GCP for Medical Device Clinical Trials: ISO 14155 and ICH E6(R3) in 2026

How Good Clinical Practice applies to medical device clinical trials — navigating ISO 14155:2026 and ICH E6(R3), sponsor and investigator responsibilities, informed consent, safety reporting, and audit readiness.

What Is Good Clinical Practice and Why It Matters for Devices

Good Clinical Practice (GCP) is the international ethical and scientific quality standard for the design, conduct, recording, and reporting of clinical trials that involve human subjects. Compliance with GCP provides public assurance that the rights, safety, and well-being of trial subjects are protected and that the clinical trial data generated is credible and accurate.

For pharmaceutical trials, GCP has been governed by ICH E6 since its adoption in 1996. For medical device trials, the situation is different. Devices are not drugs. They do not have the same pharmacokinetic profiles, they do not metabolize, and their risks arise from fundamentally different mechanisms: mechanical failure, biocompatibility reactions, electromagnetic interference, software errors, user interaction failures, and degradation over time. The clinical investigation of a device therefore demands a framework built around device-specific concerns.

That framework is ISO 14155.

ISO 14155, "Clinical investigation of medical devices for human subjects -- Good Clinical Practice," is the recognized international standard governing the design, conduct, and reporting of clinical investigations for medical devices. It is referenced directly in the EU Medical Device Regulation (EU) 2017/745 as the GCP standard applicable to device clinical investigations. The fourth edition, ISO 14155:2026, was published on March 23, 2026, replacing the 2020 edition with no transition period.

But ISO 14155 does not exist in isolation. The broader GCP landscape has also undergone a major revision with the adoption of ICH E6(R3) in January 2025. While ICH E6(R3) was developed primarily with pharmaceutical trials in mind, its principles of risk-based quality management, data integrity, and subject protection apply across all clinical research. Device manufacturers who conduct multinational trials -- or who operate in jurisdictions that reference ICH GCP -- must understand how these two frameworks interact, where they align, and where device-specific requirements take precedence.

This guide covers both frameworks in detail, explains their relationship, and provides practical guidance for conducting device clinical investigations that satisfy the requirements of both in 2026 and beyond.

Two Frameworks: ISO 14155 and ICH E6(R3)

The Relationship Between the Standards

ISO 14155 and ICH E6(R3) serve overlapping but distinct purposes. Understanding their relationship is essential for any manufacturer conducting clinical investigations for medical devices.

Aspect	ISO 14155:2026	ICH E6(R3)
Scope	Medical device clinical investigations specifically	All clinical trials, originally pharmaceutical
Legal status in EU	Referenced in EU MDR as GCP standard for device trials	Referenced in EU Clinical Trials Regulation (CTR) 536/2014 for drug trials
Primary focus	Device-specific: investigational device management, device deficiency reporting, clinical performance assessment	Drug-specific but broadly applicable: data integrity, monitoring, subject protection, quality management
Safety reporting	Dual categorization (clinical severity + device causality), device deficiency reporting	Adverse event and serious adverse event reporting, SUSAR reporting
Regulatory alignment	EU MDR Articles 62-81, Annex XV Chapter II	EU CTR 536/2014, FDA 21 CFR Parts 50/56/312
Risk management	Integrated throughout clinical investigation, aligned with ISO 14971	Risk-based quality management, quality by design
Informed consent	Device-specific requirements including implant card provisions	General informed consent principles, enhanced provisions for vulnerable populations

For medical device clinical investigations conducted under the EU MDR, ISO 14155 is the primary standard. Article 62(1) of the MDR states that clinical investigations must be designed and conducted "in accordance with the internationally harmonised standards for clinical investigation of medical devices in humans." ISO 14155 is that standard.

ICH E6(R3) becomes relevant in several circumstances:

Multinational trials where some jurisdictions apply ICH GCP requirements to all clinical research, including device trials
Combination product trials involving both a device and a drug, where both frameworks apply simultaneously
Investigator-initiated trials at academic institutions that follow ICH GCP as institutional policy
Quality management systems where sponsors adopt ICH E6(R3) risk-based quality management principles alongside ISO 14155

Where They Align

Both standards share core GCP principles:

Protection of trial subjects' rights, safety, and dignity
Requirement for informed consent
Institutional Review Board / Ethics Committee oversight
Qualified investigator responsibility for conduct at the site
Sponsor responsibility for overall trial management
Accurate and verifiable data recording (ALCOA+ principles)
Monitoring to ensure trial quality and subject safety
Investigator and sponsor maintenance of essential documents
Audit trail requirements for all trial records

Where They Diverge

The critical divergences relate to the nature of the investigational product. A drug is ingested, metabolized, and excreted. A device is implanted, applied, or used externally, and its performance depends on user skill, anatomical variation, and device-device interactions. ISO 14155 addresses these realities with requirements that have no pharmaceutical parallel:

Investigational device accountability: Tracking device receipt, use, return, and destruction at each site. A drug can be counted by dispensing records; a device must be tracked by serial number, lot number, and physical condition.
Device deficiency reporting: A concept unique to device trials. A device deficiency is any inadequacy of the investigational device that might lead to a serious adverse event if not addressed. This includes malfunctions, manufacturing defects, labeling errors, and user interface failures.
Clinical performance assessment: ISO 14155 requires the clinical investigation plan to define performance endpoints specific to the device's intended use and mechanism of action.
Device handling and storage: Requirements for maintaining investigational devices in controlled conditions, with accountability logs and reconciliation records.
Implant card requirements: Specific provisions for providing implant card information to subjects receiving implantable devices.

