Why RWD Governance Is Different From Trial Data Governance

Sponsors that built strong clinical trial data governance often assume they can extend the same framework to real-world evidence. In practice, the two problems share vocabulary but not structure. Clinical trial data governance rests on a protocol written before a single patient is enrolled, informed consent captured for the specific study, prospectively collected variables aligned to CDISC standards, and a defined chain of custody from source document to database lock. Every decision downstream can be traced to a prospectively documented rationale. That is why regulators trust it.

Real-world data breaks nearly every one of those assumptions. Claims data was generated to support billing and reimbursement, not research. Electronic health record data captures what a clinician documented for care, not what a study needed measured. Registries vary in curation intensity, consent scope, and data model. Patient-reported outcomes and wearables introduce new provenance layers. None of this data was collected for the study you are now proposing to run on it. The governance question is therefore not “did we follow the protocol correctly” but “can we prove this data, collected for another purpose, is fit for this one.”

250M+ Patients accessible through DARWIN EU as of the 2026 reporting period
$5.42B 2025 RWE solutions market, projected to $10.8B by 2030
~1/3 Share of DARWIN EU feasibility requests unable to proceed due to lack of fit-for-purpose data

A useful way to frame the shift: clinical trial governance is proactive. RWD governance is investigative. In a trial, governance controls the collection process. In RWE, governance reconstructs the collection process someone else already completed, evaluates it against a new use, and decides whether it will hold up under scrutiny. That reversal of posture has consequences for every governance domain, from stewardship to metadata to quality metrics.1

The Three Structural Differences That Reshape Governance

Purpose mismatch. Trial data is collected for the study. RWD is collected for something else and repurposed. The governance model must include a fitness-for-purpose function that trial governance simply does not need.

Consent architecture. Trial data comes with study-specific informed consent. RWD relies on a complex mix of HIPAA waivers, IRB or Privacy Board authorizations, GDPR lawful bases, and secondary-use provisions. Governance has to track and enforce a consent chain across sources with different legal bases.2

Data model heterogeneity. Trial data lands in a defined schema. RWD flows in through claims formats, EHR extracts, registry structures, and increasingly OMOP, Sentinel, or PCORnet common data models. Governance has to manage semantic harmonization as a first-class concern, not as a downstream ETL problem.3

SD PERSPECTIVE

The sponsors that struggle with RWE are not the ones lacking data. They are the ones running RWE programs under governance charters written for GCP trials. The framework needs to be rewritten from the assumption that data was collected by someone else, for another purpose, under a consent basis you did not negotiate.

Provenance is the single most important concept in RWD governance, and it is the one most programs underinvest in. When the FDA says it expects “traceability” of EHR and claims data, it means the sponsor must be able to describe how each data element originated, how it moved from its point of capture into the database being analyzed, and what transformations occurred along the way. This is not a documentation exercise. It is a defensibility exercise.4

The ISPOR SUITABILITY checklist for EHR data captures the point well: data delineation requires a complete understanding of the data, including its characteristics, provenance, and governance. Sponsors that cannot describe provenance in operational detail are not going to survive an FDA sponsor-initiated Advancing RWE Program interaction, and they should not expect the EMA’s Data Quality Framework assessment to go smoothly either.5

The Provenance Layers to Document

LAYER 1

Point of Capture

Where the data element originated. Was it clinician-entered in an EHR, generated by a billing system, transcribed from a paper form, extracted from a device, or reported by the patient? Each capture context introduces distinct error modes and quality expectations.

LAYER 2

Source System Curation

What quality controls existed at the source. This includes coding standards, mandatory-field enforcement, referential integrity, and clinician-workflow effects that determine whether an absent value means normal, unknown, or not measured.

LAYER 3

Aggregator Transformations

What the data vendor or aggregator did during ingestion. This is where mapping to a common data model, code translation, deduplication, and derived variable creation occur. Each transformation must have an audit trail the sponsor can produce.

LAYER 4

Study-Specific Preparation

What the sponsor did to prepare the dataset for a specific analysis. Cohort definitions, exclusions, imputation, outcome derivation, and linkage all belong here. These are the transformations regulators inspect most closely.

