Other frameworks: clause and topic matrix

The same view for EU GMP Annex 11, ICH E6 (by topic), ALCOA+ and GDPR. 21 CFR Part 11 has its own matrix.

Each question on a page is marked with one of four statuses:

Built — The software does this today; the evidence is cited.
Partly built — The software does part of this; the limits are stated.
Customer responsibility — The software cannot do this for you; your organization must.
Not built yet — Asked for, or expected, but the software does not do it.

This is evidence of what the software does. It is not a certification, and the software is not described anywhere on this site as validated: validation of the system for your intended use is your organization's responsibility.

EU GMP Annex 11

EU GMP guidance on computerised systems (cited where the EU or a sponsor applies it to clinical data systems).

17 of 17 rows have at least one answer.

Clause	What it covers	Coverage	Answered on
`1`	Risk management	Built ×1	Is AI used on clinical data, and could its output enter a record without a person accepting it?
`2`	Personnel	Built ×3	Is the person who designs the data collection kept away from the data it collects? Is the administrator of the system independent of the people who enter and sign the clinical data? Is the path from an empty system to a working, access-controlled organization controlled and recorded?
`3`	Suppliers and service providers	Built ×1 · Customer responsibility ×1	Are licensing decisions made by named platform administrators and recorded? Is participant or personal data sent to the AI provider?
`4`	Validation	Built ×10 · Partly built ×2 · Not built yet ×2	Is anything the AI produced accepted without a person reviewing it, and is its use recorded? Is a form tested before it is used for real data? Is a validated design protected from change after it has been tested? Is the release of a validated configuration approved by independent people, and by whom? Does the sponsor approve a release independently of the people who built and tested it? Is a failed validation test kept as evidence, with what was done about it? Is a change to the system's configuration validated and approved before it affects real data? Is the system tested for its intended use in an environment kept apart from real data? Can test activity ever be mistaken for, or mixed with, production data? Is the whole path from design to production controlled, tested and approved by independent people? Is there documented evidence that the software is tested, and do those tests run before a revision is released? Can the system's performance be shown at the size of the intended study? Is the system validated for its intended use, with evidence? Is there a validation package: IQ, OQ, PQ and a traceability matrix?
`5`	Data	Not built yet ×2	Is there a public API for integrations, with its own keys and limits? Is there an export for statistical software, or a signed export?
`6`	Accuracy checks	Built ×3	Are the values in a table cell checked and recorded as carefully as those in a field? Are values checked as they are entered, and is a check applied in the same way on every route into the system? Are values checked at entry, and by the server rather than only the screen?
`7`	Data storage	Partly built ×1 · Customer responsibility ×1	Is data held safely, and can it be restored, in the way Annex 11 expects of storage? Will the records still be available, and readable, throughout the retention period?
`8`	Printouts	Built ×6	Is a record legible, and is the copy an inspector receives readable without the system? Can the exact design that was tested and signed be produced, and matched to the data? Can I obtain a complete, accurate copy of the records for inspection? Can complete and accurate copies of the records be produced in electronic form for inspection? Can the audit trail be read and copied for inspection? Can an inspector see exactly what the system was configured to collect when a record was captured?
`9`	Audit trails	Built ×11 · Partly built ×1	Can the audit trail be altered or deleted by the application, or by someone using its credentials? Can a reviewer check independently that the audit trail is intact? Is the time of every event the system's own, so that a wrong clock cannot misdate a record? Is every change to a form's design recorded, with who and when, and can an earlier design be read back? Which events does the audit trail record? Can an auditor examine the records and the audit trail without being able to alter them? Is a change to a role traceable: who changed it, when, what and why? Can a reviewer confirm that the audit trail has not been tampered with? Is there a secure, computer-generated, time-stamped audit trail that records the date, time and operator of changes, and does not obscure earlier values? Is every action on a query attributable and time-stamped, and can the record of it be changed afterwards? Can the application, or a person using its credentials, alter or delete the audit trail? Is there a secure, time-stamped, tamper-evident record of platform administration?