ICH E6(R3), by contrast, addresses concerns more relevant to pharmaceutical trials but still applicable in principle to device trials: pharmacovigilance concepts, drug supply chain management, and specific requirements for biological sampling and laboratory oversight.

The practical rule: for device trials, ISO 14155 governs. ICH E6(R3) principles apply where they are relevant and not contradicted by ISO 14155. Where both frameworks impose requirements on the same topic, the more stringent or more specific requirement should generally be followed, with the rationale documented.

ISO 14155:2026 -- Key Changes and New Requirements

The fourth edition of ISO 14155, published March 23, 2026, introduces substantial changes from the 2020 edition. Unlike many standard revisions that provide a transition period during which either edition can be used, ISO 14155:2026 applies immediately to all new clinical investigations. Ongoing investigations initiated under the 2020 edition should be assessed for the impact of the changes, and amendments made where the new requirements affect subject safety or data integrity.

Mandatory Risk Management Integration

The 2026 edition makes risk management a continuous, integrated process throughout the clinical investigation rather than a discrete planning step. This aligns the clinical investigation risk management approach with ISO 14971 (the device-level risk management standard) and requires sponsors to:

Conduct a clinical risk analysis as part of Clinical Investigation Plan (CIP) development, identifying risks that are specific to the clinical use of the device
Implement risk control measures within the investigation protocol and document their effectiveness
Monitor risk indicators throughout the investigation and trigger protocol amendments when risk profiles change
Feed clinical investigation risk data back into the device-level risk management file

This integration means the clinical investigation plan and the device risk management file must be developed in tandem, not sequentially. Sponsors who treat clinical risk management as a checkbox exercise -- completing a risk analysis table at the start and never revisiting it -- will not comply with the 2026 requirements.

Clinical Events Committees (CECs)

ISO 14155:2026 introduces formal requirements for Clinical Events Committees for the first time. A CEC is an independent committee of qualified experts that adjudicates clinical events in a blinded, standardized manner across all investigation sites. The key provisions:

When a CEC is required: The sponsor must establish a CEC for investigations where clinical event classification could be subject to interpretation bias, where events are complex and require specialist clinical judgment, or where event adjudication directly affects primary endpoint assessment.
Composition: CEC members must be independent of the sponsor and the investigation sites, possess relevant clinical expertise, and operate under a documented charter that defines their mandate, procedures, and decision rules.
Charter requirements: The CEC charter must specify the event definitions, adjudication process (including how disagreements are resolved), blinding requirements, and reporting obligations to the sponsor and Data Monitoring Committee (DMC).
Operating procedures: The CEC must maintain records of all meetings, decisions, and rationales. Decisions must be made without knowledge of treatment assignment where the investigation design permits.

For sponsors who previously used ad hoc event adjudication or relied on investigator assessments alone, this is a significant change. CECs add cost and timeline to clinical investigations, but they also provide substantially more robust endpoint data -- which is precisely why the standard now mandates them for appropriate study designs.

Data Monitoring Committees (DMCs)

The 2026 edition expands and formalizes DMC requirements beyond what was in the 2020 version. Key provisions:

DMCs must have pre-defined suspension and stopping conditions documented in the CIP or a separate DMC charter
The DMC charter must define statistical monitoring boundaries, interim analysis plans, and the process for recommending investigation modification or termination
DMC members must be independent of the sponsor and investigators, with documented qualifications and no conflicts of interest
The sponsor must provide the DMC with unblinded data access as defined in the charter, and must respond to DMC recommendations in a documented and timely manner
DMC meeting minutes and recommendations must be maintained as essential documents

Estimand Framework

In a significant alignment with pharmaceutical clinical trial methodology, ISO 14155:2026 introduces the estimand framework, consistent with ICH E9(R1). An estimand is a precise description of the treatment effect reflecting the clinical question of interest. The framework requires sponsors to define:

The treatment condition being evaluated (the investigational device as used in the investigation)
The population to which the estimand applies
The endpoint (or variable) to be assessed
The intercurrent events and how they are handled (e.g., device explantation, subject withdrawal, protocol deviations that affect endpoint assessment)
The population-level summary for the variable (e.g., mean difference, proportion, hazard ratio)

This framework brings rigor and transparency to how clinical investigation results are planned, analyzed, and interpreted. For device trials, the handling of intercurrent events is particularly important: what happens to the analysis when a device is explanted, revised, or when the subject crosses over to an alternative treatment? The estimand framework requires these scenarios to be planned in advance rather than handled post hoc.