The Consent Chain Is Not Optional

Consent for RWD is rarely a single document. It is a chain: the original authorization that permitted data capture in the source system, the aggregator’s rights to receive and process the data, the sponsor’s basis for accessing it, and the study-specific permissions that authorize this particular use. Each link must be documented, and the governance program must enforce that a study cannot proceed until the full chain is verified.

Under HIPAA, RWE activities that qualify as research require individual authorization or an IRB or Privacy Board waiver. Activities that qualify as health care operations only require the minimum necessary standard. Deciding which regime applies is a governance decision, not an analyst decision. Under GDPR, the lawful basis for secondary use of health data is materially stricter, and the sponsor must be able to show that the basis was established at the outset of processing, not retrofitted.6

GOVERNANCE FAILURE MODE The most common consent-chain failure we see is a program that treats data-vendor contracts as sufficient evidence of consent. Contract language is not consent. The governance program must be able to trace back to the original patient authorization or the regulatory waiver that made secondary use lawful, and to demonstrate that the current use falls within its scope.

Fitness-for-Purpose: The FDA and ICH M14 Lens

Fitness-for-purpose is the organizing question of the 2026 regulatory environment for RWE. The FDA’s finalized RWE framework makes it explicit: not all real-world data automatically qualifies as regulatory-grade evidence, and sponsors must demonstrate that a dataset is fit for the specific regulatory question being asked. ICH M14, adopted in March 2026 by the FDA, EMA, and PMDA in parallel, embeds the same principle into internationally harmonized guidance for non-interventional safety studies.7

What makes fitness-for-purpose difficult in practice is that it is not a property of the data. It is a property of the pairing between the data and the question. A claims dataset that is entirely fit for a drug utilization study can be entirely unfit for an effectiveness study of the same drug in the same population. Governance must therefore assess fitness at the study-question level, not at the dataset level, and it must document that assessment before analysis begins.

The Fitness-for-Purpose Assessment Framework

1

Define the regulatory question

State precisely what the study will support: label expansion, safety signal characterization, effectiveness evidence for HTA, or a single-arm external control. The fitness assessment is meaningless without this anchor, and vague framings almost always get objections back.

2

Identify required data elements

Enumerate the variables the study needs, at the granularity it needs them. This includes exposure ascertainment, outcome definition, covariate coverage, confounder capture, and follow-up windows. Missing or coarsely captured elements are early red flags.

3

Evaluate data reliability

Assess accuracy, completeness, and consistency at the element level. Governance must produce documented evidence for each critical variable, ideally supported by validation studies, chart abstraction subsets, or benchmarking against an accepted reference.

4

Evaluate data relevance

Assess whether the population, exposure definitions, outcomes, and follow-up mirror the intended use scenario. A dataset can be perfectly reliable and completely irrelevant. This is where regulators find the most preventable failures.

5

Document the go or no-go decision

Produce a written fitness-for-purpose determination that a regulator can read and either accept or challenge. The determination should either authorize the study to proceed or specify the remediation required before it can.

WHAT THE FDA ACTUALLY WANTS

The finalized FDA framework and ICH M14 both emphasize a stepwise approach beginning with a clearly defined study rationale and research question, followed by identification of the study population, exposure, comparator, outcome, and covariates. Governance that produces this assessment in writing, before analysis, is not administrative overhead. It is the evidence that the study is defensible.

Governance Council Structure for RWE Programs

Most sponsors have some form of enterprise data governance council. Most of those councils are not structured to make RWE decisions well. The typical enterprise council spans finance, IT, operations, and commercial data domains. Its charter is oriented toward data quality, master data management, and enterprise compliance. RWE decisions require a different composition, cadence, and decision authority, and they need to be made close enough to study conduct that governance can actually influence design.

The council structure that works has three tiers, each with distinct scope, membership, and outputs. The tiers must connect to each other formally: decisions at the operational tier that raise fitness concerns must escalate to the strategic tier, and strategic-tier policy decisions must flow down as operational guidance. Programs that skip the middle tier tend to produce governance that is either too high-level to be actionable or too tactical to be defensible.

