FDA Regulation of In Vitro Diagnostic Devices: The Complete Guide for US Market Entry

Written by Joana Martins Published on 04.06.2026 Last updated on 16.07.2026

June 4, 2026

Co-authored by Floella Otudeko

The United States is the world’s largest market for in vitro diagnostic devices. It is also one of the most complex to enter. FDA regulation of IVDs operates through a risk-based framework that determines how a device is classified, which approval or clearance pathway applies, what evidence is required before commercial distribution, and what obligations continue after authorization.

This guide covers the entire FDA regulatory landscape for IVD manufacturers, from initial device qualification through classification, premarket submission, investigational use, quality management system requirements, and post-market surveillance. It also addresses the specific considerations that apply to laboratory-developed tests, companion diagnostics, and manufacturers operating in both the US and EU markets simultaneously.

Key point: FDA regulation of IVDs sits within the same statutory framework as all medical devices under the Federal Food, Drug, and Cosmetic Act (FD&C Act). However, IVDs have specific classification rules, dedicated guidances, and performance evidence requirements that differ materially from those applied to other device types.

Align Your Clinical Strategy with FDA IVD Regulations

The upcoming IMDRF N91 framework is designed to align with strict global benchmarks, and the US FDA is leading the charge. Whether you are navigating 510(k) clearances, De Novo pathways, or complex PMA submissions for companion diagnostics (CDx), securing FDA clearance demands impeccable, scientifically valid clinical evidence. To build a bulletproof regulatory strategy that satisfies FDA examiners, you need a partner who understands the nuances of US IVD clinical trial design inside and out.

Explore FDA IVD Trial Solutions

What Counts as an IVD Under FDA Law

An in vitro diagnostic product is defined under 21 CFR 809.3(a) as a reagent, instrument, or system intended for use in the diagnosis of disease or other conditions, through the in vitro examination of specimens derived from the human body.

The definition is broad. It covers reagent kits, assay systems, instruments that process or read those assays, software that interprets results, and combinations of these elements. A product intended to generate medically actionable information from a human specimen will generally fall within the IVD framework regardless of the format in which it is supplied.

Two practical questions determine whether the FDA IVD regulatory framework applies:

Is the product intended to examine specimens taken from the human body?
Is that examination intended to support a medical decision, diagnosis, monitoring, patient selection, or treatment assignment?

If both are true, the product is an IVD and must comply with the applicable FDA requirements before commercial distribution in the United States. The intended use stated by the manufacturer, not the technology, the format, or the distribution channel, determines this status.

IVD vs. LDT: Laboratory-developed tests (LDTs), assays designed, manufactured, and used within a single laboratory, have historically operated under a different framework. FDA issued a final rule in 2024, but subsequent legal challenges (including a 2025 court decision) have created uncertainty, and the long-term regulatory framework for LDTs remains in flux. See the section on LDTs below.

FDA IVD regulation pathway tree diagram: classification (Class I, II, III), premarket routes (510k, De Novo, PMA), quality system (QMSR), and post-market obligations

IVD Classification: How FDA Assigns Risk Class

All FDA-regulated devices, including IVDs, are assigned to one of three risk classes. The class determines which controls apply and which premarket pathway is available.

Class	Risk Level	Controls Required	Typical Premarket Route
Class I	Low	General controls only	Exempt or 510(k)
Class II	Moderate	General + special controls	510(k) or De Novo
Class III	High	General + special controls + PMA	Premarket Approval (PMA)

For IVDs, classification is determined primarily by intended use and the clinical consequences of erroneous results, false positives, false negatives, or invalid results, rather than by the underlying technology. An assay with a low-risk intended use (for example, confirming a known condition in a low-risk population) may qualify as Class II even if it uses the same analytical technology as a Class III device with a high-risk intended use.

The FDA maintains a product classification database with assigned device codes, regulation numbers, and review panels. Before finalising a regulatory strategy, manufacturers should search this database for devices with a similar intended use to understand how FDA has previously classified comparable products.

FDA Premarket Pathways for IVDs: 510(k), De Novo, and PMA

The three main premarket pathways differ significantly in what they require, how long they take, and what outcome they produce. Selecting the wrong pathway, or failing to engage FDA early to confirm the right one, is one of the most common and costly mistakes in IVD regulatory strategy.

510(k) Premarket Notification

A 510(k) submission demonstrates that a new device is substantially equivalent to a legally marketed predicate device. For IVDs, this means identifying a predicate with the same intended use and similar technological characteristic, or, if the technology differs, demonstrating that the differences do not raise new safety or effectiveness questions.

The 510(k) route is appropriate when a suitable predicate exists. For IVD manufacturers, substantial equivalence must be established not just at the level of technology but at the level of the clinical claim. An assay using the same analytical platform as a predicate is not automatically equivalent if it is intended for a different patient population, a different decision point, or generates results that would be used differently in clinical practice.

Standard 510(k): most common; requires performance data and predicate comparison
Abbreviated 510(k): relies on FDA-recognised performance standards
Special 510(k): limited to device modifications by the original manufacturer

Timeline: FDA’s standard review target is 90 days. In practice, requests for additional information (AI letters) are common and extend the timeline. Manufacturers should plan for 4–8 months for a standard 510(k) with a well-prepared submission.

De Novo Risk-Based Classification for Novel Devices

The De Novo pathway applies to novel devices for which no legally marketed predicate exists, making the 510(k) pathway unsuitable, but the device is not high enough risk to require PMA. It creates a new device classification with specific controls appropriate to that device type.

For IVD manufacturers developing novel diagnostic technologies or applying known assay types to new clinical applications, De Novo is often the appropriate route. A successful De Novo classification becomes itself a predicate for future 510(k) submissions by other manufacturers.

The evidentiary requirements for De Novo are substantial and in practice often comparable to those for a PMA in terms of analytical and clinical evidence depth. The key difference is that De Novo does not presuppose Class III and gives FDA the ability to define special controls that make Class II regulation workable for the device type.

Timeline: FDA’s target is 150 days for De Novo review. With AI letters, 12–18 months is a realistic planning assumption for novel IVD applications.

PMA Premarket Approval

Premarket Approval is the most rigorous FDA pathway and applies to Class III devices, those for which general and special controls are insufficient to assure safety and effectiveness. PMA requires valid scientific evidence, typically from well-controlled clinical investigations, demonstrating that the device is safe and effective for its intended use.

For IVDs, PMA applies to:

Devices that determine eligibility for high-risk therapies where no predicate or De Novo classification exists
Companion diagnostics essential for the safe and effective use of a corresponding therapeutic, the majority of CDx devices proceed through PMA, though a November 2025 FDA proposal would reclassify certain NGS and NAAT-based oncology CDx to Class II
High-risk screening tests where a false negative or false positive result has severe clinical consequences

PMA submissions are organised in modules covering administrative information, device description, clinical performance data, analytical validation, manufacturing, software, and labeling. FDA offers a modular PMA submission option that allows review of completed modules before the full package is assembled, a significant strategic advantage in co-development programmes where evidence is generated progressively.

Criterion	510(k)	De Novo	PMA
Legal standard	Substantial equivalence	Safety & effectiveness via general/special controls	Safety & effectiveness
Predicate required	Yes	No	No
Device class outcome	Class I or II	New Class I or II	Class III
Review target	90 days	150 days	180 days (modular: staged)
Post-approval changes	Change assessment required	Change assessment required	PMA supplement required
Typical IVD use case	Known assay type, clear predicate	Novel technology, moderate risk	CDx, high-risk screening, no predicate

Investigational Use of IVDs: IDE Requirements and the Significant Risk Determination

When an IVD is used in a clinical investigation before it has received FDA premarket authorisation, the manufacturer and sponsor must comply with the investigational device provisions under 21 CFR Part 812. The applicable requirements depend on whether the device is classified as significant risk (SR) or non-significant risk (NSR).

Significant Risk vs. Non-Significant Risk

A significant risk device is one that presents a potential for serious risk to the health, safety, or welfare of a subject, including devices used in diagnosing, curing, mitigating, or treating disease where errors could have serious clinical consequences.

Investigational IVDs Used in Clinical Investigations of Therapeutic Products

For IVDs, the SR determination requires analysis of four specific questions defined in FDA’s 2017 draft guidance on Investigational IVDs Used in Clinical Investigations of Therapeutic Products:

Will use of the IVD results lead some subjects to forgo or delay a treatment known to be effective?
Will use of the results expose subjects to safety risks exceeding those of the control arm or standard of care?
Is it likely that incorrect results would present a potential for serious risk, based on what is known about the biomarker-therapeutic relationship?
Does use of the IVD require invasive sampling that is not part of standard care?

Sponsors are responsible for the initial risk determination and must present it to the Institutional Review Board (IRB). If the device is classified as SR, an Investigational Device Exemption (IDE) application must be submitted to FDA (through CDRH) and FDA has 30 days to respond. If deemed NSR, IRB approval is sufficient, no IDE application is required, but abbreviated requirements under 21 CFR 812.2(b) still apply.

CDx in drug trials: When an IVD is used in a clinical investigation of a drug or biological product to determine patient eligibility or guide treatment decisions, the SR determination is critical. A misjudgement here, treating a device as NSR when it is SR, exposes the entire clinical programme to regulatory risk.

FDA Quality Management System Regulation (QMSR): What IVD Manufacturers Need to Know

Since 2 February 2026, the FDA Quality Management System Regulation (QMSR, 21 CFR Part 820) has replaced the former Quality System Regulation (QSR). QMSR incorporates ISO 13485:2016 by reference into US law, aligning US quality system requirements with the international standard for the first time.

For IVD manufacturers, QMSR introduces important practical changes. Several are particularly relevant to the IVD context:

What Changed for IVD Manufacturers Specifically

IVD quality systems under QMSR must go further than a standard ISO 13485-aligned QMS. The nature of IVD products, which generate results that directly inform clinical decisions, introduces additional complexity in several areas:

Design controls (ISO 13485 clause 7.3 / QMSR): design inputs must explicitly link intended use, specimen type, analyte definition, and performance claims to statistically robust analytical and clinical data. Design changes after clinical evidence generation may require bridging studies.
Risk management: for IVDs, risk management must account for false positive and false negative results, not just device failures. Diagnostic decision risks, interfering substances, and matrix effects must all be explicitly addressed.
Production and process control: lot-to-lot variability of biological materials requires validation against clinically relevant criteria, not just functional performance.
Post-market surveillance: systems must detect performance drift, shifts in sensitivity or specificity, which may not be visible through standard complaint handling alone.

The ISO 13485 Certification Gap

A persistent misconception in the IVD industry is that ISO 13485 certification means a manufacturer is QMSR-ready. It does not. While QMSR incorporates the standard by reference, FDA-specific requirements remain fully enforceable, and ISO certification does not address them.

The most consistently overlooked gaps include:

UDI traceability: the UDI must be recorded consistently across complaints, servicing records, and batch/history records, not just registered in GUDID
MDR linkage: complaint handling procedures must be explicitly connected to Medical Device Reporting obligations under 21 CFR Part 803
Internal audit and management review access: under QMSR, FDA inspectors can access these records, they were previously outside standard inspection scope
Labeling controls: FDA-specific label content requirements (UDI, expiry dates, handling instructions) require documented control procedures

Inspection change: Under QMSR and Compliance Program 7382.850, FDA inspections are now structured around six integrated quality system areas rather than the former QSIT subsystem model. Inspectors assess how quality processes function together across the product lifecycle, not whether each subsystem satisfies a checklist in isolation.

For manufacturers needing support with QMSR gap assessment, MDx CRO’s quality and regulatory affairs team provides structured readiness reviews specifically for IVD and CDx manufacturers. See the dedicated article: FDA QMSR: How the 2026 Regulation Shift Transforms MDSAP Audits and FDA Compliance Inspections.

Laboratory-Developed Tests (LDTs): FDA’s 2024 Rule and What It Means

FDA issued a final LDT rule in May 2024 that would have phased out enforcement discretion. However, the rule was vacated by a federal court in March 2025, and FDA later reverted the regulatory text. The future federal regulatory framework for LDTs remains uncertain.

Phase	Timeline (from May 2024)	Requirement
1	Year 1	MDR, complaint handling, correction/removal reporting
2	Year 2	Registration, listing, labeling, investigational use
3	Year 3	Quality system (QMSR) requirements
4	Year 4	Premarket review — Class III LDTs
5	Year 5	Premarket review — Class II LDTs (most)

The practical implication for laboratories offering LDTs is significant. Tests that have operated without FDA premarket review for decades now face classification, potential 510(k) or PMA requirements, QMSR compliance, and post-market surveillance obligations. The transition is particularly complex for high-complexity molecular tests, NGS-based assays, and tests used to guide treatment decisions, the categories most likely to face substantive premarket requirements.

The IVD vs. LDT distinction has also created regulatory ambiguity for assays that are commercially distributed but described as ‘laboratory services’. FDA’s position is that the legal framework applies based on the nature of the product and its intended use, not the business model through which it is offered.

Companion Diagnostics: FDA’s Co-Development and Approval Framework

A companion diagnostic is an IVD that provides information essential for the safe and effective use of a corresponding therapeutic product. FDA’s CDx framework sits at the intersection of device and drug regulation, requiring coordination between CDRH (which reviews the diagnostic) and CDER or CBER (which reviews the drug or biologic).

Most companion diagnostics require PMA, though FDA’s November 2025 proposal to reclassify certain NGS and NAAT-based oncology CDx from Class III to Class II would, if finalised, make 510(k) available for a subset of these devices. Until that reclassification is confirmed, PMA should be treated as the working assumption for novel CDx programmes.

The Contemporaneous Approval Expectation

FDA’s CDx policy generally expects the companion diagnostic and the corresponding therapeutic product to receive marketing authorization simultaneously. This means that a deficiency in the diagnostic submission, a gap in analytical validation, an incomplete bridging study, or an unresolved labeling alignment issue, can delay drug approval, even though the drug is reviewed by a different FDA centre.

The most common causes of CDx-related drug approval delays are:

Assay version used in the clinical trial differs from the commercial assay proposed for marketing, requiring bridging studies that were not planned in advance
Clinical performance data collected in one population (for example, EU samples) not adequately bridged to the US population the labeling claim would cover
Intended use statement in the device submission misaligned with the indication in the drug label
Design controls documentation not adequately tracing the clinical trial assay to the commercial configuration

MDx CRO’s FDA Companion Diagnostics guide covers the full CDx regulatory pathway including PMA structure, IDE strategy, Q-submission programme, co-development governance, and assay lock considerations. A downloadable FDA Companion Diagnostic Roadmap is available on that page.

FDA Regulation vs. EU IVDR: Key Differences for IVD Manufacturers Targeting Both Markets

Many IVD manufacturers pursue US FDA authorisation and EU CE marking under the IVDR simultaneously. While the two frameworks share some structural principles, risk-based classification, performance evidence requirements, quality management system obligations, they diverge significantly in how those principles are applied.

Area	FDA (US)	EU IVDR
Classification basis	Intended use + clinical risk	Risk class A–D based on IVDR rules + MDCG guidance
Premarket route	510(k), De Novo, or PMA	Conformity assessment via Notified Body (Class B–D) or Self-certication (Class A)
Evidence standard	Valid scientific evidence (PMA) / substantial equivalence (510(k))	Scientific validity + analytical + clinical performance
Clinical evidence location	US population; bridging required for non-US data	EU population; bridging required for non-EU data
QMS standard	QMSR (incorporates ISO 13485:2016)	ISO 13485:2016 (harmonized under the IVDR)
Performance studies	IDE framework (21 CFR Part 812)	IVDR Articles 56-58 / Annex XIV
Post-market	MDR reporting, post-approval studies (PMA)	PSUR, PMPF, vigilance reporting
CDx specifics	CDRH/CDER/CBER coordination; PMA typical	Notified Body review; Annex IX section 5.2 procedure

The most significant practical challenge for dual-jurisdiction programmes is clinical evidence. A clinical performance study conducted exclusively with EU samples may not be acceptable to FDA without bridging evidence demonstrating equivalence to the US population. The reverse applies equally. Early engagement with both FDA (via Q-submission) and the Notified Body allows sponsors to design studies that generate evidence acceptable to both frameworks, reducing the need for duplicated studies.

Analytical validation can often be leveraged across jurisdictions if conducted to CLSI and CAP/CLIA standards, which both frameworks recognise. Intended use statements can be aligned between jurisdictions, though the labeling requirements differ. The most efficient approach is to map the two frameworks at programme inception and identify shared requirements before study design is finalised.