Dual Categorization for Adverse Events

Perhaps the most operationally significant change in ISO 14155:2026 is the requirement for dual categorization of adverse events associated with device deficiencies. Every such event must be categorized along two independent dimensions:

Clinical severity: The seriousness of the adverse event from a clinical perspective (serious/non-serious, using the standard definitions of a serious adverse event)
Device causality: Whether and how the device deficiency contributed to the adverse event (definite, probable, possible, unlikely, not related, or unclassifiable)

This dual framework replaces the previous approach where a single determination was made. It provides a more nuanced understanding of device safety by separating the clinical outcome from the device's role in causing it. A serious adverse event with no device causality is a very different signal from a non-serious adverse event with definite device causality -- and both are important for different reasons.

Expanded Subject Protections

The 2026 edition includes several new provisions for subject protection:

Implant card templates: For investigations involving implantable devices, the sponsor must provide implant card information to subjects, including device identification, key device characteristics, and any specific warnings or precautions. This aligns with EU MDR Article 18 requirements.
Enhanced informed consent provisions: Subjects must be given ample time to discuss participation with family members or advisors before signing consent. The consent process must not be rushed or conducted under duress.
Subject information updates: If new information becomes available during the investigation that may affect a subject's willingness to continue participation, the sponsor must ensure that subjects are informed and that re-consent is obtained where appropriate.

New Annex K -- Clinical Investigation Design Considerations

Annex K is a new addition to the 2026 edition, providing guidance on clinical investigation design considerations. It covers:

Selection of appropriate investigation designs (randomized controlled, single-arm, cohort, etc.)
Justification of control groups (active control, sham, historical control, performance goals)
Sample size determination methodology
Endpoint selection and hierarchy
Handling of missing data
Interim analysis planning

While annexes in ISO standards are informative rather than normative (meaning they provide guidance rather than mandatory requirements), Annex K reflects the standard's expectation that clinical investigation design should be rigorous, pre-specified, and aligned with contemporary clinical research methodology.

No Transition Period

The absence of a transition period is itself a significant change. Sponsors initiating new clinical investigations after March 23, 2026 must comply with the 2026 edition from day one. For ongoing investigations, the sponsor should perform a gap analysis comparing the 2020 and 2026 requirements and implement amendments where necessary. At minimum, the following should be assessed:

Whether the risk management approach meets the new continuous integration requirements
Whether a CEC should be established based on the new criteria
Whether the adverse event categorization framework needs updating to the dual system
Whether subject information materials need updating for implant card and enhanced consent provisions

ICH E6(R3) -- What Device Manufacturers Need to Know

ICH E6(R3), "Good Clinical Practice," was adopted on January 6, 2025, representing the first major revision of the ICH GCP guideline since E6(R2) in 2016. The revision was driven by the need to accommodate modern trial designs, technology-enabled trial conduct, and a shift from rigid prescriptive compliance to risk-proportionate quality management.

Structure of ICH E6(R3)

The revised guideline uses a modular structure:

Principles: Overarching GCP principles applicable to all trials, regardless of design or methodology. These took effect in the EU in July 2025.
Annex 1: Requirements for traditional clinical trials (randomized, site-based, investigator-led). Also effective in the EU since July 2025.
Annex 2: Requirements for non-traditional trial designs, including decentralized trials, platform trials, and real-world evidence studies. Expected to finalize later in 2026.

Timeline of Implementation

Jurisdiction	Milestone	Date
ICH	Adoption of E6(R3)	January 2025
EU	Principles and Annex 1 take effect (via EU CTR 536/2014)	July 2025
US	FDA final guidance issued	September 2025
UK	MHRA annotations published	January 2026
Canada	Health Canada implementation	April 2026
ICH	Annex 2 expected finalization	Late 2026

Key Principles from ICH E6(R3) Relevant to Device Trials

Risk-Proportionate Quality Management

The most significant conceptual shift in E6(R3) is the move from rigid checklist compliance to a risk-proportionate approach. The guideline requires sponsors to implement a quality management system that identifies and manages risks to subject safety and data credibility proportionate to the nature and complexity of the trial. For device manufacturers, this means:

Quality management effort should be concentrated on activities and processes that are most critical to subject safety and reliable results
Not every aspect of a clinical investigation requires the same level of oversight -- a high-risk implantable device trial demands more intensive monitoring than a low-risk diagnostic device study
The rationale for risk-based decisions must be documented

Quality by Design

ICH E6(R3) introduces quality by design principles: building quality into the trial from the planning stage rather than relying solely on inspection and correction after the fact. This translates to:

Identifying critical-to-quality factors during CIP development
Designing investigation processes that prevent errors rather than detecting them after they occur
Establishing pre-defined quality tolerance limits that trigger investigation when breached

Computerized System Requirements

E6(R3) includes substantially expanded requirements for computerized systems used in clinical trials. For device trials, this applies to electronic data capture (EDC) systems, electronic patient-reported outcomes (ePRO), and any software used for data management or analysis:

Systems must ensure data integrity through appropriate access controls, audit trails, and backup procedures
Validation documentation must be maintained and available for inspection
Electronic records must meet the same standards as paper records for accuracy, completeness, and traceability
System changes must be documented through a controlled change management process

Active Oversight of Third-Party Service Providers

The sponsor retains ultimate responsibility for all trial-related activities, even when delegated to contract research organizations (CROs), site management organizations, or other service providers. E6(R3) requires:

Documented quality agreements with all service providers
Active oversight proportionate to the risk and complexity of delegated activities
Regular performance assessment of service providers
The sponsor's QMS must cover oversight of delegated activities