The Three-Tier Structure

Tier Scope Membership Cadence and Outputs
Strategic RWE Governance Council Portfolio-level policy, data source strategy, cross-functional standards, escalated risk decisions, regulator interaction posture Executive sponsors from Medical, Regulatory, Safety, Commercial, Real-World Evidence, and Data & Analytics; Legal and Privacy leads Quarterly; policy issuance, source portfolio decisions, escalation resolution
Operational Data Stewardship Committee Source-level fitness assessments, quality metric governance, data steward coordination, cross-study standard definitions RWD data stewards, source owners, epidemiologists, biostatisticians, IT stewards, quality leads Monthly; fitness determinations, quality metric reviews, steward escalations
Study-Level Governance Team Study-specific fitness-for-purpose, protocol and SAP alignment, deviations, provenance documentation for the study Study lead, epidemiologist, biostatistician, data steward for source, medical lead, regulatory lead Study-cadence; protocol sign-off, SAP sign-off, fitness determination, study close-out

The strategic council is where source portfolio decisions belong. Deciding to bring on a new claims aggregator, exit a registry contract, or invest in linkage capabilities has cross-program consequences that no study team can weigh alone. The operational stewardship committee is where cross-study standards live: how the program will define comorbidity indices, how it will handle out-of-window exposures, how it will validate outcomes across sources. The study-level team is where governance meets the specific research question. Programs that push everything up to the strategic council starve it. Programs that push everything down to study teams produce inconsistent submissions.

SD PERSPECTIVE

The single most useful change we recommend to RWE governance charters is separating source-level fitness from study-level fitness. Source fitness answers “is this data suitable for the class of questions we bring to it.” Study fitness answers “is this data suitable for this specific question.” Conflating the two is why studies pass internal review and then get blindsided by a regulator objection at the source layer.

Data Steward Roles for RWD

Data stewardship for RWD is not a light adaptation of enterprise data stewardship. It is a distinct role that requires domain understanding of pharmacoepidemiology, familiarity with the specific data source, and enough biostatistical fluency to have a substantive conversation with study teams. Most sponsors underinvest in this role, and it shows up in the quality of their fitness assessments and their responses to regulator questions.

Four Steward Roles That Should Exist

ROLE 1

Source Data Steward

Owns a specific data source end to end. Knows its provenance, its known quality issues, its contractual scope, its update cadence, and its historical use in the portfolio. Signs off on any new use of the source. Typically one steward per major source.

ROLE 2

Domain Data Steward

Owns a semantic domain across sources: exposure definitions, comorbidity indices, outcome phenotypes, healthcare utilization variables. Ensures consistent definitions across studies and datasets. This role is what makes portfolio-level comparability possible.

ROLE 3

Study Data Steward

Assigned to a specific study. Bridges source and domain stewards to the study team. Produces the study-level provenance documentation, tracks deviations, and owns the study’s contribution to submission-ready evidence packages.

ROLE 4

Technical Data Custodian

The IT-side counterpart. Owns platform infrastructure, access controls, environment management, and technical audit trails. Not interchangeable with the data steward roles above and should not be treated as such.

The distinction between domain and source stewards is what most programs miss. Without a domain steward, a program will have five different operational definitions of “heart failure” across studies, each defensible on its own, and none of them comparable. With a domain steward, the program produces a single vetted phenotype library that regulators can inspect once and study teams can reuse with confidence. This is where TransCelerate’s work on data relevance and reliability considerations for RWD becomes practically useful: it maps closely to the kind of documentation a mature stewardship function can produce.8

THE HIDDEN COST OF UNDER-STEWARDSHIP

When a study team has to reinvent an outcome definition because no domain steward owns it, the definition may be defensible but it is almost never traceable to prior use. Regulators asking whether the definition is consistent with the sponsor’s previous RWE submissions receive a difficult-to-answer response, and confidence in the program drops.

