The rules are scar tissue

It's not perfect. It's getting better. It's still changing.

Nobody hands you this timeline when you start in clinical research. You learn the rules as a list of things to comply with, and the reasons stay buried in training slides that were themselves written a decade ago. So people end up describing a job that changed in 2016, or quoting a statute whose guidance was never finished.

This page puts the date back on. Every entry names what failed, what the failure produced, and where it is honest to say the problem is still open. It grows with the Version History series in The Open Site File.


What changed, and why

Grouped into five threads, each running oldest to newest, because the argument is accumulation.

Protecting the people in the study

August 1947
Ethical code
The Nuremberg Code
What brokePhysicians conducted lethal experiments on prisoners who could not refuse. The defence at trial was that no written rule forbade it.
What changedTen principles issued in the tribunal's verdict, opening with the line the whole field still rests on: the voluntary consent of the human subject is absolutely essential.
June 1964
Ethical code
Declaration of Helsinki
What brokeNuremberg was written for war crimes, by judges, aimed at prisoners. It said little about ordinary medical research on ordinary patients.
What changedThe World Medical Association wrote a code by physicians for physicians. It has been amended ten times since, most recently in October 2024, which is itself the point.
1932 to 1972
Federal study
The Tuskegee Syphilis Study
What broke600 Black men were enrolled without being told what the study was. Penicillin became the standard treatment in the 1940s and was withheld from 1943 onward. It ran for forty years.
What changedNothing, for forty years. A newspaper story in 1972 ended it, not the medical establishment. A federal apology came in 1997.
12 July 1974
Statute
The National Research Act
What brokeTuskegee had just been exposed, and it was not an outlier. The Jewish Chronic Disease Hospital and Willowbrook were already known.
What changedCreated the national commission that would write Belmont, and set the framework that became institutional review boards.
18 April 1979
Report
The Belmont Report
What brokeReview boards existed but had no shared reasoning. Different committees reached different answers on the same protocol.
What changedThree principles: respect for persons, beneficence, justice. Every consent form and every IRB in the United States runs downstream of this document.
21 January 2019
Regulation
Revised Common Rule, compliance date
What brokeThe rule had barely changed since 1991. Consent forms had grown into unreadable legal documents that protected institutions rather than informing people.
What changedRequired a concise key-information section at the front of consent, and moved multi-site studies toward a single IRB.
Still open

FDA's own regulations at 21 CFR 50 and 56 are still not harmonised with it. The rule to align them was only proposed in September 2022, and 21 CFR 50.25 was last amended in 2011. Two rulebooks, one trial.

What a drug has to prove

1937 to 1938
Statute
Elixir Sulfanilamide and the Food, Drug, and Cosmetic Act
What brokeA company dissolved a sulfa drug in diethylene glycol, an antifreeze solvent, and shipped it. By FDA's own count it killed 107 people, many of them children. No law had been broken, because no law required safety testing.
What changedWithin about a year, proving a drug was safe before selling it became mandatory.
10 October 1962
Statute
The Kefauver-Harris Amendments
What brokeThalidomide. A stalled bill, and a reviewer named Frances Kelsey who refused to approve the US application because the evidence was inadequate.
What changedManufacturers now had to prove a drug worked, not merely that it was safe, through adequate and well-controlled investigations. That phrase is the statutory root of the modern clinical trial. It also introduced the first statutory informed consent requirement.

How GCP itself changed

1990
Not a regulator
ICH is founded
What brokeA company running the same drug through the US, Europe and Japan ran three different sets of studies to three different standards, and patients were dosed three times over to satisfy paperwork.
What changedRegulators and industry from all three regions began writing common technical guidelines.
Still open

ICH is not a regulator and its guidelines are not law. They govern anyway, because regions adopt them and because 21 CFR 312.120(a) lets FDA accept a foreign study only if it was conducted in accordance with GCP. Almost nobody entering this field is taught that distinction.

1996
Guideline
ICH E6(R1), the first GCP
What brokeEvery sponsor and every country had its own idea of what good practice meant.
What changedOne consolidated guideline covering the investigator, the sponsor, the review board and the protocol.
Still open

It assumed, in its own words, a largely paper-based process. Everything after this is the guideline catching up to how trials are actually run.

