Safety by Design: Pre-IND Risk Considerations for In Vivo Gene Editing Programs

Pre-IND safety planning is a regulatory expectation, not an option

Gene editing programs entering the IND application process face a safety characterization burden that is substantially higher than traditional biologics. The FDA's January 2022 guidance on human gene therapy investigational new drug applications and the agency's subsequent guidance documents for genome editing specifically articulate what pre-IND safety evidence is expected. This article provides a framework for understanding what those expectations are, what assays address each concern, and where formulation decisions intersect with safety outcomes.

This is not a regulatory guidance document. The FDA's requirements evolve, and individual programs should engage with FDA through pre-IND meetings to confirm current expectations for their specific target, editing approach, and delivery vehicle. The framework below reflects the general scientific consensus on pre-clinical safety characterization as of mid-2025.

The four safety dimensions of in vivo gene editing

Pre-IND safety for in vivo gene editing programs is organized around four distinct risk categories, each requiring specific assays and evidence packages:

1. Genotoxicity / off-target editing
2. Immunogenicity (innate and adaptive)
3. Insertional mutagenesis / unintended genome modification
4. Biodistribution and persistence of editing components

These risks are not independent. The delivery vehicle (LNP formulation) affects immunogenicity and biodistribution. The editing tool (Cas9 versus base editor versus prime editor) affects genotoxicity risk and unintended genome modification risk. The guide RNA sequence determines off-target profile. A rigorous safety strategy addresses all four dimensions with an understanding of how they interact.

Dimension 1: Genotoxicity and off-target editing

Off-target editing is the most distinctive genotoxicity concern for CRISPR-based programs — it has no direct analogue in traditional biologic or small-molecule safety pharmacology. Cas9 guided by an sgRNA can make double-strand breaks at genomic loci that share sequence homology with the on-target site. The frequency of off-target editing at any given locus is determined by the degree of sequence mismatch between the sgRNA and the off-target sequence, Cas9 concentration (higher Cas9 exposure increases off-target probability), and the local chromatin state at the off-target locus.

For standard SpCas9 programs, off-target analysis typically includes:

• In silico prediction: Computational prediction of potential off-target sites based on guide RNA sequence mismatches (up to 5 bp mismatch, with NAG and NRG PAM variants). Tools such as Cas-OFFinder, CRISPOR, and CRISPRscan are used for initial prioritization.
• Cell-free or unbiased genome-wide off-target mapping: CIRCLE-seq, SITE-Seq, GUIDE-seq, DISCOVER-Seq, and related biochemical or cell-based approaches provide unbiased identification of off-target cleavage sites without pre-selection based on sequence prediction. These methods identify low-frequency off-target sites that sequence-prediction misses and are the current standard for pre-IND off-target profiling.
• Confirmatory deep sequencing at identified sites: Once off-target sites are identified by unbiased methods, targeted amplicon next-generation sequencing at each site in the intended cell type (primary human hepatocytes for hepatic programs) quantifies editing frequency at each off-target locus. Sites with >0.1% editing frequency require particular attention; sites near known oncogenes or tumor suppressor loci are flagged for additional risk evaluation.

For base editors, the off-target risk has an additional dimension: cytosine base editors can deaminate RNA as well as DNA, producing C-to-U edits in cellular mRNA transcripts (RNA off-target editing). CBE variants with evolved APOBEC domains (CBE3max, ABEmax derivatives) have been selected partly for reduced RNA editing activity, but this property requires experimental validation for the specific CBE variant used in the program. ABEs do not produce RNA off-target edits because TadA requires DNA substrate for efficient catalysis.

Base editors also perform Cas9-independent DNA deamination: the APOBEC or TadA domain can deaminate accessible single-stranded DNA at off-target sites independently of guide RNA direction, particularly at cytosine residues in single-stranded DNA regions that transiently form during transcription or replication. This Cas9-independent off-target risk is unique to base editors and requires characterization methods beyond standard SpCas9 off-target profiling.

Dimension 2: Immunogenicity

Immunogenicity of in vivo gene editing programs has two components: the delivery vehicle (LNP) and the editing cargo (Cas9 protein).

LNP immunogenicity. The primary innate immune response to LNP-encapsulated mRNA is driven by TLR7/8 activation by single-stranded RNA in the endosomal compartment (before m1Ψ modification was standard, this was a dose-limiting innate response; m1Ψ substantially reduces TLR7/8 activation). Residual innate immune activation from m1Ψ-modified mRNA LNPs manifests as transient cytokine elevation (IL-6, TNF-α, IFN-β) at doses above a threshold and is characterized in rodent toxicology studies with dose escalation. The safety window between therapeutically effective dose and dose at which cytokine release syndrome is observed defines the therapeutic index from an innate immune standpoint.