Decentralized Trial Elements

E6(R3) explicitly supports the use of decentralized trial elements, including electronic consent (eConsent), wearable devices for remote data collection, telemedicine visits, and direct-to-patient investigational product shipping. For device trials, these elements are less straightforward than for drug trials -- you cannot typically ship an investigational device directly to a subject's home -- but certain elements are applicable:

eConsent for informed consent processes
Remote monitoring visits via telemedicine
Wearable sensors for post-procedure follow-up data collection
Electronic diaries for subject-reported outcomes

How to Apply GCP to Device Trials -- A Practical Framework

Determine Which Frameworks Apply

Before designing a clinical investigation, determine which GCP requirements apply based on the regulatory jurisdiction, device classification, and investigation type:

Factor	Primary Standard	Secondary Considerations
EU MDR clinical investigation (Articles 62-81)	ISO 14155:2026	ICH E6(R3) principles where relevant
EU MDR PMCF investigation	ISO 14155:2026	ICH E6(R3) risk-based quality management
FDA IDE study (21 CFR 812)	21 CFR 812 + ISO 14155	FDA recognizes ISO 14155 as a consensus standard
Multinational trial (EU + US + others)	ISO 14155:2026 (primary) + ICH E6(R3)	Jurisdiction-specific requirements as applicable
Combination product (device + drug)	Both ISO 14155 and ICH E6(R3)	Coordinate requirements; document rationale for any divergent approaches

Build the Quality Management System

The clinical investigation QMS should incorporate elements from both frameworks:

Risk management process aligned with ISO 14155:2026 continuous risk management requirements and ICH E6(R3) risk-based quality management
Standard operating procedures covering CIP development, site selection, monitoring, data management, safety reporting, device accountability, and document control
Training program ensuring all personnel are qualified for their roles and aware of both ISO 14155 and relevant ICH E6(R3) requirements
Document management system maintaining all essential documents with version control and audit trails
Vendor management process for qualifying, contracting, and overseeing CROs and other service providers

Develop the Clinical Investigation Plan

The CIP is the central document governing the clinical investigation. Under ISO 14155:2026, the CIP must include:

Device description and intended use
Investigation objectives and endpoints (using the estimand framework)
Investigation design and rationale
Risk analysis and risk control measures
Subject selection criteria (inclusion/exclusion)
Investigational device description and handling requirements
Clinical investigation procedures and assessment schedule
Statistical considerations including sample size justification
Safety reporting plan including dual categorization framework
Monitoring plan
Data management plan
CEC and DMC charters (if applicable)
Informed consent requirements
Device accountability procedures

Under ICH E6(R3), additional CIP considerations include:

Quality tolerance limits defining when the investigation may be deviating from acceptable quality parameters
Risk-based monitoring strategy and rationale
Computerized systems to be used and their validation status
Plans for decentralized trial elements (if applicable)

The sponsor bears ultimate responsibility for the clinical investigation. Under ISO 14155:2026 and ICH E6(R3), sponsor responsibilities are extensive and non-delegable in certain critical areas, even when operational tasks are contracted to CROs.

Clinical Investigation Plan Preparation

The sponsor is responsible for developing the CIP, either directly or through a qualified delegate. The CIP must be finalized before any subject is enrolled. Key sponsor obligations:

Ensure the CIP is scientifically sound, ethically justified, and compliant with applicable regulations
Obtain Ethics Committee / Institutional Review Board approval before site initiation
Register the clinical investigation in the appropriate registry (e.g., ClinicalTrials.gov, EU Clinical Trials Information System)
Ensure the CIP is consistent with the device risk management file and clinical evaluation plan
Implement the estimand framework for endpoint definition and analysis planning

Investigator Selection and Qualification

The sponsor must select investigators who are qualified by training, experience, and licensure to conduct the clinical investigation. This requires:

Verification of the investigator's medical credentials, clinical experience relevant to the device and indication, and any required institutional appointments
Assessment of the investigator's prior clinical research experience, including any regulatory findings, warning letters, or audit observations
Evaluation of the investigation site's capabilities: adequate facilities, qualified staff, sufficient patient population, and available equipment
Documentation of the investigator's qualifications in the Investigator Brochure or investigator file
Execution of a formal agreement (clinical investigation agreement) with each investigator and site

Monitoring Plan Development

ISO 14155:2026 requires the sponsor to develop and implement a monitoring plan proportionate to the risks of the investigation. ICH E6(R3) reinforces this with its risk-based quality management approach. The monitoring plan must specify:

Monitoring approach: On-site monitoring, remote monitoring, or a combination, with rationale for the chosen approach
Monitoring frequency: Determined by risk assessment, not applied uniformly. Higher-risk investigations or sites with compliance concerns warrant more frequent monitoring
Monitoring activities: Source data verification, device accountability verification, informed consent review, adverse event reporting review, protocol compliance assessment
Key risk indicators: Pre-defined metrics that the monitor will track to identify potential quality issues
Reporting requirements: Monitoring visit reports, follow-up letters, and escalation procedures

The monitoring plan should be a living document, updated as the investigation progresses and risk information accumulates. If a pattern of protocol deviations emerges at a particular site, the monitoring frequency for that site should increase.

