ISO 14155:2020 — Clinical investigation of medical devices

ISO 14155:2020, Clinical investigation of medical devices for human subjects — Good clinical practice, is the device-sector counterpart to pharmaceutical GCP. It sets ethical and scientific quality requirements for human investigations of medical devices, spanning sponsor, investigator, ethics-committee, and monitor duties. The standard drives consistency in clinical evidence used by regulators and notified bodies, ensuring subject protection, reliable data, and traceability.

Practically, ISO 14155 structures the Clinical Investigation Plan (CIP), informed consent, monitoring, data management, device accountability, and adverse event handling. Its principles are embedded by authorities through guidance, recognition programs, and conformity assessments. In the EU, clinical data produced under ISO 14155 is central to demonstrating conformity with Regulation (EU) 2017/745 for investigational and CE-marked devices.

The standard does not replace local law. It operates alongside national and regional statutes such as US 21 CFR Parts 812, 50, and 56, and EU MDR Annex XV and Chapter VI. Sponsors align their quality systems so that clinical processes, vendors, and monitoring controls integrate coherently with design controls and post-market surveillance. A readiness approach helps connect ISO 14155 execution to technical documentation and notified body expectations, reducing rework during assessments and submissions.

Many sponsors formalize ISO 14155 operations within their device QMS and clinical SOP suite. Crosswalks that reference protocol development, risk management, data integrity, and safety reporting make audits predictable and inspection-ready. This approach also shortens timelines when responding to regulator questions and notified body observations during conformity reviews.

For implementation planning and cross-functional scoping, see the related guide to ISO 13485 alignment and gap-closure activities in ISO 13485 Readiness.

ISO 14155 applies to clinical investigations of medical devices in human subjects, covering feasibility, pivotal, and post-market studies, including post-market clinical follow-up when an interventional design is used. It addresses device-specific realities such as iterative design, usability, learning curves, and performance endpoints distinct from purely pharmacologic effects. The standard is intended for devices across classes, with proportionality in risk-based planning and monitoring.

The scope includes active, non-active, implantable, and reusable devices, and it is adaptable to combined diagnostic-therapeutic workflows where the device action is primary. In vitro diagnostic devices follow separate, IVD-specific clinical performance frameworks; however, the ethical and data-integrity expectations remain similar. For software-driven devices, the same GCP principles apply to human studies that evaluate clinical performance, usability, and workflow integration.

Regulators and notified bodies reference ISO 14155 for scientific and ethical quality, while requiring compliance with local law for submissions and oversight. Sponsors routinely cite ISO 14155 in clinical protocols, investigator brochures, and technical documentation to establish their good clinical practice framework and to harmonize with device-class expectations and study risk. Early scoping should consider classification, route to market, and whether an investigational exemption or notification is required.

Sponsors should confirm whether their product and intended use require an interventional clinical investigation or can leverage existing data, literature, bench, and simulated-use evidence. Careful pathway selection, particularly for borderline cases and software, reduces avoidable delays and rework during authority and ethics reviews. See Medical Device Classification for early scoping, and for software-specific pathways consult Software as a Medical Device (SaMD) Readiness. For market access in Great Britain and Northern Ireland, review transition specifics in UKCA Medical Device Transition.

ISO 14155 frames a governance model that puts the sponsor at the center of planning, oversight, and accountability. The sponsor establishes and maintains the Clinical Investigation Plan, selects qualified investigators, secures ethics and authority approvals, and assures monitoring and data integrity. Investigator responsibilities focus on subject safety, protocol adherence, accurate data capture, and appropriate device accountability at the site.

Ethics committees or institutional review boards safeguard subject rights and well-being, reviewing risk–benefit, consent materials, recruitment practices, and scientific rationale. Monitors verify compliance with the CIP, consent, source data, adverse event processing, and device accountability. When risk justifies it, an independent data monitoring committee may be chartered to review unblinded safety and performance trends.

A robust operating model ties these roles to the sponsor’s QMS, ensuring traceable training, vendor qualification, and quality events routing. Monitoring is risk-based, with visit frequency and depth calibrated to device risk, site experience, and data criticality. The governance framework should also anticipate remote and centralized review models, ensuring that privacy and data integrity requirements are met across jurisdictions.