Complement activation by LNP lipid components is a separate innate immune concern. Positively charged particles at pH 7.4 are more potent complement activators than neutral or negatively charged particles. Ionizable lipids with pKa >7.0 retain some positive surface charge at physiological pH, increasing complement activation risk. This is a direct formulation parameter link to a safety dimension: pKa selection affects complement activation, which affects pre-IND safety.

Adaptive immune response to Cas9. SpCas9 is a bacterial protein (from Streptococcus pyogenes) and is immunogenic in humans. Pre-existing T-cell responses to Cas9 peptides have been detected in a substantial fraction of healthy human donors (studies have reported 58–79% T-cell reactivity to SpCas9 peptides in human PBMCs), reflecting natural immune priming from prior Streptococcal infections. Pre-existing T-cell memory to Cas9 epitopes has the potential to drive cytotoxic T-cell killing of transduced cells expressing Cas9 protein — analogous to the T-cell response to AAV capsid peptides observed in some AAV gene therapy trials.

For LNP-delivered Cas9 mRNA programs, Cas9 protein is transiently expressed (mRNA has a half-life of hours, not days), which limits the duration of Cas9 antigen presentation and reduces, though does not eliminate, the T-cell response risk. The transient expression argument is a key component of the immunological safety rationale for LNP-delivered Cas9 mRNA over AAV-delivered Cas9 DNA (where sustained expression extends antigen presentation and T-cell risk).

Pre-IND immunogenicity characterization for Cas9 programs typically includes: Cas9-specific T-cell reactivity in donor PBMC samples (ELISPOT or ICS assay); Cas9-specific antibody assessment in donor sera; and, in repeat-dose studies, adaptive immune response monitoring against both Cas9 protein and LNP lipid components.

Dimension 3: Insertional mutagenesis and unintended genome modification

CRISPR-based programs that use double-strand break-inducing Cas9 carry a theoretical insertional mutagenesis risk if the DSB is repaired by NHEJ in a way that disrupts a tumor suppressor gene or activates an oncogene. The probability of this outcome at a given locus depends on the off-target editing frequency at oncogene/TSG loci and the selective growth advantage conferred by the resulting mutation.

For base editors, insertional mutagenesis from NHEJ is substantially reduced — nCas9 makes a single-strand nick rather than a DSB, and single-strand nicks are repaired by base excision repair rather than the more error-prone NHEJ pathway. DSB frequency from base editors (from rare nCas9 cleavage events where both nicks occur simultaneously on opposing strands at the same site) is measurably lower than from SpCas9. This reduced DSB frequency is part of the genotoxicity risk reduction argument for base editors relative to standard Cas9.

Unintended indels from base editor programs arise primarily from: (1) guide RNA-directed activity at off-target sites (addressed by off-target profiling); (2) nCas9-mediated nicking at off-target sites producing low-frequency indels via repair pathway crossover; and (3) bystander base editing — editing of non-target cytosines (for CBEs) or adenines (for ABEs) within the editing window at the on-target site, which is an intended-locus event that may or may not be clinically relevant depending on whether the bystander edit changes a functional sequence.

Pre-IND evidence for dimension 3 typically includes: targeted deep sequencing at on-target and top off-target loci to quantify indel frequency; whole-genome sequencing of clonally expanded cells (for ex vivo programs) or statistical sampling of liver tissue (for in vivo programs) to detect clonal expansion events; and in vitro transformation or oncogenicity assays if on-target or off-target editing is near oncogene regulatory regions.

Dimension 4: Biodistribution and persistence of editing components

Biodistribution characterization for LNP-delivered gene editing programs assesses where the LNP goes, where editing occurs, and how long editing components persist after administration. FDA guidance expects quantification in both target tissues and non-target organs for IND-enabling biodistribution studies.

LNP biodistribution after IV administration in rodent models is evaluated by luciferase mRNA bioluminescence imaging (IVIS, for whole-body distribution at the organ level) and by quantitative PCR for mRNA or sgRNA in tissue biopsies (for tissue-level quantification). Primary biodistribution to the liver (hepatic signal >80% of total signal after IV in BALB/c or C57BL/6 mice) is expected for LNPs formulated for hepatic delivery via the ApoE-LDLR pathway; off-target signal in spleen (Kupffer cells and splenic macrophages) is normal at low levels.