`10`	Change and configuration management	Built ×21 · Partly built ×1	Is the configuration of a study under change control, so that "what was in force on this date" can be answered? Can a standard form be reused across studies without the copy changing later? Is every change to a form's design recorded, with who and when, and can an earlier design be read back? Is a form tested before it is used for real data? Are changes to a released data-collection design controlled, tested and approved before they take effect? Is the schedule of assessments (which forms at which visits) controlled and part of what is tested and signed? Are documents version-controlled, and can an earlier version be produced? Can a study's own checks be changed after release without a record of it? Can the protocol-level settings of a study be changed after release without a record? Is a validated design protected from change after it has been tested? Is the release of a validated configuration approved by independent people, and by whom? Are regulatory documents version-controlled and approved, with a record of who handled them? Is a protocol change implemented under control, with participants consenting again where required? Is a study's data-collection design built under change control from the start? Is each form's design reviewed and tested before use, and is every change recorded? Are essential documents kept with their versions, and can the version in force on a date be produced? Is the visit schedule and its windows controlled as part of the validated design? Is a change to the system's configuration validated and approved before it affects real data? Can a released design be changed in place? Can a change to a validated, running study be introduced without losing control of what was captured under the earlier version? Is the whole path from design to production controlled, tested and approved by independent people? Can a form that is wrong be used to collect data?
`11`	Periodic evaluation	Built ×1 · Customer responsibility ×1	Is the system tested for its intended use in an environment kept apart from real data? Is periodic review of the validated state supported?
`12`	Security	Built ×32 · Partly built ×5 · Not built yet ×1	Is access protected against unauthorized use at the network edge, with transport security and secure session handling? Are licensing decisions made by named platform administrators and recorded? Can the operator withdraw an organization's access immediately, and is the decision recorded with its reason? Is the creation of a tenant and its first administrator controlled and traceable? Is access to the platform's administrative functions limited to named individuals, and are failed attempts recorded? Is every operation behind an access check, or can a script do what a screen refuses? Is access limited to authorized people, by role? Can a role be given both sides of a separation of duties, such as entering data and locking it? Is there a session timeout and a cap on how long a session lives? Does the system enforce the order of steps, or can a status be set to anything? Can one person do everything on a study? Are the rules a configuration that could be weakened? Is the person who designs the data collection kept away from the data it collects? Is the administrator of the system independent of the people who enter and sign the clinical data? Is a role limited to the data entry its task needs? Can the person who runs the study alter the data it collects? Can oversight of site conduct be exercised without the ability to change the site's data? Is access for external supply staff limited to what their task needs? Are sign-in credentials controlled, limited in attempts and not reusable? Can access be withdrawn immediately when a person leaves, and does it leave a record? Is each user uniquely identified, and is an identity never reused? Are authority checks and separation of duties built into how roles can be defined? Are access credentials controlled, and does the system end unattended sessions? Can a person see and end the sessions held in their name? Can the organization show who holds which role, where and since when, at any time? Are temporary deviations from a role controlled, time-limited and approved? Is access to the system limited to authorized individuals, and are roles defined before people are given access? Are the roles checked for separation of duties when they are created? Can one person approve their own work? Is access to a study granted only to named, attributable people, with every grant and withdrawal recorded? Can the person who raised a query also answer or close it? Is the path from an empty system to a working, access-controlled organization controlled and recorded? Are records and signatures protected when the system is used over networks the organization does not control? Can a document be something other than what it says it is? Can a sign-in or signature code be intercepted from a log or a queue? Is a person's access removed when they leave or are suspended? Is access to clinical data limited to those who need it, including through exports? Is every read of a participant's data recorded, so that access can be reviewed?
`13`	Incident management	Partly built ×2	Does the system support the detection, assessment and notification of a personal data breach? Are security incidents detected and reported so that they can be assessed?
`14`	Electronic signature	Built ×5 · Partly built ×1	Is the investigator's responsibility for eligibility, delegation and signature exercised only by the investigator? Does the sponsor approve a release independently of the people who built and tested it? Are electronic signatures on a release attributable, bound to what was signed, and checked by a second factor? Do electronic signatures show the signer, the time and the meaning, and are they linked to the record so they cannot be copied? Is the final lock of the database controlled and attributable to two people? Does a signature use two distinct components?
`15`	Batch release	Not built yet ×1	Does the system support batch release?
`16`	Business continuity	Built ×2	Can the operator withdraw an organization's access immediately, and is the decision recorded with its reason? Is the path from an empty system to a working, access-controlled organization controlled and recorded?
`17`	Archiving	Built ×1	Can the application, or a person using its credentials, alter or delete the audit trail?

ICH E6 GCP

Good Clinical Practice. Listed by topic: clause numbers are added only where they have been checked against the text of the revision in force.