Safety Reporting and Vigilance

The sponsor is responsible for the complete safety reporting chain. Under ISO 14155:2026, this includes:

Receiving adverse event reports from investigators within defined timelines
Applying the dual categorization framework (clinical severity + device causality) to all device-related adverse events
Conducting causality and severity assessments, potentially with CEC adjudication
Reporting serious adverse events and device deficiencies to regulatory authorities per MDR Article 80
Notifying all investigators of safety information that may affect subject safety or willingness to participate
Updating the Investigator Brochure and risk management file with new safety information
Preparing the clinical investigation report with comprehensive safety analysis

Data Management and Statistical Analysis

The sponsor must ensure that clinical investigation data is managed according to the highest quality standards:

Implement validated data management systems with appropriate access controls and audit trails
Develop a data management plan specifying data collection, entry, validation, and storage procedures
Ensure statistical analysis is conducted according to the pre-specified statistical analysis plan
Maintain blinding procedures (if applicable) throughout data collection and analysis
Address missing data according to the pre-specified plan in the CIP
Ensure all data modifications are tracked with reasons and timestamps

Device Accountability and Tracking

Device accountability is a sponsor responsibility unique to device trials. The sponsor must:

Maintain records of all investigational devices manufactured, shipped, received, used, and returned or destroyed
Ensure each investigational device is traceable by serial number or lot number to the subject, the site, and the manufacturing batch
Implement procedures for device storage, handling, and return that maintain device integrity
Reconcile device inventory at each site and at investigation close-out
Document any device modifications, malfunctions, or failures during the investigation
Ensure that devices used in the investigation conform to the specifications documented in the CIP and Investigator Brochure

Investigator Responsibilities in Detail

The principal investigator (PI) is responsible for the conduct of the clinical investigation at their site. Under both ISO 14155 and ICH E6(R3), the PI must be a qualified physician (or, where appropriate, another qualified healthcare professional) who takes personal responsibility for subject safety and data integrity at the site.

Conducting the Investigation Per the CIP

The investigator must conduct the investigation exactly as described in the approved CIP. Deviations from the CIP require either:

Protocol amendments: Prospective changes to the CIP that are submitted to the Ethics Committee and regulatory authorities for approval before implementation
Protocol deviations: Unplanned departures from the CIP that must be documented, justified, and reported to the sponsor. Significant deviations that affect subject safety or data integrity must be reported immediately

Under ICH E6(R3), the PI must prove active oversight of all delegated tasks. This means maintaining real-time delegation of authority (DoA) logs that document:

Which tasks are delegated to which team members
The qualifications and training status of each delegate
The dates of delegation and, if applicable, withdrawal of delegation
Evidence that the PI is actively supervising delegated activities, not merely signing off after the fact

The investigator is personally responsible for ensuring that informed consent is obtained from every subject before any investigation-specific procedures are performed. The consent process must comply with EU MDR Article 63 and ISO 14155 requirements, as detailed in the Informed Consent Requirements section below.

Safety Monitoring and Adverse Event Reporting

The investigator must:

Monitor each subject for adverse events throughout the investigation and follow-up period
Report all serious adverse events to the sponsor within the timelines specified in the CIP (typically within 24 hours of the investigator becoming aware of the event)
Report all device deficiencies, whether or not they resulted in an adverse event
Apply the dual categorization framework for adverse events associated with device deficiencies
Cooperate with CEC adjudication by providing requested medical records and clinical information in a timely manner
Report any safety concerns that may affect the risk-benefit balance of the investigation to the Ethics Committee

Source Documentation

The investigator must maintain complete and accurate source documentation for all investigation data. Source documents are the first location where data is recorded and include:

Hospital medical records
Physician office charts
Laboratory reports
Imaging reports
Device output data (e.g., from the investigational device itself)
Subject diaries
Pharmacy dispensing records
Operative notes and procedure reports

The ALCOA+ principles apply to all source documentation: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available.

Device Storage and Accountability at Site Level

The investigator must ensure that investigational devices at their site are:

Stored under the conditions specified in the CIP and device labeling
Accessible only to authorized investigation personnel
Accounted for at all times, with receipt, use, and disposition recorded in the device accountability log
Returned to the sponsor or destroyed per sponsor instructions at investigation close-out
Reported to the sponsor if any device malfunction, deficiency, or unexpected behavior is observed

Ethics Committee Communication

The investigator must maintain ongoing communication with the Ethics Committee or Institutional Review Board, including:

Submitting the CIP, informed consent form, and supporting documents for initial review and approval
Reporting serious adverse events and safety information as required by the Ethics Committee
Submitting protocol amendments for review and approval before implementation
Providing progress reports at intervals defined by the Ethics Committee
Notifying the Ethics Committee of investigation completion, termination, or suspension
Submitting the final clinical investigation report or summary to the Ethics Committee

Safety Reporting -- The New Dual Categorization Framework

The safety reporting requirements under ISO 14155:2026 represent one of the most operationally significant changes in the new edition. Understanding and correctly implementing the dual categorization framework is essential for every sponsor and investigator.

