“Good Clinical Practice (GCP) certification” is one of the most-searched clinical-research
compliance terms, and one of the most misunderstood. There is no single government agency
that issues a “GCP certification,” no national license, and no one body that owns the term.
What exists instead is a patchwork of training courses and professional credentialing exams,
run by different organizations, that all try to demonstrate the same underlying thing:
competency in the principles of Good Clinical Practice as defined by the International
Council for Harmonisation’s ICH E6 guideline. This guide explains what GCP
certification actually is, who is typically required to hold it, the real providers behind
it, how long it lasts, and how it differs from the broader human-subjects-protection
training every research-active institution also requires.
What GCP certification actually is
GCP certification is documentation — usually a course-completion certificate, sometimes a
credentialing-exam credential — that an individual has been trained in, and in some cases
tested on, the principles and procedural requirements of Good Clinical Practice as set out in
ICH GCP. It is not a license to
practice, and it is not issued or enforced by FDA, EMA, or any other regulator. FDA’s own
regulations illustrate this directly: 21 CFR 312.53(a) requires a sponsor to select
investigators “qualified by training and experience,” but the regulation does not specify a
minimum qualification, a required course, or a specific certification an investigator must
hold. The obligation to demonstrate GCP competence sits with sponsors and institutions, who
satisfy it — almost universally, in practice — by requiring staff to complete a recognized GCP
training course or hold a GCP-aligned professional credential.
ICH E6(R2), Principle 2.8 (“The Principles of ICH GCP”), states the underlying rule plainly:
“Each individual involved in conducting a trial should be qualified by education, training,
and experience to perform his/her respective task(s).” GCP certification is the field’s
practical answer to that principle — a portable, auditable record that a person has met it.
The standard behind it: ICH E6(R2) and the shift to E6(R3)
ICH E6 is the governing GCP guideline referenced by virtually every GCP training course and
every sponsor SOP. ICH E6(R2), the Integrated Addendum finalized in 2016, has
been the operative version for most of the last decade. ICH E6(R3), the
current core guideline revision, was finalized on 6 January 2025; the EMA set 23 July 2025 as
the effective date for its Principles and Annex 1 in the EU, and FDA issued its own final
E6(R3) guidance on 8 September 2025. E6(R3) restructures the guideline around risk-based
quality management and gives more explicit attention to decentralized and pragmatic trial
elements than E6(R2) did.
Training providers are mid-transition as of 2026: most GCP courses still teach E6(R2)
directly or teach E6(R2) with E6(R3) delta content layered on, and professional bodies are
updating their certification exam content outlines on their own schedules (ACRP, for example,
has stated it will begin incorporating E6(R3) content into its certification exams starting
with its Fall 2026 testing window). When you or your institution select a GCP course, confirm
which version of E6 it is aligned to — this matters more in 2026 than in a typical year,
because the underlying standard itself changed.
Who typically requires GCP certification
No single law mandates “GCP certification” as a universal credential. Instead, the
requirement is layered in from several directions, and most people working on a clinical
trial end up needing to satisfy more than one of them at once:
- Sponsors and CROs — Trial sponsors and contract research organizations
routinely require documented GCP training as a condition of site initiation, written into the
clinical trial agreement or the monitoring plan. This is a contractual requirement, not a
regulatory one, but it is close to universal in industry-sponsored trials. - Investigator sites and academic medical centers — Institutions running
their own investigator-initiated trials typically mandate GCP training institution-wide for
anyone with a role on a clinical trial protocol — investigators, sub-investigators, clinical
research coordinators, and research nurses. - NIH-funded trials specifically — NIH’s GCP training policy
(NOT-OD-16-148,
effective 1 January 2017) requires NIH-funded investigators and staff responsible for the
conduct, management, or oversight of an NIH-funded clinical trial to complete GCP training,
refreshed at least every three years, regardless of trial phase or intervention type. This
applies alongside — not instead of — any sponsor or institutional requirement. - IRBs and ethics committees — Some IRBs require evidence of current GCP
training as part of continuing-review or new-protocol submission for clinical trial
protocols specifically, distinct from the human-subjects-protection training they require of
all researchers. - Device trials under ISO 14155 — Medical device clinical investigations
are governed by ISO 14155:2020 rather than ICH E6 directly, and device-focused GCP courses
are built around that standard’s requirements instead.
See CASRAI’s guide to what qualifies as a
clinical trial under the NIH
definition for how that four-part test determines whose trials this policy reaches, and
the guide to clinical
trial registration and reporting compliance for the adjacent set of NIH- and FDAAA-driven
obligations that often travel with the same protocols.
