ISO 14155:2026 Clinical Investigation of Medical Devices — Complete GCP Guide

What Is ISO 14155?

ISO 14155 is the international standard for Good Clinical Practice (GCP) in medical device clinical investigations. It specifies requirements for the design, conduct, recording, and reporting of clinical investigations carried out in human subjects to assess the clinical performance, effectiveness, and safety of medical devices. The standard protects the rights, safety, and well-being of human subjects while ensuring the scientific validity and credibility of clinical investigation results.

On March 23, 2026, ISO published the fourth edition — ISO 14155:2026 — replacing ISO 14155:2020 with no transition period. This is one of the most significant updates to medical device clinical investigation standards in years, introducing mandatory risk management integration, formal Clinical Events Committees (CECs), Data Monitoring Committees (DMCs), and an estimand framework aligned with pharmaceutical clinical trial practices.

The timing is notable. On January 28, 2026, the European Commission published Implementing Decision (EU) 2026/193, formally harmonizing EN ISO 14155:2020/A11:2024 with the EU MDR — the first time ISO 14155 had been harmonized since the MDR entered into force. The new ISO 14155:2026 edition then replaced it almost immediately. For manufacturers who had waited years for harmonization, this means the newly harmonized version is already superseded.

Who Must Comply with ISO 14155?

ISO 14155 applies to any organization conducting clinical investigations of medical devices in human subjects, including:

• Medical device manufacturers sponsoring pre-market clinical investigations for regulatory approval (510(k), PMA, CE marking under EU MDR)
• Contract Research Organizations (CROs) contracted to manage clinical investigations on behalf of sponsors
• Clinical investigation sites and principal investigators conducting the research
• Ethics committees and institutional review boards (IRBs) reviewing investigation protocols
• Regulatory authorities assessing clinical evidence in device submissions

The standard does NOT apply to in vitro diagnostic medical devices (which fall under ISO 20916), though certain sections may be relevant depending on the device and national requirements.

ISO 14155 vs. Other Clinical Standards

What Changed in ISO 14155:2026

The fourth edition represents a fundamental shift in how clinical investigations are designed and managed. Here are the most critical changes:

1. Risk Management Now Investigation-Specific

The 2026 edition integrates risk management directly into clinical investigation planning and conduct, aligned with ISO 14971. Previously, risk management in clinical investigations was often theoretical — the new edition requires:

• Investigation-specific risk analysis — Risks must be evaluated relative to "routine clinical practice" as the benchmark, not in isolation
• Dual risk categorization — Risks are now separated into those related to the investigation procedure and those related to the device itself
• Documentation throughout the investigation lifecycle — From CIP development through final clinical investigation report

For multi-country studies, what counts as "routine clinical practice" varies by region. These differences must be identified and documented in the Clinical Investigation Plan (CIP).

2. Clinical Events Committees (CECs) and Data Monitoring Committees (DMCs)

ISO 14155:2026 formally defines and requires governance structures that were previously only referenced:

• Clinical Events Committee (CEC) — An independent committee that adjudicates clinical events, ensuring consistent and unbiased assessment of endpoints and adverse events across investigation sites
• Data Monitoring Committee (DMC) — An independent group with the authority to recommend suspension or termination of the investigation based on interim safety or efficacy data

These committees must have documented charters, predefined operating procedures, and independence from the sponsor.

3. Stricter Eligibility Enforcement

The new edition explicitly prohibits deviations from inclusion/exclusion criteria. Any change to eligibility requirements must be made through a formal Clinical Investigation Plan amendment — not through protocol deviations. This is a significant tightening from the 2020 edition, where some flexibility was implied.

4. Enhanced Adverse Event Reporting (Annex F)

Annex F now requires mandatory dual categorization for adverse events (AEs) linked to device deficiencies:

• Category 1: The nature and severity of the adverse event itself
• Category 2: The relationship between the AE and the device deficiency

This dual approach provides regulators with more structured data for safety assessment. At the same time, the standard introduces a more proportionate approach — certain events may not need to be routinely collected or reported if justified within the CIP. This is structured oversight, not reduced accountability.