The Dual Categorization System

Under the 2026 edition, every adverse event associated with a device deficiency must be categorized along two independent dimensions:

Dimension 1: Clinical Severity

Category	Definition	Examples
Serious Adverse Event (SAE)	Results in death, life-threatening condition, inpatient hospitalization or prolongation of existing hospitalization, persistent or significant disability or incapacity, or is a congenital anomaly or birth defect	Device explantation due to infection, stroke during catheterization procedure, permanent nerve damage from mispositioned implant
Non-Serious Adverse Event	Any adverse event that does not meet the criteria for a serious adverse event	Mild skin irritation at adhesive site, transient discomfort, minor bruising at access site

Dimension 2: Device Causality

Category	Definition	Application
Definitely related	The device deficiency directly caused the adverse event, with no other plausible explanation	Catheter fracture during procedure causing vessel injury; software error causing incorrect dose delivery
Probably related	The device deficiency is the most likely cause, but other factors may have contributed	Insufficient adhesive on electrode causing lead dislodgement; device malfunction occurring during critical procedure
Possibly related	The device deficiency may have contributed, but other causes are equally or more likely	Infection at implant site where device coating integrity was compromised
Unlikely related	The adverse event occurred in temporal association with device deficiency but is more likely due to other factors	Subject fall in hospital during post-operative monitoring of device
Not related	No causal relationship between the device deficiency and the adverse event	Subject develops unrelated upper respiratory infection
Unclassifiable	Insufficient information to determine causality	Subject lost to follow-up after reporting symptoms

Device Deficiency Reporting

Device deficiencies are reported separately from adverse events. A device deficiency is any inadequacy of the investigational device related to its identity, quality, durability, reliability, safety, or performance. Under ISO 14155:2026, device deficiencies must be reported even if they did not result in an adverse event.

Categories of reportable device deficiencies include:

Device malfunctions (failure to perform as intended)
Manufacturing defects or quality deviations
Labeling errors or inadequacies
User interface failures (confusing instructions, misleading displays)
Packaging or sterility failures
Software errors or anomalous behavior
Mechanical failures (fracture, fatigue, wear)
Biocompatibility issues (unexpected material reactions)

Serious Adverse Event Reporting Timelines

Under EU MDR Article 80 and ISO 14155:2026:

Immediately: The investigator must report any SAE to the sponsor within the timeline specified in the CIP, typically within 24 hours of becoming aware of the event
Within 7 days: The sponsor must report any SAE that suggests an imminent risk of death, serious injury, or serious illness to the concerned Member State(s)
Within 30 days: The sponsor must report any other SAE to the concerned Member State(s)
Upon request: Additional information as requested by regulatory authorities

CEC Adjudication and Cross-Site Consistency

When a CEC is established, the safety reporting workflow becomes:

The investigator reports the adverse event and device deficiency to the sponsor
The sponsor provides the CEC with de-identified event information and relevant clinical records
The CEC adjudicates the event using pre-defined criteria, determining clinical severity classification and event characterization
The sponsor uses the CEC determination for regulatory reporting and safety analysis
The investigator is informed of the CEC determination and updates site records accordingly

This process ensures that the same event type is classified consistently across all investigation sites, eliminating the variability that arises when individual investigators apply different clinical judgment to similar events.

Informed consent is a cornerstone of GCP. Under EU MDR Article 63 and ISO 14155:2026, the informed consent process for device clinical investigations has specific requirements that go beyond general clinical research consent.

EU MDR Article 63 Requirements

Article 63 of the MDR establishes detailed requirements for informed consent in clinical investigations:

Article 63(1): Informed consent must be given freely, after the subject has been informed of the nature, significance, implications, and risks of the clinical investigation
Article 63(2): The subject must be given the opportunity to ask questions and must receive satisfactory answers
Article 63(3): The informed consent must be documented by means of a dated and signed document, or, where the subject is unable to write, by an audiovisual recording
Article 63(4): The subject may withdraw consent at any time without any detriment and without having to provide any justification

ISO 14155:2026 Enhanced Provisions

The 2026 edition adds specific provisions that enhance subject protection:

Ample time for deliberation: Subjects must be given sufficient time to consider participation, discuss with family members or personal advisors, and make a free and informed decision. The consent process must not be rushed.
Plain language: The informed consent form must be written in language understandable to the subject. Technical jargon must be avoided or explained in lay terms.
Device-specific information: The consent form must include information about the investigational device, its expected benefits, known and potential risks, alternative treatments, and what will happen if the device is explanted or the subject withdraws.
Implant card provisions: For implantable devices, the consent process must include information about the implant card that the subject will receive, including device identification and any specific precautions.