11 of 11 rows have at least one answer.

Clause	What it covers	Coverage	Answered on
`investigator-oversight`	Investigator oversight and responsibility	Built ×9	Is the administrator of the system independent of the people who enter and sign the clinical data? Is the investigator's responsibility for eligibility, delegation and signature exercised only by the investigator? Can the person who runs the study alter the data it collects? Are authority checks and separation of duties built into how roles can be defined? Is consent recorded before any procedure, and eligibility decided by the investigator? Are the roles checked for separation of duties when they are created? Is delegation of trial tasks recorded and signed by the investigator before a delegate can act? Is eligibility determined by the investigator and no one else? Is site staff access authorized by the principal investigator before it begins?
`delegation`	Delegation of trial tasks and training of delegates	Built ×10 · Partly built ×1	Is a role limited to the data entry its task needs? Is the investigator's responsibility for eligibility, delegation and signature exercised only by the investigator? Does the site's staff have access only after the investigator has authorized them? Is the creation of a study attributable, and is there always someone accountable for it? Can a site start enrolling before its ethics approval and training are on record? Can the organization show who holds which role, where and since when, at any time? Are temporary deviations from a role controlled, time-limited and approved? Is access to the system limited to authorized individuals, and are roles defined before people are given access? Is delegation of trial tasks recorded and signed by the investigator before a delegate can act? Is site staff access authorized by the principal investigator before it begins? Does the system stop an untrained person from working?
`informed-consent`	Informed consent	Built ×5	Is a protocol change implemented under control, with participants consenting again where required? Can a participant be enrolled without eligibility confirmed and consent on record? Is consent, and consent to a changed protocol, recorded and linked to what the participant then follows? Is consent recorded before any procedure, and eligibility decided by the investigator? Is informed consent recorded before any study procedure, and is a participant's consent history kept?
`protocol-compliance`	Protocol compliance and deviations	Built ×8 · Not built yet ×1	Is the schedule of assessments (which forms at which visits) controlled and part of what is tested and signed? Is a protocol change implemented under control, with participants consenting again where required? Are the reasons a participant leaves the study recorded in a standard form, with the safety follow-up that remains owed? Can a participant be enrolled without eligibility confirmed and consent on record? Can a site start enrolling before its ethics approval and training are on record? Is the visit schedule and its windows controlled as part of the validated design? Are protocol deviations recorded, classified and reviewed, and are reportable ones identified? Is entry outside the allowed window controlled and justified? Does the system allocate participants to treatment, or manage drug supply?
`data-corrections`	Data changes, corrections and their traceability	Built ×6 · Partly built ×1 · Customer responsibility ×1	Are out-of-range values flagged for review rather than silently accepted or refused? Is a query closed by someone independent of the person who raised or answered it? Is each value attributed to the person who entered it, and can a saved value be changed only with a reason? Is data review independent of data entry, and is the resolution of a discrepancy confirmed by someone other than the person who answered it? Is every correction traceable, with the reason, and the original preserved? Is every change to a clinical value traceable, reasoned and independent of the person who first entered it? Does a failing check always leave a record that a human has to look at? Who decides that an answer is acceptable, and how quickly must queries be handled?
`data-governance`	Data governance: access, audit trail, security of trial data	Built ×13 · Partly built ×1 · Not built yet ×2	Can a reviewer check independently that the audit trail is intact? Is every operation behind an access check, or can a script do what a screen refuses? Is access limited to authorized people, by role? Can one person do everything on a study? Can an administrator override a separation rule? Can an auditor examine the records and the audit trail without being able to alter them? Is access for external supply staff limited to what their task needs? Is the freezing of the database a controlled act that two people sign, knowing what was still open? Can access be withdrawn immediately when a person leaves, and does it leave a record? Are access credentials controlled, and does the system end unattended sessions? Is access to a study granted only to named, attributable people, with every grant and withdrawal recorded? Can the person who raised a query also answer or close it? Is the final lock of the database controlled and attributable to two people? Is access to clinical data limited to those who need it, including through exports? Can a blinded study be run, and is the allocation hidden from people who should not see it? Is every read of a participant's data recorded, so that access can be reviewed?
`computerised-systems`	Computerised systems used in the trial	Built ×14 · Partly built ×1 · Not built yet ×2	Is the configuration of a study under change control, so that "what was in force on this date" can be answered? Is anything the AI produced accepted without a person reviewing it, and is its use recorded? Can the exact design that was tested and signed be produced, and matched to the data? Is a form tested before it is used for real data? Are changes to a released data-collection design controlled, tested and approved before they take effect? Is the person who designs the data collection kept away from the data it collects? Is the release of a validated configuration approved by independent people, and by whom? Does the sponsor approve a release independently of the people who built and tested it? Is a study's data-collection design built under change control from the start? Is a change to the system's configuration validated and approved before it affects real data? Is the system tested for its intended use in an environment kept apart from real data? Is AI used on clinical data, and could its output enter a record without a person accepting it? Can a change to a validated, running study be introduced without losing control of what was captured under the earlier version? Is the whole path from design to production controlled, tested and approved by independent people? Is there documented evidence that the software is tested, and do those tests run before a revision is released? Is the system validated for its intended use, with evidence? Is there a validation package: IQ, OQ, PQ and a traceability matrix?
`monitoring`	Monitoring and source data verification	Built ×4 · Partly built ×2	Is source data verification independent of data entry, and is its evidence tied to the value verified? Can oversight of site conduct be exercised without the ability to change the site's data? Can a monitor verify data against source, with the evidence tied to the exact value and protected from the person who entered it? Can the sponsor and the team see the state of the study without anyone preparing a separate report? Does the system support risk-proportionate monitoring and central monitoring? Are query response times tracked against a target?
`safety-reporting`	Safety reporting	Built ×2 · Partly built ×4 · Not built yet ×1	Is there an independent medical review of serious events, kept apart from the site's report? Are the reasons a participant leaves the study recorded in a standard form, with the safety follow-up that remains owed? Does the system produce or send expedited safety reports? Is the time the site became aware of a serious event recorded, with a deadline derived from it? Are serious events tracked from awareness to reporting, follow-up, independent medical review and reconciliation, with every step attributable? Is the chain from an event to its regulatory report, follow-up, medical review and reconciliation recorded, timed and attributable? Is medical coding of adverse events and medications supported?
`essential-records`	Essential records and their retention	Built ×3 · Partly built ×1 · Customer responsibility ×1 · Not built yet ×2	Are documents version-controlled, and can an earlier version be produced? Are regulatory documents version-controlled and approved, with a record of who handled them? Are essential documents kept with their versions, and can the version in force on a date be produced? Can a document be something other than what it says it is? Will the records still be available, and readable, throughout the retention period? Can a participant's source file be attached to a form? Is the register a trial master file?
`quality-management`	Quality management and risk-proportionate controls	Built ×2 · Partly built ×3 · Customer responsibility ×1 · Not built yet ×2	Can the sponsor and the team see the state of the study without anyone preparing a separate report? Can the state of the whole study's data capture be seen at a glance without a separate report that could disagree with the data? Does the system support risk-proportionate monitoring and central monitoring? Are query response times tracked against a target? Can the system's performance be shown at the size of the intended study? Who decides that an answer is acceptable, and how quickly must queries be handled? Is the site told when a query is raised or becomes overdue? Is the site told when a query is raised or when one becomes overdue?