9 November 2016
Guideline
ICH E6(R2)
What brokeTwenty years of electronic records, and monitoring practices that had never been measured against what they actually caught.
What changedAdded risk-based quality management, quality tolerance limits, and explicit sponsor responsibility for oversight of vendors.
6 January 2025
Guideline
ICH E6(R3)
What brokeR2 was an addendum bolted onto a 1996 structure. Digital health tools and decentralised elements had nowhere to sit.
What changedRestructured into Principles plus Annex 1, and made data governance a first-class section rather than an afterthought. Effective in the EU from 23 July 2025.
Still open

Annex 2, covering decentralised and pragmatic elements and real-world data, reached Step 4 on 3 June 2026 and takes effect in the EU on 15 January 2027. If you are being trained on GCP right now, you are learning a version already scheduled to be superseded.

Data, and the patient's own voice

20 August 1997
Regulation
21 CFR Part 11, electronic records
What brokeTrials were moving to computers with no rule saying when an electronic record or signature could be trusted.
What changedSet requirements for system validation, audit trails, record retention and access control.
Still open

In September 2003 FDA announced it would interpret the scope of Part 11 narrowly and would not enforce validation, audit trail, retention or copying requirements as written. The rule is still on the books. This is the clearest proof in the whole timeline that regulation is negotiated and revisable, not handed down.

December 2009
Guidance
Patient-reported outcomes
What brokeWhether a treatment worked was decided by what a clinician could measure. How the patient actually felt had no standing on a label.
What changedFDA set out when a patient-reported outcome instrument can support a labeling claim, which made the patient's own account admissible evidence.
Still open

The Patient-Focused Drug Development series is four guidances long, and number four, the one on endpoints, has sat in draft since April 2023.

2013
Guidance
Risk-based monitoring
What brokeThe industry verified trial data against source documents at close to 100 percent, at enormous cost, and had never measured the yield. TransCelerate measured it in May 2013 and found source data verification produced 7.8 percent of total queries and 2.4 percent of critical data queries.
What changedFDA's guidance that August moved monitoring toward the data and processes carrying the most risk, rather than checking every field on every patient equally. A question and answer follow-up came in April 2023.
September 2024
Guidance
Decentralised elements
What brokeA trial required a person to be physically near a site. Distance was an eligibility criterion nobody wrote down.
What changedFDA finalised guidance on conducting trials with decentralised elements, building on the real-world evidence provisions of the 2016 Cures Act.
Still open

The evidence is thinner than the enthusiasm. Completion rates ran 82.4 percent against 83.3 percent for conventional trials, 78.2 percent of decentralised trials used only a single decentralised element, and uptake had fallen back to pre-pandemic levels by 2023. Roughly 20 percent of the US population has neither broadband nor a smartphone.

The industry that runs the trials

19 March 1987
Regulation
The CRO enters the regulations
What brokeSponsors were already contracting out monitoring and data work with no regulatory definition of who was accountable.
What changedPart 312 defined a contract research organization. Under 21 CFR 312.52 a sponsor may transfer any or all of its obligations to a CRO, it has to be in writing, and anything not written down stays with the sponsor.
Still open

There is no regulator-published CRO register and no official figure for how much trial work is outsourced. Every number in circulation comes from paywalled market research.

29 December 2022
Statute
Diversity action plans
What brokeTrials kept enrolling populations that did not resemble the people who would take the drug.
What changedFDORA required sponsors of certain pivotal trials to submit a diversity action plan.
Still open

Nearly four years later the obligation still does not exist. FDA's own report to Congress states the requirement applies only 180 days after publication of the FINAL guidance, and the guidance is still a draft from June 2024. A real statute, no enforceable duty. This is the clearest example on the page of why 'there's a law now' is not the same as 'it is handled'.

Read further

Where this page came from

Every entry above traces to a primary source. If you want the argument rather than the citation, these are the books and archives that carry it. Three of the twelve are free.

Some links below are Amazon affiliate links. If you buy through one, Root to Rx earns a small commission at no extra cost to you. It does not change what is recommended or what is said about it. As an Amazon Associate we earn from qualifying purchases. Where a source is free, it is marked free and linked straight to the free copy, because selling you something you can read for nothing is exactly the behaviour this newsletter exists to point at.

Thalidomide and the 1962 turn

The moment proving a drug works became law rather than good manners.

01
Trent Stephens and Rock Brynner | Basic Books, 2001, paperback 2002 | ISBN 978-0-7382-0590-8

The founding story behind the Kefauver-Harris Amendments, written for a general reader.