Quality Metrics That Actually Matter to Regulators

Data quality frameworks in RWE increasingly converge on the same core dimensions: accuracy, completeness, consistency, timeliness, and integrity. The EMA’s Real-World Data Quality Framework, the FDA’s data quality expectations, and industry frameworks like TransCelerate’s data relevance and reliability considerations all draw on similar constructs. But regulators do not credit generic quality metrics. They credit metrics tied to specific study needs.9

The Metrics That Move Regulators

1

Element-level completeness for study-critical variables

Not overall dataset completeness. The specific percentage of the study cohort with non-missing values for each variable required by the analysis, with a documented assessment of whether missing means unknown, negative, or unmeasured. This is the single most-inspected quality metric.

2

Validated accuracy for outcomes and key exposures

Chart validation subsets, gold-standard comparisons, or published PPV and sensitivity for the algorithms used to identify outcomes. Regulators are increasingly explicit that unvalidated outcome definitions are a fitness-for-purpose problem, not a limitation to acknowledge in the discussion section.

3

Timeliness of data cutoffs relative to the study window

The lag between the data event and its appearance in the analyzable dataset. Post-market safety studies in particular fail on timeliness assessments when the sponsor cannot demonstrate that recent events are represented at the same rate as older ones.

4

Consistency across time and site

Whether coding practices, capture rates, and definitions are stable across the study period and across contributing sites. Consistency failures often masquerade as effect changes and require formal analytical adjustments.

5

Loss to follow-up and censoring drivers

Not just the overall censoring rate, but a documented understanding of what drives it. Insurance churn in claims data, care fragmentation in EHR data, and enrollment lapses in registries all create informative censoring risks that unvalidated data quality frameworks miss.

QUALITY MEASUREMENT DONE WELL The mature programs we see stop measuring quality at the dataset level and start measuring it at the analysis-cohort level. A dataset with 90 percent completeness on a critical variable can produce an analysis cohort with only 40 percent completeness once eligibility criteria are applied. Regulators care about the second number, not the first.

Common Regulator Objections and How Governance Prevents Them

Regulator objections to RWE submissions cluster into a small number of recurring patterns. Each maps to a preventable governance failure upstream. Understanding the mapping is one of the highest-leverage changes a sponsor can make, because it lets the governance program invest in the controls that actually reduce submission risk rather than the controls that produce impressive-looking policy documents.

The Recurring Objection Patterns

Regulator Objection What Actually Went Wrong Governance Control That Prevents It
Unresolved confounding by indication Study proceeded without a fitness assessment of covariate coverage for known confounders Study-level fitness-for-purpose determination requiring documented confounder capture assessment
Weak or absent comparator Data source lacked adequate untreated or alternative-treatment population, and no source-level fitness gate caught it Source-level fitness assessment specifically for external-control and comparative-effectiveness use classes
Selection bias in cohort definition Cohort definition was study-specific with no domain-steward review Domain data steward sign-off on cohort and outcome definitions before SAP finalization
Unvalidated outcome definitions Program had no validated phenotype library and each study reinvented outcome algorithms Investment in domain stewardship and a maintained phenotype library with documented validation
Missing-not-at-random data Completeness was measured at dataset level, not at analysis-cohort level, and mechanism was undocumented Analysis-cohort completeness metrics required in fitness-for-purpose documentation
Retrofitted analysis plan Statistical analysis plan was written after preliminary data review Governance requirement that SAP be locked and pre-registered before dataset access
Opaque data lineage Sponsor could not produce a complete record of transformations from source to analysis dataset Provenance documentation requirement at each of the four provenance layers

The FDA notes that only 35 drugs, biologics, or vaccines have incorporated RWE into their applications since 2016, while more than 250 device premarket authorizations have included RWE in the same period. That gap is not entirely about data. A material portion of it reflects governance readiness. Sponsors whose governance programs cannot produce defensible answers to the objections above are, understandably, reluctant to bet a submission on RWE. Sponsors who have built the controls in advance can and do.10

OVER A THIRD FAIL FIT-FOR-PURPOSE The EMA’s own review of DARWIN EU experience reports that over a third of requests that completed feasibility assessment could not proceed, primarily due to lack of fit-for-purpose data. This is not a data-availability problem. It is a governance problem: the fitness assessment happened too late in the process, after commitments had already been made.

