PI Protocol Deviations in China Trials

Life Sciences & Healthcare Blog · Legal cluster

After a serious protocol deviation in a China clinical trial, the emails that say "the PI messed up" become exhibits — and they may be incomplete. The allocation of responsibility between the sponsor, the hospital, the contract research organisation (CRO), and the principal investigator (PI) is a fact question, not a blame reflex. This article explains how to sort the frame — eligibility errors at the bedside, ambiguous protocol design, missed monitoring, and consent-process failures — under the Drug Administration Law, Good Clinical Practice (GCP), and the Civil Code's tort rules, and what the sponsor should do before any public narrative hardens.

Why this matters: the deviation file becomes the liability file#

A protocol deviation — an eligibility error, a dosing error, a missed visit window, an unapproved procedure — is an everyday event in clinical research, and most are minor. The moment a deviation is serious, however, the character of the paperwork changes. The sponsor's investigation, the CRO's monitoring reports, the hospital's internal review, and the insurance notification become the record that regulators, courts, and arbitration tribunals will read if a subject is injured or if the study data is questioned. In China, where NMPA site inspections and subject-injury litigation are both live risks, the deviation file is the liability file.

The danger is premature blame. If the sponsor's first reaction is to conclude "the PI messed up," the file will be built around that conclusion — and the conclusion may be wrong. The PI's bedside decision may have been forced by an ambiguous protocol. The hospital's enrolment process may have been defective. The CRO may have seen the red flag and not escalated. The sponsor's own design may have created the ambiguity. Each of these is a different allocation of responsibility, and the allocation determines who pays, who reports to the regulator, and who carries the insurance claim.

Governing legal and statutory framework#

Drug Administration Law of the People's Republic of China (2019 revision)#

The Drug Administration Law establishes the framework for drug clinical trials in China, including the requirement that trials be conducted in accordance with GCP, and it imposes obligations on the sponsor and the clinical trial institution. The 2019 revision strengthened the clinical-trial framework and connected it to the NMPA's inspection and enforcement powers. A serious deviation that reflects a systemic failure — rather than an isolated error — can implicate the sponsor's obligations to ensure the trial is conducted lawfully and the institution's obligations to comply with GCP.

PRC Good Clinical Practice (GCP) — 2020 amendment#

The current GCP rules (the 2020 revision of the Guidelines for Good Clinical Practice) allocate specific duties: the sponsor is responsible for quality management, monitoring, and reporting; the investigator is responsible for conducting the trial in accordance with the protocol and protecting subjects; the institution provides the facilities and oversight. The relevant articles — including those addressing investigator obligations, sponsor monitoring, and quality management — provide the contractual and regulatory basis for dividing responsibility when a deviation occurs. GCP Article 21 and related provisions address investigator qualifications and conduct, Article 32 addresses sponsor monitoring, and Article 63 addresses the sponsor's quality assurance. The precise article numbers matter less than the allocation they create: the investigator owns the bedside decision; the sponsor owns the design and oversight; the CRO owns the monitoring it contracted to perform.

Guidelines for Good Clinical Practice (2020), Article 32 (sponsor monitoring): The sponsor shall appoint qualified monitors... to monitor the progress of the trial and to verify that the rights and wellbeing of subjects are protected, that the reported trial data are accurate, complete, and verifiable from source documents, and that the conduct of the trial complies with the approved protocol, GCP, and applicable regulatory requirements.

PRC Civil Code — Tort Liability Book#

Where a subject is injured, the Civil Code's tort provisions allocate compensation among the responsible parties. The employer/unit liability rules and the general tort principles determine whether the hospital, the investigator (as the hospital's staff), or the sponsor bears the loss, and the sponsor's contractual indemnification of the site is governed by the contract. The tort analysis is driven by fault — who breached which duty — which is exactly the question the deviation investigation must answer with facts.

Key legal analysis and enforcement precedents#

NMPA site inspections produce deficiency findings that frequently include protocol deviations, and the published inspection summaries show how the regulator characterises them. When deviations cluster — multiple enrolments of ineligible subjects, repeated dosing errors, monitoring records that do not match source documents — the finding migrates from "investigator error" toward "site quality-system failure" or "sponsor oversight failure," depending on the evidence. The NMPA's characterisation drives the corrective action and, in serious cases, the suspension of the site or the study.

Civil negligence disputes involving clinical research have reached Chinese courts in the subject-injury context. The reported decisions allocate liability between the hospital and the sponsor based on the specific facts: where the protocol was ambiguous or the sponsor's instructions defective, the sponsor shared responsibility; where the error was purely at the bedside, the hospital and the investigator carried it; where the CRO missed documented red flags, its monitoring failure was examined under its contract with the sponsor. The courts do not apply a presumption against any party; they follow the evidence of duty and breach.

Insurance is the third player. Clinical-trial subject-injury insurance is required in China, and the insurer will conduct its own investigation. The sponsor's internal narrative matters because the insurance claim and the liability analysis feed each other: a premature finding of "investigator fault" can complicate the sponsor's claim, while a documented, fact-based allocation preserves the insurance coverage for the responsible party. The deviation investigation must therefore be run with the insurer in mind from day one.