ALCOA+

Data-integrity attributes expected of a clinical record.

9 of 9 rows have at least one answer.

Clause	What it covers	Coverage	Answered on
`attributable`	Attributable: who did it, and when	Built ×22 · Partly built ×4	Are licensing decisions made by named platform administrators and recorded? Can the operator withdraw an organization's access immediately, and is the decision recorded with its reason? Is the creation of a tenant and its first administrator controlled and traceable? Is access to the platform's administrative functions limited to named individuals, and are failed attempts recorded? Can a default value end up in the record as if the person had entered it? Which events does the audit trail record? Is source data verification independent of data entry, and is its evidence tied to the value verified? Is each value attributed to the person who entered it, and can a saved value be changed only with a reason? Is there an independent medical review of serious events, kept apart from the site's report? Is every correction traceable, with the reason, and the original preserved? Is the creation of a study attributable, and is there always someone accountable for it? Is every entry attributable and time-stamped, and is a change to an entry impossible to make silently? Can access be withdrawn immediately when a person leaves, and does it leave a record? Is each user uniquely identified, and is an identity never reused? Is a change to a role traceable: who changed it, when, what and why? Can a person see and end the sessions held in their name? Can a monitor verify data against source, with the evidence tied to the exact value and protected from the person who entered it? Is consent, and consent to a changed protocol, recorded and linked to what the participant then follows? Is there a secure, computer-generated, time-stamped audit trail that records the date, time and operator of changes, and does not obscure earlier values? Do electronic signatures show the signer, the time and the meaning, and are they linked to the record so they cannot be copied? Is every action on a query attributable and time-stamped, and can the record of it be changed afterwards? Is every change to a clinical value traceable, reasoned and independent of the person who first entered it? Is there a secure, time-stamped, tamper-evident record of platform administration? Is a value set automatically by a rule distinguishable from one a person typed? Are serious events tracked from awareness to reporting, follow-up, independent medical review and reconciliation, with every step attributable? Is the chain from an event to its regulatory report, follow-up, medical review and reconciliation recorded, timed and attributable?
`legible`	Legible: readable and permanent	Built ×1	Is a record legible, and is the copy an inspector receives readable without the system?
`contemporaneous`	Contemporaneous: recorded when it happened	Built ×6 · Partly built ×2	Is the time of every event the system's own, so that a wrong clock cannot misdate a record? Is every entry attributable and time-stamped, and is a change to an entry impossible to make silently? Is there a secure, computer-generated, time-stamped audit trail that records the date, time and operator of changes, and does not obscure earlier values? Is entry outside the allowed window controlled and justified? Is consent recorded before any procedure, and eligibility decided by the investigator? Is informed consent recorded before any study procedure, and is a participant's consent history kept? Is the time the site became aware of a serious event recorded, with a deadline derived from it? Is the chain from an event to its regulatory report, follow-up, medical review and reconciliation recorded, timed and attributable?
`original`	Original: the first record, or a certified copy	Built ×20 · Partly built ×1 · Not built yet ×1	Can the audit trail be altered or deleted by the application, or by someone using its credentials? Does the system keep what was entered exactly as it was entered, in a form that does not depend on how the field is displayed? Can a calculated value be altered by someone, or be wrong because of the browser? Is every change to a form's design recorded, with who and when, and can an earlier design be read back? Are the values in a table cell checked and recorded as carefully as those in a field? Can a field that holds data be removed from a form? Are documents version-controlled, and can an earlier version be produced? Is source data verification independent of data entry, and is its evidence tied to the value verified? Can the person who runs the study alter the data it collects? Can a locked database be changed without a trace? Is a failed validation test kept as evidence, with what was done about it? Is every correction traceable, with the reason, and the original preserved? Is every entry attributable and time-stamped, and is a change to an entry impossible to make silently? Are essential documents kept with their versions, and can the version in force on a date be produced? Can a monitor verify data against source, with the evidence tied to the exact value and protected from the person who entered it? Can a reviewer confirm that the audit trail has not been tampered with? Is there a secure, computer-generated, time-stamped audit trail that records the date, time and operator of changes, and does not obscure earlier values? Is every action on a query attributable and time-stamped, and can the record of it be changed afterwards? Can the application, or a person using its credentials, alter or delete the audit trail? Is every change to a clinical value traceable, reasoned and independent of the person who first entered it? Is there a secure, time-stamped, tamper-evident record of platform administration? Can a participant's source file be attached to a form?