How MDx CRO Supports IVD Manufacturers Targeting the US Market

MDx CRO is a specialist contract research and regulatory organisation focused on IVDs, companion diagnostics, and medical devices. Our regulatory affairs and quality teams support IVD manufacturers entering or expanding in the US market across the full regulatory lifecycle.

Regulatory Strategy and Pathway Determination

We help manufacturers determine the appropriate FDA classification, premarket pathway, and investigational use strategy before resources are committed. For manufacturers also pursuing EU IVDR CE marking, we map the two frameworks in parallel to identify shared and divergent requirements early.

QMSR Gap Assessment

We conduct structured QMSR readiness assessments for IVD and CDx manufacturers, identifying gaps between current quality systems and FDA QMSR requirements, prioritising findings by inspection risk, and supporting remediation. Our quality team has specific IVD expertise, covering the additional complexity that performance claims, clinical evidence traceability, and analytical validation introduce into design controls and risk management under QMSR.

IDE and Investigational Use Support

We support the significant risk determination process, IDE application preparation, and coordination between the IVD and drug sponsors in combined studies. This includes IVDR performance study applications for EU clinical sites running in parallel with FDA IDE submissions for US sites.

Companion Diagnostic Co-Development

For pharma sponsors co-developing an IVD with their therapeutic programme, we provide IVD regulatory strategy, assay lock planning, bridging study design, and submission preparation, with the goal of achieving contemporaneous FDA authorization of the CDx alongside the drug or biologic.

Frequently Asked Questions

What is the difference between an IVD and a laboratory-developed test under FDA regulation?

A commercial IVD is a product manufactured and distributed to multiple laboratories or end users. An LDT is an assay designed, manufactured, and used within a single CLIA-certified laboratory. Historically FDA did not enforce premarket requirements against LDTs, but its 2024 final rule phases in the same regulatory framework for LDTs as for commercial IVDs over a four-year period beginning May 2024.

Does a 510(k) clearance mean an IVD is approved?

No. 510(k) results in FDA clearance, not approval. Clearance confirms substantial equivalence to a predicate device. FDA approval, issued through PMA, applies to Class III devices and requires independent demonstration of safety and effectiveness. The distinction matters clinically and commercially: the evidentiary standard and post-market obligations differ significantly.

Can clinical evidence generated in Europe be used to support an FDA submission?

It can be submitted, but FDA will assess whether the evidence is adequate for the US intended use and patient population. For devices where clinical validity depends on population-specific biomarker prevalence, disease incidence, or treatment patterns, bridging evidence may be required to establish that EU data is applicable to the US population. This should be discussed with FDA via Q-submission before the clinical study is designed.

What is the IDE pathway for IVDs used in drug trials?

When an IVD is used in a clinical investigation of a drug or biological product and classified as a significant risk device, the sponsor must submit an IDE application to FDA under 21 CFR Part 812. FDA has 30 days to approve or disapprove the application. If the device is non-significant risk, only IRB approval is required. The risk determination must be made by the sponsor and presented to the IRB before the study begins.

What does QMSR mean for IVD manufacturers who already have ISO 13485 certification?

ISO 13485 certification does not equal QMSR compliance. While QMSR incorporates ISO 13485:2016 by reference, FDA-specific requirements remain fully enforceable, including UDI integration across record types, MDR linkage to complaint handling, and specific labeling control documentation. Additionally, under QMSR, FDA inspectors can now access internal audit reports, management reviews, and supplier audits, which were previously outside inspection scope. A gap assessment against QMSR requirements is recommended even for certified manufacturers.

What is the FDA’s position on companion diagnostics and contemporaneous approval?

FDA’s policy for companion diagnostics that are essential for the safe and effective use of a therapeutic product generally expects simultaneous authorization of both products. A device deficiency can delay drug approval even when the therapeutic programme itself is ready. This makes early integration of the CDx regulatory programme into the drug development timeline, and coordination between CDRH and CDER or CBER, a practical necessity rather than an optional best practice.

The FDA IVD Regulatory Framework at a Glance

FDA regulation of IVDs operates through a risk-based classification system that assigns devices to three classes and directs them toward 510(k), De Novo, or PMA premarket pathways depending on risk level and the availability of a predicate. Investigational use of IVDs in clinical studies requires an IDE for significant risk devices. Commercial distribution requires compliance with QMSR quality management system requirements, which have been in force since February 2026 and now give FDA investigators access to records previously outside inspection scope.

Laboratory-developed tests are progressively subject to the same framework under FDA’s 2024 rule. Companion diagnostics follow the general device framework but require coordination with the drug regulatory review and are generally subject to PMA. Manufacturers pursuing both US FDA authorization and EU IVDR CE marking can leverage shared analytical validation data but must address population-specific clinical evidence requirements for each jurisdiction.

Services

Written by:

Joana Martins

Quality and Regulatory Affairs professional specializing in medical devices and IVDs. More than 10 years supporting companies in achieving global compliance with EU MDR and FDA requirements, focusing on QMS implementation, risk management, and regulatory strategy.

View all articles →

Industry Insights & Regulatory Updates

FDA Human Factors Guidance 2026: What the Final Guidance Means for Your Submission

MDCG 2021-24 Rev.1: What Changed in EU MDR Device Classification (April 2026)

ISO 10993-1:2025 From Checkbox Compliance to Risk-Based Biocompatibility

FDA Companion Diagnostics: A Complete Regulatory Guide to CDx Development, Approval, and Co-Development Strategy

ISO 20417:2026 You May Have a Gap Today: What Medical Device Manufacturers Shall Do Now

ISO 10993-1:2025 From Checkbox Compliance to Risk-Based Biocompatibility

Written by Diego Rodriguez Muñoz Published on 11.05.2026 Last updated on 15.07.2026

May 11, 2026

Written by Diego Rodriguez, Regulatory Consultant & Alberto Bardají de Quixano, Head of Medical Devices.

A physician does not request every possible test for every patient simply because the tests exist. First, the physician understands the patient, the symptoms, the history, and the risk factors. Then the physician decides which tests are necessary to confirm or rule out a concern.

The same logic now applies to medical device biocompatibility.

When ISO 10993-1:2025 was published in November 2025, it marked one of the most significant evolutions in biological evaluation of medical devices in decades. At first glance, the update may appear to be a refinement. In reality, it represents a fundamental shift in philosophy; biocompatibility is no longer a testing exercise. It is a risk management process.

For manufacturers, this means rethinking how biological evaluation is approached, both for existing devices and new developments. Many manufacturers continue to ask the wrong question; “Which tests do we need to perform now?” The better question is; “What biological risks are relevant for this device, and what evidence do we need to justify its safety?”

This article breaks down the eight major shifts in ISO 10993-1:2025, what they mean for your organization, and how to implement them without unnecessary cost or delay.

What Changed: The Eight Major Shifts in ISO 10993-1:2025

The 2025 revision of ISO 10993-1 does not introduce completely new concepts, but it significantly clarifies, strengthens, and restructures existing principles. According to Diego Rodriguez Muñoz, RA Specialist at MDx CRO, the shift from checklist compliance to risk-based assessment represents a maturation in how the industry understands biocompatibility:

“The philosophy changed because ISO 10993-1:2025 reinforces that biological safety cannot be demonstrated only by completing a predefined list of tests. A medical device is biologically safe when the manufacturer can demonstrate, through a structured risk-based evaluation, that the materials, contact type, exposure, manufacturing process, lifecycle, and available evidence have been properly assessed.”

1. From Matrix-Based Testing to Risk-Based Biological Assessment

For decades, biological evaluation was driven by predefined test matrices. The approach was straightforward; identify your device category, look up the matrix, perform the tests listed. It felt objective. It felt safe.

ISO 10993-1:2025 closes this approach permanently.

The new standard makes explicit what should have been obvious; the purpose of biological evaluation is not to complete a checklist. The purpose is to demonstrate that a device is biologically safe through structured, scientific assessment of actual biological risks.

The old mindset: “Which tests do we need?”
The new mindset: “What are the biological risks, and what evidence justifies safety?”

This shift appears subtle, but it is not. It fundamentally changes how you plan a biological evaluation.

Consider a scenario; a silicone implant intended for long-term use. Under the old approach, you would follow the matrix, run all prescribed tests, check the boxes, and declare compliance. Under the new approach, you start by understanding the device; its materials, how it contacts tissue, how long it stays in the body, what could go wrong, and what evidence already exists to address each risk. If existing data satisfies the risk assessment, additional testing may not be needed. If gaps exist, testing is targeted to those gaps.

The outcome is more scientific justification; potentially fewer unnecessary tests; better decisions about where to invest resources.

Many manufacturers worry that ISO 10993-1:2025 means “more testing.” Often, the opposite is true. As Diego explains, the key message is not that the new standard
requires additional tests;

“The new standard is not about automatically adding more tests, but about building a stronger scientific justification based on the device materials, contact type, exposure, manufacturing process, lifecycle, and overall biological risk profile.”

If your planning is thorough and your rationale is sound, testing requirements may actually decrease.

2. Chemical Characterization Becomes the Foundation for Biological Evaluation

Before ISO 10993-1:2025, chemical characterization existed. It was important. But it often played a secondary role to biological testing, now it is central.

ISO 10993-1:2025 prioritizes a clear evaluation logic:

First: understand the materials and constituents (detailed chemical characterization)
Then: perform toxicological risk assessment based on that information
Finally: conduct biological testing only if relevant gaps remain

This reordering is profound because chemical characterization is preventive. If you understand what a material releases, you can estimate whether those substances pose toxicological risk without animal testing. If the risk is low and well-justified, biological testing becomes optional rather than mandatory.

Why manufacturers historically missed this: Many organizations focused on “what tests can we run?” rather than “what do we know about our materials?” Chemical data; extractables, leachables, composition; was treated as supporting information. ISO 10993-1:2025 elevates it to decision-making status.

The practical impact: If chemical characterization is properly planned from the beginning, it can avoid unnecessary testing and may reduce the need for animal testing by providing stronger scientific justification for biological safety. This matters both for timelines and costs. Missing chemical information early can delay the evaluation or require remedial work later; when it is expensive to fix.

3. Device Categorization Based on Actual Contact Type Instead of Device Classification

ISO 10993-1:2025 reorganized how devices are categorized. The shift moves away from treating device category as a fixed label toward defining it based on actual biological interaction.

Devices are now assessed according to the type of body contact;

Intact skin contact
Mucosal surface contact
Compromised tissue or internal tissues (non-blood)
Blood contact

For many devices, this change has not created a major practical “category move.” But it has shifted how manufacturers think about categorization; less about what the device is (for example, “implant”), more about where and how it touches the body.

Real example, dental products for long-term oral use: Zirconia dental products intended for long-term oral use were already assessed based on their contact with the oral environment; mucosal/oral tissue exposure. Under ISO 10993-1:2025, this categorization remained appropriate, but the standard now describes the logic more clearly. The work was less about changing categories and more about confirming that contact type, exposure duration, and biological endpoints were still correctly justified.

The practical impact on the Biological Evaluation Plan (BEP) was limited in this case, but the documentation requirements became stricter. Manufacturers now need to explicitly justify why the selected contact category is correct and why the biological endpoints included in the evaluation are appropriate.

4. Biological Evaluation Plan (BEP) is Now Mandatory, Not Optional

The BEP has always existed in ISO 10993 standards, but ISO 10993-1:2025 elevates it to mandatory status with clearer expectations.

The BEP defines your evaluation strategy; which risks are relevant, how you will assess each, what data you will use, and what conclusions you will draw. It is your roadmap before you spend money on testing or documentation.

Many manufacturers skip or minimize the BEP, treating it as bureaucratic overhead. This is a mistake. A well-developed BEP prevents costly rework. It clarifies expectations with regulators before submission. It demonstrates thinking, not just activity.

ISO 10993-1:2025 expects the BEP to cover;

Device and material description
Contact assessment (type, duration, exposure)
Biological hazard identification
Information gathering strategy (what data already exists, what is needed)
Chemical characterization plan
Biological testing strategy (and justification for why this strategy is appropriate)
Risk assessment approach

The BEP should be part of your design and development plan, demonstrating integration with design controls. It is a living document that evolves with your device, not a static compliance box.

5. Exposure Duration Calculated as Contact Days; Not as Continuous Hours

ISO 10993-1:2025 introduces a more clinically relevant way of assessing exposure using “contact day” logic.

Previously, manufacturers sometimes added together seconds or minutes of multiple exposures to calculate total contact duration. The new standard clarifies that any exposure counts as a minimum of one day. Two exposures means at least two days of contact, even if they total only minutes.

This matters because contact duration category affects which biological endpoints you need to address. It is not that ISO 10993-1:2025 changed the biological science; it is that it clarified how real-world use should be assessed.

Example: A bandage used for 24 hours, removed, and then reapplied for another 24 hours.

Old approach: Could be calculated as 48 hours continuous contact
New approach: Two separate days of contact (potentially affecting duration category)

For reusable devices or those with intermittent use, this shift can significantly influence the overall risk profile and the biological evaluation strategy.

6. Reasonably Foreseeable Misuse Must Be Evaluated in the Biological Assessment

ISO 10993-1:2025 explicitly requires consideration of reasonably foreseeable misuse; use of the device in a way not intended by the manufacturer, but in ways that can reasonably be expected based on known behavior, post-market data, or clinical literature.

This is not entirely new; it was already part of overall risk management philosophy. But ISO 10993-1:2025 makes it explicit within biological evaluation.

Example; A wound dressing intended for 24 hours of use: It is reasonably foreseeable that a patient might leave it on longer. The manufacturer should assess whether that extended exposure changes the biological risk. Does the adhesive degrade? Does moisture accumulation increase risk? Does the duration move the device into a different contact category?

This does not automatically mean additional testing is needed. But it must be justified in the BEP and BER (Biological Evaluation Report). The manufacturer must demonstrate that either (a) the extended use does not materially change risk, or (b) the biological evaluation already accounts for the extended use scenario.

7. ISO 14971 Risk Management Framework Integration, Biological Evaluation is No Longer Separate

Biological evaluation is no longer separate from overall device risk management.

ISO 10993-1:2025 aligns biological evaluation directly with ISO 14971 (risk management), adopting its structure, terminology, and logic. This means biological hazards and risks must be identified, assessed, and controlled within your comprehensive risk management framework; not in isolation.

8. Device Lifecycle Thinking, Biological Assessment Continues Beyond Launch

Biological safety is no longer assessed at a single point in time. It must be considered across the entire lifecycle of the device, including material selection, manufacturing, transport, storage, clinical use (including reuse or reprocessing), and end-of-life considerations.

Changes at any of these stages can influence biological safety and should be evaluated within the overall risk management framework.

The Real Impact: Gap Assessment Case Study for ISO 10993-1:2025 Compliance

Theory is one thing, implementation is another, here is what gap assessment looks like in practice.

A Real Case Study to illustrate ISO 10993-1:2025 Compliance

Zirconia Dental Products for Long-Term Oral Contact

The team at MDx CRO recently worked with a manufacturer of zirconia dental products intended for long-term oral contact who faced the question
every manufacturer now faces; “Does our existing biological evaluation meet ISO 10993-1:2025 expectations?” This real-world case exemplifies the practical challenges manufacturers encounter.

The challenge was not philosophical; it was practical; ensuring that the new requirements and expectations introduced by the 2025 revision were correctly interpreted and fully addressed, while making sure no relevant gap was omitted and that existing evidence was sufficient to justify that no additional testing was required.

The approach: Structured gap assessment

Rather than assume, the organization performed a systematic review against ISO 10993-1:2025;

Intended Use; Confirmed the stated purpose, contact type, and exposure duration under the new “contact day” logic.
Material Composition and Manufacturing; Reviewed material specifications, manufacturing process documentation, and any relevant chemical characterization data.
Existing Biological Data; Cataloged all available biological testing results, literature references, and historical evidence.
Contact Assessment; Confirmed whether the device contacts intact skin, mucosal surfaces, internal tissues, or blood, and verified duration categorization.
Endpoint Assessment; For each biological endpoint relevant to the contact category, assessed whether it was;
- Already covered by existing data
- Covered but requiring stronger rationale
- Missing and requiring additional information
Risk Management Integration; Confirmed that biological evaluation was integrated with overall device risk management (ISO 14971).

The outcome

No additional testing was required. But the biological evaluation file was updated to strengthen rationale where needed, to address the new expectations around chemical characterization, and to clearly document how each biological endpoint was justified.

The real value is clarity. The manufacturer moved from “we think we are compliant” to “here is exactly why we are compliant, and here are the gaps we identified (and why they do not require action).”