The investigation record is only as good as the source documents it rests on. In a China trial, the site's electronic data capture system, the source documents at the hospital, the monitoring visit reports, and the chat records between the CRO and the site are all potential evidence, and the preservation plan must cover each of them before anyone starts analysing fault. A practical rule is to freeze the relevant systems at the moment the deviation is reported — no draft edits, no record overwrites, no file deletions — and to document the freeze in the investigation file. The regulator and the insurer will both test whether the record was complete at the time of the event, and an incomplete record is its own finding.

Operational vulnerabilities and transactional pitfalls#

• The blame reflex: the sponsor's legal or CRO team emails "the PI messed up" before the facts are gathered, and the email becomes the narrative. Later evidence of an ambiguous protocol cannot compete with a written conclusion that already exists.
• Missing source preservation: site staff delete draft notes, "clean up" source documents, or overwrite electronic records before they are preserved. In a data-integrity environment, the absence of source is itself a finding.
• Uncoordinated notifications: the sponsor, the hospital, and the CRO each contact the regulator, the insurer, and the ethics committee separately, with different versions of events. Divergent narratives create a second problem on top of the first.
• The scapegoat track: the hospital disciplines the investigator or the sponsor terminates the CRO to demonstrate seriousness, without a documented factual basis. The disciplinary action becomes its own exhibit, and a labour or contract dispute follows.
• Safety-reporting clock mismanagement: while the parties argue about fault, the expedited safety-reporting timelines keep running, and a late report to the NMPA is a standalone violation.

What a Wuhan pharma practice does before blame hardens#

In my pharmaceutical and biotech compliance practice in Wuhan, the protocol-deviation file arrives in one of two states: either the sponsor’s team has already emailed “the PI messed up”, or the site has already “cleaned up” the source documents. Both states are losses. The first email becomes the narrative that later evidence cannot compete with — an ambiguous protocol, a missed visit window or a dosing error that was partly the system’s fault cannot rewrite a written conclusion that already exists. The source-document cleanup is the second loss: in a data-integrity environment, deleted draft notes and overwritten electronic records are themselves the finding, often more damaging than the deviation that triggered the review. The discipline that works is the one this article maps: stand up a privilege-aware investigation plan before blame hardens, preserve the source documents including the electronic records and chat logs, sort the frame by fact — the protocol, the training record, the monitoring report — and only then allocate responsibility among sponsor, CRO, investigator and institution. The GCP obligations under the 2020 revision and the Drug Administration Law’s inspection framework mean the regulator will read the deviation cluster as a quality-system finding where the patterns repeat. My advice is always the same: subject care first, facts second, and blame never before the evidence — the deviation file becomes the liability file, and the file is built in the first 48 hours.

Strategic compliance roadmap and action plan#

Before blame hardens, run the allocation protocol:

1. Stand up a privilege-aware investigation plan: designate the investigation team, preserve source documents (including electronic records and chat records), and instruct everyone — site, CRO, sponsor — not to destroy or alter anything. The plan is drafted with legal counsel so the investigation work can be protected to the extent the law allows.
2. Sort the frame by fact: classify the deviation into its allocation boxes — eligibility or dosing error at the bedside points to the investigator/site; an ambiguous protocol or defective product lot points to the sponsor/manufacturer; missed monitoring of known red flags points to the CRO and sponsor oversight; consent-process failures point to ethics and site process with sponsor protocol-design input. The classification is provisional until the evidence says otherwise.
3. Keep the safety-reporting clocks moving: file every required expedited safety report to the NMPA and the ethics committee on time, regardless of who is at fault. Late reporting is a separate violation that no allocation of fault will cure.
4. Notify insurers early and precisely: give the insurer the facts, the timeline, and the provisional allocation — not a conclusion about blame. The insurer's investigation is aligned with the same evidence base.
5. Align public statements: the sponsor, hospital, and CRO issue no public or semi-public statements about fault until the investigation is complete. Subject care and subject communication come first, always, and the communication with the subject and family is factual and supportive.

When the investigation concludes, the written allocation names the responsible parties, the evidence for each, and the corrective actions. That document — not the first email — is the file that the regulator, the court, and the insurer will read.

The sponsor's contract with the hospital and the CRO should allocate the investigational process at the outset, so that the post-event analysis operates within an agreed framework rather than an improvised one. The clinical trial agreement typically includes the site's obligation to conduct the trial in accordance with GCP and the protocol, the CRO's monitoring obligations with defined escalation triggers, and the sponsor's indemnification arrangements for subject injury and for defined categories of sponsor-caused issues. When a deviation occurs, the contract becomes the starting point for the allocation — not because it answers every question, but because it establishes who owned which duty, and the factual investigation then tests whether the duty was performed. A well-drafted contract does not prevent deviations; it prevents the allocation from becoming a blame contest.

What not to do#

Do not write "the PI messed up" into an email that will become an exhibit. Do not let the site clean up source documents before preservation. Do not let three parties file three versions of the same deviation with the regulator. Do not fire anyone for a systemic failure until the system — and the person — has been examined on the facts. Subject care first, facts second, blame never before the evidence.

Read next: Subject injury & insurance · CRO/CDMO disputes · Data integrity

Cluster: Life sciences legal hub · Life sciences blog