How regulatory affairs works with a CRO

A contract research organization can run a clinical trial end to end — recruit sites, monitor data, manage safety reporting — without regulatory affairs ever touching a case report form. That operational reality makes it easy to assume the CRO has also taken on the sponsor’s regulatory responsibility for the trial. It hasn’t, not automatically, and not by default. What actually transfers is narrower, and it only transfers if someone wrote it down.

What 21 CFR 312.52 actually transfers

The regulation is narrower than most services agreements read. A sponsor may transfer responsibility for any or all of its IND obligations to a CRO, but the transfer has to be described in writing. If the sponsor isn’t transferring everything — and most arrangements don’t — the writing has to describe each specific obligation the CRO is assuming, one by one. A general statement that the CRO will “manage the study” doesn’t satisfy that requirement, however comprehensive the day-to-day arrangement actually is. If regulatory affairs can’t point to the document that lists what transferred, the honest working assumption is that nothing did.

What doesn’t move with the contract

Whatever the CRO assumes in writing, the sponsor stays the IND holder of record and keeps the parts of the relationship a CRO was never going to take on: overall development strategy, the regulatory relationship with FDA, and judgment calls that span more than one obligation at a time. Safety reporting is the clearest example of where this gets confusing in practice. A CRO frequently processes individual case safety reports, the kind covered in how to read an IND safety report, but aggregate safety evaluation and the sponsor’s overall judgment about what the accumulating data means for the trial is a different obligation, and it doesn’t move just because case processing did. Regulatory affairs’ role here is oversight, not absence — confirming the transferred pieces are being handled as described, and actively owning everything that wasn’t transferred at all.

Where this goes wrong in practice

The failure mode is rarely a CRO doing careless work. It’s a sponsor team that never checked what the contract actually transferred against what 312.52 requires in writing, and finds out the gap exists during an inspection rather than before one. A services agreement built around deliverables and milestones can look thorough without ever naming regulatory obligations in the regulation’s terms. Reading that agreement with 312.52 open beside it, and treating anything it doesn’t explicitly name as still the sponsor’s, is the habit that keeps this from becoming a surprise.

The handoff works the other direction too. Regulatory professionals who move from a CRO into sponsor-side work often describe the adjustment the same way: realizing how much of the regulatory obligation was never actually transferred in the first place, and how much of the sponsor’s job was oversight all along, even when the CRO’s name was on the day-to-day work.