Comparison of “Serious Breach” (EMA) vs “Important Protocol Deviation” (FDA)

International Council for Harmonisation (ICH) E3 Guideline: Structure and Content of Clinical Study Reports Questions & Answers (R1) (2012) provided the definition for protocol deviation and important protocol deviation. The term "protocol violation" should be avoided and replaced with "protocol deviations" :

A protocol deviation is any change, divergence, or departure from the study design or procedures defined in the protocol. 

Important protocol deviations are a subset of protocol deviations that may significantly impact the completeness, accuracy, and/or reliability of the study data or that may significantly affect a subject's rights, safety, or well-being. For example, important protocol deviations may include enrolling subjects in violation of key eligibility criteria designed to ensure a specific subject population or failing to collect data necessary to interpret primary endpoints, as this may compromise the scientific value of the trial.

Protocol violation and important protocol deviation are sometimes used interchangeably to refer to a significant departure from protocol requirements. The word “violation” may also have other meanings in a regulatory context. However, in Annex IVa, Subject Disposition of the ICH E3 Guideline, the term protocol violation was intended to mean only a change, divergence, or departure from the study requirements, whether by the subject or investigator, that resulted in a subject’s withdrawal from study participation. (Whether such subjects should be included in the study analysis is a separate question.)

To avoid confusion over terminology, sponsors are encouraged to replace the phrase “protocol violation” in Annex IVa with “protocol deviation”, as shown in the example flowchart below. Sponsors may also choose to use another descriptor, provided that that the information presented is generally consistent with the definition of protocol violation provided above.

In adopting and implementing the ICH E3 guidelines, the European Medicines Agency (EMA) and the U.S. Food and Drug Administration (FDA) differ in certain respects. In particular, the EMA guidelines introduce a new term: “serious breach.” While the concept of a “serious breach” overlaps with that of an “important protocol deviation,” subtle distinctions remain between the two terms.

The EMA’s clinical trial protocol breach guideline (CTR Article 52) uses the term “serious breach” to mean a protocol or regulation violation with significant impact on a trial. In contrast, FDA’s protocol deviations guidance (Draft version, December 2024) adopts ICH definitions and uses “important protocol deviation” for critical departures from the protocol. We compare these terms by definition, thresholds, reporting, examples, and implications.

	Serious Breach (EMA/CTR)	Important Protocol Deviation (FDA/ICH)
Definition	Any deviation of the approved protocol (or EU CTR) likely to affect subject safety, rights, or data reliability to a significant degree. This is a legal term under EU CTR (Art. 52).	A subset of protocol deviations that might significantly affect data completeness, accuracy, or reliability or significantly affect a subject’s rights, safety, or well‑being. (FDA guidance aligns with ICH E3(R1)).
Criteria/Threshold	Threshold is “likely to affect to a significant degree” at least one of: safety, rights, or data integrity​. The impact must be substantial (regulatory text: “significant degree”​). In practice, breaches that systematically endanger participants or core data are serious.	Threshold is “might significantly affect” key trial aspects. Important deviations are those that could undermine data quality or subject welfare – for example, affecting critical‑to‑quality factors (ICH E8(R1)) such as eligibility, endpoint collection, randomization, or safety monitoring​. Deviations not reaching “significant” impact are considered minor.
Reporting Obligations	Mandatory notification to regulators: The sponsor must report via CTIS (EU portal) without undue delay, and within 7 calendar days of becoming aware. The sponsor is responsible for the report (it may delegate CTIS submission). All serious breaches must be entered into the EU database (CTIS). Investigators and CROs must promptly inform the sponsor of any suspected serious breach. Failure to report can trigger GCP inspection findings​.	No direct mandatory FDA notification: FDA does not require sponsors to notify FDA of individual protocol deviations. Instead, FDA recommends that investigators promptly report important deviations to the sponsor and IRB, and sponsors document them. Specifically, investigators should report all deviations to the sponsor (highlighting the important ones)​, and device trials must report emergency deviations to sponsor/IRB within ~5 days​. Sponsors should capture important deviations in oversight and include them in regulatory submissions: FDA guidance advises sponsors to discuss important deviations in the Clinical Study Report (NDA/BLA) and list all deviations in the Study Data Tabulation Model (SDTM) (with an indicator of importance)​.
Examples	EMA guideline Appendix I (non‑exhaustive) includes situations like: dosing a subject with the wrong drug or dose (e.g. incorrect IMP, wrong frequency)​; giving IMP to a pregnant subject without protocol-required test​; systematically failing to administer required therapy. Other examples: temperature excursions unverified by corrective action, severe informed consent lapses, etc. These all have significant safety/data impact.	FDA guidance examples highlight failures that impair safety or data. For instance: skipping key safety assessments (e.g. missing lab tests or not administering study drug per spec)​; giving a prohibited concomitant treatment​; failure to obtain valid informed consent​ or protect private data; dosing errors (wrong treatment or dose)​; non‑adherence to randomization; enrolling ineligible subjects or missing primary endpoint data​; or unblinding inappropriately​. These deviations affect subject protection or critical data (as listed in the FDA document).
Consequences/Implications	Regulatory action: Reporting a serious breach obligates Member States to evaluate it. Some breaches may require corrective actions overseen by regulators; others may trigger inspections or trial suspension​. Failure to have a proper breach‐reporting system can itself be a GCP inspection finding​. If serious breaches reveal fundamental trial defects (e.g. safety is compromised), the trial approval or application may be withdrawn. In summary, a serious breach can lead to heightened regulatory scrutiny, mandatory CAPA plans, or more severe sanctions.	Data validity risks: The FDA guidance notes that frequent or severe important deviations can compromise a trial’s validity. Reviewers may judge a study “not adequate and well‑controlled” if key deviations occur (e.g. wrong enrollment or missing data)​. As a result, sponsors are urged to design protocols to minimize these issues (via “quality‑by‑design”)​. Important deviations do not immediately trigger FDA enforcement, but they must be documented; pervasive deviations could lead FDA to question the reliability of submitted data​. Investigators/IRBs also review important deviations for participant safety.

