly: the sponsor must report a serious and unexpected suspected adverse reaction in an IND safety report no later than 15 calendar days after the sponsor determines the information qualifies, and must report any unexpected fatal or life-threatening suspected adverse reaction as soon as possible but no later than 7 calendar days after initial receipt of the information. So the demands align in direction (expedite SUSARs) but differ in specificity: ICH points to the applicable regional rule, and in the US that rule is the 15-day and 7-day Part 312.32 timeline. A sponsor running a US IND under ICH GCP has to satisfy both at once, and the way to do that is to read the Part 312.32 clock as the concrete instantiation of the E6(R3) “expedite in accordance with applicable regulatory requirements” instruction, not as a competing rule. Beyond reporting, ICH E6(R3) §3.13 keeps the underlying ongoing safety evaluation of the product with the sponsor in all cases.

How to evidence oversight: what an inspector asks to see

This is where outsourced trials most often fall apart in a GCP or BIMO-style inspection. The common finding is not that the sponsor did the work badly; it is that the sponsor transferred the task and then lost the trail, leaving nothing to show it stayed in control. ICH E6(R3) §3.9.5 frames the standard: the range and extent of oversight measures should be fit for purpose and tailored to the trial’s complexity and risks, and it names the selection and oversight of investigators and service providers as fundamental features of the oversight process. ICH E6(R3) §3.9.6 adds the duty to ensure appropriate and timely escalation and follow-up of issues. Translate those into the artifacts an inspector will request:

• The oversight plan that defines how the sponsor supervises each vendor, sized to risk (E6(R3) §3.9.5).
• The transfer-of-obligations agreement, with each transferred duty itemized and nothing left to silent default (E6(R3) §3.6.4; 21 CFR 312.52).
• The vendor-oversight log: scheduled reviews, performance metrics, and findings, showing the oversight actually happened rather than existing only on paper.
• Quality tolerance limit definitions and any excursions, with the evaluation of whether a breach signaled a systemic issue (E6(R3) §3.10.1.3).
• The escalation and CAPA trail proving issues were raised, routed, and closed in a timely way (E6(R3) §3.9.6).

If those documents exist and connect to each other, you can demonstrate oversight. If they do not, the regulator’s working assumption is that there was none, regardless of how capable your CRO was.

Where teams get it wrong

The recurring failure modes are predictable. First, treating the contract as complete when it is silent: under both E6(R3) §3.6.4 and 21 CFR 312.52, an unassigned obligation is a retained obligation, so a thin transfer agreement quietly leaves more on the sponsor’s plate, not less. Second, assuming the CRO’s quality system replaces the sponsor’s: E6(R3) §3.10 keeps the QMS with the sponsor, and a vendor’s fit-for-purpose processes supplement it rather than substitute for it. Third, oversight that is asserted but not evidenced: §3.9.5 and §3.9.6 expect a fit-for-purpose, documented, escalating process, and “we trusted them” is not that. Fourth, reading “outsourced safety reporting” as relief from the safety duty: §3.13 keeps ongoing safety evaluation with the sponsor and 21 CFR 312.32 puts the IND safety-report clock on the sponsor, no matter who keys the report.

A note on language matters too. No software platform, CRO, or process “makes a sponsor compliant.” Tools and vendors enable compliance by helping the sponsor design quality in, run oversight, and keep the trail. The responsibility under E6(R3) §3.6.6 does not move. That is the practitioner’s bottom line: build the oversight system, write the boundary down, and keep the evidence, because in this framework the sponsor is the one entity that can never delegate its way out.

For deeper treatment of adjacent topics, see our sibling guides on CRO oversight and vendor management, risk-based monitoring and quality tolerance limits, what changed in ICH E6(R3), and IND safety reporting under 21 CFR 312.

Sources

• ICH E6(R3) Good Clinical Practice (version r3) — ICH — https://www.ich.org/page/efficacy-guidelines
• ICH E8(R1) General Considerations for Clinical Studies (version r1) — ICH
• 21 CFR Part 312 Investigational New Drug Application (version 2026-04) — FDA