I Read All 24 ICH Guidelines Over a Weekend. Here's What Surprised Me

I've quoted ICH guidelines for years. I'd never read all of them end to end. So one Saturday morning in March I made coffee, opened a folder with every active ICH guideline as a PDF, and started reading. Forty-one hours later, on Sunday night, I closed the last one.

That's about 1,800 pages. Twenty-four guidelines, plus the two 2024-2025 revisions that nobody outside RA has fully digested yet (E6(R3) and M14). I took notes the whole time. This post is the short version of what surprised me.

The first thing that hits you

Most regulatory work happens by Ctrl+F. You hit a question (does my repeat-dose study need recovery animals?), you guess which guideline covers it (ICH M3, probably, or maybe S4), you search the PDF, you copy-paste the relevant paragraph into your Slack reply, you move on.

Reading them straight through is a different experience. You start to notice what isn't there. You notice when one guideline assumes you've already read another. You notice the footnotes.

Here's the thing nobody tells you about ICH guidelines: a lot of the binding language lives in footnotes.

The footnote that explains half the clinical holds

ICH M3(R2), the nonclinical safety guideline, has a footnote on dose selection that reads roughly: the high dose in repeat-dose toxicity studies should be limited to 50-fold the human clinical exposure on an AUC basis, except where toxicity is observed at lower exposures.

That "except where" clause is doing enormous work. I've seen four clinical holds in the last two years where the sponsor set their high dose using the 50× rule, hit toxicity at 30×, and then had to argue with FDA about whether they'd characterized the toxicity adequately. They had not, because their study was designed around the rule, not the exception.

The exception is the rule. The 50× number is the comfortable default everyone quotes. The real rule is: characterize the dose-response curve up to the toxicity, whatever that is. M3(R2) says this in the footnote and almost nowhere else.

If I were writing M3 from scratch, that footnote would be the first sentence of the section.

Three contradictions I didn't expect

Most "ICH contradicts itself" claims I've heard turn out to be different guidelines using different definitions of the same word. But three of them are real.

E6(R3) versus M11. E6(R3) (2025 revision of GCP) says protocol amendments should be minimized through better upfront design. M11 (the electronic protocol template) introduces structured fields that all but guarantee amendments when sponsors fill them in too specifically too early. Both are right; neither acknowledges the tension. If you build your protocol the M11 way, you will amend it more often than E6(R3) wants you to.

S7B versus E14. S7B is the in vitro/in vivo cardiac safety guideline. E14 is the clinical QT study guideline. The 2022 Q&A revision was supposed to harmonize them around a "double-negative" model where a clean S7B dataset can substitute for a thorough QT study. In practice, FDA reviewers are still asking for E14-style data when the S7B package is borderline, and what counts as borderline isn't defined. Two guidelines, one decision, no rule for which one wins.

M3(R2) versus S6(R1) on biologics tox study duration. M3 says 9 months chronic in non-rodent for small molecules. S6 says 6 months is usually adequate for biologics, but "case by case." Sponsors developing antibodies routinely default to 9 months because it's safer politically, even though S6 explicitly opens the door to shorter studies. Reading them together, the case for 6 months is stronger than the field treats it. We've internalized M3 as the default for everything.

The thing nobody reads

ICH Q9(R1) on quality risk management was revised in January 2023. It's 42 pages. It governs how you justify almost every CMC decision in a modern submission. Almost nobody outside CMC quality groups reads it.

The 2023 revision added explicit language on subjectivity in risk assessment — basically, an admission that the same risk can score very differently depending on who scores it, and that companies need formal procedures to manage that. If you're doing risk-based GMP justification for a Phase 1 IND and you haven't read the (R1), you're using a 2005 framework to defend a 2026 decision.

What changed for me

Three things, after the weekend.

I stopped quoting M3 numbers without footnote context. The 50×, the 9-month, the 14-day — none of them are real rules without their qualifiers.

I started cross-referencing by default. When a question lands in M3, I check S6 and S9 too, because a third of the time the actual answer lives in the adjacent guideline.

I built a spreadsheet of "rule X has a footnote in Y that overrides it." It's six pages. I share it with anyone on our team who's reviewing a study package.

That spreadsheet is, more or less, what we ended up encoding into the RegFo rules engine. The product story isn't "we read ICH so you don't have to." It's "we read ICH carefully enough to find the footnotes, and now those live in the check."

What to do if you don't have a weekend

Most VPs of Reg don't have 41 hours to spend like this, and shouldn't have to. The minimum I'd recommend:

Read M3(R2) end to end, footnotes included. Most preclinical questions touch it.
Read E6(R3) (2025) — it's the new GCP and it changes how you should think about protocol amendments.
Skim Q9(R1) just for the new language on subjectivity. Half a day.

Everything else, hit it when the question comes. But know that the answer is probably in a footnote, two guidelines over from where you started looking.

A few more from the spreadsheet, since people always ask:

ICH S7A's "core battery" footnote on integration with repeat-dose tox — most teams run S7A as standalone studies and miss the integration option
ICH Q1A(R2) bracketing/matrixing rules — buried in Section 2.7, override the default stability matrix most CMC teams use
ICH E9 Section 5.4 on multiplicity adjustments — quietly governs how your primary endpoint analysis must be structured

The rest live in the engine.

The fastest way to see them: paste one repeat-dose toxicity report into a free workspace. The check flags the footnote-overrides automatically — no credit card, 30 seconds, you'll know whether your study would survive a footnote-aware reviewer.