Key differences: A serious breach is a legal CT regulation concept requiring prompt notification to EU authorities; by contrast, an important protocol deviation is a statistical/GCP concept from FDA/ICH guidance, focused on documenting major protocol departures in the trial record. The EMA rule imposes timely reporting to regulators (CTIS) for serious breaches, whereas the FDA guidance places emphasis on internal reporting and documentation (investigator→sponsor/IRB, sponsor→study report) rather than immediate FDA notification.

References:

• EMA’s “Guideline for the notification of serious breaches of Regulation (EU) 536/2014 or the clinical trial protocol”​ 
• FDA’s Draft Guidance for Industry “Protocol Deviations for Clinical Investigations of Drugs, Biological Products, and Devices".

Classifying Protocol Deviations - New FDA Guidance on Protocol Deviations

In clinical trials, protocol deviations are generally unintentional departures from the IRB-approved protocol and are commonly not discovered until after they occur (e.g., an investigator’s failure to perform a protocol-required test is discovered by the study monitor during a routine monitoring visit).

Too many protocol deviations could indicate the protocol issue (the protocol is poorly written), the protocol compliance by the investigators, and the overall quality of the study. Protocol deviations are collected and reviewed throughout the study. At the end of the study, the final list of protocol deviations will be converted into the data set (CDISC SDTM DV data set). The protocol deviations will then be listed and summarized for the inclusion in the clinical study report. According to ICH E3 "Structure and Contents of Clinical Study Reports", protocol deviations will be described in the CSR section 10.3.

For NDA/BLA submissions to CDER, FDA, there is a special requirement for submitting the BIMO (bioresearch monitoring) data sets and listings to assist FDA to select the investigational sites for inspection. Protocol deviations are important part of the BIMO data. According to "BIORESEARCH MONITORINGTECHNICAL CONFORMANCE GUIDE", the protocol deviations need to be provided in listings by subject and by clinical site. 

7. Protocol Deviations 

This by-subject, by-clinical site listing should include all protocol deviations. The listing should include a description of the deviation and identify whether the sponsor considered the deviation to be an important or non-important protocol deviation. 

Protocol deviations need to be classified based on the seriousness of the protocol deviation and the impact on the safety and efficacy evaluation of the protocol deviations. Traditionally, we have classified the protocol deviations into minor and major categories. However, other terms are used for categorizing the protocol deviations: critical protocol deviations, significant protocol deviations, ... 

FDA's new guidance "Protocol Deviations for Clinical Investigations of Drugs, Biological Products, and Devices" (December 2024) sets this straight. Only two categories will be used for protocol deviations: Important protocol deviations and other protocol deviations. 

1. Important Protocol Deviations 

As noted above, in this guidance an important protocol deviation is a subset of protocol deviations that might significantly affect the completeness, accuracy, and/or reliability of the study data or that might significantly affect a subject’s rights, safety, or well-being. While other terms such as major, critical, and significant have sometimes been used to classify such protocol deviations, FDA recommends using important to encompass all these terms. 