Training completion vs. a professional credentialing exam — a real distinction
“GCP certification” gets used loosely to describe two genuinely different things, and
mixing them up causes real confusion for people trying to satisfy a sponsor or funder
requirement:
- Course-completion certification — Complete an online (or, less commonly,
in-person) GCP training module; pass an embedded knowledge check; receive a completion
certificate with a specific expiration date. This is what most sponsors, IRBs, and NIH’s own
GCP training policy mean by “GCP training” or “GCP certification.” CITI Program’s GCP series
is the dominant example in academic and hospital-based research. - Professional credentialing certification — Meet a documented experience
threshold, pass a proctored knowledge exam covering a detailed content outline, and hold a
formal post-nominal credential (for example, ACRP’s CCRC or SOCRA’s CCRP) that is renewed on
its own multi-year cycle with continuing-education requirements. This is a career credential,
closer in structure to a professional certification like the PMP or CPA, not a per-protocol
training requirement.
The two are not interchangeable for compliance purposes: holding a CCRC or CCRP credential
demonstrates broader clinical-research competency and typically satisfies an institution’s or
sponsor’s GCP-training requirement, but it does not, by itself, replace the specific
protocol- or sponsor-required training some trials still mandate separately.
Major GCP training and certification providers
CITI Program
The CITI Program (Collaborative Institutional Training Initiative), operated as a division
of BRANY (Biomedical Research Alliance of New York), is the training platform most U.S.
academic institutions and hospitals actually deploy for GCP. CITI’s GCP series is organized
into separate biomedical tracks — GCP for drugs/biologics aligned to ICH guidance, GCP for
FDA-regulated drug/device trials, and a device-specific track aligned to ISO 14155 — plus a
social and behavioral research track, each offered as a basic (initial) course and a shorter
refresher course. CITI’s GCP courses are listed under TransCelerate BioPharma’s GCP Mutual
Recognition Program, meaning a completion can be recognized by other participating sponsor
companies without retraining for each one. CASRAI’s dedicated guide covers
what CITI training is, what it covers, and what it doesn’t
satisfy in more detail — worth reading alongside this page, since CITI’s course catalog
spans far more than GCP alone.
ACRP (Association of Clinical Research Professionals)
ACRP administers four professional credentialing exams, each requiring a documented
experience threshold (generally around 3,000 hours performing the tasks in the relevant
content outline, with experience older than ten years not counting) and a proctored exam:
CCRC (Certified Clinical Research Coordinator), CCRA
(Certified Clinical Research Associate, for monitors), CPI (Certified
Principal Investigator), and ACRP-CP (ACRP Certified Professional, a broader
credential open to clinical research professionals generally). All four credentials are
maintained on a two-year cycle, requiring 24 continuing-education points earned during that
period, plus a renewal fee. ACRP has said it will begin folding ICH E6(R3) content into its
certification exams starting with the Fall 2026 testing window, so an exam taken later in
2026 may test differently than one taken earlier in the year.
SOCRA (Society of Clinical Research Associates)
SOCRA administers the CCRP (Certified Clinical Research Professional)
credential — historically the other major alternative to ACRP’s credentials, and one many
research administrators treat as functionally interchangeable with ACRP’s CCRC for hiring and
sponsor-qualification purposes, though the two are run by separate organizations with
separate exams. CCRP certification runs on a three-year cycle: certificants must complete 45
hours of continuing education within that period, at least 22 of which must relate directly
to clinical research regulations and policy, and must formally apply for renewal to SOCRA’s
Certification Committee before the certification expires.
Other pathways worth knowing about
CITI, ACRP, and SOCRA cover the large majority of GCP training and certification activity
in the U.S. research-administration context, but they are not the only pathway. Some sponsors
and CROs run their own proprietary GCP training that satisfies their internal requirement
without producing a portable, third-party credential. Outside the U.S., other national and
regional training bodies exist (for example, TRREE’s modules are separately recognized under
TransCelerate’s GCP Mutual Recognition Program). If a specific sponsor or funder names a
required provider or course, follow that instruction directly — this guide describes the
general landscape, not a substitute for a specific sponsor’s stated requirement.
GCP certification and credential renewal cycles compared
| Program | Type | Renewal cycle | Continuing requirement |
|---|---|---|---|
| CITI Program GCP course | Course completion certificate | No fixed CITI-wide expiration — the receiving institution or sponsor sets the acceptance window; most require retraining roughly every 3 years, consistent with NIH’s own 3-year GCP refresh requirement |
Retake the refresher course before the institution’s or sponsor’s deadline |
| ACRP CCRC / CCRA / CPI / ACRP-CP | Professional credentialing exam | 2 years | 24 continuing-education points plus a renewal fee |
| SOCRA CCRP | Professional credentialing exam | 3 years | 45 continuing-education hours (≥22 in clinical research regulation/policy) plus formal reapplication to the Certification Committee |
The practical implication for research administrators: a course-completion GCP
certificate and a professional credential are not on the same clock, and “my GCP training is
current” can mean different things depending on which of the three rows above someone is
actually referring to. When verifying compliance for a monitoring visit or an audit, confirm
which specific certificate or credential the sponsor’s requirement points to, not just that
“GCP certification” exists on file.