Information That Must Be Provided

Under ISO 14155:2026, the informed consent form must include, at minimum:

That the clinical investigation involves an investigational device and that the device has not yet been approved or certified for the intended use under investigation
The purpose of the clinical investigation
The investigational procedures to be followed
The subject's responsibilities during the investigation
Those aspects of the investigation that are experimental
The reasonably foreseeable risks, discomforts, or inconveniences to the subject
The reasonably expected benefits, with a clear statement when no clinical benefit is expected
Available alternative procedures or treatments and their potential risks and benefits
The extent to which confidentiality of records identifying the subject will be maintained
The expected duration of the subject's participation in the investigation
A statement that the subject may withdraw from the investigation at any time without penalty
The person to contact for further information or in the event of an investigation-related injury
The foreseeable circumstances under which the subject's participation may be terminated by the investigator without the subject's consent
The expected compensation or treatment available to the subject in the event of investigation-related injury
Any additional costs to the subject that may result from participation

Special Populations

Additional informed consent requirements apply to special populations:

Minors: Consent must be obtained from a parent or legal guardian. Where appropriate, the minor's assent should also be obtained.
Incapacitated subjects: Consent must be obtained from a legal representative. The subject's wishes should be respected where they can be expressed.
Emergency situations: Where a subject cannot give prior consent and the clinical investigation relates to an emergency medical condition, provisions for deferred consent or consent by a legal representative apply, subject to Ethics Committee approval and national law.

Monitoring and Data Management

Risk-Based Monitoring Strategy

Both ISO 14155:2026 and ICH E6(R3) emphasize risk-based monitoring -- allocating monitoring resources proportionate to the risks to subjects and the criticality of the data being collected. This is a departure from the historical practice of 100% source data verification at every monitoring visit.

A risk-based monitoring strategy should:

Identify critical data and processes: Not all data points are equally important. Focus monitoring effort on data that directly supports primary endpoints, subject safety assessments, and key secondary endpoints.
Conduct a risk assessment: Evaluate the likelihood and impact of potential errors at each stage of data collection and processing. This assessment should consider the complexity of the investigation, the experience of the investigators, the technology used, and the therapeutic area.
Define monitoring activities: Based on the risk assessment, determine the mix of on-site monitoring, remote monitoring, centralized statistical monitoring, and triggered monitoring visits.
Implement centralized monitoring: Use statistical methods to detect unusual data patterns across sites in real time. Centralized monitoring can identify issues such as unusual adverse event reporting rates, atypical data distributions, or enrollment anomalies that warrant targeted on-site investigation.
Document and report: All monitoring activities, findings, and follow-up actions must be documented. Monitoring reports should identify issues, assess their impact, and document corrective actions.

Data Integrity Requirements

Data integrity under both frameworks follows the ALCOA+ principles:

Principle	Requirement	Practical Application
Attributable	Every data entry must be traceable to the person who recorded it	Unique user logins for EDC systems; signed and dated source documents
Legible	Data must be readable throughout the retention period	Avoid pencil; use indelible ink for paper records; ensure electronic records are in accessible formats
Contemporaneous	Data must be recorded at the time the activity is performed	No backdating entries; document the time of observation as close to real-time as possible
Original	The first recording of data is the source	Preserve original documents; copies are acceptable only when verified against originals
Accurate	Data must reflect the actual observation	No selective recording; errors must be corrected with a single line through, initialed, and dated, with the reason for correction
Complete	All data must be recorded, including data that may be unfavorable	No deletion of unfavorable results; report all protocol deviations
Consistent	Data should not contain contradictions	Reconcile discrepancies between source documents and CRF entries
Enduring	Data must be durable for the required retention period	Use archival-quality paper; maintain electronic backups; migrate data to current formats as technology evolves
Available	Data must be accessible for review and audit throughout the retention period	Organized filing systems; indexed electronic archives; documented retrieval procedures

Computerized System Validation

ICH E6(R3) places particular emphasis on computerized system validation. For device clinical investigations, this applies to:

Electronic Data Capture (EDC) systems: Must be validated for intended use, with documented evidence that the system correctly captures, stores, and retrieves data. Validation must cover user acceptance testing, data migration, system interfaces, and disaster recovery.
Electronic Patient-Reported Outcomes (ePRO) systems: Must ensure that subject-reported data is captured accurately, with appropriate controls to prevent data manipulation. Time-stamping and device identification are important audit trail elements.
Clinical trial management systems (CTMS): Must accurately track site status, enrollment, monitoring visits, and document submission.
Safety databases: Must support the dual categorization framework, enable timely reporting, and maintain audit trails for all safety data modifications.

Validation documentation should include: validation plan, requirements specifications, test scripts, test results, deviation reports, and a validation summary report. This documentation must be available for regulatory inspection.

Preparing for Audit Readiness Under Both Frameworks

Regulatory inspections and sponsor audits are an expected part of clinical investigation conduct. EU MDR Article 78 gives Member State competent authorities the right to inspect clinical investigation sites, and FDA conducts bioresearch monitoring (BIMO) inspections under 21 CFR Part 56. Being audit-ready means maintaining a state of continuous compliance rather than preparing reactively when an inspection is announced.