Know before you buy: Short and twenty-five years old. It tells the story, not the statutory mechanics.

02
Cheryl Krasnick Warsh | Oxford University Press, 2024 | ISBN 978-0-19-763254-3

An archival biography that tests the heroic version of the Kelsey story rather than repeating it.

Know before you buy: Academic, 424 pages, and expensive. It covers much of the same ground as Dark Remedy, so pick one.

Where the randomised trial came from

There is no single trade history of the RCT. The best material here is free.

03
Free PDF from the Nuffield Trust
Archie Cochrane | Nuffield Provincial Hospitals Trust, 1972

The founding document of the demand for evidence in medicine. Everything called evidence-based traces here.

Know before you buy: Do not buy this. It is free, it is from 1972, and it is written about the British NHS.

04
Free, CC-BY licensed
A free, openly licensed archive | jameslindlibrary.org

Primary documents on the history of fair tests of treatments, including the 1948 streptomycin trial usually called the first properly randomised one.

Know before you buy: An archive rather than a narrative. Go looking for something specific.

05
David Salsburg | W. H. Freeman, early 2000s | ISBN 978-0-8050-7134-4

The readable on-ramp to where the statistics in your training module actually came from.

Know before you buy: Statistics history, not trial history, and criticised for being loose with anecdotes. Sources disagree on whether it published in 2001 or 2002, which is why no firm year is printed here.

The FDA as an institution

Why the agency behaves the way it does, which is rarely the way people assume.

06
Philip J. Hilts | Knopf, 2003 | ISBN 978-0-375-40466-5

A hundred years of drug regulation in a form you will actually finish.

Know before you buy: It argues a thesis, that regulation drove innovation, and it is over twenty years old.

07
Daniel P. Carpenter | Princeton University Press, 2010 | ISBN 978-0-691-14180-0

The standard scholarly reference. Where Hilts and Carpenter disagree, cite Carpenter.

Know before you buy: 856 pages, academic, expensive, and it stops around 2010. Read it by chapter, not cover to cover.

How evidence became the standard

The intellectual history underneath every SOP you will ever follow.

08
Harry M. Marks | Cambridge University Press, 1997 | ISBN 978-0-521-78561-5

The intellectual centre of this whole shelf, on how the controlled trial won.

Know before you buy: Demanding, and it stops in 1990, so no ICH-GCP and no CROs. The author died in 2011, so no update is coming.

09
Stefan Timmermans and Marc Berg | Temple University Press, 2003 | ISBN 978-1-59213-188-4

The serious critique of evidence-based medicine, which is not the same thing as a debunking of it.

Know before you buy: Written in sociology vocabulary and over twenty years old.

The industry you actually work in

No book exists on the history of the CRO industry. These are the closest thing.

10
Jill A. Fisher | Rutgers University Press, 2008 | ISBN 978-0-8135-4409-0

The closest thing that exists to a book about privatised trial conduct as a system.

Know before you buy: US fieldwork from the mid-2000s. It predates decentralised trials and central IRBs.

11
Adriana Petryna | Princeton University Press, 2009 | ISBN 978-0-691-12657-9

Why your site list has the countries on it that it does.

Know before you buy: Anthropology, theory-heavy, and openly critical. Sixteen years old, and trial geography has moved since.

12
Free open-access PDF from Mattering Press
Sergio Sismondo | Mattering Press, 2018

Publication planning, key opinion leaders and ghost authorship, by the researcher who documented them.

Know before you buy: Unambiguously a critique, written in science-and-technology-studies vocabulary.

What is deliberately not here

Anything we could not trace to a primary source. Several widely repeated figures about this industry, particularly the size of the contract research market and the share of trial work that is outsourced, come only from paywalled market research and are not published by any regulator. Where a number is missing here, that is usually why.

There is also a gap we went looking for twice and could not fill. No book exists, popular or scholarly, whose subject is the history of the contract research organization. The industry that runs most of the world's clinical trials has not had its history written. The closest available work is listed above under the industry heading, and none of it is that book.

If you find an error, say so. Corrections get made in public, with the date, which is the same standard this page applies to everyone else.

This page isn't finished. It grows with the Version History series in The Open Site File. Every new entry starts as an issue: what broke, what changed, and what still hasn't been fixed. Subscribe and you'll get each one as it lands.

© 2026 Root to Rx · Part of Open Label Media, LLC.
beehiivPowered by beehiiv