5. Estimand Framework (Annex K)

A new informative annex references ICH E9(R1), bringing the device world closer to pharmaceutical-grade statistical rigor. The estimand framework requires:

• Clear definition of the treatment effect to be estimated
• Handling of intercurrent events (e.g., treatment discontinuation, use of rescue medication)
• Strategies for missing data
• Population-level effect estimation

This means study protocols must be better defined from the outset with clearer statistical methodologies.

6. Strengthened Subject Protection

The 2026 edition expands protections beyond human subjects to include users and other persons who may be affected. Key additions:

• Implant Card templates — New requirement for providing implant cards to subjects receiving implantable devices
• Informed consent process — Must ensure subjects have "ample time" for family discussion before consent
• Vulnerable populations — Enhanced requirements for studies involving vulnerable subjects, including cross-border studies where language and cultural considerations apply

7. Expanded Investigator's Brochure (IB)

The Investigator's Brochure must now include:

• In-silico testing data — Computational modeling and simulation results supporting device safety and performance
• User-training precautions — Specific warnings and precautions related to device operation and handling
• Updated safety information — As new data emerges, the IB must be updated throughout the investigation

Comparison: ISO 14155:2020 vs. ISO 14155:2026

Clinical Investigation Planning Under ISO 14155

The Clinical Investigation Plan (CIP)

The CIP is the master document governing every aspect of the clinical investigation. ISO 14155 specifies the minimum content requirements, and the EU MDR's Annex XV, Chapter II, Section 3 further mandates specific elements. MDCG 2024-3 (published March 2024) provides detailed guidance on CIP content.

A compliant CIP must include:

1. Identification and description — Device name, model, intended purpose, classification, and sponsor details
2. Justification for the investigation — Clinical background, prior investigation data, rationale for the study design
3. Investigation objectives and endpoints — Primary and secondary endpoints, with clear estimand definitions per the new Annex K
4. Study design — Randomization, blinding, control group, sample size calculation with statistical justification
5. Risk management plan — Investigation-specific risk analysis per ISO 14971, with mitigation measures
6. Eligibility criteria — Inclusion and exclusion criteria (no deviations permitted without formal amendment)
7. Informed consent procedures — Consent process, forms, and provisions for vulnerable populations
8. Adverse event reporting — Procedures for documenting, categorizing, and reporting AEs per Annex F
9. Data management — Electronic data capture, data quality controls, and statistical analysis plan
10. Monitoring plan — Monitoring strategy, frequency, and procedures for ensuring data integrity
11. CEC/DMC charter — Governance structure for independent oversight committees
12. Multicenter requirements — Coordination across investigation sites, including multi-country considerations

Sponsor Responsibilities

The sponsor (typically the manufacturer) retains overall responsibility for the clinical investigation, even if contracted to a CRO. Key responsibilities under ISO 14155:2026 include:

• Planning and initiation — Developing the CIP, selecting investigators and sites, obtaining ethics committee and regulatory authority approvals
• Quality assurance — Ensuring the investigation is conducted within prescribed QA/QC principles
• Monitoring — Establishing and executing a monitoring plan, including site visits and data verification
• Safety reporting — Recording, assessing, and reporting all adverse events and device deficiencies to regulatory authorities
• Data management and analysis — Maintaining data integrity, performing statistical analysis, and preparing the final clinical investigation report
• Study termination — Properly closing the investigation, communicating results to authorities, and ensuring record retention
• Financial disclosure — Documenting financial arrangements with investigators and sites

Principal Investigator Responsibilities

The principal investigator manages the day-to-day conduct of the investigation at each site:

• Subject management — Recruiting and screening subjects, obtaining informed consent, managing participation and withdrawal
• Protocol compliance — Conducting the investigation exactly as specified in the CIP
• Data collection and recording — Ensuring accuracy, completeness, and timeliness of all case report form (CRF) entries
• Adverse event documentation — Identifying, documenting, and reporting all adverse events and device deficiencies to the sponsor
• Medical care — Providing adequate medical care to subjects during and after participation
• Record retention — Maintaining all investigation-related records as required by the standard and applicable regulations
• Site management — Training and supervising investigation staff, maintaining delegation logs

Managing Risk in Clinical Investigations

Risk-Based Approach

ISO 14155:2026 requires a risk-based approach to clinical investigations, aligned with ISO 14971:2019. The key principle is that risks must be evaluated relative to routine clinical practice — the benchmark is not zero risk, but rather whether the investigation introduces risks beyond what patients would encounter in normal clinical care.