Why this matters?

This case exemplifies what regulators expect under ISO 10993-1:2025. They want to see thinking, structure, and scientific reasoning; not just test reports. A manufacturer who invests in proper gap assessment demonstrates both competence and transparency.

The Most Common Mistakes About ISO 10993-1:2025 Implementation (and How to Avoid Them)

Implementation is new, but patterns are already emerging. Here are the mistakes manufacturers are making; and how to avoid them.

Mistake #1. Continuing to Think “Testing Checklist” Instead of “Risk Assessment”

The mistake; Starting with the question “Which tests do we need?” and working backward from there.

Why it happens; The old matrix-based approach made this feel objective and safe. Changing thinking takes time.

The fix; Start with the device, its materials, its intended use, and its actual biological risks. Let the risk assessment drive decisions about what evidence is needed. Testing becomes one tool among many, not the default answer.

Mistake #2. Ignoring Chemical Characterization Data in the Planning Phase

The mistake; Relegating chemical data to a supporting role instead of elevating it to decision-making status.

Why it happens; Historically, biological testing seemed more “rigorous” than chemistry. Many organizations lack in-house chemical expertise.

The fix; Invest in chemical characterization data upfront. Extractables/leachables analysis, material composition review, and toxicological assessment should inform your biological evaluation strategy from day one.

Mistake #3. Treating Gap Assessment as an Optional Compliance Step

The mistake; Assuming that a 2018 biological evaluation automatically “passes” under 2025 expectations without systematic review.

Why it happens; Gap assessment requires time and expertise. It is tempting to skip it and hope for the best.

The fix; Conduct a structured comparison of your existing documentation against ISO 10993-1:2025 expectations. Identify what is already covered, what needs stronger rationale, and what is genuinely missing. This investment prevents costly surprises later.

Mistake #4. Not Integrating Biological Evaluation into Overall Risk Management

The mistake; Treating biological evaluation as a standalone compliance exercise rather than as part of ISO 14971 risk management.

Why it happens; Different teams, different timelines, different reporting structures.

The fix; Ensure that biological hazards and risks are identified, assessed, and controlled within your overall risk management framework. Biological evaluation is not separate; it is integrated.

Implementing ISO 10993-1:2025, A Practical Roadmap for Device Manufacturers

Implementation varies depending on whether you are managing existing devices or developing new ones.

For Existing Devices: The Gap Assessment Path

Step 1: Gap Assessment (Weeks 1-4)

Conduct a structured review of existing biological evaluation documentation against ISO 10993-1:2025 expectations. Identify gaps, prioritize, and classify each as;

Already adequately covered
Covered but requiring stronger rationale
Missing (requiring new information or testing)

Step 2; Update BEP/BER (Weeks 4-8)

Revise biological evaluation documentation to reflect new standard expectations. Strengthen rationale where needed. Document decisions clearly.

Step 3; Regulatory Alignment (Weeks 8+)

If necessary, discuss findings with notified bodies or regulatory contacts. Most manufacturers find that proper gap assessment and documentation update are sufficient; additional testing is often not required.

Timeline; 8-12 weeks for most devices, depending on complexity and existing documentation quality.

Resource needs; In-house expertise or external partner with ISO 10993-1:2025 knowledge and gap assessment experience.

For New Devices; Plan from Design Phase Forward

Step 1: BEP Development (Design Phase)

Develop the biological evaluation plan as part of your design and development plan. Define contact category, exposure duration, relevant biological endpoints, and evaluation strategy before design lock.

Step 2: Material Selection with Chemical Information in Mind

Select materials based not just on performance but on understanding chemical composition, extractables, and potential toxicological risk. This informs your testing strategy.

Step 3: Chemical Characterization Planning (Development Phase)

Conduct extractables/leachables studies and toxicological assessment in parallel with design development, not after.

Step 4: Risk-Based Testing Strategy

Determine which biological tests (if any) are necessary based on chemical data and risk assessment. Avoid reflexive testing; justify each test against identified risks.

Step 5: BER Documentation

Upon completion, compile biological evaluation report demonstrating how each identified risk was addressed and why the device is biologically safe.

Timeline: Integrated into normal device development; no additional timeline required if planned properly.

Resource needs: Access to biological evaluation expertise early in development.

Key Deliverables: BEP and BER

Biological Evaluation Plan (BEP):

Device description and intended use
Contact assessment (type, duration)
Material composition and chemical characterization strategy
Biological hazard identification
Information gathering and testing strategy
Expected outcomes and decision criteria

Biological Evaluation Report (BER):

Executive summary of findings and conclusions
Device and material description
Contact assessment
Chemical characterization results
Toxicological risk assessment
Biological test results (where conducted)
Literature review
Overall risk evaluation
Safety conclusion with scientific justification

Both documents must demonstrate traceability; every claim must be supported by evidence or clear scientific reasoning.

Regulatory Alignment EU and FDA Approaches to ISO 10993-1:2025

EU perspective; The Medical Device Regulation (MDR) recognizes ISO 10993-1:2025 as state-of-the-art. Notified bodies are already aligning with the 2025 revision. Manufacturers seeking CE marking should plan for ISO 10993-1:2025 compliance.

FDA perspective; The FDA has not yet formally recognized ISO 10993-1:2025 in its official database of recognized consensus standards. However, FDA’s draft guidance on “Chemical Analysis for Biocompatibility Assessment” (published September 2024) aligns with the risk-based, chemistry-forward approach of the 2025 standard. FDA recognition is expected, but timelines are typically 12-24 months behind EU adoption.

For manufacturers in both markets; Plan for ISO 10993-1:2025 compliance. The scientific approach aligns across both regions. No major friction is expected between EU and FDA interpretations; the main difference will be adoption timeline.

Why ISO 10993-1:2025 Matters Beyond Compliance and Testing Requirements

The shift to risk-based biological evaluation is not just regulatory; it is patient-centric.

Patient Safety; A more rigorous risk assessment process, grounded in materials science and clinical understanding, identifies and controls biological risks more effectively than checklist compliance.

Animal Welfare; Smart chemical characterization means fewer animals used in testing. By using data-driven approaches to inform testing decisions, manufacturers can justify reduced animal use without compromising safety.

Business Case; Proper planning reduces rework, prevents unnecessary testing, and accelerates time to market. Manufacturers who invest in structured biological evaluation planning see faster regulatory approval and lower development costs.

Regulatory Confidence; Risk-based, scientifically justified evidence carries more weight than checkbox compliance. When you present a regulator with clear thinking and evidence, approval is more straightforward.

When to Bring in Expert Support for ISO 10993-1:2025 Compliance

ISO 10993-1:2025 implementation is manageable with the right expertise. Here are the signs you might benefit from external guidance.

Red flags that expert support would help;

You are unsure about your device’s contact category under the new standard
Your chemical characterization data is incomplete or unclear
Performing gap assessment feels overwhelming given your internal resources
Your timeline is tight and you cannot afford delays
You have received preliminary feedback from regulators and need guidance on responding

What expert guidance typically includes;

Gap assessment and recommendations
BEP/BER review and strengthening
Risk strategy development
Regulatory interaction support
Timeline and resource planning

The right partner brings three things; deep ISO 10993-1:2025 knowledge, regulatory experience, and practical understanding of device development. They help you avoid the expensive mistakes while accelerating toward approval.

Gap Assessment Checklist

To support your ISO 10993-1:2025 compliance review, we have created a detailed gap assessment checklist that walks you through each requirement step-by-step.

This checklist includes;

15-20 assessment questions
Scoring rubric (Low Risk / Medium Risk / High Risk)
Next steps based on your assessment results
Regulatory alignment guidance

Access the Gap Assessment Checklist

ISO 10993-1:2025 is not a burden; it is clarity.

For decades, the testing matrix provided a false sense of objectivity. Manufacturers could follow the rules and feel confident. ISO 10993-1:2025 removes that illusion and demands something better; thinking.

The shift from “checklist mentality” to “risk-based assessment” reflects a mature understanding of what biocompatibility truly means. It is not about running a certain number of tests. It is about demonstrating, through structured evaluation and scientific reasoning, that a device is safe for its intended use.

Manufacturers who embrace this shift early will see benefits;

More efficient biological evaluation
Faster regulatory approval
Better patient safety outcomes
Reduced unnecessary animal testing

The standard is new, but the direction is clear. Whether you are managing existing devices or developing new ones, the time to act is now. Early implementation positions you ahead of competitors and demonstrates commitment to robust biological safety.

If your organization is ready to align with ISO 10993-1:2025, a structured gap assessment and risk-based biological evaluation strategy is the starting point. That is where clarity begins.

DISCUSS YOUR BIOLOGICAL EVALUATION STRATEGY WITH OUR TEAM

Written by:

Diego Rodriguez Muñoz

Diego is a PhD researcher and Clinical Regulatory Associate at MDx CRO. With a strong foundation in Molecular Bioscience and immunology from the Universidad Autónoma de Madrid, he now focuses his insights on the EU AI Act. Diego is passionate about exploring how emerging AI regulations will shape the future of clinical research and healthcare technology, blending his scientific training with a keen interest in modern tech policy.

View all articles →

Industry Insights & Regulatory Updates

FDA Regulation of In Vitro Diagnostic Devices: The Complete Guide for US Market Entry

FDA Companion Diagnostics: A Complete Regulatory Guide to CDx Development, Approval, and Co-Development Strategy

Making IVDR Work in Combined Studies: Scientific & Operational Lessons from 40+ Programs

ISO 14155:2026 What’s Changed and What It Means for Your Clinical Investigation

Portugal’s New Clinical Trials Law No. 9/2026: What Sponsors Need to Know

Making IVDR Work in Combined Studies: Scientific & Operational Lessons from 40+ Programs

Written by Carlos Galamba Published on 13.04.2026 Last updated on 15.07.2026

April 13, 2026

Combined studies, clinical trials that simultaneously investigate a medicinal product and an IVD under both the Clinical Trials Regulation (CTR) and the IVDR, are among the most complex regulatory challenges in precision medicine today. The lack of a coordinated EU assessment means sponsors face separate national submissions, divergent NCA interpretations, and timelines that can stretch 6-12 months beyond what was planned.

Last week, I presented at the 16th Clinical Biomarkers & Companion Diagnostics Summit Europe in London, sharing data and lessons from over 40 combined programs that MDx CRO has managed across 20+ EU countries. This article distils the key findings from that presentation: what triggers IVDR performance study requirements, why the same protocol can get three different answers from three NCAs, the top RFIs we see across programs, and how the regulatory landscape is evolving with MDCG 2025-5 and the December 2025 Health Services Pack.

Whether you are a pharmaceutical sponsor planning your first combined study, or a regulatory affairs professional navigating the dual-track CTR/IVDR submission process, this article gives you the operational intelligence that no guidance document provides.

Want the full CDx presentation slides?

Download the complete deck with case studies, the PSA approval timeline map, and the wave planning framework below.

Free download, presented at the 16th Clinical Biomarkers & CDx Summit Europe, London, March 2026

The Combined Studies Bottleneck: Why This Matters Now

The numbers tell the story. According to the EU COMBINE Analysis Report 2024, there were 402 combined study applications across the EU, of which 343 were CTR/IVDR combinations, and 86% of those were multinational. The mean approval time was 137 days, but the range was enormous: 45 to 267 days depending on the country, the submission pathway, and the quality of the initial dossier.

The root cause is structural. There is no coordinated IVDR assessment across Member States. Each country evaluates the performance study component independently, using national portals, national forms, and critically, national interpretations of the same regulation. For sponsors running multinational oncology trials with a companion diagnostic, this means multiplicative complexity: every additional country adds not just a submission, but a potentially different regulatory conclusion about whether a Performance Study Application (PSA) is even required.

And the volume is growing. Industry estimates project over 3,000 IVD submissions expected by 2029 as more CDx-driven oncology programs reach the EU. The system is already under strain.

This is the environment in which every combined study sponsor now operates. The question is not whether you will encounter divergent NCA opinions, it is how you prepare for them.

Same protocol, same device, three different answers.

The case presented at CDx Europe involved a pharmaceutical sponsor planning a multinational Phase 1b/2 oncology trial across France, Germany, and Spain. The study used a CE-marked companion diagnostic to run central testing retrospectively on leftover tumour samples, after enrolment was complete, purely as exploratory biomarker analysis. No additional invasive procedures. No impact on protocol-mandated treatment decisions. The sponsor sought pre-submission advice from three Member State competent authorities, presenting the same protocol and the same scientific rationale to each.

The three responses were incompatible.

NCA 1 concluded that no PSA was required, it accepted the sponsor’s argument that the activity was purely exploratory and non-interventional.

NCA 2 took the opposite position: because the assay was being used outside the scope of its CE-marked intended purpose, and because discrepant results would be communicated to investigators who could potentially act on them, it classified the study as interventional and required full PSA authorisation.

NCA 3 had not issued a definitive answer within the consultation period. This authority lacks a formal structured consultation procedure for performance studies and typically responds by email without fixed timelines.

When we presented this at the conference, there was an audible reaction in the room. Several attendees nodded immediately, this clearly resonated with their own experience. The most revealing question came from a regulatory affairs director at a mid-size pharmaceutical company who asked: “If the strictest authority changes its mind on appeal and agrees with the others, do we then need to explain to the permissive authority why we did something they told us we didn’t need to do?”

That question captures the operational absurdity of the current system perfectly. Sponsors are caught between harmonising upward, following the strictest requirement everywhere, which creates unnecessary burden in permissive jurisdictions, and harmonising downward, which creates compliance risk in the strictest one.

How Was It Resolved?

No harmonised consensus was reached between the three authorities. The sponsor appealed to the strictest authority in late 2025, providing additional justification and citing the fact that the most permissive authority had accepted the same protocol without any submission. By early 2026, the sponsor was cautiously optimistic that the appeal would succeed.

In parallel, they prepared contingency documentation for a dual-track approach: a full PSA in the country requiring it, a Performance Study Notification (PSN) in the country where the outcome remained uncertain, and no submission in the country that had cleared the protocol outright. Each country would effectively follow its own regulatory requirement.

Timeline impact: The divergent opinions introduced approximately 4–6 months of delay to the diagnostic component of the trial, encompassing multiple pre-submission consultation rounds, country-specific dossier preparation, appeal proceedings, and the need to compile and translate Annex XIV documentation for each jurisdiction independently.

There is currently no formal escalation or conflict-resolution pathway for performance study assessments. This is precisely the structural gap the COMBINE programme’s coordinated assessment pilot is intended to address.

What Triggers IVDR Performance Study Requirements?

Understanding the regulatory pathways is critical for any combined study. The IVDR establishes three routes, and the distinction between them determines everything: your timeline, your documentation burden, and whether your study can start at all.

Article 58.1 Authorisation Required

This applies to non-CE-marked devices or devices used outside their intended purpose. The process involves a 25-day validation phase followed by a 45-day review. You need full PSA authorisation when the study involves surgically invasive sample-taking for study purposes only, when it is an interventional clinical performance study, or when there are additional invasive procedures or risks beyond standard care.

Article 58.2 Notification Pathway

This applies to companion diagnostics using leftover samples only, where results do not influence treatment during the trial. The pathway is immediate or NCA-dependent after validation, depending on the Member State.

Article 70 CE-Marked Devices

This is a 30-day notification route for CE-marked devices used within their intended purpose but involving additional invasive or burdensome procedures beyond normal use. A critical nuance: if a CE-marked IVD is studied outside its intended purpose, the Article 70 notification route does not apply, it must be assessed under Article 58 instead.

The Key Decision Factors

From our experience across 40+ combined programs, the questions that determine which pathway applies and where NCAs diverge, are consistent:

CE mark status: for the specific trial use (intended purpose) not just whether the device has a CE mark, but whether the trial use falls within the marked scope
Whether results impact medical management: this is the most contested threshold, as “interventional” in the IVDR context carries a different meaning from “interventional” in clinical trial legislation
Study design: interventional vs observational
Sample type: fresh vs leftover, and the level of invasiveness required to collect them
Risk profile: additional procedures vs standard care
Whether device endpoints are clearly distinguished: from drug endpoints

Top 12 RFIs From 40+ Combined Programs

This is the data MDCG guidance documents do not provide. Over 40 combined programs, these are the most frequent Requests for Information (RFIs) we have received from NCAs and Ethics Committees across Europe:

1. Insufficient analytical validation (GSPR 9.1a). The test is a clinical trial assay, prototype, or lab-developed test (LDT) and was not developed under full design control. This may be accepted in US early-phase trials but is a common reason for rejection in the EU.

