DCT Risks: Data, Regulatory & Equity Gaps

Deciding to run a trial with decentralized elements is not just an operational choice — it is a risk-assessment exercise. A decentralized clinical trial (DCT) does not create a separate regulatory category and does not lower the bar for data quality, participant protection, or GCP compliance; it moves specific activities away from a central investigator site, which changes where risk sits and often multiplies the number of parties who have to manage it. This guide assumes familiarity with what a DCT is and focuses narrowly on the risks a sponsor, CRO, or research administrator needs to weigh before launching one. For the underlying definitions and FDA guidance, see CASRAI’s Decentralized Clinical Trials (DCTs) guide; for a side-by-side operational comparison against a traditional site-based design, see Centralized vs. Decentralized Clinical Trials.

Data quality and equivalence risk

When a blood draw, an imaging scan, or a vital-sign reading is captured at a local lab, through a mobile phlebotomy service, or by a wearable digital health technology (DHT) instead of at the central site, the sponsor takes on the burden of demonstrating that data is of comparable quality and reliability to what the protocol would have obtained centrally. That burden is not automatic — it has to be built into the data management plan and validated device-by-device and vendor-by-vendor, not asserted after the fact. Fragmenting data collection across multiple local labs, home-health providers, and DHT platforms also multiplies the number of places a data-integrity gap can originate, which is precisely the concern the ALCOA+ data-integrity principles (attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring, available) are used to test for. See CASRAI’s ALCOA+ entry, and CASRAI’s Risk-Based Quality Management (RBQM) guide for how ICH E6(R3)’s risk-based, quality-by-design approach is meant to direct oversight resources toward the data and processes most likely to affect trial reliability — a DCT’s dispersed data sources are exactly the kind of critical-to-quality factor that framework was built to surface early rather than catch late.

Site and vendor oversight risk

A traditional trial concentrates delegation and oversight at a small number of investigator sites. A DCT often replaces that with a network of local health care providers (HCPs), home-health agencies, couriers, and technology vendors, each performing a slice of what a single site used to do — and each of whom the sponsor or investigator must qualify, train, delegate to, and document. FDA’s decentralized clinical trials guidance is explicit that this dispersed delegation still has to be documented the same way delegation to sub-investigators and coordinators is documented on a traditional trial; see CASRAI’s Delegation of Authority (DoA) Log entry for the underlying mechanism. Direct-to-participant (DtP) drug shipment carries a parallel risk: the same chain-of-custody, temperature-control, and accountability documentation a central site’s pharmacy would generate has to be reconstructed for shipments going to individual homes, which is a materially harder logistics and audit problem. See CASRAI’s Clinical Trial Supply Management guide for the IMP handling and accountability requirements a DCT still has to satisfy off-site.

Cross-jurisdiction regulatory variability risk

For multi-country trials, regulatory treatment of decentralized elements is not uniform. FDA’s September 2024 final guidance applies existing US requirements — IND/IDE, GCP, informed consent, 21 CFR Part 11 — to off-site activities rather than creating a new pathway. In the European Union, the European Commission, EMA, and the Heads of Medicines Agencies published a recommendation paper on decentralised elements in clinical trials in 2022 under the Accelerating Clinical Trials in the EU (ACT EU) initiative, but implementation has been uneven: several member states still lack DCT-specific implementing rules and, in some cases, continue to rely on emergency measures introduced during the Covid-19 pandemic to address issues such as remote informed consent, at-home IMP administration, and the use of third-party service providers. That unevenness means the legal validity of a remote consent workflow, the acceptability of a given e-signature method, and the permissibility of a specific home-health or courier arrangement can differ by country in ways a US-only protocol design will not anticipate. A sponsor running a multi-country DCT needs a country-by-country regulatory map for these elements rather than a single global remote-consent design assumed to travel everywhere unchanged. See CASRAI’s Informed Consent in Research guide, and the Common Rule (45 CFR 46) and ICH E6(R3) entries for the frameworks a DCT is still reviewed under regardless of where activities occur.

Technology access and digital equity risk

A DCT’s ability to widen geographic and demographic reach is real, but it runs in both directions. Relying on smartphone apps, broadband connectivity, and comfort navigating a patient portal for eConsent, ePRO, or DHT data capture can just as easily exclude older adults, participants with limited digital literacy, rural participants without reliable connectivity, or lower-income participants without a suitable device — the same populations a decentralized design is often pitched as reaching more easily. Mitigating this is not a one-time design decision; it typically requires offering non-digital or assisted alternatives (paper consent with an in-person or telehealth option, provisioned devices, local site backup) and documenting that those alternatives are genuinely available rather than nominal. Digital-equity gaps that go unaddressed at design time tend to surface later as a diversity-of-enrollment problem rather than a technology problem. See CASRAI’s eConsent and Wearable Devices and Digital Health Technologies (DHT) entries for the underlying tools this risk attaches to.