The risk management process for clinical investigations involves:

1. Risk analysis — Identifying hazards and hazardous situations specific to the clinical investigation (device-related and procedure-related)
2. Risk evaluation — Estimating and evaluating risks using defined severity and probability scales
3. Risk control — Implementing measures to reduce risks to acceptable levels
4. Residual risk evaluation — Assessing whether residual risks are acceptable given the benefits
5. Risk/benefit analysis — Determining whether the overall benefits outweigh the residual risks

Monitoring Strategies

Monitoring is essential for ensuring data quality and subject safety. ISO 14155:2026 allows for risk-adapted monitoring approaches:

Adverse Event Reporting

Categories of Adverse Events

ISO 14155:2026 uses a structured adverse event taxonomy defined in Annex F:

Dual Categorization Requirement

The 2026 edition introduces mandatory dual categorization for AEs linked to device deficiencies. Each event must be assessed on two dimensions:

1. Clinical severity — The medical impact on the subject (mild, moderate, severe, life-threatening, fatal)
2. Device causality — The relationship between the AE and the device deficiency (not related, possibly related, probably related, definitely related)

This provides regulators with more structured safety data and enables better signal detection across studies.

Post-Market Clinical Investigations

ISO 14155:2026 explicitly addresses post-market clinical investigations, confirming that the standard's principles apply to these studies "as far as relevant, considering the nature of the clinical investigation" (Annex I). Post-market clinical investigations are typically conducted to:

• Confirm long-term safety and performance of CE-marked devices
• Fulfill PMCF (Post-Market Clinical Follow-up) requirements under EU MDR Article 74
• Respond to safety signals identified through post-market surveillance
• Support label extensions or new indications
• Generate comparative clinical evidence for market access

For post-market studies, certain ISO 14155 requirements may be adapted based on the nature and risk level of the investigation. The standard provides guidance in Annex I on which provisions apply and how they should be tailored.

Regulatory Alignment: EU MDR, FDA, and Global Markets

EU MDR Alignment

ISO 14155 is critical for EU MDR compliance. Clinical investigations conducted under the MDR must comply with Article 62-82 and Annex XV. Key EU-specific requirements:

• Ethics committee approval required before enrollment begins
• Competent authority notification per national transposition of MDR requirements
• EUDAMED registration — Clinical investigations must be registered in the European database
• MDCG 2024-3 guidance — Provides CIP content requirements aligned with both MDR Annex XV and ISO 14155
• MDCG 2024-5 guidance — Addresses Investigator's Brochure requirements

The EN ISO 14155:2020/A11:2024 was harmonized under the MDR in January 2026. While ISO 14155:2026 has not yet been harmonized, it represents the latest state of the art and should be followed.

FDA Recognition

The FDA recognizes ISO 14155 and accepts clinical data collected outside the US when the standard has been followed. For US regulatory submissions:

• 21 CFR Part 812 — Investigational Device Exemptions (IDE) govern clinical investigations in the US
• 21 CFR Part 50 — Protection of Human Subjects
• 21 CFR Part 56 — Institutional Review Boards
• FDA Guidance — The agency's expectations align closely with ISO 14155 principles, particularly for multi-regional clinical trials

The closer alignment between ISO 14155:2026 and ICH GCP guidance reduces friction for manufacturers working across both device and pharmaceutical requirements, including combination products and companion diagnostics.