2. Insufficient data supporting the chosen cut-off. A small number of samples were used for cut-off validation. NCAs expect robust, data-driven rationales, not theoretical arguments.

3. Lacking or vague definitions of primary endpoints related to IVD performance, and the absence of a statistical analysis plan for the device component.

4. Informed Consent Form (ICF) lacks performance study-specific content. This is extremely common in combined CT/PS ICFs. Authorities regularly request revision in lay-user language that clearly distinguishes participation in the drug trial from participation in the diagnostic study.

5. Inconsistent objectives between the clinical trial application and performance study documentation. When the CPSP says one thing and the CTA says another, expect an RFI.

6. Incomplete risk plans and reports, with insufficient evaluation in the Investigator’s Brochure of how inaccurate test results could impact the clinical trial, especially for high-toxicity therapies.

7. Investigator and site documentation lacking PS references, required translations, or country-specific insurance certificates.

8. Lack of consideration towards monitoring the IVD study under ISO 20916, especially in sponsor-CRO or multicentre settings.

9. Divergent views between Ethics Committees and NCAs on risk, burden, or benefit, sometimes within the same country.

10. Use of leftover samples for future research without clear documentation on traceability, consent, or ethical approval.

11. Safety monitoring procedures in the CPSP not aligned with IVDR Article 74 and MDCG 2024-4.

12. Scientific inaccuracies in the CPSP, IB, and technical documentation, simple errors that erode credibility and trigger additional scrutiny.

What “Device-Specific Endpoints” Actually Means

One of the most common mistakes we see in combined studies is sponsors relying solely on drug efficacy endpoints (ORR, PFS, OS) as evidence of IVD performance. Under the IVDR and MDCG 2025-5, performance studies must generate data that establish or confirm device performance, not drug performance.

Analytical Endpoints (Often Used in Phase 1/2 Studies)

These include reportable rate, invalid-result rate, repeat-test rate, and assay failure rate; precision and reproducibility in the clinical setting; and accuracy at clinically relevant cut-offs.

Clinical Endpoints (CDx-Type, Often Used in Phase 3 and Bridging)

These include concordance with a clinically valid reference assay (PPA, NPA, OPA); diagnostic sensitivity and specificity vs clinical status; clinical outcomes studies in the IVD-selected group linked to drug endpoints; and clinical bridging studies.

What Is Not Sufficient as a Sole Endpoint

Turnaround time alone, and drug efficacy endpoints (ORR, PFS, OS) without device-specific performance measures.

Case Study: From Rejection to 8-Country Approval

One of the programs presented in detail involved an NGS-based CDx used to detect a specific mutation for targeted therapy patient eligibility in a rare tumour indication. It was a Phase 3 global trial with an interventional combined performance study across 30+ EU sites.

The Initial Rejection

The first EU submission was rejected. The reasons were typical of what we see repeatedly:

Incomplete analytical performance data vs GSPR 9.1(a) at the mutation cut-off
Weak linkage between biomarker, clinical condition, and treatment, a scientific validity gap
Under-developed risk management for false negatives in a high-toxicity therapy

What We Did

MDx CRO conducted a full gap analysis and remediation covering the Scientific Validity Report (SVR), Analytical Performance Report (APR), CPSP, and risk file versus Annex XIII requirements. We rewrote the CPSP with device-specific treatment-decision endpoints, strengthened the analytical data at the decision threshold, and quantified the false-negative impact in the risk management file.

The Outcome

Harmonised resubmission to 8 Member States. All RFIs resolved. Approvals in all 8 countries, within 4 months.

This case illustrates a pattern we see consistently: the initial submission fails not because the science is weak, but because the documentation does not speak the language the NCAs expect. The same data, presented differently, achieves a completely different result.

The Most Costly Mistake Sponsors Make

The single most expensive mistake we have seen sponsors make in the IVDR portion of a combined study is treating the performance study application as an afterthought, something to be “bolted on” after the clinical trial application is already in motion.

In one program, the sponsor had not engaged with IVDR requirements until approximately three months before planned first-patient-in. At that point they discovered that a PSA was required in multiple Member States, that documentation requirements were not harmonised across those countries, and that each required different local forms, different ethics committee interactions, and in some cases certified translations.

The result was a nine-month delay to the European portion of the trial and an estimated additional cost in the range of €800,000-€1.2 million when accounting for CRO renegotiation, site re-engagement fees, amended contracts, and the opportunity cost of delayed clinical data.

This is not an outlier. Industry survey data shows that a significant proportion of sponsors experience 6–12 months of IVDR-related delay in combined programs, with some reporting delays beyond 12 months. The structural cause is always the same: the pharmaceutical team and the diagnostics team are operating on disconnected timelines, and the IVDR submission is not integrated into the master trial timeline from the outset.

Wave Planning: The Operational Playbook

Not all EU Member States are equal when it comes to combined study submissions. One of the practical tools shared at the conference was our wave planning approach, a strategic framework for sequencing country activations based on regulatory architecture, not just commercial priority.

Wave 1: Speed, Parallel/Combined Processes

Spain offers parallel review, with submission to both AEMPS via the portal and the Ethics Committee (usually via email). Total timeline: approximately 85 days.

Belgium uses a consolidated review via CESP where the NCA and EC coordinate and issue a single opinion. Timeline: approximately 60 days.

These are faster because the EC and NCA review simultaneously, not sequentially.

Wave 2: Sequential Requirements

Germany, Austria, and Hungary all require EC approval first, followed by NCA submission. This adds the full EC timeline (46–166 days) before the NCA clock even starts. Total timelines: 135–267 days.

Wave 3: Administrative Complexity

Bulgaria requires notarised and apostilled Powers of Attorney, sworn translations, and physical courier submissions.

Poland requires paper copy submissions to both the EC and NCA, including wet-ink signed site documents, sworn translations, and stricter requirements demonstrating the Sponsor’s business registration and Power of Attorney.

Ireland has non-harmonised reviewers, causing inconsistent RFI rounds.

Why Wave Planning Matters

Typically, it is strategic to avoid submitting to high-administrative-burden countries in Wave 1. For example, Poland necessitates that the entire submission package is delivered to the EC and NCA via courier in printed form with wet-ink signatures. It is more efficient to submit first to countries with accessible pathways so that feedback from RFIs and lessons learned can be incorporated from the start for the more labour-intensive submissions.

The strategy: stagger activation by submission architecture and administrative burden, not just by regulator consolidation.

Illustration of European map showing estimated PSA approval timelines and submission complexities for MedTech products in the context of IVDR compliance. — Visual overview of European regions highlighting approval timelines and submission challenges for MedTech companies navigating IVDR requirements in combined studies.

How MDCG 2025-5 Is Changing the Landscape

MDCG 2025-5, published in June 2025, is the first dedicated Q&A guidance specifically addressing IVDR performance studies comprehensively. It covers 54 questions across topics that sponsors and NCAs have been debating since 2022, including:

A regulatory pathway decision tree (Appendix I) providing a structured framework for determining whether a planned activity requires a PSA, a PSN, or no submission at all
Clarification that “interventional” in the IVDR context meaning the results may influence patient management carries a different meaning from “interventional” as used in clinical trial legislation. This conflation has caused significant confusion
A working definition of “leftover samples” and the conditions under which they trigger notification rather than full application requirements
Guidance on combined studies including sponsor responsibilities, substantial modification handling across both the CTR and IVDR pathways, and the role of the performance study investigator

Are NCAs Following It?

Partially, and unevenly. Some authorities have begun aligning their pre-submission guidance with the decision-tree logic. Others continue applying their own interpretations, particularly on the definition of “interventional” which remains the most contested threshold.

The guidance is explicitly non-binding: MDCG 2025-5 itself states it cannot be regarded as reflecting the official position of the European Commission and that only the Court of Justice of the EU can give binding interpretations. In practice, guidance adoption across Member States typically lags publication by 12–18 months before a clear majority are operating consistently with it.

The Health Services Pack and the Biotech Act: Will It Actually Simplify Combined Studies?

In December 2025, the European Commission proposed two complementary pieces of legislation as part of a broader health services package. The first is a targeted revision of the MDR and IVDR, aimed at simplifying the existing regulatory framework. The second is the Biotech Act, which proposes amendments to the Clinical Trials Regulation that are directly relevant to combined studies.

What the Biotech Act Changes for Combined Studies

This is the more consequential development. The Biotech Act explicitly introduces a single integrated application for combined studies. Under the current framework, sponsors must seek authorisation of the clinical trial under the CTR and the performance study under the IVDR entirely independently separate portals, separate assessments, separate timelines, separate Member State interactions.

The Biotech Act proposes to eliminate that dual-track requirement. Instead, the sponsor would submit a single application covering both the investigational medicine and the IVD through a combined authorisation process managed under the CTR. That assessment would be led and coordinated by a Reporting Member State (RMS), with coordinated approvals across participating countries.

The proposal also accelerates CTR timelines generally, reducing the multinational CTA review from 106 days to 75 days, and as low as 47 days when no information request is issued.

My Assessment

This is not wishful thinking for the first time, there is a concrete legislative mechanism on the table that directly addresses the structural root cause of combined study delays. If adopted as proposed, it would be a genuine step-change.

However, three cautionary notes:

Legislative timeline. Even with political priority, realistic adoption and implementation timelines are 18–24 months from proposal. Do not expect sponsors to be able to use the single-application pathway before late 2027 at the earliest.

Implementation gap. CTIS will need to be updated to accept performance study documentation alongside the CTA, and Member State competent authorities will need to build assessment capacity for the IVD components within their CTR review teams.

The COMBINE pilot is the bridge. The COMBINE programme’s Project 1 pilot, launched on 13 June 2025, is already testing an “all-in-one” coordinated assessment approach. Sponsors who participate now are effectively rehearsing for the future framework.

The December 2025 package does have the potential to fundamentally simplify combined studies. But sponsors working in 2026 are still operating under the current framework. The practical advice remains: use the COMBINE pilot if you can, plan for Member State divergence if you can’t, and build your combined study submission strategy on the assumption that the current dual-track system will be in place until at least late 2027.

The #1 Mistake Sponsors Make in Their First Combined Study

They assume the IVDR performance study is the diagnostic manufacturer’s problem, not theirs.

The pharmaceutical sponsor designs the trial, defines the biomarker strategy, selects the assay, and writes the protocol. But when the conversation turns to the IVDR submission, they expect their diagnostic partner to handle it independently.

The reality is that under Article 2(57) of the IVDR, the “sponsor” is whichever entity takes responsibility for the initiation, management, and financing of the performance study and in a combined study, particularly in early-phase trials, that is often the pharmaceutical company itself.

This disconnect produces predictable failures:

The drug application is submitted through CTIS months before the PSA is even drafted
The diagnostic partner lacks access to the clinical trial protocol, site-level information, and country-specific documentation needed to complete the Annex XIV dossier
When an NCA issues an RFI at the interface between the two applications, neither team owns the response

MDCG 2022-10 is explicit: the clinical trial sponsor is responsible for overall compliance of products used in the trial, including the IVDR. Where a sponsor uses a CE-marked IVD outside its intended purpose, it assumes manufacturer responsibilities under Article 16(1).

The fix is straightforward: from Day 1 of trial design, the PSA workstream sits inside the integrated trial timeline, with a named owner, shared document management, and joint governance between pharmaceutical and diagnostics teams. Sponsors who do this avoid most problems. Sponsors who don’t are the ones calling us nine months before database lock.

How Much Time Does Expert Guidance Save?

Based on our experience across 40+ combined programs, working with a CRO that has specific IVDR and IVD regulatory expertise saves an average of 3 to 5 months compared to in-house teams or generalist CROs approaching combined studies for the first time.

The savings accumulate in three areas:

Pre-submission strategy (4–6 weeks saved). A specialist knows which Member States to sequence in Wave 1, what each authority actually expects beyond the statutory minimum, and which borderline classification questions need to be resolved before any dossier is submitted. Preventing a single misclassification avoids months of remediation.

Documentation preparation (4–8 weeks saved). Generalist CROs frequently prepare a single PSA dossier and submit it identically across all Member States. A specialist prepares country-adapted packages from the outset correct local forms, country-specific ethics committee requirements, certified translations, and portal-specific submission formats.

RFI management (2–4 weeks saved). When an NCA issues a request for information, a specialist drafts a response that also anticipates how the same question may be raised by other authorities whose reviews are still in progress preventing cascading delays across the wave.

Five Steps to De-Risk Your Next Combined Study

Based on the patterns from 40+ programs, these are the five actions that make the biggest difference:

1. Science first: do not underestimate analytical validation data. Analytical data should be traceable and robust, particularly around the cut-off. The APR and IB should be readable as standalone documents NCAs assess them that way.

2. Decide stakeholder ownership early. Sponsor vs Dx partner vs CRO for both the CTR and IVDR pathways. Ambiguous ownership is the single biggest source of delay.

3. Design device-specific endpoints upfront. Analytical and/or clinical, not just drug efficacy. If your performance study plan only lists ORR as an endpoint, expect a rejection.

4. Build the Annex XIII/XIV package early. SVR, APR, CPSP, risk management, GSPR logic evaluate internal capabilities and gaps before the submission clock starts.

5. Use structured tools for multi-country variation. Don’t rely on memory or email threads. Robust study design combined with an informed country strategy is what separates 60-day approvals from 267-day ones.

Looking Ahead: 2026–2027

From our experience, it will get slightly worse before it gets meaningfully better with the inflection point likely in late 2026 to early 2027.

The short-term pressure comes from volume. More sponsors are now aware of IVDR performance study requirements, which means more submissions entering the system. NCA capacity has not grown proportionally. Several smaller Member States still lack dedicated performance study reviewers.

The medium-term improvement will come from three converging developments: MDCG 2025-5 gradually reducing classification disputes, the COMBINE programme’s coordinated assessment pilot producing procedural lessons by mid-2026, and the December 2025 legislative revision proposal delivering structural changes by late 2027.

The biggest variable remains NCA behaviour. Regulatory guidance adoption is uneven and slow. It typically takes 12–18 months from MDCG publication before a clear majority of authorities are operating consistently with it.

For sponsors planning programs in 2026, the practical reality has not changed: plan for divergence between Member States, budget for country-specific regulatory strategies, engage the IVDR workstream at trial design not after the CTR is submitted and do not assume that what worked in one country will work in the next.

Download the Full Presentation

This article is based on my presentation at the 16th Clinical Biomarkers & Companion Diagnostics Summit Europe in London (March 30, April 1, 2026). The full slide deck includes additional data, the PSA approval timeline map across EU Member States, and detailed case studies that could not be covered in article format.

Need Help With Your Combined Study?

MDx CRO has managed 40+ combined programs across 20+ countries with a 100% approval rate and 90+ performance study submissions in the EU27. Our fastest program went from kick-off to full IVD Study Package Development and submission in 4 weeks.

If you are planning a combined study under the CTR and IVDR, talk to our team about how we can accelerate your path to first patient tested.

Frequently Asked Questions about IVDR Combined Studies

What triggers IVDR performance study requirements in a combined study?

IVDR performance study requirements are triggered through three pathways. Article 58.1 requires authorisation for non-CE-marked devices or devices used outside their intended purpose. Article 58.2 requires notification for companion diagnostics that use leftover samples only. Article 70 requires notification for CE-marked devices that involve additional burdensome procedures. Key decision factors include CE mark status for the specific trial use, whether results affect medical management, the study design, the sample type, and the risk profile.

How long does IVDR performance study approval take in a combined study?

Approval timelines vary by Member State. The EU COMBINE Analysis Report 2024 shows an average of 137 days, with a range of 45–267 days. Countries with parallel ethics committee and national authority review, such as Spain (~85 days) and Belgium (~60 days), are faster than those with sequential review, such as Germany, Austria, and Hungary (135–267 days).

What are the most common RFIs in IVDR combined studies?

Based on data from more than 40 combined programs, the most common RFIs include insufficient analytical validation under GSPR 9.1(a), insufficient data supporting the selected cut-off, missing device-specific endpoints in the CPSP, informed consent forms lacking performance study-specific content, and inconsistent objectives between the clinical trial application and performance study documentation.

What changed with MDCG 2025-5 for IVDR performance studies?

MDCG 2025-5, published in June 2025, is the first comprehensive Q&A guidance for IVDR performance studies. It introduces a regulatory pathway decision tree, clarifies that “interventional” in the IVDR context differs from the CTR definition, defines “leftover samples,” and addresses sponsor responsibilities in combined studies. Adoption by national authorities is uneven, and full alignment is expected within 12–18 months.

