What Regulation (EU) No 536/2014 requires of sponsors today, from CTIS submission to results disclosure, and how the proposed European Biotech Act could reshape the framework from 2028.
For sponsors running clinical trials in Europe, the regulatory ground has shifted twice in four years. Regulation (EU) No 536/2014, the Clinical Trials Regulation (CTR), became applicable on 31 January 2022, replacing the Clinical Trials Directive 2001/20/EC. Its three-year transition period closed on 30 January 2025. Since then, every clinical trial in the EU, including trials originally approved under the Directive, has been governed by the CTR, and more than 5,000 trials were moved into the new system during the transition window.1
A second wave of change is underway. In December 2025, the European Commission proposed the European Biotech Act, which would substantially amend the CTR. The European Medicines Agency (EMA) has said the proposed changes touch roughly 70% of current functionality in the Clinical Trials Information System (CTIS), and that the first amendments could enter into force in early 2028.2
This guide sets out what sponsors must do under the CTR as it stands, where operational risk tends to concentrate, and what to plan for as reform advances.
Why the CTR exists, and why it is being revised
Under the Directive, each Member State transposed clinical trial rules into national law. A sponsor running a study in six countries faced six submissions, six assessment processes and six sets of timelines. The CTR is a directly applicable regulation: one dossier, one portal, and one coordinated assessment for all concerned Member States.
Harmonization alone has not reversed Europe’s declining share of global research. An IQVIA analysis for EFPIA and Vaccines Europe found that the European Economic Area’s share of global commercial trials fell from 22% in 2013 to 12% in 2023, even as global trial numbers grew by 38%. Over the same decade, China’s share rose to 18%, and Europe’s share of cell and gene therapy trials dropped from 25% to 10%.3 Slow and fragmented multinational authorization is widely cited as a contributing factor, and it is the main target of the Biotech Act.
The core architecture: one application, two parts
CTIS as the single entry point
Since 31 January 2023, all initial clinical trial applications in the EU/EEA have been submitted through CTIS. By September 2026, CTIS had supported the authorization and management of more than 14,000 trials and was receiving over 200 new applications each month.2 Sponsors use the same portal for substantial modifications, notifications, safety-related submissions and results disclosure, so CTIS user administration and role management are compliance functions, not merely IT tasks.
Part I and Part II
Every application is split into two. Part I covers the scientific and regulatory content: protocol, Investigator’s Brochure, investigational medicinal product dossier (IMPD), benefit-risk, GMP compliance and labeling. It is assessed jointly by all Member States concerned under the coordination of a Reporting Member State (RMS) proposed by the sponsor. Part II covers national and ethical aspects: informed consent, recruitment arrangements, site and investigator suitability, insurance and compensation, data protection and financial arrangements. Each Member State assesses Part II for its own territory.7
In practice, Part II is where national variation persists. Sponsors running studies across many Member States should build country-specific Part II packages early, particularly informed consent forms in local languages and site suitability documentation.
Statutory timelines
Validation takes up to 10 days. The Part I assessment report follows within 45 days of validation, and the RMS can extend that window by up to 31 days when it issues a request for information (RFI), with sponsors normally given 12 days to respond. Each Member State then issues its decision within 5 days. For a multinational trial, the maximum is therefore about 106 days, with an additional 50 days for advanced therapy medicinal products (ATMPs).5,7 Missing an RFI deadline is costly: the application is deemed withdrawn in the Member State concerned.
Low-intervention clinical trials
The CTR created a lighter category for trials using authorized products in line with their marketing authorization, or in evidence-based use supported by published data, where additional diagnostic or monitoring procedures pose minimal additional risk. These trials benefit from reduced monitoring and trial master file (TMF) expectations and more flexible insurance arrangements.7
Table 1. Core sponsor obligations under Regulation (EU) No 536/2014
| Obligation | Requirement under the CTR | Timeline |
|---|---|---|
| EU legal representative | Sponsors not established in the EU must appoint a legal representative in the Union (Art. 74) | Before submission |
| Trial milestones | Notify start of trial, first visit of first subject and end of recruitment in each Member State via CTIS (Art. 36) | Within 15 days |
| SUSAR reporting | Report suspected unexpected serious adverse reactions to EudraVigilance (Art. 42) | 7 days if fatal or life-threatening; 15 days otherwise |
| Annual safety report | Submit annual safety report per investigational product, aligned with the ICH E2F DSUR (Art. 43) | Annually |
| Serious breach | Notify serious breaches of the CTR or protocol via CTIS (Art. 52) | Within 7 days of awareness |
| End of trial | Notify end of trial in each Member State and in all Member States (Art. 37) | Within 15 days |
| Summary results | Post summary results and a lay summary in CTIS (Art. 37, Annexes IV and V) | Within 1 year of end of trial |
| TMF archiving | Archive the trial master file content (Art. 58) | At least 25 years after end of trial |
Sponsor obligations across the trial lifecycle
Authorization is the most visible part of the CTR, but most compliance exposure arises after the trial starts. Table 1 summarizes the obligations sponsors most commonly track. Three areas deserve particular attention.