Global Acceptance

Implementing ISO 14155:2026: Step-by-Step

Step 1: Conduct a Gap Analysis

Compare your current clinical investigation procedures, templates, and SOPs against the new requirements. Focus areas:

• Risk management documentation and investigation-specific analysis
• CEC/DMC governance structures and charters
• Adverse event reporting procedures (dual categorization)
• Informed consent processes (implant cards, family discussion time)
• Investigator's Brochure content (in-silico data, user-training precautions)

Step 2: Update Your Quality Management System

Revise the clinical investigation portions of your QMS:

• Update SOPs for clinical investigation planning, conduct, monitoring, and reporting
• Revise templates for CIPs, informed consent forms, CRFs, and adverse event reports
• Add procedures for CEC and DMC establishment and governance
• Update risk management procedures to align with the investigation-specific approach

Step 3: Train Your Teams

Structured training for clinical, regulatory, and quality teams is critical. Key training areas:

• Risk management in clinical investigations (what changed and why)
• CEC/DMC governance and decision-making
• Dual adverse event categorization methodology
• Estimand framework and its practical application
• Updated informed consent requirements

Step 4: Evaluate Ongoing Studies

For investigations already underway:

• Assess whether existing documentation meets the new requirements
• Document the rationale for actions taken or not taken regarding the updated standard
• Consider whether CIP amendments are needed for critical gaps
• Prioritize changes that affect subject safety and data integrity

Step 5: Plan New Investigations to the 2026 Standard

All new clinical investigations should be designed to comply with ISO 14155:2026 from the outset. Early planning prevents costly amendments and delays.

FAQ

Is ISO 14155 mandatory? ISO 14155 is a voluntary international standard, but compliance is effectively required because regulators worldwide recognize it as the GCP standard for medical device clinical investigations. Under the EU MDR, EN ISO 14155 is a harmonized standard providing presumption of conformity with clinical investigation requirements. The FDA accepts clinical data collected under ISO 14155. Non-compliance creates significant regulatory risk.

What is the difference between ISO 14155 and ICH GCP? ISO 14155 is specific to medical device clinical investigations, while ICH E6 GCP was developed for pharmaceutical clinical trials. The 2026 edition of ISO 14155 brings the standards closer together by incorporating the estimand framework from ICH E9(R1). Key differences remain in risk management (ISO 14971 for devices vs. ICH Q9 for drugs), endpoint types (device performance vs. drug efficacy), and adverse event categorization.

Does ISO 14155 apply to IVD devices? No. ISO 14155 explicitly states it does not apply to in vitro diagnostic medical devices. IVD clinical performance studies are governed by ISO 20916. However, there may be situations where specific sections of ISO 14155 could be applicable depending on the device and national requirements.

What happens if I do not follow ISO 14155 for my clinical investigation? Regulatory authorities may reject your clinical data, refuse your marketing application, or require you to repeat the investigation. Ethics committees may not approve your protocol. Notified Bodies may issue non-conformities during assessment. In the EU, non-compliance with GCP standards can lead to investigation suspension by competent authorities.

How does ISO 14155 relate to the EU MDR clinical investigation requirements? The EU MDR (Article 62-82 and Annex XV) establishes legal requirements for clinical investigations conducted in EU member states. ISO 14155 provides the detailed GCP framework for meeting those legal requirements. EN ISO 14155 is harmonized under the MDR, meaning compliance with the standard provides presumption of conformity with the relevant MDR requirements. MDCG 2024-3 provides additional guidance on CIP content.

What is the difference between a sponsor and a principal investigator? The sponsor (typically the manufacturer) initiates, manages, and finances the clinical investigation, retaining overall responsibility even if a CRO is used. The principal investigator manages day-to-day conduct at the investigation site, including subject recruitment, data collection, and protocol compliance. Their responsibilities are defined in Clauses 8 and 9 of ISO 14155 respectively.

When should I start implementing ISO 14155:2026? Immediately. There is no transition period. All new clinical investigations should be designed to comply with the 2026 edition. For ongoing studies, conduct a gap analysis and document your assessment of what changes are needed, prioritizing subject safety and data integrity.

Do I need a Clinical Events Committee for my investigation? The requirement depends on the nature and risk level of your clinical investigation. CECs are typically needed for studies with subjective or complex endpoints, multicenter investigations where consistent event adjudication is critical, and studies where regulatory authorities expect independent event assessment. Document your rationale for establishing or not establishing a CEC in your CIP.