How GCP certification differs from broader human-subjects-protection training
GCP certification is frequently confused with — and sometimes bundled alongside — the
human-subjects-protection (HSP) and Responsible Conduct of Research (RCR) training every
research-active institution also requires. They are not the same requirement, and satisfying
one does not automatically satisfy the other:
- Scope. HSP/IRB training (commonly delivered via CITI’s Human Subjects
Research series) covers the ethical and regulatory framework for research involving human
participants generally — informed consent, IRB review, the Belmont Report, vulnerable
populations — and applies to essentially all human-subjects research, not just clinical
trials. GCP training is narrower and specific to the conduct and quality-management
requirements of interventional clinical trials: protocol adherence, investigational product
accountability, monitoring, source-data verification, and regulatory reporting. - Who requires it. HSP training is typically an IRB-membership and
protocol-approval prerequisite set by the institution itself. GCP training is more often
driven externally, by the trial sponsor, CRO, or a funder policy like NIH’s NOT-OD-16-148. - Standard referenced. HSP/RCR training draws on the Belmont Report, the
Common Rule (45 CFR 46), and NIH’s RCR expectations. GCP training draws specifically on ICH
E6 (or ISO 14155 for device trials).
In practice, most people conducting clinical trials need both: HSP training to be
qualified to interact with human participants and satisfy IRB requirements, and GCP training
or certification to satisfy the sponsor’s, funder’s, or institution’s clinical-trial-specific
quality standard. See CASRAI’s guides to
CITI Program training and
Responsible Conduct of Research
(RCR) training for how those two adjacent, commonly-confused requirements actually work,
and the informed consent guide for the HSP
requirement GCP-certified staff still separately need to meet.
Verifying and tracking GCP certification as a research administrator
For sponsors, CROs, and institutional research offices, GCP certification records are
typically tracked as part of the site’s regulatory binder or delegation-of-authority log for
each protocol — every individual listed on the delegation log should have current,
verifiable GCP training on file for the duration of their role on that trial, since this is
one of the first things a sponsor monitor or an FDA/EMA inspector checks. Because CITI
completion certificates are tied to the learner’s own account rather than solely to one
institution’s system, a coordinator moving between institutions typically adds the new
institution as an additional affiliation rather than retaking the course from scratch —
whether the receiving institution accepts the existing completion without retraining depends
on that institution’s own acceptance-window policy, which varies. TransCelerate’s Mutual
Recognition listing exists specifically to reduce this friction between sponsor companies for
CITI-issued (and certain other providers’) completions, though it does not override an
individual sponsor’s own stricter requirement if one applies.
Frequently asked questions
Is GCP certification legally required?
Not directly, in the sense of a government-issued license. No FDA or EMA regulation names a
specific required GCP certification. What is required — by FDA regulation (21 CFR 312.53(a)),
by NIH policy for NIH-funded trials (NOT-OD-16-148), and by essentially every sponsor’s own
SOPs and clinical trial agreements — is that individuals conducting a trial be demonstrably
qualified by training and experience. GCP certification is how that requirement gets
satisfied and documented in practice, even though no single law mandates the certificate
itself.
How long does GCP certification last?
It depends entirely on which certification. A CITI GCP course completion has no single
universal expiration — the institution or sponsor relying on it sets the acceptance window,
commonly around three years, matching NIH’s own three-year refresh requirement under
NOT-OD-16-148. ACRP’s professional credentials (CCRC, CCRA, CPI, ACRP-CP) renew every two
years. SOCRA’s CCRP credential renews every three years. See the comparison table above.
Is CITI’s GCP course the same as an ACRP or SOCRA certification?
No. CITI’s GCP course produces a training-completion certificate demonstrating you have
covered ICH E6 (or ISO 14155) content — it does not require prior clinical-research
experience and involves no proctored exam. ACRP’s and SOCRA’s credentials are professional
certifications: they require a documented experience threshold and a proctored knowledge
exam, and they function as career credentials rather than a per-protocol training
requirement. Many people hold both — a current CITI GCP completion for protocol-specific
compliance, and a CCRC or CCRP credential as a professional qualification.
Does GCP certification satisfy my institution’s human-subjects-protection training
requirement?
Generally no, not by itself. GCP training and human-subjects-protection (HSP)/IRB training
cover different, adjacent requirements — see the comparison above. Most clinical research
staff need to complete both, typically as separate CITI course series (or the institution’s
equivalent), not one course standing in for the other.
Which GCP training should I take if my sponsor doesn’t specify one?
Confirm your institution’s default provider first — most academic medical centers and
universities have a standing CITI subscription and a designated GCP course track for exactly
this situation. If a specific study sponsor names a required course or provider in the
clinical trial agreement or site initiation materials, follow that instruction directly; it
generally takes precedence over your institution’s own default requirement for that
particular protocol.