Safety reporting. SUSARs go directly to EudraVigilance rather than to individual national competent authorities. Pharmacovigilance and clinical teams need reliable reconciliation between the safety and clinical databases, consistent MedDRA coding, and clear ownership of the annual safety report. Sponsors that rely on a CRO or a functional service provider (FSP) for case processing remain accountable for timeliness.
Transparency. CTIS is a public database. Revised transparency rules took full effect on 18 June 2024 alongside an updated public portal, simplifying what is published and when. Sponsors still need a redaction workflow for personal data and commercially confidential information before uploading documents, because much of what is submitted becomes publicly visible.
Good Clinical Practice. ICH E6(R3) Principles and Annex 1 have been applied in the EU since 23 July 2025, replacing E6(R2). Annex 2, covering decentralized, pragmatic and other non-traditional designs, takes effect on 15 January 2027.4 E6(R3) puts risk proportionality and critical-to-quality factors at the center of trial design and oversight, which has direct implications for monitoring plans, vendor oversight and data governance.
Managing CTIS in practice: user access and administration
Many of the CTIS problems that delay sponsors are not scientific. They are access problems: no one with the right role is available to answer an RFI, a former employee still holds the only administrator account, or a CRO user cannot see the documents needed to prepare a submission. Because every application, notification and response runs through the portal, user management deserves the same control as any other GCP-relevant process.
Two models of user administration
CTIS supports two approaches and applies one automatically, depending on whether the sponsor organization has a registered Sponsor Admin.9 In the organization-centric model, the sponsor registers in EMA’s Organization Management Service (OMS), part of the SPOR data services, and EMA validates a named individual as Sponsor Admin through EMA Account Management. That administrator then controls access across all of the organization’s trials. In the trial-centric model, there is no Sponsor Admin: whoever creates a clinical trial application becomes its CT Admin and manages access to that trial alone. EMA encourages the organization-centric approach, because trial-centric management offers no central oversight and can create duplicate organization records.9
Table 2. CTIS access levels for sponsor users8,9
| Access level | How it is assigned | What it allows |
|---|---|---|
| Sponsor Admin (high-level) | Assigned in EMA Account Management after EMA validation; the organization must first be registered in OMS | Assigns and revokes CT Admin and business roles across all of the organization’s trials |
| CT Admin (medium-level) | Assigned in CTIS by a Sponsor Admin, or acquired automatically by the creator of an application under the trial-centric model | Approves role requests, assigns and revokes roles, and performs business actions for trials in scope |
| Business roles (e.g., Viewer, Preparer, Submitter) | Requested by the user and approved by a Sponsor Admin or CT Admin | Viewer reads and downloads; Preparer drafts; Submitter submits, withdraws or updates. Roles are cumulative and scoped to all trials or to specific trials |
Common pain points
Single points of failure. If an organization’s only Sponsor Admin leaves, no one can approve role requests until a replacement is registered through EMA’s identity and access management process. EMA advises having at least two Sponsor Admins per organization. If a departed administrator’s account remains active, requests keep routing to that account; an active employee should request the External Organization Administrator role in EMA Account Management and reassign the Sponsor Admin and CT Admin roles.8
Offboarding. Departing administrators should reassign their roles before disabling their EMA accounts. Every user needs an individual EMA account tied to a personal email address. Shared mailboxes are not permitted, so a team inbox cannot stand in for a named back-up.8
CRO and vendor access. CRO staff record the CRO, not the sponsor, as their employer and request roles that the sponsor’s administrator approves. Missing employer details make affiliation hard to verify, and assigning a role under the wrong sponsor can expose confidential information, including personal data.8 Access should match the contract scope and be revoked when the engagement ends.