Will the December 2025 Health Services Pack simplify combined studies?

The Biotech Act proposed in December 2025 introduces a single integrated application for combined studies under the CTR framework. If adopted, it would remove the need for dual CTR and IVDR submissions. Realistic implementation is not expected before late 2027. The COMBINE programme pilot is currently testing coordinated assessment as a bridge to the future framework.

Written by:

Carlos Galamba

With more than 18 years of experience in the IVD sector, including hands-on work as a scientist in transfusion medicine and infectious disease diagnostics, and regulatory review experience at BSI, one of the EU's largest Notified Bodies, Carlos Galamba brings a uniquely integrated perspective to IVD regulatory strategy. Their work spans Class C/D IVDs, companion diagnostics, NGS-based assays, and software-based IVDs, with a current advisory role to the European Commission on regulatory matters. At MDx CRO, they lead regulatory strategy for complex IVD programs across EU IVDR, FDA, and global markets.

View all articles →

Industry Insights & Regulatory Updates

FDA Regulation of In Vitro Diagnostic Devices: The Complete Guide for US Market Entry

ISO 10993-1:2025 From Checkbox Compliance to Risk-Based Biocompatibility

ISO 14155:2026 What’s Changed and What It Means for Your Clinical Investigation

Portugal’s New Clinical Trials Law No. 9/2026: What Sponsors Need to Know

IMDRF Draft N91 2026: New Clinical Evidence Requirements for IVDs Explained

ISO 14155:2026 What’s Changed and What It Means for Your Clinical Investigation

Written by Kirsty Macleod Published on 08.04.2026 Last updated on 15.07.2026

April 8, 2026

The fourth edition of the international GCP standard for medical device clinical investigations is now in effect, with no transition period. Here is what sponsors, investigators, and CROs need to know.

ISO 14155:2026 was published in March 2026.

It replaces ISO 14155:2020 as the global benchmark for Good Clinical Practice (GCP) in medical device clinical investigations, covering everything from trial design and risk management to informed consent and safety reporting. There is no defined transition period. If your study is in planning, you are expected to comply now.

Data	Status
Current edition	ISO 14155:2026 (4ª edition), March 2026
Transition Period	None, applies immediately
EU MDR harmonisation	EN ISO 14155:2020 remains the harmonised standard; 2026 harmonisation in progress
Last Update	10 June 2026

A Standard That Has Been a Long Time Coming

ISO 14155 has been the GCP reference for medical device clinical investigations since its first edition in 2003. The third edition, published in July 2020, made significant strides in aligning the standard with the EU Medical Devices Regulation (MDR 2017/745) and the ICH E6(R2) framework. But five years of practical implementation exposed gaps, particularly around risk management, study oversight structures, and statistical planning.

The fourth edition directly addresses those gaps. It introduces more prescriptive requirements, clearer distinctions between types of risk, new formal oversight structures, and a statistical annex that brings medical device investigations much closer to the rigour expected in pharmaceutical trials.

⚠ No transition period, requirements apply immediately

One timing point worth noting: ISO 14155:2020 had only just achieved formal harmonisation with the EU MDR when the fourth edition arrived, an unusual situation that has created legitimate questions for sponsors about the harmonisation status of the new standard. As of publication, EN ISO 14155:2020 remains the harmonised standard for MDR conformity purposes. The harmonisation process for ISO 14155:2026 is ongoing. Sponsors should monitor the EU Official Journal for updates.

The Key Changes: What’s New in ISO 14155:2026

1. Risk Management: A Clearer, More Structured Framework

If applying ISO 14971 risk management principles to clinical investigations has been a grey area in your organisation, the fourth edition addresses this directly.

The key distinction introduced is the separation of two categories of risk:

Device-related risks: including residual risks relevant to the specific study population, sample size, and indication, must be evaluated using full ISO 14971 methodology. The standard recognises that adverse device effect rates during an investigation can differ from post-market use. A small trial population amplifies ethical impact; risks must be contextualised accordingly.

Procedure-related risks: arising from non-routine clinical procedures required by the Clinical Investigation Plan (CIP) but outside standard clinical practice, require a descriptive risk assessment.

A risk based monitoring approach should be defined to manage the oversight of risks associated with the clinical investigation.

The standard clarifies how general device risk management principles translate into study-specific considerations, with focus on investigational device risks, especially residual risks relevant to the study population, sample size, and indication. These updates will require greater rigour when conducting and documenting risk assessments, but the result will be sponsors having more robust, better-documented risk management files tailored to each investigation.

Kirsty Macleod, Head of Clinical Research, MDx CRO

2. Data Monitoring Committees and Clinical Events Committees: Formal Requirements for Both

Study oversight structures receive significant attention in the fourth edition.

For DMCs, ISO 14155:2026 provides further clarification on this requirement. Where a DMC is determined to be in place, sponsors must now pre-define, and document in the CIP, the specific conditions under which a study would be suspended or stopped.

CECs are introduced for the first time in ISO 14155:2026. A Clinical Events Committee is an independent group of clinical experts established by the sponsor to ensure consistent classification and assessment of clinical events across sites. In multi-centre studies, different investigators may characterise the same event type differently, a CEC reduces that variability and strengthens data reliability. Where a CEC is used, its independence, role, and conflict-of-interest management must be formally defined at the outset of the study.

Key point for CROs and sponsors

The DMC and CEC requirements are not about adding bureaucracy. They are about ensuring that the necessary due diligence on safety review levels has been performed and captured in study documentation before the study starts, not after a safety signal emerges.

3.Informed Consent: Strengthened Expectations and Ethics Committee Implications

The fourth edition introduces more operational requirements around ethics, subject rights, and consent.

Specific updates include a prohibition on deviations from eligibility criteria without a formal CIP amendment; clearer requirements for explaining future use of health data to subjects; and expanded protection requirements for vulnerable populations and cross-border studies.

Ethics committees will scrutinise these more closely. Sponsors referencing ISO 14155:2026 compliance in submissions should expect greater attention to consent documentation, the consent process itself, and how protocol deviations are governed.

Ethics committees will have altered expectations when sponsors state compliance with the revised standard. Any mismatches between the risk management file and the informed consent form, downplaying known residual risks, using generic language, are routinely flagged during ethics review. The risk file and the consent must tell the same story, in plain language.

Kirsty Macleod, Head of Clinical Research, MDx CRO

4. Design Considerations: The Estimand Framework Arrives

The introduction of Annex K, a new informative annex on clinical investigation design considerations, brings the device world significantly closer to the statistical expectations long standard in pharmaceutical development.

In practice, this means study protocols are expected to more precisely define the clinical question being answered, including how intercurrent events (patient dropouts, treatment switches, protocol deviations) are handled in the primary analysis. Missing data strategies must be planned prospectively, not fixed post-hoc.

For organisations working across both medical devices and pharmaceuticals, this alignment reduces friction. For teams accustomed to simpler device trial designs, it will require additional investment in biostatistics at the planning stage.

5. Clinical Performance: A Sharper Definition With Real Consequences

The definition of “clinical performance” has been updated to more explicitly link device performance to measurable clinical benefit resulting from technical or functional characteristics. This is not a minor editorial change. It has direct implications for how endpoints are selected and justified in the CIP, and how clinical evidence is structured in Clinical Evaluation Reports (CERs).

Sponsors designing new studies need to ensure their primary endpoints map directly to the updated definition. For CER authors, it adds another layer of alignment to consider when assessing clinical data generated under different versions of the standard.

The Most Common Mistakes Sponsors Make regarding ISO 14155, and How to Avoid Them

When running and overseeing clinical investigations, the same errors appear repeatedly when sponsors try to apply risk management requirements to active studies. The fourth edition makes some of these errors significantly harder to ignore during regulatory or ethics review.

The mistake	What is expected instead
Reusing the post-market risk file unchanged Clinical investigations have different risk profiles, smaller populations, learning-curve users, investigational configurations. The ISO 14971 product risk file created for design verification does not translate directly.	A study-specific risk assessment clearly linked to the CIP, subject population, site capabilities, and operator experience. Justified differences between clinical investigation risk and intended-use risk.
Applying full ISO 14971 to procedure risks Sponsors apply the full methodology to blood draws, biopsies, imaging, and extra clinic visits, logging these as device risks. Regulators increasingly challenge over-engineered risk files because they obscure actual device risk.	Clear separation in documentation: device-related risks, ISO 14971 process; procedure-related risks, descriptive assessment. Explicit statement in the CIP explaining this distinction.
Freezing the risk file once the study starts Risk management is treated as a design artefact with no named responsibility during execution. Adverse events, near-misses, and protocol deviations that reveal new hazards are not fed back into risk assessment.	Defined triggers for risk review (SADEs, DMC recommendations, deviation trends). Documented updates showing how clinical findings feed back into hazard identification, risk estimation, and benefit-risk evaluation.
Weak linkage between risk file and consent form The informed consent form downplays known residual risks, uses generic language, or is inconsistent with what appears in the risk management file. Ethics committees view this as a red flag.	Clear mapping between residual risks and subject-facing explanations. Justification where technical risks are simplified or grouped. Immediate consent updates if risk understanding changes.
Risk controls that exist on paper but not in the study Controls are listed in the risk file but not implemented, training listed but not documented, IFU warnings not reflected in consent, monitoring controls not built into the protocol.	Traceability from risk, control, CIP section, training, monitoring. Cross-checks during monitoring that controls are actively applied. This is one of the most common audit findings.

What Happens to Studies Already Underway?

This is a frequently asked question by sponsors where the answer requires some nuance.

Studies initiated and approved under ISO 14155:2020 remain valid. The publication of the fourth edition does not retroactively invalidate work done in compliance with the previous version. A study designed, approved, and conducted in line with ISO 14155:2020 remains compliant with that version, and that data remains usable to support CE marking, clinical evaluation updates, and post-market evidence, provided it was compliant at the time of initiation.

Where things become more complex is with substantial amendments. If an ongoing study undergoes a significant change after March 2026, a protocol amendment, addition of new sites, introduction of a DMC or CEC, changes to the subject population, regulators and notified bodies may expect the affected areas to be brought into alignment with ISO 14155:2026. This is not a hard rule, but it is a risk-based expectation that should be assessed and documented.

In practice, authorities accept a clear, documented rationale: the clinical investigation was designed and initiated in compliance with ISO 14155:2020, which represented the state of the art at the time of study initiation. The publication of ISO 14155:2026 has been reviewed, and no changes were required that would materially impact subject safety, data integrity, or scientific validity. This approach is widely accepted, provided it is documented, risk-based, and justified.

Kirsty Macleod, Head of Clinical Research, MDx CRO

What Sponsors and Investigators Must Do Now

Given that there is no transition period, the question is not whether to act but how to prioritise. Here is a practical framework:

1. Run a formal gap analysis

Assess your current SOPs, CIP templates, risk management processes, and oversight structures against ISO 14155:2026. Focus first on risk management (device vs. procedure risk distinction), DMC/CEC governance, and statistical planning documentation.

2. Update your QMS and SOPs

Procedures, templates, and SOPs that reference ISO 14155:2020 need revision, particularly around CEC governance (new), DMC governance (strengthened), risk management integration, and informed consent processes.

3. Assess ongoing studies

Review active protocols or protocols in development. For studies with upcoming substantial amendments, prepare a documented assessment of whether and how ISO 14155:2026 requirements apply. Always document the rationale for decisions made, or not made.

4. Deliver structured training

Sharing the updated standard document is not sufficient. The risk management changes in particular require dedicated training for clinical affairs, regulatory affairs, and quality teams, not just a circulated PDF.

5. Monitor the harmonisation process

Keep an eye on the EU Official Journal for updates on the formal harmonisation of ISO 14155:2026 under the MDR. Until harmonised, EN ISO 14155:2020 remains the reference for MDR conformity presumption.

Key insight

The core principles of Good Clinical Practice for medical device investigations remain stable. What the 2026 revision adds is greater structure, clarity, and prescriptiveness, especially around risk management and ethical requirements. In the long run, this benefits patient safety, study design rigour, and the robustness of the evidence generated. The burden is front-loaded; the payoff is fewer audit findings and more defensible submissions.

Frequently Asked Questions about ISO 14155:2026

When did ISO 14155:2026 come into effect?

ISO 14155:2026 (Edition 4) was published in March 2026 and replaced ISO 14155:2020 immediately, with no defined transition period. Any new clinical investigation initiated after publication is expected to reference ISO 14155:2026 or provide a clear justification for non-alignment.

Do studies already underway under ISO 14155:2020 need to be updated?

Studies initiated and approved under ISO 14155:2020 remain valid. However, any substantial amendment to an ongoing study after March 2026 may trigger an expectation to align affected parts with ISO 14155:2026, or provide a documented justification explaining why partial or full transition is not appropriate. Always document the rationale.

Is ISO 14155:2026 harmonised with the EU MDR?

Not yet. As of April 2026, EN ISO 14155:2020 remains the harmonised standard providing presumption of conformity with the EU MDR. The formal harmonisation process for ISO 14155:2026 is underway. Sponsors should monitor the EU Official Journal regularly for updates.

What is the difference between a DMC and a CEC under ISO 14155:2026?

A Data Monitoring Committee (DMC) oversees overall trial safety and has the authority to recommend stopping or modifying a study. ISO 14155:2026 requires sponsors to pre-define stopping conditions and justify the absence of a DMC. A Clinical Events Committee (CEC) newly introduced in the 2026 edition, is an independent panel of clinical experts that ensures consistent classification of events across sites in multi-centre studies, improving data reliability.

Does ISO 14155:2026 apply to PMCF studies?

Yes. ISO 14155 applies to post-market clinical investigations, including PMCF studies. Annex I of the standard defines the applicability of requirements to different types of post-market investigations. Some requirements may be modified or exempt for observational studies, but the core GCP principles, including risk management, monitoring, and data governance, apply.

What is the estimand framework introduced in Annex K?

The estimand framework (from ICH E9(R1)) provides a structured approach to defining exactly what clinical question the investigation is designed to answer, and how events that disrupt the intended treatment (dropouts, protocol deviations, treatment switches) should be handled in the primary analysis. It requires these decisions to be made and documented at the design stage, not resolved post hoc in statistical analysis.

Does ISO 14155:2026 apply to IVD clinical performance studies?

ISO 14155 applies to medical devices, not in vitro diagnostics (IVDs). IVD clinical performance studies are governed by ISO 20916:2019. However, where a medical device and an IVD are used in an integrated system, elements of both standards may apply. Sponsors of combination investigations should assess both standards.

How MDx Helps You Implement ISO 14155:2026

Running a gap analysis, updating SOPs, or setting up DMC/CEC governance for an active or upcoming clinical investigation? MDx CRO’s Clinical Research team manages medical device and IVD clinical investigations end-to-end under the new standard — from SOP revision to full study oversight.

Planning a study under ISO 14155:2026? Talk to our Clinical Research team

Request a Gap Analysis

ISO 14971 Applied to Clinical Investigations: A Practical Guide

PMCF Under MDR: What ISO 14155 Requires

Clinical Investigation Plan: What You Must Include (2026 Update)

EN ISO 14155:2020/A11:2024 and MDR Harmonisation

Written by:

Kirsty Macleod

Kirsty is Head of Clinical Research at MDx CRO with over 28 years of experience in clinical research, clinical operations, and medical diagnostics. She has led global teams and large-scale clinical programs across CRO, biotech, and medtech environments. Before joining MDx CRO, she spent more than five years at QIAGEN, most recently as Director of Global Clinical Operations, where she oversaw monitoring, study administration, data management, budgeting, regulatory submissions, and continuous improvement initiatives. Earlier in her career, Kirsty spent over two decades at LifeScan, progressing from laboratory and development roles to Director of Clinical Operations. She has extensive experience generating clinical evidence to support product development, global registrations, and regulatory compliance across international markets.

View all articles →

Industry Insights & Regulatory Updates

FDA Regulation of In Vitro Diagnostic Devices: The Complete Guide for US Market Entry

ISO 10993-1:2025 From Checkbox Compliance to Risk-Based Biocompatibility

Making IVDR Work in Combined Studies: Scientific & Operational Lessons from 40+ Programs

Portugal’s New Clinical Trials Law No. 9/2026: What Sponsors Need to Know

IMDRF Draft N91 2026: New Clinical Evidence Requirements for IVDs Explained

Portugal’s New Clinical Trials Law No. 9/2026: What Sponsors Need to Know

Written by Ana Sofia Silva Published on 24.03.2026 Last updated on 15.07.2026

March 24, 2026

Portugal has formally updated its national legal framework for clinical trials on medicinal products for human use through Law No. 9/2026 of 6 March, the third amendment to Law No. 21/2014 of 16 April, fully aligning it with the EU Clinical Trials Regulation (CTR) 536/2014. This update clarifies how clinical trials are authorized, conducted, and supervised across the country and provides sponsors with a clear and harmonized framework.