• Sponsor: overall accountability for design, approvals, monitoring, safety reporting, and data integrity across the investigation lifecycle.
• Investigator: conduct at site, subject safety, accurate data recording, device accountability, and local report submissions per law and ethics requirements.
• Ethics Committee/IRB: independent review of risk–benefit, consent, recruitment, and ongoing safety oversight, including review of amendments and serious events.
• Monitor: verification of consent, protocol compliance, source data, device accountability, and timely issue escalation to the sponsor.

The Clinical Investigation Plan (CIP) anchors ISO 14155 execution. It articulates objectives, endpoints, design, statistical methods, eligibility, procedures, monitoring, data handling, and safety reporting. The CIP must show a risk-based rationale that integrates preclinical, usability, and prior clinical data, culminating in a justified sample size and endpoint hierarchy. Every requirement in the plan must map to traceable operational controls and case report forms.

Supporting documents include the Investigator’s Brochure, informed consent materials, case report forms, monitoring plan, data management plan, and device accountability procedures. The CIP should explicitly reference device risk controls and user-interface considerations that affect subject safety and performance assessment. For example, human factors validation and labeling constraints frequently inform inclusion/exclusion, training, and endpoint definitions.

Source data and CRF design should enable unambiguous reconstruction of critical endpoints and adverse events. Version control across the CIP, consent, and site materials must be rigorous to prevent data misclassification or protocol deviations. Each amendment requires impact assessment, retraining, and re-approval by ethics bodies and, where required, competent authorities, before implementation at sites.

Device-specific context belongs in the core documents. Instructions for assembly, calibration, and use, limitations, and device accountability procedures must be consistent with current labeling. For investigational devices, the CIP should capture how changes to the device or software will be controlled and communicated to sites, and how any revalidation will be handled before resumed use.

Tie device labeling and usability to protocol logistics using Instruction for Use (IFU) principles. Ensure design and training reflect Human Factors insights, and keep controlled documents current with Document Control.

ISO 14155 requires the sponsor to implement proportionate, risk-based monitoring. The monitoring plan should specify visit frequency, centralized monitoring parameters, source data verification strategy, device accountability checks, and triggers for for-cause visits. It should also define how remote activities will be conducted, including privacy safeguards and controls for electronic records.

Site initiation establishes readiness, training, device handling, and data entry workflows. Ongoing monitoring verifies informed consent, eligibility, protocol adherence, endpoint assessments, adverse event processing, and corrective actions for deviations. Investigational device inventories, calibration checks, and maintenance logs must reconcile with patient use and returned devices to ensure complete chain of custody.

Data integrity depends on validated systems, audit trails, and role-based access. Electronic CRFs and eSource must preserve attribution, legibility, contemporaneity, originality, and accuracy. The sponsor should maintain a coherent query and data-cleaning strategy that links to lock procedures and statistical analysis timelines, preventing analysis before resolution of critical data issues.

Deviations and noncompliances require prompt documentation, root-cause analysis, and corrective actions. The sponsor should track patterns across sites, assess subject-safety impact, and consider protocol amendments when systemic. Procedural controls must enable rapid exclusion of erroneous data while preserving audit trails and investigator attestations.

Validate eCRF platforms against compliance expectations for audit trails, security, and electronic signatures. Where applicable, confirm compatibility with 21 CFR Part 11 and local privacy safeguards, and verify that monitoring portals and document exchange workflows meet confidentiality and integrity requirements.

ISO 14155 defines terminology and processes for adverse events, adverse device effects, serious adverse events, serious adverse device effects, unanticipated effects, and device deficiencies. The sponsor is responsible for timely assessment, documentation, and reporting to ethics committees and competent authorities per local law. Investigators must promptly inform the sponsor of events and provide the documentation needed for medical review and causality assessment.

In the European Union, clinical investigation safety reporting interfaces with MDR oversight of investigational devices and the EUDAMED module when fully implemented. In the United States, unanticipated adverse device effects must be reported under 21 CFR 812 within specified timelines, and IRBs and FDA require appropriate notifications. Other jurisdictions adopt similar expectations, requiring immediate hazard mitigation and rapid communication where subject safety is at stake.