`accurate`	Accurate: error-free, and any change documented	Built ×16 · Partly built ×1 · Not built yet ×1	Can a default value end up in the record as if the person had entered it? Does the system keep what was entered exactly as it was entered, in a form that does not depend on how the field is displayed? Can a calculated value be altered by someone, or be wrong because of the browser? Are the values in a table cell checked and recorded as carefully as those in a field? Are out-of-range values flagged for review rather than silently accepted or refused? Are values checked as they are entered, and is a check applied in the same way on every route into the system? Does a safety or eligibility rule that never fires look as if it is working? Can the protocol-level settings of a study be changed after release without a record? Is a query closed by someone independent of the person who raised or answered it? Is each value attributed to the person who entered it, and can a saved value be changed only with a reason? Is data review independent of data entry, and is the resolution of a discrepancy confirmed by someone other than the person who answered it? Is every correction traceable, with the reason, and the original preserved? Are values checked at entry, and by the server rather than only the screen? Is a change to a role traceable: who changed it, when, what and why? Is the system tested for its intended use in an environment kept apart from real data? Is every change to a clinical value traceable, reasoned and independent of the person who first entered it? Does a failing check always leave a record that a human has to look at? Is medical coding of adverse events and medications supported?
`complete`	Complete: nothing missing, including repeats and changes	Built ×7 · Not built yet ×1	Can a hidden field block a form from being completed, or hide data that was entered? Which events does the audit trail record? Can I obtain a complete, accurate copy of the records for inspection? Are the reasons a participant leaves the study recorded in a standard form, with the safety follow-up that remains owed? Can complete and accurate copies of the records be produced in electronic form for inspection? Are protocol deviations recorded, classified and reviewed, and are reportable ones identified? Can the state of the whole study's data capture be seen at a glance without a separate report that could disagree with the data? Is the system validated for its intended use, with evidence?
`consistent`	Consistent: sequences and time stamps agree	Built ×5	Does the system enforce the order of steps, or can a status be set to anything? Are changes to a study's operational state controlled and attributable? Can the state of the whole study's data capture be seen at a glance without a separate report that could disagree with the data? Can test activity ever be mistaken for, or mixed with, production data? Can a change to a validated, running study be introduced without losing control of what was captured under the earlier version?
`enduring`	Enduring: lasts for the retention period	Built ×8 · Partly built ×2	Can the audit trail be altered or deleted by the application, or by someone using its credentials? Can a field that holds data be removed from a form? Is the freezing of the database a controlled act that two people sign, knowing what was still open? Can a locked database be changed without a trace? Is a failed validation test kept as evidence, with what was done about it? Is consent, and consent to a changed protocol, recorded and linked to what the participant then follows? Can a reviewer confirm that the audit trail has not been tampered with? Can the application, or a person using its credentials, alter or delete the audit trail? Is data held safely, and can it be restored, in the way Annex 11 expects of storage? Is there a secure, time-stamped, tamper-evident record of platform administration?
`available`	Available: can be seen and reviewed on request	Built ×8 · Partly built ×1 · Customer responsibility ×1	Can the exact design that was tested and signed be produced, and matched to the data? Can I obtain a complete, accurate copy of the records for inspection? Can an auditor examine the records and the audit trail without being able to alter them? Can complete and accurate copies of the records be produced in electronic form for inspection? Can the organization show who holds which role, where and since when, at any time? Can the audit trail be read and copied for inspection? Can the sponsor and the team see the state of the study without anyone preparing a separate report? Can an inspector see exactly what the system was configured to collect when a record was captured? Is data held safely, and can it be restored, in the way Annex 11 expects of storage? Will the records still be available, and readable, throughout the retention period?