Tying Governance Into Study Design, Protocol, and SAP

Governance that does not shape study design is theater. The most consequential governance activities in an RWE program happen at three specific moments: before the study concept is finalized, during protocol drafting, and before the statistical analysis plan is locked. If governance is invited in only after these moments, its role degrades to documentation. If it is embedded at these moments, it directly reduces regulator objections and shortens review cycles.

The Three Governance Gates in Study Lifecycle

1

Concept gate: source and question fit

Before the study concept advances, the study-level governance team confirms that at least one candidate data source can plausibly answer the question. This is not a full fitness-for-purpose determination. It is a threshold check that prevents concepts from advancing when no fit-for-purpose data exists. Programs skip this gate to their cost.

2

Protocol gate: full fitness determination and lineage plan

Before protocol sign-off, the operational stewardship committee reviews a full fitness-for-purpose determination, the provenance and lineage plan for the study, and any known limitations that will need to be acknowledged in the submission. The output is a documented go, no-go, or conditional-go with specified remediation.

3

SAP gate: pre-registration and dataset access control

Before the statistical analysis plan is finalized and the analyzable dataset is accessed, governance confirms that the SAP is complete, that any protocol amendments are reflected, and that appropriate pre-registration has occurred. This gate is what protects the study from the retrofitting objection.

The FDA is explicit that a study protocol and analysis plan should be created prior to analyzing RWD, regardless of whether the RWD are extant or to be collected in the future. Pre-specification of the research question, study design, and analytic approach in the protocol and SAP before initiating the study is a foundational expectation. Governance that enforces access control to the analyzable dataset until the SAP is locked operationalizes this expectation in a way regulators can inspect.11

What Belongs in the Governance-Reviewed Protocol

RWE PROTOCOL ELEMENTS GOVERNANCE MUST REVIEW

Rationale for the non-interventional design and discussion of alternatives considered.

Data source justification with fitness-for-purpose determination attached.

Cohort and outcome definitions with domain steward attestation and validation evidence.

Confounder capture and adjustment strategy, including negative controls and sensitivity analyses.

Follow-up windows and censoring approach, including handling of intercurrent events.

Missing data mechanism assumption and handling, with rationale.

Sample size and analytic plan for primary and key secondary endpoints.

Pre-registration status and location of the public protocol posting.

The FDA’s Advancing RWE Program, operating under PDUFA VII for fiscal years 2023 through 2027, is a useful signal of what a well-governed protocol looks like. The program provides sponsors a structured, pre-submission mechanism to receive feedback on RWE study designs intended to support effectiveness. Governance programs that produce protocols meeting the program’s expectations are, by definition, producing protocols meeting the FDA’s current standard for RWE-supported effectiveness evidence.12

WHAT SUCCESS LOOKS LIKE A sponsor whose governance program has embedded the three gates above will submit RWE studies where the protocol answers regulator questions before they are asked, the fitness-for-purpose determination is already documented, the provenance is inspectable, and the SAP was locked before dataset access. That is not a documentation exercise. That is the shortest path to a productive regulatory interaction.

Conclusion

The 2026 regulatory environment for RWE is more inviting than it has ever been and less forgiving than it has ever been. Regulators have made clear that RWE is welcome. They have also made clear that they will apply fitness-for-purpose, provenance, and quality expectations that were not fully articulated even three years ago. Sponsors that adapt their governance frameworks to the specific structure of RWD, distinct from clinical trial data governance, are the ones that will convert the market opportunity into approvals. Sponsors that do not will find their RWE programs producing evidence that is scientifically sound and regulatorily insufficient.

Sakara Digital works with pharma and biotech organizations building this kind of RWE governance. If you are standing up a program, refactoring one that predates the 2026 framework changes, or trying to shorten the distance between your RWE studies and a productive regulator interaction, we are happy to have that conversation.