Essential Document Management

Both ISO 14155 and ICH E6(R3) require maintenance of a Trial Master File (TMF) or essential documents. The TMF should be organized, indexed, complete, and accessible at all times. Key categories include:

Before the Clinical Investigation:

Signed CIP and amendments
Ethics Committee approval letters
Regulatory authorization letters
Investigator qualifications and CVs
Signed clinical investigation agreements
Investigator Brochure (current version)
Informed consent form (approved versions)
Device accountability logs (initialized)
Monitoring plan
Insurance and indemnity documentation
Delegation of authority logs

During the Clinical Investigation:

Monitoring visit reports and follow-up correspondence
Adverse event and device deficiency reports
Protocol deviation documentation
Subject enrollment and screening logs
Updated risk management documentation
CEC and DMC meeting minutes and recommendations
Device accountability reconciliation records
Training records for new investigation personnel
Correspondence with regulatory authorities and Ethics Committees

After the Clinical Investigation:

Clinical investigation report
Final device accountability and reconciliation
Subject completion status summary
Archive arrangements for essential documents and data
Notification to regulatory authorities and Ethics Committees of investigation completion

Retention Periods

Document retention requirements vary by jurisdiction:

Jurisdiction	Minimum Retention Period	Basis
EU (under MDR)	At least 10 years after the device is last placed on the market, or 15 years for implantable devices	EU MDR Article 10(7)
US (under FDA)	2 years after FDA approval of a PMA, or the period the sponsor is required to retain records under 21 CFR 812	21 CFR 812.190
ICH regions	At least 2 years after formal discontinuation of the clinical investigation or after marketing approval in the ICH region	ICH E6(R3)

The practical approach is to apply the most stringent applicable retention period. For multinational trials, this often means 15 years or longer for implantable devices.

Common Audit Findings and How to Prevent Them

Understanding the most common audit and inspection findings helps sponsors and investigators proactively address vulnerabilities:

Informed Consent Deficiencies

Informed consent obtained after investigation-specific procedures began
Incorrect version of the consent form used
Missing signatures or dates on consent forms
Consent forms not available in the subject's native language
Inadequate documentation of the consent discussion
Failure to obtain re-consent when new safety information became available

Prevention: Implement a consent form version control log at each site. Train investigators and study coordinators on consent procedures. Include consent form verification in the monitoring plan as a mandatory activity at every visit. Use a pre-screening checklist that confirms consent is obtained and documented before any investigation-specific procedures.

Device Accountability Gaps

Missing device accountability log entries
Discrepancies between sponsor shipping records and site receipt records
Devices used after expiration or outside storage conditions
Inadequate documentation of device disposition (return or destruction)
Devices used for subjects not enrolled in the investigation

Prevention: Establish a device accountability SOP that requires real-time logging. Include device accountability verification in every monitoring visit. Reconcile device inventory at defined intervals, not only at close-out. Use barcode or RFID tracking where feasible.

Protocol Deviation Management

Failure to report deviations to the sponsor and Ethics Committee
Inadequate root cause analysis for significant deviations
No corrective and preventive actions (CAPAs) implemented
Pattern of similar deviations at the same site without escalation

Prevention: Define clear categories of deviations and reporting timelines in the CIP. Implement a deviation tracking log at each site. Require root cause analysis for significant deviations. Set thresholds for escalating deviation patterns to the sponsor's quality management review.

Source Data Discrepancies

Data in the Case Report Form (CRF) does not match source documents
Source documents missing or inaccessible
Unexplained alterations to source documents
Data entered retrospectively without documentation of the delay

Prevention: Include source data verification in the monitoring plan with priority given to critical data points. Train site staff on source documentation requirements. Implement source document worksheets or templates that standardize recording. Use EDC systems with edit checks and query management.

Safety Reporting Delays

SAEs reported to the sponsor beyond the required timeline
Incomplete initial SAE reports
Failure to report device deficiencies that did not result in adverse events
Sponsor regulatory reporting to authorities beyond required timelines

Prevention: Establish a 24-hour hotline or electronic reporting system for SAEs. Train investigators on the dual categorization framework. Include safety reporting compliance in monitoring activities. Implement automated timeline tracking for regulatory submissions.

Inspection Preparation Checklist

When an inspection is announced or anticipated, the following should be verified within 24-48 hours:

TMF is complete, organized, and indexed
All informed consent forms are present, correctly versioned, and properly signed/dated
Device accountability logs are reconciled and complete
All adverse event reports have been filed and reported within timelines
All protocol deviations are documented with root cause analysis and CAPAs
Delegation of authority logs are current with documented training
Monitoring visit reports and follow-up letters are filed
Ethics Committee correspondence is complete (approvals, amendments, safety reports)
Financial disclosure documentation is current for all investigators
Site staff training records are up to date

The Audit Mindset

The most effective approach to audit readiness is not last-minute preparation but sustained compliance throughout the investigation. This requires:

A culture of documentation: if it was not documented, it did not happen
Proactive quality oversight: identifying and addressing issues before they become audit findings
Regular internal audits: conducting mock inspections or self-assessments at defined intervals
Corrective action tracking: ensuring that identified issues are resolved and that CAPAs are effective
Communication: maintaining open channels between the sponsor, CRO, investigators, and monitors so that issues are reported and addressed promptly

The regulatory landscape for clinical investigations in 2026 demands more rigor, more documentation, and more proactive quality management than ever before. Both ISO 14155:2026 and ICH E6(R3) reflect a global trend toward risk-based, technology-enabled, and quality-by-design approaches to clinical research. Device manufacturers who invest in building robust quality management systems, training their teams on both frameworks, and maintaining audit readiness as a continuous discipline will navigate this landscape successfully. Those who treat GCP as a bureaucratic burden to be minimally satisfied will find that the gap between what regulators expect and what they deliver is wider -- and more consequential -- than ever.