Risk management activities must be synchronized with safety reporting. New hazards, hazardous situations, or risk-control shortcomings identified during the investigation should feed the risk file, design controls, and training updates. This closed-loop ensures that clinical insights translate into durable controls before market entry and during post-market follow-up.

Terminology precision matters. For example, distinguishing a device deficiency without subject harm from a related adverse device effect influences both reporting timelines and trend analysis. Sponsors should pre-specify medical review workflows and coding dictionaries to maintain consistency across sites and regions.

Establish a harmonized safety lexicon and escalation matrix connected to your risk file. Align with Adverse Event Reporting practices and keep the risk framework current with ISO 14971:2019/Amd1:2024.

ISO 14155 expects prespecified, justified endpoints and statistical methods that reflect device performance, safety, and clinical benefit. Sponsors should define primary and key secondary endpoints aligned with the intended use, including success criteria and handling of intercurrent events. Sample-size computations must incorporate clinically meaningful effect sizes, variability, and attrition, and adjustments for multi-arm or adaptive features where applicable.

Adaptive and staged designs are common in device development due to learning curves and incremental innovation. Such designs require robust control of operational bias, data access, and interim decision rules, often with independent committees overseeing unblinded data. Data quality thresholds for primary endpoints and adjudication procedures should be specified before enrollment begins.

Sponsors increasingly complement interventional evidence with registries, literature, and pragmatic data. When appropriately curated, real-world information can support external controls, generalizability, and longer-term outcomes. Authorities may engage early via scientific advice to align on appropriateness of comparators, endpoint hierarchy, and evidence synthesis plans.

Early dialogue reduces iteration during review and helps align clinical objectives with regulatory pathways such as conformity assessment or premarket submissions. Clear, testable endpoint definitions also enable efficient monitoring and reduce data queries, shortening lock and analysis timelines while preserving interpretability.

Explore pragmatic sources and external comparators under Real-World Evidence, and use early engagement via the FDA Q-Submission Program to de-risk endpoint selection and analysis plans.

Frequent ISO 14155 gaps include incomplete risk-based rationales in the CIP, insufficient linkage between device risk controls and eligibility or procedures, and inconsistent consent documentation. Sponsors also encounter findings where device accountability records cannot be reconciled with use, calibration, or maintenance logs, creating uncertainty around exposure and performance endpoints.

Another common issue is misclassification of device deficiencies versus adverse device effects, which cascades into late or incorrect safety reports. Monitoring plans that are not tailored to the device risk and site history can lead to over- or under-sampling of critical data, leaving gaps in primary endpoint verification. Electronic systems deployed without validation or clear role-based access controls undermine audit trails and data integrity.

Preventive strategies include designing the CIP around critical-to-quality factors, codifying safety lexicon and reporting thresholds, and implementing centralized analytics that trigger targeted on-site verification. Proactive vendor qualification and training reduce variability in device handling and data entry. Simulated enrollment and dry runs of endpoint assessments can expose operational ambiguities before first patient in.

Inspection readiness hinges on document control, deviation management, and timely corrective actions. Establish investigation templates, root-cause frameworks, and cross-site trending to detect systemic issues. Ensure all decision points and rationale are contemporaneously documented, including those that led to amendments or early stopping decisions.

Institutionalize continuous improvement using your quality system’s CAPA processes. Reference clinical-process ownership within QMS so audit trails, training, and supplier oversight remain synchronized across the investigation lifecycle.

V5 Ultimate provides an end-to-end operational backbone for ISO 14155, embedding document control, audit trails, and role-based workflows across clinical planning, monitoring, and safety reporting. Sponsors can map CIP requirements to controlled procedures, training, and site materials, ensuring version alignment and rapid, auditable amendments.

Risk-based monitoring is orchestrated through configurable plans, centralized analytics, and issue routing that link site findings to deviations, CAPA, and safety reporting queues. Device accountability and chain-of-custody records are maintained with item-level traceability, enabling precise reconciliation between inventories, subject exposure, and returned investigational devices.

Electronic records and signatures are safeguarded with validated audit trails, permissions, and data-integrity controls. Real-time notifications accelerate approvals, document exchanges, and safety escalations, while inspection-ready reports compile protocol versions, training attestations, monitoring logs, and safety submissions into a coherent package for authorities and ethics bodies.