2. All Other Protocol Deviations 

All other protocol deviations that do not meet the definition of an important protocol deviation may encompass the commonly used terms minor, noncritical, and non-significant deviations. Examples of all other protocol deviations may include small deviations from protocol-specified visit windows; a signed consent with a page missing a participant’s initial; or failure to perform a study procedure not relevant for safety monitoring or not related to an important study efficacy endpoint (e.g., primary or secondary endpoints). 

Protocol Deviations - How is the Protocol Deviation Data Analyzed and Used?

For any clinical trial, the study protocol is the blueprint of how the clinical trial should be conducted. Clinical study protocols must be conducted according to the International Council for Harmonization (ICH) guidance on good clinical practice (GCP), which, among other things, helps safeguard the rights, safety, and well-being of study participants. If conducted as designed, the associated data should be reliable and reproducible and support clear interpretation of the results, while maintaining the participants’ protection. In light of this, one might reasonably assume that deviations from this protocol could be harmful to the participant or the accuracy of the data and should therefore be avoided.

However, the reality is that within clinical trials, protocol deviations do happen, despite best efforts in designing and conducting the clinical trial. According to the ICH E3 Q&A R1, the protocol deviation is defined as: 

"A protocol deviation is any change, divergence, or departure from the study design or procedures defined in the protocol.

Important protocol deviations are a subset of protocol deviations that may significantly impact the completeness, accuracy, and/or reliability of the study data or that may significantly affect a subject's rights, safety, or well-being."

In the early days, the term 'protocol violation' may be used and is still used in some clinical trial documents. According to the ICH E3 Q&A R1, the term 'protocol violation' should be replaced with 'protocol deviation'

"To avoid confusion over terminology, sponsors are encouraged to replace the phrase “protocol violation” in Annex IVa with “protocol deviation”,

There is considerable variability regarding the interpretation, and classification of what an important protocol deviation is, which creates challenges in the identification, collection, and reporting of deviations - resulting in over-reporting PDs that could potentially delay the identification of important patient safety information by increasing the noise in the system or under-reporting PDs that could influence the reliability of the study results and patient safety signals.

In order to reduce the variability in what, when, how the PDs should be collected, it might be helpful to take a look at how the data about the PDs are analyzed and used. 

After the protocol deviation data is collected, the data will be mapped into the CDISC data sets (DV data set in SDTM and ADDV data set in ADaM). Then a data listing will be generated to list all protocol deviations by subjects including the date the protocol deviation occurred, the description of the protocol deviation, the category of the protocol deviation (out of visit window, informed consent issue, SAE safety reporting issue, ......), and the classification of the protocol deviations (minor, major, critical, or important).  A statistical summary table will then be generated for all protocol deviations and for major protocol deviations. 

The protocol deviation data will then be used in the following aspects: 

For the clinical study report (CSR):

CSR must include a section to describe the protocol deviations that occurred during the conduct of the study. According to  ICH E3 (Structure and Content of Clinical Study Reports), the protocol deviations section is an essential part of the CSR. 

10.2 Protocol Deviations 

All important deviations related to study inclusion or exclusion criteria, conduct of the trial, patient managements or patient assessment should be described. 

In the body of the text, protocol deviations should be appropriately summarized by center and grouped into different categories, such as: 

• Those who entered the study even though they did not satisfy the entry criteria. 
• Those who developed withdrawal criteria during the study but were not withdrawn. 
• Those who received the wrong treatment or incorrect dose. 
• Those who received an excluded concomitant treatment. 

In Appendix 16.2.2, individual patients with these protocol deviations should be listed, broken down by center for multicenter studies. 

For FDA BIMO of NDA/BLA submission under Center for Drug Evaluation and Research (CDER):

The FDA Office of Scientific Investigations (OSI) requests that the by-site data and listing are provided for Bioresearch Monitoring (BIMO). The by-site data is used by OSI to select the investigational sites for inspections for CDER submissions.

The FDA Office of Scientific Investigations (OSI) requests that the items described in the draft guidance for industry Standardized Format for Electronic Submission of NDA and BLA Content for the Planning of Bioresearch Monitoring (BIMO) Inspections for CDER Submissions (February 2018) and the associated Bioresearch Monitoring Technical Conformance Guide Containing Technical Specifications be provided to facilitate development of clinical investigator and sponsor/monitor/CRO inspection assignments, and the background packages that are sent with those assignments to the FDA ORA investigators who conduct those inspections. This information is requested for all major
trials used to support safety and efficacy in the application (i.e., phase 2/3 pivotal trials).