Participant engagement and retention risk

Removing routine site visits removes a touchpoint that, on a traditional trial, does double duty as both a data-collection event and an opportunity for staff to build rapport, answer questions, and catch early signs a participant is disengaging. Without that structure, a DCT depends more heavily on proactive outreach, app engagement, and remote coordinator contact to sustain participation — and a participant who stops responding to a portal notification is harder to flag early than one who simply misses a scheduled visit. This is a real and distinct retention risk in remote models, but the underlying retention strategies, withdrawal-rights mechanics, and lost-to-follow-up tracking are the same regardless of trial design; see CASRAI’s Clinical Trial Patient Retention guide for the full treatment rather than duplicating it here.

Data privacy and cybersecurity risk

Continuous data transmission from home-based DHTs, remote eConsent platforms, and telehealth visit records extends a trial’s electronic footprint well past a single investigator site’s network, expanding the attack surface for a data breach and the number of vendors whose security posture the sponsor is implicitly relying on. Each remote data flow still has to satisfy 21 CFR Part 11’s requirements for trustworthy, reliable electronic records and signatures, and each new vendor — DHT platform, eConsent provider, telehealth service, home-health agency — needs a data security and privacy agreement covering breach notification and data handling, not just a data-quality agreement. Sponsors that treat DCT vendor onboarding as purely a data-quality exercise, without an equivalent security review, are carrying this risk unmanaged.

Protocol design and IRB review risk

IRB oversight of the protocol as a whole does not change for a DCT, but the IRB can only evaluate what the protocol describes. A common and avoidable failure mode is a protocol that references decentralized elements in general terms — “eConsent will be used,” “some visits may occur remotely” — without specifying who performs each remote activity, how it is documented, and how data quality is verified, leaving the IRB unable to meaningfully assess those elements at initial review. That gap tends to surface later as a protocol amendment, an IRB query, or a finding during monitoring, all of which cost more time than describing DCT-specific procedures explicitly up front. See the IRB and regulatory considerations section of CASRAI’s Decentralized Clinical Trials guide, and the IRB entry, for what a DCT protocol needs to make explicit.

Weighing these risks: why most real trials end up hybrid

None of the risks above are arguments against decentralization — they are the reason most real-world DCTs are hybrid rather than fully remote, mixing decentralized elements with a reduced number of in-person visits chosen procedure by procedure rather than adopting a fully remote design wholesale. A screening visit or a procedure requiring specialized imaging might stay on-site while routine follow-up moves to telehealth and local labs; a data point with a validated home-collection method moves off-site while one that does not stays on-site. See CASRAI’s Centralized vs. Decentralized Clinical Trials comparison for a structured, dimension-by-dimension way to make that choice, and CASRAI’s Decentralized Clinical Trial (DCT) Platform entry for the vendor-tooling category sponsors typically use to operationalize a hybrid design.

Frequently asked questions

Are decentralized clinical trials inherently riskier than traditional site-based trials?

Not inherently — the regulatory and safety framework is identical either way. The risks are different in kind, not necessarily greater in degree: a DCT trades the concentrated logistics of a single site for distributed oversight of more parties (local HCPs, couriers, DHT vendors), which requires more deliberate documentation and vendor management to manage well.

What is the biggest regulatory challenge in running a DCT across multiple countries?

Uneven implementation of DCT-specific rules between jurisdictions, particularly around whether and how remote informed consent, at-home investigational product administration, and third-party service providers are formally recognized. A design that is fully compliant under FDA’s guidance is not automatically compliant everywhere a multi-country trial enrolls.

Does a hybrid design eliminate these risks?

No — it reduces exposure to some of them (fewer fully remote data points to validate, fewer participants who need a digital-only pathway) but does not eliminate the underlying oversight, consent, and data-quality obligations for whichever elements remain decentralized.

Who is responsible for overseeing local health care providers performing trial procedures in a DCT?

The investigator remains responsible under GCP, even when a local HCP performs the procedure on the investigator’s behalf. The sponsor’s documented delegation and oversight process is what demonstrates that responsibility was actually exercised, not just assumed.

Challenges and Risks of Launching a Decentralized Clinical Trial