Most buying guides are a feature checklist. For 2027 the more useful question is which criteria deserve the most weight now that GCP has been rewritten, FDA has restated its position on electronic systems and AI is showing up in vendor pitches. This is our opinionated take, with sources.
Free sandbox · No credit card · 21 CFR Part 11 aligned
Vendor A, weighted score
74 / 100
The short version
What changed
If you want the generic version, with a shortlist method, a requirements list and the common mistakes, our clinical trial software selection guide and EDC vendor comparison guide already cover it. This post is the layer on top: what has moved in the last two years and how it should change the weights in your scorecard.
First, GCP itself. ICH adopted the final E6(R3) guideline at Step 4 on 6 January 2025. The EMA's Step 5 text gives 23 July 2025 as the date the principles and Annex 1 came into effect in the EU, and FDA posted the final text and published it in the Federal Register in September 2025. The tone is the important part: E6(R3) asks for proportionate, risk-based, quality-by-design trials, and it puts data governance and the fitness of computerised systems for their intended purpose front and centre. Our E6(R3) guide for clinical trial teams goes through the structure.
Second, electronic records. On 2 October 2024 FDA published its final guidance Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers. It finalised the March 2023 draft and replaced the 2007 guidance on computerized systems used in clinical investigations. It is non-binding recommendations on how 21 CFR Part 11 applies, but it is where reviewers and inspectors now look for how FDA thinks about vendor-supplied systems, validation and trustworthy records.
Third, decentralised and pragmatic designs. ICH adopted E6(R3) Annex 2, which covers decentralised elements, pragmatic designs and real-world data used in interventional trials, at Step 4 on 3 June 2026. It has to be read with the principles and Annex 1. The EMA's guideline page lists 15 January 2027 as its date of coming into effect, and regional timing differs, so check the current text for your region. Our Annex 2 guide covers what it means in practice.
Eight criteria
Each row is a criterion and how to test it. Weights are yours to set, but the order below is how we would rank a typical small or mid-sized sponsor.
Can you build only what the protocol needs, change it safely when risk changes, and see risk signals (query rates, overdue visits) without exporting data first?
Ask for a field-level audit trail with user, timestamp, old value, new value and reason for change. Check that it cannot be edited through the interface and that it exports.
Ask what documentation supports your own validation and UAT, and test in a sandbox with every feature switched on. Part 11 validation is a shared responsibility, so be wary of "fully compliant" slogans.
Consent, questionnaires, site data and safety reports in one audit trail beat four vendors stitched together, particularly for the decentralised elements Annex 2 now addresses.
Measure from sign-up to a working, tested build. If the answer involves a statement of work and a queue, add that to your timeline.
Ask for a sample export in your analysis format, including a data dictionary. CDISC SDTM output as SAS XPT with Define-XML saves programming time. See CDISC SDTM export software.
Count licence, build, change requests, training, validation effort and your own staff time. Run your numbers through the EDC cost calculator.
If a vendor leads with AI, ask what it does, what is reviewed by a human, what is logged and how changes are notified. See our GxP checklist for AI in data capture.
The free sandbox has every feature, no credit card and no time limit. Build a study, test edit checks and e-signatures, and look at the audit trail before you talk to anyone.
Method
A scorecard only works if it is fixed before the demos start. Agree the weights with the people who will live with the system: the data manager, a site coordinator, the person who signs off validation, and whoever pays. Then give every vendor the same task, not a bespoke demo.
Feature counts, logo walls and unverifiable superlatives. A vendor that says it is "compliant with everything" has not told you which controls exist. Ask which Part 11 controls the system provides, which are left to your procedures, and what evidence supports each one. Capture's own wording is deliberately specific: 21 CFR Part 11-aligned controls, a field-level audit trail, e-signatures and role-based access, with validation remaining a shared responsibility.
Ask every vendor
| Topic | Ask | A good answer looks like |
|---|---|---|
| Audit trail | Show me the history of one changed value | User, timestamp, old value, new value and reason, visible and exportable |
| Validation | What supports our UAT? | Documentation and a sandbox you can test in without paying first |
| Amendments | Who edits a form after go-live? | Your team, with draft and approved states and every change logged |
| Data out | Send me a sample export | Analysis-ready files with a data dictionary; SDTM if you need it |
| Hosting | Where is data stored? | A named region that fits your regulatory needs (Capture offers the EU, Frankfurt, and the USA, N. Virginia) |
| Support | Who answers, and how fast? | A named channel and a stated response time, plus documentation and training |
Capture's support is email with a typical response time under 24 hours, plus documentation, video tutorials and setup guides.
Where we fit
Capture is a self-serve, all-in-one platform: EDC, an eCRF builder, ePRO, eConsent, randomization, safety reporting and monitoring workflows in one system with one audit trail, used for Phase 1 through Phase 3. You can sign up, build a study (or upload a protocol and let the AI study builder draft visits and forms for your review), test everything for free and only pay when you go live with real participants.
Be sceptical in the right places. We do not publish prices on the site, so ask us. Check our security page for what we claim and what we do not. And run the same-task trial on us as you would on anyone: if the sandbox does not let you reach a decision, that is a fair reason to look elsewhere. To compare against enterprise tools and REDCap, see Compare REDCap and our EDC buyer scorecard template.
A weighted scorecard fixed before demos, with criteria for risk-based GCP fit, defensible records and audit trail, reusable validation evidence, an integrated participant journey, time to a tested study, data portability, total cost and governance of AI features.
The principles and Annex 1 were adopted at Step 4 on 6 January 2025 and came into effect in the EU on 23 July 2025. FDA posted the final guidance in September 2025. Annex 2 was adopted at Step 4 on 3 June 2026, with regional timing that you should check.
FDA's final guidance Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers, published in the Federal Register on 2 October 2024, finalised the March 2023 draft and supersedes the 2007 guidance.
Three is usually enough: score all on the same real task and the same weights. More vendors mostly adds noise, unless your procurement rules require it.
Yes, if the vendor offers a self-serve sandbox. Capture's free sandbox includes every feature with no credit card and no time limit, and you pay only when you go live with real participants.
Scoring the demo instead of the system. Fix the weights first, run the same task on every vendor and test an amendment and an export before you decide.
Keep exploring
Clinical trial software selection guide
The shortlist method and checklist.
EDC vendor comparison guide
Compare systems on common criteria.
EDC buyer scorecard template
A scorecard to reuse.
ICH E6(R3) guide
What the new GCP text asks for.
EDC validation checklist
Plan your own validation and UAT.
EDC cost calculator
Estimate total cost of ownership.
Free sandbox with every feature. No credit card, and you pay only when you go live.