Editing component persistence is a LNP-specific safety advantage over viral vectors. LNP-encapsulated mRNA is inherently transient — Cas9 mRNA t½ in hepatocytes is approximately 8–12 hours; detectible Cas9 protein typically clears within 24–72 hours post-dose. The genomic edit (created during the window of Cas9 expression) persists, but the editing machinery does not. The cleared-enzyme safety narrative is part of the pre-IND package for mRNA-based editing programs and distinguishes them from DNA-based delivery (plasmid or AAV) where the template can persist for days to months.

Where formulation decisions intersect with safety outcomes

The LNP formulation is not safety-neutral — it directly determines several of the safety-relevant parameters above:

• Ionizable lipid pKa → complement activation risk. pKa >7.0 → residual positive charge at physiological pH → elevated complement activation. pKa within 6.2–6.8 → near-neutral surface charge at pH 7.4 → lower complement activation risk.
• PEG-lipid density → anti-PEG antibody → accelerated blood clearance → altered biodistribution on repeat dose. Higher PEG-lipid mol fraction → higher anti-PEG IgM generation → greater ABC effect on repeat dosing → potential shift in biodistribution on second dose.
• Particle size → Kupffer cell uptake vs hepatocyte uptake. Particles >200 nm are preferentially phagocytosed by Kupffer cells → higher innate inflammatory signal, lower hepatocyte editing efficiency. Particles 80–150 nm reach hepatocytes via fenestrae with reduced Kupffer cell competition.
• Ionizable lipid identity → inflammatory lipid metabolites. Some ionizable lipid chemistries produce metabolic byproducts during endosomal lipid degradation that activate TLR pathways independently of the mRNA cargo. Lipid degradation product safety is part of the toxicology characterization for novel ionizable lipid structures.

Formulation optimization that maximizes transfection efficiency — the standard Gendelivr optimization target — is largely aligned with formulation that minimizes these safety risks. High-efficiency hepatic delivery (small particles, neutral surface charge, efficient ApoE adsorption, high encapsulation) reduces required dose, which is the primary driver of dose-dependent safety signals. A formulation requiring 10-fold less mRNA to achieve equivalent hepatic editing reduces the immunostimulatory load proportionally.

This alignment between efficacy optimization and safety optimization is not accidental — it reflects the same underlying biology. Particles that escape complement, reach hepatocytes via the ApoE-LDLR pathway, and escape the endosome efficiently are the same particles that require lower doses for equivalent editing and produce fewer off-pathway immune responses. Pre-IND formulation optimization is both an efficacy and a safety investment.

Building the pre-IND safety package: practical sequence

For early-stage hepatic LNP + CRISPR programs (pre-IND, 12–18 months from a well-characterized lead formulation), the evidence package is built in roughly this sequence:

1. Lead formulation selection (months 1–5): computational pre-screening → bench synthesis of top-ranked candidates → HepG2/primary hepatocyte transfection screen → lead formulation selection based on EE, particle size, PDI, and transfection efficiency.
2. Off-target profiling (months 4–8, can begin when lead guide RNA sequence is finalized): CIRCLE-seq or DISCOVER-Seq in primary hepatocytes → identification of top off-target sites → targeted NGS at each site.
3. Rodent biodistribution and editing efficiency (months 6–10): IV injection in C57BL/6 or BALB/c mice → organ-level bioluminescence biodistribution → tissue harvest for quantitative PCR → liver biopsy NGS for on-target editing efficiency.
4. Rodent toxicology and immunogenicity (months 8–14): GLP-compatible toxicology study with dose escalation → ALT/AST liver enzyme monitoring → cytokine panel → Cas9-specific T-cell and antibody assays → histopathology of liver and off-target organs.
5. NHP (non-human primate) safety and editing study (months 12–18): IV injection in cynomolgus macaque → biodistribution, editing efficiency, safety labs → essential for supporting IND dosing assumptions in humans.
6. IND Module 3 CMC finalization (months 14–18): GMP manufacturing of clinical lot → CMC specification with identity, purity, potency, and stability-indicating methods.

The Gendelivr platform contributes most directly to step 1 (lead formulation selection) and to the CMC formulation specification in step 6. The safety studies in steps 2–5 require specialized safety pharmacology, toxicology, and NGS capabilities that are outside the scope of LNP formulation optimization — but the lead formulation delivered in step 1 determines the starting point for all subsequent safety evaluation. A well-optimized formulation that minimizes required dose, achieves particle size within the hepatic targeting window, and maintains neutral surface charge at physiological pH reduces the burden at every subsequent safety step.