Role gaps. Roles are granular, and gaps tend to surface near deadlines. A CT Admin needs the separate ASR Submitter role to submit annual safety reports,9 and the Application Submitter role shows only the Part I final assessment report, not Part II.8
Access reviews. CTIS has no function for exporting user roles, so periodic reviews must be done manually in the system.8 Inspectors expect sponsors to show who had access to what and when, and a maintained access register outside CTIS fills that gap.
Missed alerts. In 2026, EMA introduced an opt-in daily email digest of CTIS notices and alerts. It is off by default and arrives overnight, and regulators stress that users remain responsible for monitoring CTIS directly, particularly for time-sensitive RFIs.10
Where sponsors most often stumble
- RFI turnaround. A 12-day response window rarely leaves time to convene medical, CMC, statistics and regulatory reviewers from scratch. Sponsors that pre-assign RFI owners and draft response templates before submission fare better.
- Part II inconsistency. Variable national expectations for consent documents, site suitability evidence and compensation arrangements cause avoidable delays when sponsors use a single generic package.
- Modification sequencing. Substantial modifications currently take up to 96 days to assess, and parallel assessment of independent modifications is not yet permitted.5 Poorly sequenced amendments can stall a program for months.
- Transparency planning. Last-minute redaction decisions risk either over-disclosure or deferred submissions.
- Oversight of delegated duties. Sponsors may delegate tasks to CROs, but under both the CTR and ICH E6(R3) they cannot delegate accountability. Documented, risk-based vendor oversight is an inspection focus.
What the proposed Biotech Act would change
The Commission’s proposal, COM(2025) 1022, amends the CTR alongside related legislation including the ATMP Regulation.6 Table 3 compares current timelines with those proposed.
Table 3. Selected CTR elements: current framework vs. Biotech Act proposal (source: IQVIA analysis of COM(2025) 1022)5
| Element | CTR today | Biotech Act proposal |
|---|---|---|
| Initial authorization, multinational trial | Up to 106 days | 75 days, inclusive of validation and ethical review |
| Additional ATMP assessment step | +50 days | Removed |
| Substantial modification assessment | Up to 96 days | 47 days |
| Independent substantial modifications | Assessed sequentially | Parallel assessment permitted |
| Ethical review across Member States | National ethics input per Member State | RMS ethics committee consolidates input |
| Trials using authorized products per their marketing authorization | Low-intervention category, full authorization required | New minimal-intervention category requiring ethics approval only |
Beyond timelines, the proposal would strengthen the RMS role so other Member States rely on its assessment, except on matters of national law, ethics, or standards of care. It would also introduce a single CTIS submission for combined studies involving medicines with medical devices or in vitro diagnostics, a “core dossier” for investigational products that can be cross-referenced across trials, mandatory harmonized templates for certain Part II documents, an explicit GDPR-aligned legal basis for processing trial data, clearer rules for direct-to-patient supply of investigational products, and regulatory sandboxes for novel designs and AI tools.5
The Commission plans to measure success through key performance indicators, including 500 additional multinational trials over five years and 66% of trials beginning recruitment within 200 days of submission, compared with around 50% today.5 The proposal remains under negotiation in the Council and the European Parliament. EMA expects to begin building a new CTIS platform in early 2027, with first CTR changes potentially in force in early 2028.2 Provisions may change before adoption, so sponsors should treat current CTR requirements as binding and the Biotech Act as a planning horizon.
Practical steps for sponsors now
- Map every active EU trial against the obligations in Table 1 and confirm named owners for each.
- Build a standing RFI response process with pre-assigned reviewers and turnaround tracking.
- Develop country-specific Part II templates for your most frequently used Member States.
- Align quality management systems, monitoring plans and vendor oversight with ICH E6(R3), and assess decentralized elements against Annex 2 before January 2027.
- Formalize a transparency and redaction workflow that runs before CTIS upload, not after.
- Appoint at least two CTIS Sponsor Admins, keep an access register aligned with CRO and vendor contracts, and review roles at least quarterly and whenever staff or vendors change.