EU General Data Protection Regulation, where personal data is handled.

8 of 8 rows have at least one answer.

Clause	What it covers	Coverage	Answered on
`art.5`	Principles relating to processing of personal data	Partly built ×1	Are personal data limited to what is necessary, and kept no longer than needed?
`art.15`	Right of access by the data subject	Partly built ×1	Can a participant obtain a copy of their data on request?
`art.17`	Right to erasure	Not built yet ×1	Can a participant's data be erased on request?
`art.25`	Data protection by design and by default	Built ×1 · Partly built ×2 · Customer responsibility ×2	Is AI used on clinical data, and could its output enter a record without a person accepting it? Are personal data limited to what is necessary, and kept no longer than needed? Is access to clinical data limited to those who need it, including through exports? Is participant or personal data sent to the AI provider? Does the AI processing keep data within an agreed region and out of model training?
`art.28`	Processor	Customer responsibility ×2	Is participant or personal data sent to the AI provider? Does the AI processing keep data within an agreed region and out of model training?
`art.30`	Records of processing activities	Customer responsibility ×1	Does the system support the record of processing activities?
`art.32`	Security of processing	Built ×1 · Partly built ×2 · Customer responsibility ×1 · Not built yet ×1	Is access protected against unauthorized use at the network edge, with transport security and secure session handling? Does the system support the detection, assessment and notification of a personal data breach? Are security incidents detected and reported so that they can be assessed? Does the AI processing keep data within an agreed region and out of model training? Is every read of a participant's data recorded, so that access can be reviewed?
`art.33`	Notification of a personal data breach to the supervisory authority	Partly built ×2	Does the system support the detection, assessment and notification of a personal data breach? Are security incidents detected and reported so that they can be assessed?

EU GMP Annex 11#

ICH E6 GCP#

ALCOA+#

GDPR#

EU GMP Annex 11

ICH E6 GCP

ALCOA+

GDPR