One critical piece of the BIMO data is the protocol deviation data by site. The number of protocol deviations or important protocol deviations can be an indicator of protocol compliance and the study quality for specific investigational sites. According to BIORESEARCH MONITORINGTECHNICAL CONFORMANCE GUIDE Technical Specifications Document", the following protocol deviation data should be provided:

"Subject-level data line listings, by clinical site, should include consented subjects, treatment assignment, discontinuations, study population, inclusion and exclusion criteria, adverse events, important protocol deviations, efficacy endpoints, concomitant medications, and safety monitoring, as further described below"

7. Important Protocol Deviations Contains Nonbinding Recommendations 

This by-subject, by-clinical site listing should include all protocol deviations. The listing should include a description of the deviation and identify whether the sponsor considered the deviation to be an important or non-important protocol deviation.  

Clinical Site Data Elements Summary Listing

"Total number of important protocol deviations at a given site by treatment arm for subjects in the SAFPOP. A protocol deviation is any change, divergence, or departure from the study design or procedures defined in the protocol or associated investigational plans that is not implemented or intended as a systematic change. This value should include multiple deviations per subject and all major deviation types. Important deviations are those deviations that might significantly affect the completeness, accuracy, and/or reliability of the study data or that might significantly affect a subject's rights, safety, or well-being"

"Total number of protocol deviations, excluding important protocol deviations, at a given site by treatment arm for subjects in the SAFPOP. A protocol deviation is any change, divergence, or departure from the study design or procedures defined in the protocol or associated investigational plans that is not implemented or intended as a systematic change."

FDA's Good Review Practice: Clinical Review Template listed the protocol violation information as part of the review items for assessing the GCP compliance and the impact of the protocol violations on the data quality and the safety and efficacy results. 

3.2 Compliance With Good Clinical Practices

This section should include comments on compliance with good clinical practices, including informed consent, protocol violations, site-specific issues, and whether the clinical trials were conducted in accordance with acceptable ethical standards. 

If a DSI audit process and report is not requested, provide a brief summary on the quality and nature of other methods used to audit or check the applicant’s data and/or analyses. 

For DSI-requested audits, include a brief summary of the rationale for DSI audits and site selection such as: 

• A specific safety concern at a particular site based on review of adverse events, serious adverse events, deaths, or discontinuation 

• A specific efficacy concern based on review of site-specific efficacy data

 • A specific concern for scientific misconduct at one or more particular sites based on review of financial disclosures, protocol violations, clinical trial discontinuations, or safety and efficacy results  

For defining the per-protocol population for Sensitivity or Supplemental Analyses

Efficacy analyses are usually performed in full analysis set or intention-to-treat population. However, to test the robustness of the statistical results and to assess the impact of the protocol deviations on the statistical results, additional sensitivity or supplemental analyses are usually performed on the per-protocol population. 

According to ICH E9 (Statistical Principles for Clinical Trials), the per-protocol population is defined and sensitivity analyses based on per-protocol population are suggested:  

Per protocol set (valid cases, efficacy sample, evaluable subjects sample): The set of data generated by the subset of subjects who complied with the protocol sufficiently to ensure that these data would be likely to exhibit the effects of treatment according to the underlying scientific model. Compliance covers such considerations as exposure to treatment, availability of measurements, and absence of major protocol violations.

In practice, the per-protocol population is usually defined as "all randomized subjects who have no major protocol deviations" or "all randomized subjects who have no major protocol deviations that may have an impact on the efficacy assessment". The decision on the inclusion of subjects in per-protocol population needs to be decided before the database lock and study unblinding. The protocol deviation data may be reviewed at the blinded data review meeting. Subjects who are excluded from the per-protocol population need to be documented in the blinded data review report.

ICH E9 Addendum also discussed the per-protocol set (PPS) and analyses based on PPS are included as supplemental analysis: 

The meaning and role of an analysis of the per protocol set is also re-visited in this addendum; in particular whether the need to explore the impact of protocol violations and deviations can be addressed in a way that is less biased and more interpretable than naïve analysis of the per protocol set

Section 5.2.3. indicates that it is usually appropriate to plan for analyses based on both the FAS and the Per Protocol Set (PPS) so that differences between them can be the subject of explicit discussion and interpretation.

Additional Reference: Transcelerate Protocol Deviations