- Track Biotech Act negotiations and model how a 75-day authorization window and parallel modifications would change program timelines and country selection.
Frequently asked questions
Does the CTR apply to trials that started under the old Directive?
Yes. Since 31 January 2025, all ongoing EU trials are governed by the CTR. Trials that were not transitioned to CTIS by 30 January 2025 may face corrective measures from Member States, and sponsors must now submit a new application via CTIS rather than a transition request.1
How long does EU clinical trial authorization take?
For a multinational trial, the statutory maximum is about 106 days from submission to decision, with an additional 50 days for ATMPs. Many applications conclude faster, but RFIs and Part II issues frequently extend timelines in practice.
Do non-EU sponsors need an EU legal representative?
Yes. Article 74 of the CTR requires sponsors not established in the EU to ensure a legal representative is established in the Union. Member States may waive this for trials conducted solely in their territory, provided a contact person is designated.
When must trial results be published?
Summary results, including a lay summary, must be posted in CTIS within one year of the end of the trial in all Member States concerned. A shorter six-month window applies to pediatric trials under EU pediatric guidance.
When will the Biotech Act changes apply?
Not yet. The Council and European Parliament are still negotiating the proposal. EMA has indicated that, under an ambitious legislative timeline, the first changes to the CTR could come into force in early 2028.2
About AICROS
AICROS, the Association of International CROs, is a global alliance of small-to-midsize contract research organizations headquartered in Bremen, Germany. Its members provide specialist-led services across biostatistics, clinical operations, data management, medical writing, pharmacovigilance and regulatory affairs, combining the responsiveness of focused teams with multinational reach. For sponsors running trials in Europe, AICROS members support CTR submissions, CTIS management, EU legal representation, safety reporting and multinational trial coordination.
Planning a clinical trial in the EU? Talk to the AICROS team about CTR strategy, CTIS submissions and multinational coordination at info@aicros.org.
References
- European Medicines Agency. “EU Clinical Trials Regulation becomes fully applicable” (press statement, 31 January 2025), as reproduced by IEU Monitoring. https://ieu-monitoring.com/editorial/ema-eu-clinical-trials-regulation-becomes-fully-applicable/539108/
- European Medicines Agency. “EMA Management Board: highlights of September 2026 meeting.” https://www.ema.europa.eu/en/news/ema-management-board-highlights-september-2026-meeting
- IQVIA for EFPIA and Vaccines Europe. Assessing the Clinical Trial Ecosystem in Europe: Final Report (August 2024; published October 2024). https://www.ema.europa.eu/nl/media/65396
- European Medicines Agency. “ICH E6 Good clinical practice – Scientific guideline” (Principles and Annex 1 effective 23 July 2025; Annex 2 effective 15 January 2027). https://www.ema.europa.eu/en/ich-e6-good-clinical-practice-scientific-guideline
- Thacker Z, Hines P, Bamford C, Bergström R. “The EU’s Biotech Act (Part 2): compelling changes to clinical trial regulation.” IQVIA, 29 June 2026. https://www.iqvia.com/locations/emea/blogs/2026/06/the-eu-biotech-act-part-2
- Council of the European Union. WK 480/2026 INIT: consolidated CTR amendments proposed in COM(2025) 1022 final (European Biotech Act), 14 January 2026. https://data.consilium.europa.eu/doc/document/WK-480-2026-INIT/en/pdf
- Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use. https://eur-lex.europa.eu/eli/reg/2014/536/oj
- European Medicines Agency. Clinical Trials Information System (CTIS): Sponsor Frequently Asked Questions, EXT/40478/2026, version 1.0, 26 March 2026. https://www.ema.europa.eu/system/files/documents/presentation/sponsor-faqs_-v-10-en.pdf
- European Medicines Agency. “CTIS Bitesize talk: user access and role management” (presentation, 24 February 2022). https://ema.europa.eu/en/documents/presentation/presentation-clinical-trials-information-system-ctis-bitesize-talk-user-access-and-role-management_en.pdf
- Danish Medicines Agency. “Are you running clinical trials? You can now activate e-mail notifications in CTIS,” 29 June 2026. https://laegemiddelstyrelsen.dk/en/news/2026/are-you-running-clinical-trials-you-can-now-activate-e-mail-notifications-in-ctis-/