Here is what changes for sponsors.

KEY TAKE AWAY

On March 6, 2026, Portugal published Law No. 9/2026, which implements the EU Clinical Trials Regulation (CTR) No. 536/2014 at national level and establishes the specific legal framework for clinical trials on medicinal products. It enters into force on April 5, 2026. For sponsors planning clinical trials in Portugal, this means a clearer regulatory framework, a formalized dual-authority approval model (INFARMED for scientific assessment and CEIC for ethical review), and new obligations around post-trial access and liability insurance.

Why Law No. 9/2026 Matters?

The EU Clinical Trials Regulation (CTR) 536/2014 has been in force since January 2022, and since January 2025 all new clinical trial applications in the EU must be submitted through the Clinical Trials Information System (CTIS). However, each Member State still needs national implementing legislation to define the specific roles of competent authorities and ethics committees, and to establish local rules on participant protection, insurance, and sanctions.

Portugal’s previous framework for clinical trials was built on Law No. 21/2014, the Clinical Research Law, which transposed the older EU Clinical Trials Directive (2001/20/EC). While the CTR itself is directly applicable across the EU, there were aspects of national implementation that remained unresolved in Portugal, until now.

Law No. 9/2026 constitutes the third amendment to the Clinical Research Law and establishes the complete legal framework for conducting clinical trials on medicinal products for human use in Portugal under the EU regulation.

“The new Clinical Trials Law updates the Portuguese framework to fully align with the EU Clinical Trials Regulation, reinforcing the roles of INFARMED and CEIC and requiring an integrated scientific and ethics assessment before trial authorization.”

Catarina Pragana, Clinical Research Manager, MDx CRO

Importantly, this is not an isolated development. In December 2025, Portugal also approved Law No. 71/2025, which transposes the MDR (Regulation 2017/745) and IVDR (Regulation 2017/746) into national law for all matters relating to clinical investigations of medical devices and performance studies of IVDs. Together, these two laws signal Portugal’s intention to modernize its entire clinical research ecosystem.

Key Provisions of Law No. 9/2026

1. INFARMED and CEIC: Roles Formalized

The law formally establishes the dual-authority model that the CTR requires at the national level:

Regulatory Responsibilities Under Law No. 9/2026

INFARMED (Autoridade Nacional do Medicamento e Produtos de Saúde) is designated as the competent authority responsible for scientific and technical assessment, the national point of contact under the CTR, and the entity issuing the final authorization decision.

CEIC (Comissão de Ética para a Investigação Clínica) is designated as the ethics committee responsible for assessing ethical aspects of clinical trial applications, including recruitment materials, informed consent procedures, and evaluation of the study team. CEIC issues a binding opinion.

INFARMED consolidates both assessments and makes the final authorization decision, which must be based on the results of the scientific evaluation and CEIC’s binding ethics opinion.

CEIC may also delegate certain assessments to local Health Ethics Committees that are part of the national network, as long as the requirements of Article 9 of the CTR are observed.

According to Ana Sofia Silva, Clinical Research Specialist at MDx CRO, this clearer structure is a positive development:

“This new structure could speed things up by reducing duplicated communication and paperwork between CEIC and INFARMED. A clearer division of responsibilities usually helps streamline the process”.

2. Submission Through CTIS

All clinical trial applications, including requests for substantial amendments, must be submitted through the EU CTIS portal. As Catarina Pragana notes, “For clinical trials involving medicinal products, all submissions now run through CTIS, the central European system. INFARMED reviews the scientific and technical components, while CEIC is responsible for the ethics assessment.”

INFARMED is responsible for ensuring the coordination between CTIS and Portugal’s existing Registo Nacional de Estudos Clínicos (RNEC), so that national clinical trial information remains integrated and publicly accessible.

For sponsors already familiar with CTIS from other EU markets, this is a familiar process. The key point is that Portugal’s national validation and assessment procedures now fully align with the timelines and workflows established in the CTR.

3. Participant Protection and Informed Consent

Law No. 9/2026 establishes detailed provisions for protecting trial participants that go beyond the general CTR framework:

Informed Consent Rules

Minors aged 16+: Their written assent is required in addition to consent from a legal representative. For minors under 16 who can understand the information, their assent must also be obtained (in any form).

Emergency inclusion: Participants facing serious or immediate risk to life may be enrolled without prior consent if the research directly relates to their clinical situation, the protocol has been pre-approved by an ethics committee, additional risks are minimal, and consent is obtained as soon as possible afterwards.

Incapacitated adults and minors in institutional care: Cannot be enrolled in clinical trials except when non-participation would result in a potential disadvantage to them.

Cluster trials (mononational only): Simplified consent procedures may be used for Portugal-only trials, subject to CEIC approval, when the conditions of Article 30 of the CTR are met.

4. Post-Trial Access Obligations

One of the most sponsor-relevant provisions of the new law is Article 14, which establishes a legally binding obligation for sponsors to continue providing investigational medicinal products free of charge after the trial ends.

This obligation applies only if the investigator considers that continued treatment is indispensable for the participant and no therapeutically equivalent alternatives of comparable efficacy and safety are available. The obligation continues until the product becomes accessible through Portugal’s National Health Service (SNS).

Ana Sofia Silva offers a nuanced perspective on what this means in practice:

“Although Article 14 introduces post-trial access requirements, these apply only when the investigator considers that continued treatment is indispensable and no equivalent alternatives exist. This approach is stricter than in most EU countries, where post-trial access is generally addressed through ethics guidance rather than binding national legislation. Since the continuation only applies in clinically justified scenarios, I do not expect it to be a major setback for most sponsors.”

5. Liability Insurance

Sponsors and investigators bear joint and strict liability (independent of fault) for both material and non-material damages caused to trial participants. The law requires mandatory civil liability insurance, though CEIC may waive the requirement of a trial-specific policy for low-intervention trials if the sponsor can demonstrate existing coverage.

An important provision establishes a presumption of causality: any adverse health effects experienced by a participant during the trial or within one year after the end of participation are presumed to be related to the trial, unless proven otherwise. CEIC may extend this period depending on the nature and risk profile of the study.

6. Language Requirements

Understanding the language rules is critical for sponsors preparing their dossier:

Document Type	Language Required
Technical dossier (scientific sections)	Portuguese or English
Informed consent forms & participant-facing materials	Portuguese (mandatory)
Lay summary of trial results	Portuguese (mandatory)
Protocol synopsis (Annex I, Section D.24)	Portuguese (mandatory)
IMP / auxiliary medicinal product labeling	Portuguese (mandatory); English accepted if products are only handled on-site

7. Penalty Framework

The law establishes a sanctions regime that sponsors should factor into their compliance planning:

Key Penalties Under Law No. 9/2026

Individuals: Fines from €500 to €50,000

Companies: Fines from €5,000 to €750,000

Additional sanction: Suspension or prohibition of conducting clinical trials for up to 2 years

Violations include: conducting a trial without authorization, failing to report safety events, non-compliance with GCP, conducting a trial without mandatory insurance, and failing to comply with post-trial access or language requirements.

“Sponsors should always factor potential penalties into their risk planning. But the violations mentioned, running a trial without authorization or not reporting safety events, are serious deviations that should never occur in a well-managed study. Although Portugal’s maximum fines are higher than in many EU countries, similar penalty systems exist across the EU, since all Member States must establish sanctions under the Clinical Trials Regulation.”

Ana Sofia Silva, Clinical Research Specialist, MDx CRO

Practical Impact for Sponsors: What This Means on the Ground

The Approval Workflow

Under the new law, the end-to-end authorization process for a clinical trial in Portugal follows a clearly defined path:

Step-by-Step: Clinical Trial Authorization in Portugal

Step 1. Submission via CTIS: The sponsor submits the application dossier through the EU portal, including all elements required by Annex I of the CTR.

Step 2. Validation: INFARMED validates the dossier completeness, consulting CEIC on the elements within its scope (sections K, L, M, N, O, P, and R of Annex I).

Step 3. Assessment: INFARMED assesses the scientific/technical aspects (Part I). CEIC assesses the ethical aspects (Part I ethical elements + Part II).

Step 4. Consolidation: INFARMED consolidates both assessments within CTR timelines.

Step 5. Decision: INFARMED issues the final authorization decision, based on the consolidated assessment and CEIC’s binding opinion.

Contract Requirements

The law requires sponsors to execute a contract with each clinical trial site that covers the financial arrangements and other terms referenced in Section P of Annex I of the CTR. These terms are assessed as part of the authorization procedure. The contract can be finalized before, during, or immediately after the authorization notification, but it only takes effect after authorization is granted.

A Competitive Edge: Shorter Timelines for Mononational Trials

Article 30 of Law No. 9/2026 authorizes the Portuguese government to set maximum timelines that are shorter than those established in the CTR for clinical trials conducted exclusively in Portugal. While the specific reduced timelines are yet to be defined by ministerial order, this provision creates a potential competitive advantage for attracting single-country studies to Portugal.

“I think shorter timelines for mononational trials could be seen as a competitive advantage for Portugal.”

Ana Sofia Silva, Clinical Research Specialist, MDx CRO

Fee Exemptions

Non-commercial clinical trials and investigator-initiated trials are exempt from the assessment fees. Until the new fee schedule is published (expected via ministerial order within 30 days of the law’s entry into force), the existing fees from Portaria 63/2015 remain applicable.

Portugal as a Clinical Trial Destination: The Bigger Picture

Law No. 9/2026 does not exist in isolation. Over the past two years, Portugal has been building a more comprehensive and attractive framework for clinical research:

April 2014

Law 21/2014: Portugal’s original Clinical Research Law enacted

January 2022

EU Clinical Trials Regulation (536/2014) became applicable and CTIS was lauched

January 2025

CTIS mandatory for all new clinical trial applications in the EU

December 2025

Law 71/2025 National implementation of MDR and IVDR for clinical investigations of medical devices and IVD performance studies

February 2026

CEIC publishes new Financial Agreement Template for medical device clinical investigations

March 2026

Law 9/2026 National implementation of EU CTR for clinical trials of medicinal products

April 5, 2026

Law 9/2026 enters into force

The pattern is clear: Portugal is modernizing its regulatory infrastructure across both pharmaceuticals and medical devices simultaneously. The creation of AICIB (Agência de Investigação Clínica e Inovação Biomédica) and the launch of the Portugal Clinical Studies platform are additional signals that the country is actively positioning itself to attract more international clinical research.

“Interest seems to be increasing compared to a few years ago, although there is still work to do to make the country more competitive overall.”

Ana Sofia Silva, Clinical Research Specialist, MDx CRO

Practical Considerations: What Sponsors Should Know

Portugal is becoming an increasingly attractive destination for clinical trials thanks to a more streamlined and transparent regulatory framework. However, beyond regulatory improvements, sponsors should carefully consider key operational factors to ensure successful study execution.

According to Ana Sofia Silva, the Portuguese clinical research landscape still shows a stronger familiarity with traditional drug trials compared to medical device (MD) and in vitro diagnostic (IVD) investigations. This means that when MD or IVD studies are introduced, clinical sites may require additional guidance and support, as these types of studies are less common in the local market.

Another important factor is the contracting process with Portuguese hospitals, which can be slower than expected. This can have a direct impact on study timelines, making early planning essential for sponsors aiming to avoid delays.

Our Clinical Research Specialist highlights three key recommendations for sponsors planning clinical trials in Portugal under the new regulatory framework:

Take advantage of a more efficient approval process: The updated INFARMED and CEIC structure is designed to streamline submissions and accelerate approvals.
Start site selection and contracting early: Given the potential delays in hospital agreements, early initiation of these processes is critical.
Plan realistic budgets and site support: Many clinical sites face staffing constraints, so adequate compensation per participant and proper resource allocation are essential to maintain engagement and performance.

By aligning regulatory expectations with operational realities, sponsors can better position their clinical trials for success in Portugal, optimizing both timelines and site collaboration.

What Sponsors Should Do Now Portugal’s New Clinical Trials Law

With the law entering into force on April 5, 2026, sponsors planning or conducting clinical trials in Portugal should take several practical steps:

Review your internal procedures to ensure alignment with the new dual-authority model (INFARMED for scientific assessment, CEIC for ethics).
Ensure your CTIS workflows account for Portugal-specific validation requirements, particularly CEIC’s role in validating Annex I sections K through R.
Check your insurance coverage mandatory civil liability insurance is required, with a one-year post-trial presumption of causation.
Prepare Portuguese translations of all participant-facing materials, including informed consent forms, lay summaries, and labeling.
Budget for post-trial access obligations particularly when no suitable therapeutic alternatives to the investigational product are available in Portugal.
Begin site qualification and contracting early hospital contracting in Portugal can be slow, and many sites face resource constraints.
Monitor secondary legislation the new fee schedule and IMP manufacturing requirements are expected via ministerial order in the coming weeks.

Frequently Asked Questions

When does Portugal’s new clinical trials law enter into force?

Law 9/2026 was published on March 6, 2026 and enters into force 30 days later, on April 5, 2026.

Which authority approves clinical trials in Portugal?

INFARMED issues the final authorization decision, based on its own scientific/technical assessment and the binding ethics opinion from CEIC. All applications must be submitted through the EU CTIS portal.

Are sponsors required to provide post-trial access to investigational products?

Under Article 14, sponsors must continue providing investigational medicinal products free of charge when the investigator considers continued treatment indispensable and no equivalent alternatives are available. This obligation continues until the product is commercially accessible through Portugal’s National Health Service.

What are the penalties for non-compliance?

Fines range from €500 to €50,000 for individuals and from €5,000 to €750,000 for companies. Authorities may also suspend or prohibit a company from conducting clinical trials for up to two years.

Can clinical trial documents be submitted in English?

The technical dossier can be submitted in Portuguese or English. However, all participant-facing documents (informed consent, lay summaries, protocol synopsis) must be in Portuguese.

Does Portugal offer faster timelines for local-only trials?

Yes. Article 30 allows the government to set shorter maximum timelines for trials conducted exclusively in Portugal. The specific reduced timelines are pending a ministerial order.

Does this law affect medical device clinical investigations?

No. Law No. 9/2026 applies specifically to clinical trials on medicinal products for human use. Clinical investigations of medical devices and performance studies of in vitro diagnostic devices are governed primarily by the EU Medical Device Regulation (MDR) 2017/745 and the EU In Vitro Diagnostic Regulation (IVDR) 2017/746, which are implemented in Portugal through Law No. 71/2025.

Planning a Clinical Trial in Portugal?

MDx CRO supports sponsors with regulatory strategy, clinical trial submissions, and clinical research management across the EU. Get in touch to discuss how we can help you navigate Portugal’s regulatory framework.

Contact Our Team

Written by:

Ana Sofia Silva

Ana Sofia is a Clinical Research Specialist with 8+ years of experience across clinical research, neuroscience, and the pharmaceutical industry. She currently works at MDx CRO, supporting the execution of clinical studies and contributing to the development of safe and effective therapies. Her background includes leading multicentric, multinational clinical trials in ophthalmology as a Clinical Project Manager at AIBILI, where she managed all phases of the study lifecycle—from start-up and regulatory submissions to maintenance and close-out—ensuring compliance with ICH-GCP standards. She holds a PhD in Neuroscience from the Medical University of Vienna as a Marie Skłodowska-Curie Fellow, with research focused on the molecular mechanisms of psychoactive compounds and published work in neuropharmacology. Her career also includes hands-on experience coordinating Phase II–IV clinical trials across multiple therapeutic areas, as well as an early foundation in community pharmacy and patient care. Her work is defined by a strong scientific mindset, attention to detail, and the ability to collaborate effectively across international and cross-functional teams.

View all articles →

Industry Insights & Regulatory Updates

FDA Regulation of In Vitro Diagnostic Devices: The Complete Guide for US Market Entry

ISO 10993-1:2025 From Checkbox Compliance to Risk-Based Biocompatibility

Making IVDR Work in Combined Studies: Scientific & Operational Lessons from 40+ Programs

ISO 14155:2026 What’s Changed and What It Means for Your Clinical Investigation

IMDRF Draft N91 2026: New Clinical Evidence Requirements for IVDs Explained

Written by Carlos Galamba Published on 12.03.2026 Last updated on 14.07.2026

March 12, 2026

The International Medical Device Regulators Forum (IMDRF) has released a significant new draft guidance, IMDRF/CEIVD WG/N91: Clinical Evidence for IVD Medical Devices, Definitions and Principles of Performance Evaluation, open for public consultation from 4 March to 5 May 2026. For IVD manufacturers, regulatory affairs teams, and companion diagnostic developers, this is not a minor update. It is a comprehensive reset of the global reference framework for how clinical evidence is defined, generated, documented, and defended.

