Usage Examples
- Which Part 312 obligations are we actually transferring, and is each one named in the transfer document?
- The CRO ran the monitoring, but the inspection observation is written to us as sponsor.
- E6(R3) calls them service providers now, so update the oversight SOP language before the next audit.
What is Contract Research Organization (CRO)?
A Contract Research Organization is an independent contractor that assumes, under written transfer from a sponsor, one or more of that sponsor's regulatory obligations for a clinical investigation and must itself comply with the regulations governing them.
A Contract Research Organization exists because sponsor obligations under 21 CFR Part 312 are portable but never erasable. A sponsor without monitors, data managers, or a safety desk can buy that capacity, and the regulation lets the obligation travel with the work rather than forcing the sponsor to build the function in-house. What the regulation does not allow is for the obligation to disappear in the process.
A Contract Research Organization holds only the obligations named in the written transfer. 21 CFR 312.52(a) requires any transfer to be described in writing, and ICH E6(R3) section 3.6.4 states that activities not specifically transferred to and assumed by a service provider are retained by the sponsor. A vendor that supplies a service without assuming a sponsor obligation is a service provider under E6(R3) but is not a CRO under Part 312.
A Contract Research Organization is managed in practice through the transfer-of-obligations document and the oversight built on top of it. Sponsors enumerate each transferred obligation, assess the CRO's suitability before selecting it, and keep oversight over the transferred activities, including anything the CRO subcontracts further. The obligations a sponsor never transferred, listed in 21 CFR 312.50, remain the sponsor's to discharge.
Not to be confused with
- Service provider
- ICH E6(R3) retired CRO as a standalone glossary entry; its entry for Contract Research Organisation (CRO) now reads only "See Service Provider," a wider category covering any commercial, academic, or other organisation supplying a trial service. Every CRO is a service provider; not every service provider assumes a sponsor obligation.
- Sponsor
- the sponsor initiates the clinical investigation and takes responsibility for it. A CRO holds only what was transferred in writing, and under ICH E6(R3) 3.6.6 the ultimate responsibility for participant safety and data reliability never leaves the sponsor.
- Investigator
- an individual who actually conducts the investigation, under whose immediate direction the drug is administered or dispensed. A CRO is an organization that assumes sponsor-side obligations; it does not conduct the investigation at the site.
- Sponsor-investigator
- an individual who both initiates and conducts an investigation and therefore carries both sets of obligations at once. There is no counterparty to transfer to, so 21 CFR 312.52 does not apply.
The obligations run in both directions, sponsor and CRO. These are the anchors.
What you must do
- 1Establish which sponsor obligations the organization is assuming as an independent contractor with the sponsor, because that assumption is what makes it a CRO rather than an ordinary vendor21 CFR 312.3(b)
- 2Describe every transfer of sponsor responsibility in writing, enumerating each obligation individually when the transfer is partial21 CFR 312.52(a)
- 3Comply, as the CRO, with the specific regulations applicable to every obligation assumed21 CFR 312.52(b)
- 4Keep ultimate responsibility for participants' rights, safety and well-being and for the reliability of the trial data with the sponsor, however much is transferredICH E6(R3) Annex 1, 3.6.6
- 5Require the CRO to implement appropriate quality management and to report to the sponsor any incident that might affect participant safety or trial resultsICH E6(R3) Annex 1, 3.6.6
- 6Maintain sponsor oversight of important transferred activities, including activities the CRO subcontracts furtherICH E6(R3) Annex 1, 3.6.9
Common mistakes
Treating the master services agreement as the transfer of obligations
a contract that lists deliverables and milestones but never names the Part 312 obligations transfers nothing. 21 CFR 312.52(a) requires the transfer itself to be described in writing, and anything not specifically transferred is retained by the sponsor, which is exactly where the finding lands.
Assuming the CRO absorbs the liability
21 CFR 312.52(b) makes the CRO answerable for what it assumed, and ICH E6(R3) 3.6.6 keeps ultimate responsibility with the sponsor. The two are cumulative, not alternative. Engaging a CRO buys capacity, not indemnity from the regulator.
Stopping oversight at the first tier
sponsors audit the CRO and never look at whom the CRO subcontracted. ICH E6(R3) 3.6.9 extends the sponsor's oversight duty to activities further subcontracted by the service provider, so an unmonitored fourth party is a sponsor problem, not a CRO problem.
When This Matters
- Which Part 312 obligations are we actually transferring, and is each one named in the transfer document?.
- The CRO ran the monitoring, but the inspection observation is written to us as sponsor.
- E6(R3) calls them service providers now, so update the oversight SOP language before the next audit.
Frequently Asked Questions
Yes, a sponsor may transfer any or all of its Part 312 obligations to a CRO, but the transfer must be described in writing and the sponsor keeps ultimate responsibility. ICH E6(R3) section 3.6.6 places ultimate responsibility for participant safety and data reliability with the sponsor regardless of what was transferred.
Related Use Cases
- Pharma Use Cases
Cut NDA and sNDA prep time by 60% with AI-assisted drafting and automated readiness checks
- Biotech Use Cases
Compress IND prep from 8-12 weeks to under 3 weeks with AI-assisted drafting and validation
- Clinical Workflows
Track clinical trial regulations across global markets
- Regulatory Affairs Workflows
Cut regulatory intelligence tracking from 10+ hours/week to automated, real-time alerts