This article breaks down what N91 actually changes, what it means for different types of manufacturers, and based on Carlos Galamba’s experience supporting IVDR submissions and CDx programs at MDx CRO, what practical steps teams should be taking right now.

Why this matters now?

The IMDRF consultation opened on 4 March 2026 and closes on 5 May 2026. Manufacturers with products in development, legacy portfolios under review, CDx programs in progress, or AI-based IVDs in any stage should read this draft carefully, and consider submitting comments before the deadline.

Navigate IMDRF N91 with an Expert IVD CRO Partner

The draft IMDRF N91 guidelines make one thing clear: the bar for IVD clinical evidence is rising globally. Don’t let shifting regulatory demands stall your market entry. Partnering with a specialized IVD CRO ensures your clinical performance studies are designed, executed, and documented to meet the highest international standards from day one.

Partner with an IVD CRO Expert

IMDRF N91 is A Framework Reset, Not Just a Revision

IMDRF N91 is a draft guidance document developed by the IMDRF Clinical Evidence for IVD Devices Working Group. Its full title is Clinical Evidence for IVD Medical Devices, Definitions and Principles of Performance Evaluation, and it represents the most significant update to the global IVD clinical evidence framework since the original GHTF documents were published.

The document runs to 31 pages and introduces 17 defined terms, consolidating vocabulary that has historically been inconsistent across jurisdictions. More importantly, it establishes a lifecycle-based model for clinical evidence that goes beyond premarket evidence generation and explicitly links performance evaluation to intended purpose, state of the art, and post-market updates.

What it supersedes

IMDRF N91 replaces both:

GHTF/SG5/N6:2012 Clinical Evidence for IVD Medical Devices: Scientific Validity Determination and Performance Studies for IVD Medical Devices
GHTF/SG5/N7:2012 Clinical Evidence for IVD Medical Devices: Key Definitions and Concepts

These two documents have been the global reference point for IVD clinical evidence since 2012. Replacing them with a single updated framework is a significant consolidation.

IMDRF’s role in the regulatory landscape

IMDRF is not a legislative body. Its guidance documents are not legally binding. However, they carry significant weight because they are developed by the regulatory agencies of major markets, including the European Commission, the FDA, Health Canada, the TGA (Australia), PMDA (Japan), and others. MDCG documents (which govern EU IVDR interpretation) explicitly reference IMDRF concepts, and regulatory reviewers at Notified Bodies and competent authorities routinely use IMDRF frameworks as reference benchmarks.

In practice, this means that once an IMDRF guidance is finalized, manufacturers that are not aligned with it will increasingly face questions during technical reviews, audits, and submissions, even if the guidance is not formally cited as a legal requirement.

“In my experience, serious regulatory teams start aligning almost immediately, even before formal citation becomes routine. Active referencing in reviewer templates, training, and audit language often takes somewhere between 6 and 18 months, depending on jurisdiction and organization. My advice is not to wait for formal enforcement language, if the direction is clear, start aligning your evidence strategy now”.

Carlos Galamba, CEO MDx

The Three Pillars of Clinical Evidence Under IMDRF N91

N91 formalizes and aligns with the three-pillar structure already embedded in EU IVDR: scientific validity, analytical performance, and clinical performance. Together, these constitute the clinical evidence that manufacturers must generate, document, and maintain across the device lifecycle.

Understanding each pillar, and where manufacturers routinely fall short, is essential for teams planning their evidence strategy.

Scientific Validity: Establishing the Biomarker Association

Scientific validity addresses whether the analyte being measured is genuinely associated with the clinical condition or physiological state the device is intended to detect. For many established biomarkers, this is largely a literature-based exercise. For novel biomarkers, it is a substantial research task that must begin much earlier than most teams expect.

As Carlos Galamba notes: “In the context of CDx, this work should start as early as biomarker selection and intended-use definition. Under IVDR, the performance evaluation plan is supposed to map the development phases and the sequence for establishing scientific validity, analytical performance, and clinical performance, so this work really starts at the translational stage, not at the submission stage.”

N91 makes clear that scientific validity cannot be assumed. It must be documented, and for novel analytes without established clinical consensus, the absence of scientific validity will block the entire evidence pathway.

Analytical Performance: what IVD manufacturers Most Often Underestimate

Analytical performance covers the device’s ability to accurately and reliably detect or measure the analyte, including precision, reproducibility, cut-off justification, specimen stability, pre-analytical factors, interference, and comparability.

According to Carlos Galamba, this is the pillar that IVD manufacturers most frequently underprepare: “When dealing with clinical trial assays or CDx, teams are usually very focused on the biomarker story and the drug program, so they assume the assay can be optimized later. In reality, regulators often scrutinize analytical robustness first. IVDR itself already requires manufacturers to build the evidence case across all three pillars, not just clinical performance.”

This is a pattern MDx CRO encounters regularly, particularly in CDx programs where the clinical hypothesis is well-developed but the analytical package is treated as an afterthought. N91 reinforces that regulators, including Notified Bodies and the FDA, will assess analytical performance in depth, not simply accept it as a technical formality.

Clinical Performance: What Documentation Is Required vs. What Evidence Must Be Generated

Clinical performance refers to the device’s ability to yield results that correlate with a clinical condition in the intended patient population. N91 clarifies an important distinction that has significant operational implications: manufacturers must always document clinical performance, but they do not always need to generate new evidence through a prospective study.

Whether new evidence is required depends on the device’s risk class, novelty of the analyte, intended use population, and available published data. This mirrors the IVDR framework, where existing literature, registry data, and published experiences from routine diagnostic use can contribute to the clinical performance evidence base, if they are sufficient and methodologically sound.

For more detail on how clinical performance studies are designed and conducted under IVDR, see our guide: Running Clinical Studies Under IVDR: What You Need to Know.

Software as an IVD (SaIVD) and AI/ML: What IMDRF N91 Changes

One of the most substantive additions in N91 is its dedicated section on Software as an IVD (SaIVD), including IVDs that incorporate AI and machine learning. This reflects a genuine regulatory gap: the 2012 GHTF documents predated the widespread deployment of AI-based diagnostics, and manufacturers have been operating without a clear global framework for what clinical evidence looks like for these products.

N91 requires manufacturers of AI-based SaIVDs to address: data lifecycle traceability, performance drift monitoring, transparency of AI outputs, and documentation of the transition point at which AI recommendations are reviewed by qualified healthcare professionals. Critically, N91 affirms that final clinical decisions must always rest with qualified healthcare professionals, not with the AI system itself.

The Most Common Mistake in AI-Based IVD Evidence Packages

Carlos Galamba identifies a pattern he sees repeatedly in AI-based IVD programs: “The most common mistake is treating algorithm accuracy as if that alone were clinical evidence. For AI-based IVDs, you also need to show data provenance, representativeness, version control, performance across real-world input scenarios, monitoring for drift, and transparency about limitations. The IMDRF draft is quite clear that for AI-based SaIVD, manufacturers should document the whole data lifecycle, manage AI-specific failure modes, monitor post-market drift, and make outputs interpretable enough for human oversight.”

This is a significant operational gap for many software and AI companies entering the IVD space. Algorithm performance metrics, sensitivity, specificity, AUC, are necessary but not sufficient. N91 signals that regulators will expect a much broader evidence architecture for these products.

For related reading on IMDRF’s approach to AI in medical devices, see: IMDRF Machine Learning-enabled Medical Devices: Key Terms and Definitions.

IMDRF N91 and Companion Diagnostics: Co-Development, Cut-Off Locking, and Clinical Bridging

Companion diagnostics (CDx) receive dedicated and substantially more detailed treatment in N91 than in the 2012 GHTF documents. This reflects both the growing regulatory complexity of CDx programs globally and the specific challenges that arise when an IVD must be co-developed alongside, and validated in the context of, a therapeutic clinical trial.

N91 explicitly addresses the relationship between the CDx and its linked drug program, including clinical trial design considerations (therapy stratification vs. therapy selection), the role of the companion diagnostic in defining the eligible patient population, and the use of bridging studies to establish comparability between a clinical trial assay and the final commercial CDx.

The Hardest Practical Challenge in CDx development: Timeline Alignment

The core operational difficulty in CDx development is well-known to anyone who has run a real program. As Carlos Galamba describes it: “The hardest part is usually locking the assay and its cut-off early enough for the drug trial, while still leaving room to evolve toward the final commercial CDx. In practice, teams want flexibility during early clinical development, but regulators want traceability, reproducibility, and a defensible bridge to the final device. That tension is what makes CDx programs operationally difficult.”

N91 does not resolve this tension, but it does provide a clearer framework for documenting the development pathway, which is ultimately what Notified Bodies and regulatory authorities are looking for.

Clinical Bridging Studies: Where Evidence Packages Break Down

When a bridging study is required, linking a clinical trial assay to a subsequent commercial CDx, manufacturers frequently arrive at submission with incomplete packages. Based on Carlos Galamba’s experience with CDx submissions: “The common gaps are weak analytical comparability, poor justification for cut-off transfer, insufficient specimen representativeness, and incomplete explanation of discordant results. IMDRF N91 now directly recognizes bridging from a clinical trial assay to a subsequent CDx and says the study should establish clinical comparability using direct or indirect data.”

N91’s explicit recognition of bridging is significant because it gives regulatory teams a defined framework to reference, and it sets expectations that regulators in IMDRF member jurisdictions will increasingly apply.

For a step-by-step guide to CDx performance studies under IVDR, see: IVDR Annex XIV Performance Studies for Companion Diagnostics: A Step-by-Step Guide 2026.

IMDRF N91 vs. IVDR: What Changes for EU-Compliant Manufacturers?

A practical question for manufacturers already operating under IVDR: does N91 require significant additional work?

The short answer, according to Carlos Galamba, is no, with important nuances: “For a manufacturer that is genuinely IVDR-compliant, N91 should not feel like a reinvention. IVDR already requires clinical evidence based on scientific validity, analytical performance, and clinical performance, supported by a continuous performance-evaluation process tied to intended purpose and updated over the lifecycle. The additional work is mostly in tightening structure, terminology, and rationale, especially for software, AI, and CDx.”

The key phrase here is “genuinely IVDR-compliant.” Many manufacturers have documentation that is technically complete but not logically structured around intended use, clinical benefit, and lifecycle evidence updates, the elements N91 makes more central. For those teams, N91 is a useful diagnostic tool for identifying where their evidence architecture needs strengthening.

For EU manufacturers, it is also worth noting that IMDRF is referenced in MDCG documents, and MDCG has in some cases explicitly built on or endorsed IMDRF concepts. While IVDR remains the legally binding framework in the EU, alignment with IMDRF guidance is increasingly reflected in Notified Body expectations.

For clinical evidence requirements under IVDR specifically, see: MedTech Europe IVDR Clinical Evidence Requirements

Where additional work may be required

Area	Likely additional work for IVDR-compliant manufacturers
SaIVD / AI-based IVDs	N91 adds specificity on data lifecycle documentation, drift monitoring protocols, and transparency requirements that may exceed current IVDR technical file scope
Companion diagnostics	Bridging study documentation and cut-off transfer justification may need to be more formally structured against N91 requirements
Legacy portfolios	Evidence packages that are technically complete but not logically structured around intended use and clinical benefit may need restructuring
Terminology alignment	N91 introduces 17 defined terms. Ensuring internal documentation uses consistent, N91-aligned terminology will reduce reviewer friction

Who Is Most Exposed by IMDRF N91?

Not all manufacturers face the same level of exposure from N91’s new requirements. Based on Carlos Galamba’s assessment: “The most exposed are probably legacy portfolio holders and AI/software IVD developers. Legacy manufacturers often have evidence packages that are technically complete but not logically structured around intended use, clinical benefit, and lifecycle updates. AI and software companies face extra complexity because N91 explicitly addresses data lifecycle, drift, transparency, and the need for ongoing re-verification. CDx developers are also highly exposed because of the added bridging and co-development challenges.”

Startups building new products from scratch arguably face less disruption, if they build their evidence strategy around N91 from day one, they are building to the standard rather than retrofitting to it.

3 Actions to Take Before IMDRF Consultation Closes on 5 May 2026

N91 is unambiguous: clinical evidence is a lifecycle activity, not a premarket deliverable. If your organization’s evidence strategy is still organized around submission milestones rather than continuous performance evaluation and intended-use discipline, this is the moment to change that.

The IMDRF consultation for N91 is open until 5 May 2026. This is a genuine opportunity for IVD manufacturers to shape the final guidance. Carlos Galamba’s recommendation for teams reading N91 today:

“First, run a structured gap assessment against the draft using your current intended uses, performance evaluation reports, and evidence-generation plans. Second, identify where the draft creates operational friction for your products, especially if you work in CDx, AI/software, NGS, decentralized testing, or legacy portfolios, and submit concrete comments. Third, check whether your evidence strategy is truly lifecycle-based, or whether it is still a premarket-only mindset.”

How to prepare Before IMDRF Consultation Closes

Run a structured gap assessment
Map your current intended uses, performance evaluation reports, and evidence-generation plans against the N91 draft. Focus specifically on: how your three-pillar evidence is documented and whether it is genuinely tied to intended purpose; whether your SaIVD or AI products have data lifecycle and drift monitoring documentation; and whether your CDx bridging evidence is structured in a way that satisfies the comparability requirements in N91’s Section 7.
Identify operational friction and submit comments
The public consultation is a genuine opportunity to shape the final guidance. Manufacturers should identify where N91 creates operational friction for their specific product types, particularly in CDx, AI/software, NGS, decentralized testing, or legacy portfolios, and submit concrete, technically grounded comments to IMDRF before 5 May 2026
Audit your evidence mindset
N91 is unambiguous: clinical evidence is a lifecycle activity, not a premarket deliverable. If your organization’s evidence strategy is still organized around submission milestones rather than continuous performance evaluation and intended-use discipline, this is the moment to change that.

The consultation period closes 5 May 2026. Feedback can be submitted via the IMDRF consultation page.

If your team needs support conducting a structured gap assessment or preparing a pre-submission technical review, MDx CRO’s IVDR Pre-Submission Assessment service is designed exactly for this type of exercise.

How MDx Can Help

MDx CRO combines 18+ years of IVD regulatory expertise with hands-on experience at Notified Bodies, European Commission advisory roles, and operational leadership across Class C/D IVDs, CDx, NGS, and AI-based diagnostic software. Our team has supported hundreds of IVDR submissions and continues to track global regulatory developments including IMDRF consultations in real time.

Whether you are running a gap assessment against the N91 draft, building your CDx evidence strategy, preparing for IVDR submission, or developing a clinical evidence plan for an AI-based IVD, our team can provide the regulatory depth and operational experience to move efficiently.

Ready to align with IMDRF N91?

Contact MDx CRO to discuss a structured gap assessment against the N91 draft, or to review your current clinical evidence strategy before the consultation closes on 5 May 2026.

Contact an expert

Frequently Asked Questions

What is IMDRF N91 and why does it matter for IVD manufacturers?

IMDRF N91 is the 2026 draft document Clinical Evidence for IVD Medical Devices, Definitions and Principles of Performance Evaluation. Open for public consultation from 4 March to 5 May 2026, it supersedes the 2012 GHTF N6 and N7 documents. It matters because it updates the global reference framework for how manufacturers should define, generate, document, and defend IVD clinical evidence, including for modern areas like software, AI, and companion diagnostics.

Does IMDRF N91 replace IVDR clinical evidence requirements?

No. EU IVDR 2017/746 remains the legally binding framework in the EU. IMDRF N91 is best understood as a global convergence guidance document that is highly relevant to IVDR because the core architecture is already aligned: intended purpose, scientific validity, analytical performance, clinical performance, lifecycle updating, and state of the art. IMDRF is referenced in MDCG documents, and the binding framework in the EU remains MDR/IVDR, not IMDRF itself.

What are the three pillars of clinical evidence in IMDRF N91?

Scientific validity (establishing the association between the analyte and a clinical condition), analytical performance (the ability of the IVD to detect or measure the analyte correctly), and clinical performance (the ability of the IVD to yield results that correlate with a clinical condition in the target population). All three must be addressed in an integrated performance evaluation strategy tied to the device’s intended purpose.

Does IMDRF N91 apply to AI-based diagnostic software?

Yes. N91 includes a dedicated section on Software as an IVD (SaIVD) that explicitly addresses AI and machine learning-based devices. Requirements include data lifecycle documentation, performance drift monitoring, AI transparency, version control, and the principle that final clinical decisions must rest with qualified healthcare professionals.

What is a clinical bridging study and why does N91 address it?

A clinical bridging study is used to link a new commercial CDx to an existing clinical trial assay that was used during a drug’s pivotal study. N91 formally recognizes this approach and requires that bridging studies establish clinical comparability using direct or indirect comparability data. This addresses a significant gap in the existing regulatory framework for CDx development.

When does IMDRF N91 come into effect?

N91 is currently in public consultation, which closes on 5 May 2026. The guidance will be finalized after comments are reviewed. It is not currently in force, but manufacturers who align with it proactively will be better positioned as Notified Bodies and regulatory agencies begin referencing it in reviews, training, and audit frameworks, which typically occurs 6 to 18 months after finalization.

What is a scientific validity report and is it required under IMDRF N91?

A scientific validity report (SVR) documents the established association between an analyte and a specific clinical condition, physiological state, or intended use. It forms the foundation of the clinical evidence package. Under IVDR Annex XIII, an SVR is already a mandatory component of technical documentation for IVDs. N91 reinforces this requirement globally and provides updated definitions and expectations for how scientific validity should be determined and documented.

Written by:

Carlos Galamba

View all articles →

Industry Insights & Regulatory Updates

FDA Regulation of In Vitro Diagnostic Devices: The Complete Guide for US Market Entry

ISO 10993-1:2025 From Checkbox Compliance to Risk-Based Biocompatibility

Making IVDR Work in Combined Studies: Scientific & Operational Lessons from 40+ Programs

ISO 14155:2026 What’s Changed and What It Means for Your Clinical Investigation

Portugal’s New Clinical Trials Law No. 9/2026: What Sponsors Need to Know

EU AI Act and Medical Devices: What SaMD Developers Need to Know (2026)

Written by Diego Rodriguez Muñoz Published on 09.03.2026 Last updated on 15.07.2026

March 9, 2026

The EU AI Act (Regulation (EU) 2024/1689) applies to AI-powered medical devices automatically classified as high-risk under Annex III. Manufacturers of SaMD with AI components must comply by August 2026, or August 2027 for CE-marked devices subject to Notified Body review under MDR or IVDR. Both frameworks apply simultaneously, requiring integrated technical documentation, data governance, and human oversight mechanisms.

This is not a distant compliance horizon. The provisions most relevant to medical device AI became applicable from August 2026. Companies that have not yet assessed their AI systems against the AI Act risk gaps in their technical documentation and conformity processes at exactly the moment Notified Bodies are beginning to incorporate AI Act considerations into their assessments.

This guide explains what the AI Act requires from SaMD developers, how it interacts with MDR and IVDR, and what practical steps manufacturers should be taking now.

For general SaMD MDR compliance, see our SaMD EU MDR Compliance Guide

Timeline Update: April 2026

Since this article was originally published, two important milestones have passed and one critical deadline distinction has been clarified. If you are planning your AI Act compliance roadmap as a SaMD developer, your timeline may need adjusting.

February 2026: Commission published guidelines on Article 6

The European Commission met its deadline under Article 6(5) of the AI Act and published practical guidelines on how to classify AI systems as high-risk, including concrete examples of what qualifies and what does not. If your team has not yet reviewed these guidelines as part of your classification assessment, this is a priority action, they directly affect how you document your high-risk determination in your technical file.

2 August 2026: Most high-risk AI obligations now apply, but with a critical exception for medical devices

As of 2 August 2026, the majority of high-risk AI obligations under the AI Act entered into application. However, there is an important split that is directly relevant to SaMD developers:

Article 6(1) the provision that covers AI systems embedded in products subject to third-party conformity assessment under EU harmonisation legislation, does not apply until 2 August 2027. This is the provision that governs CE-marked medical devices and IVDs regulated under MDR and IVDR, where Notified Body involvement is required.

In practical terms, this means that manufacturers of Class IIb/III medical devices (MDR) or Class C/D IVDs (IVDR) that incorporate AI have until August 2027, not August 2026, to comply with the Article 6(1) high-risk classification pathway. The 2026 deadline applies primarily to AI systems listed in Annex III of the AI Act that are not subject to Notified Body conformity assessment under other EU legislation.

There is also a transitional provision worth noting: AI systems already placed on the market before 2 August 2026 are only subject to the new obligations if they undergo significant design changes after that date.

The full official timeline is available at the EU AI Act implementation timeline.

Revised compliance milestones for SaMD developers

February 2025: AI literacy requirements and prohibitions on unacceptable-risk AI applied
August 2025: GPAI model obligations applied (relevant if your SaMD is built on a foundation model)
February 2026: Commission guidelines on Article 6 classification published
2 August 2026: Most high-risk AI obligations apply (Annex III systems without NB assessment)
2 August 2027: Article 6(1) applies: key deadline for CE-marked MDR/IVDR SaMD

We’re already seeing Notified Bodies ask AI Act-style questions during MDR audits, well ahead of the 2027 deadline. Manufacturers who wait for the legal deadline to start documenting training data governance will be reworking technical files under time pressure.

Diego Rodríguez Muñoz, PhD, QA/RA Specialist, MDx CRO

We recommend beginning compliance preparation now regardless of which deadline applies to your device. Notified Bodies are already incorporating AI Act expectations into their MDR and IVDR assessments ahead of the legal deadline, and the documentation work involved, training data governance, bias assessment, human oversight design, takes considerable time to complete properly.

The rest of this article describes what the high-risk AI obligations require in practice. Read it with the above timeline in mind.

1. Does the AI Act Apply to Your Software?

The AI Act applies to AI systems placed on the market or put into service in the EU. An AI system is defined as a machine-based system that, given explicit or implicit objectives, infers from inputs how to generate outputs such as predictions, content, recommendations, or decisions that can influence real or virtual environments.

This definition is intentionally broad. It covers:

Machine learning models (supervised, unsupervised, reinforcement learning)
Deep learning systems including convolutional neural networks used in medical imaging
Natural language processing tools used in clinical documentation or decision support
Bayesian classifiers and other probabilistic inference systems

It does not cover:

Traditional rule-based software with no learning or inference component
Software that executes fixed logic without adaptive behaviour

If your SaMD uses any form of machine learning or statistical inference to generate clinical outputs, the AI Act almost certainly applies.

2. High-Risk AI Classification for Medical Devices

The AI Act categorises AI systems by risk level. For medical device manufacturers, the critical category is high-risk AI.

Under Annex III of the AI Act, AI systems intended to be used as safety components of medical devices, or which are themselves medical devices regulated under MDR or IVDR, are automatically classified as high-risk AI.

This means: if your SaMD is a CE-marked medical device or IVD, or is a software component that performs a safety function within one, it is high-risk AI under the AI Act. There is no further classification analysis required, the medical device status determines it.

High-risk AI systems are subject to the full obligations of the AI Act, including:

Risk management system: an AI-specific risk management process, documented and integrated with the ISO 14971 risk management already required under MDR
Data and data governance: training, validation, and testing datasets must be relevant, representative, free of errors, and sufficiently complete; demographic and geographic representativeness must be documented
Technical documentation: a detailed record of the AI system’s design, development process, training methodology, validation approach, and performance characteristics
Transparency and instructions for use: users must be provided with clear information about the AI system’s capabilities, limitations, accuracy metrics, and circumstances under which human oversight is required
Human oversight: the system must be designed to allow human oversight and intervention; it must not undermine the ability of the operator or user to override, disregard, or reverse outputs
Accuracy, robustness, and cybersecurity: performance must be declared and validated; the system must be resilient to errors, faults, and adversarial manipulation
Conformity assessment: high-risk AI systems must undergo a conformity assessment before being placed on the market

3. How the AI Act Interacts with MDR and IVDR

This is where the compliance picture becomes complex, and where early planning pays off.

The AI Act does not replace MDR or IVDR. Both regulatory frameworks apply simultaneously to AI-powered SaMD. However, the EU has designed a streamlined pathway for medical devices that are already subject to Notified Body review under MDR or IVDR.

Under Article 11 and Annex II of the AI Act, AI systems that are regulated as medical devices benefit from a single technical documentation approach meaning the AI Act technical documentation requirements can be integrated into the existing MDR/IVDR technical file rather than creating a separate document set.

Similarly, for Class IIb and III medical devices (MDR) and Class C and D IVDs (IVDR) which are the most likely to contain high-risk AI the Notified Body involvement already required under MDR/IVDR can cover the AI Act conformity assessment. The Notified Body acts as the relevant conformity assessment body for both frameworks.

In practice this means:

What changes for AI-powered SaMD under the AI Act:

Technical documentation must now explicitly address AI-specific elements: training data governance, model validation across subgroups, bias assessment, explainability approach, and human oversight mechanisms
Post-market monitoring must include AI performance monitoring tracking model drift, accuracy degradation over time, and distribution shift in real-world data
Transparency obligations require new IFU content describing AI limitations and human oversight requirements
A fundamental rights impact assessment may be required for certain high-risk AI applications in healthcare

What does not change:

The MDR/IVDR conformity assessment route remains the primary pathway
The Notified Body relationship established for MDR/IVDR CE marking remains the relevant body
ISO 14971 risk management, IEC 62304 lifecycle management, and clinical evaluation requirements are unchanged AI Act risk management is additive, not a replacement

4. General Purpose AI (GPAI) Models in Medical Devices

A separate and increasingly relevant category is General Purpose AI (GPAI) large foundation models or multimodal AI systems that can be adapted or fine-tuned for specific applications.

If a SaMD developer is building on top of a GPAI model: for example, fine-tuning a large language model for clinical documentation, or adapting a vision foundation model for medical image analysis both the GPAI model provider and the SaMD developer have obligations under the AI Act.

GPAI model providers must publish technical documentation and comply with copyright and transparency requirements. SaMD developers who deploy or fine-tune GPAI models are responsible for ensuring the resulting system meets all high-risk AI obligations, including data governance, validation, and clinical performance claims. The validation methodology for fine-tuned GPAI models in medical contexts is an area where regulatory guidance is still developing, early engagement with your Notified Body is strongly recommended.

5. Key Timelines

August 2024: AI Act enters into force.

February 2025: Prohibitions on unacceptable-risk AI systems apply. Not directly relevant for medical SaMD, but important for any AI used in patient-facing administrative processes.

August 2025: GPAI model obligations apply. SaMD developers building on foundation models must assess their exposure now.

August 2026: High-risk AI obligations fully apply. This is the key deadline for medical device AI. From this date, new AI-powered SaMD placed on the EU market must comply with all high-risk AI requirements.

Post-2026: Notified Bodies designated under the AI Act will begin conducting AI Act-specific conformity assessments. The intersection with MDR/IVDR NB assessments will become a standard part of the conformity process.

6. What to Do Now: A Practical Checklist

Classify your AI systems. Identify every AI component in your SaMD portfolio and confirm whether it meets the EU’s definition of an AI system. For each, document the risk classification and the rationale.

Assess your technical documentation gaps. Review your existing MDR/IVDR technical files against the AI Act Annex IV requirements. Identify where AI-specific content, training data documentation, bias assessment, explainability approach, is missing or insufficient.

Review your data governance. The AI Act’s requirements for training data representativeness and bias documentation are more explicit than anything in MDR. If your training data governance is not documented at the level the AI Act requires, this is a gap that needs addressing before your next Notified Body audit.

Update your IFU and labelling. Transparency obligations mean users must be explicitly informed about AI limitations, performance metrics across relevant subgroups, and circumstances requiring human override. Most current SaMD IFUs are not written to this standard.

Engage your Notified Body. Ask your NB directly how they are approaching AI Act integration into MDR/IVDR assessments. Different NBs are at different stages of readiness, and early clarity on what they will expect prevents last-minute documentation gaps.

Build AI performance monitoring into your PMS. Post-market surveillance for AI-powered SaMD must now track model performance over time. If your PMS plan does not include AI-specific monitoring metrics, update it before August 2026.

How MDx Helps You Close the AI Act Gap

From classifying your AI components to integrating AI-specific technical documentation into your existing MDR/IVDR technical file, MDx CRO’s Software, Digital Health & AI team supports SaMD developers through the full Article 6(1) compliance pathway, gap assessment, data governance documentation, and Notified Body engagement strategy.

Talk to our Software, Digital Health & AI team

Key Requirements at a Glance

AI-powered SaMD classified as high-risk under the EU AI Act must meet the following obligations before market placement:

Risk management system: An AI-specific risk management process, documented separately from but integrated with ISO 14971 requirements under MDR/IVDR.
Data governance: Training, validation, and test datasets must be representative, bias-assessed, and documented for demographic and geographic coverage.
Technical documentation: AI-specific content, including training methodology, model validation, and performance characteristics, must be incorporated into the MDR/IVDR technical file.
Human oversight: The system must be designed so clinicians can override, disregard, or reverse AI outputs at all times.
Transparency and IFU: Instructions for use must explicitly state AI limitations, accuracy metrics, and when human review is required.
Conformity assessment: CE-marked SaMD undergoes AI Act conformity assessment through the existing Notified Body route (Article 6(1), applicable from August 2027).

AI Act SaMD Classification: When Is Your Software Automatically High-Risk?

Under the EU AI Act, Software as a Medical Device does not go through a separate AI risk classification process if it is already regulated as a medical device. The classification is automatic.

The rule under Annex III: Any AI system that is itself a medical device, or functions as a safety component of a medical device, regulated under EU MDR or IVDR, is automatically classified as high-risk AI under Article 6(1).

A Class IIa diagnostic imaging AI — high-risk AI.
A Class III surgical decision-support algorithm — high-risk AI.
A Class C IVD with an AI-based interpretation engine — high-risk AI.
Rule-based software with no learning component — not covered by the AI Act.

EU AI Act August 2026 Deadline: What It Means for Medical Device Manufacturers

The date most frequently cited, 2 August 2026 is real, but it does not apply equally to all medical device AI. Understanding the split is critical for compliance planning.

What applies from 2 August 2026

High-risk AI obligations apply to Annex III AI systems not subject to third-party conformity assessment. In the medical device context: hospital workflow tools, patient triage algorithms not CE-marked as medical devices.

What applies from 2 August 2027

For CE-marked MDR/IVDR devices, Article 6(1) applies and it does not enter into force until 2 August 2027. This is the deadline that matters most for SaMD developers.

AI Act vs MDR: Understanding the Dual Compliance Framework for SaMD

AI-powered medical devices are subject to two overlapping EU regulatory frameworks simultaneously. They are not alternatives — both apply, and compliance with one does not fulfil the other.

	EU MDR / IVDR	EU AI Act
What it governs	Safety, performance, and clinical efficacy of the device	How the AI was built, trained, validated, and governed
Key deadline	Ongoing (MDR transitional periods ended)	Aug 2026 (non-NB AI) / Aug 2027 (CE-marked SaMD)

General Purpose AI (GPAI) Models in Medical Devices: What the AI Act Requires

A General Purpose AI (GPAI) model is an AI model trained on large amounts of data, capable of serving a wide range of downstream tasks. Foundation models and LLMs adapted for clinical use fall into this category.

Tier 1: GPAI model provider obligations (August 2025)

The company that trains the foundation model must document training data, comply with copyright law, and publish transparency summaries — applicable since August 2025.

Tier 2: SaMD developer obligations (August 2026/2027)

When a SaMD developer fine-tunes a GPAI model for a medical application, they become the high-risk AI provider and must conduct their own clinical validation, document training data for fine-tuning, and design human oversight mechanisms specific to the clinical context.

What is the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) is the European Union’s comprehensive legal framework for artificial intelligence systems. It entered into force on 1 August 2024 and is being phased in progressively through 2027.

What does it regulate?

The AI Act classifies AI systems by risk level, from unacceptable-risk (prohibited) to high-risk, limited-risk, and minimal-risk, and sets obligations proportionate to that classification. High-risk AI systems, which include all AI used in medical devices regulated under MDR or IVDR, face the most stringent requirements.

Who does it apply to?

Any organisation that develops, deploys, or places on the EU market an AI system, including manufacturers of AI-powered Software as a Medical Device (SaMD), regardless of where they are based.

How does it differ from MDR?

The MDR governs whether a device is safe and performs as claimed. The AI Act governs how the AI system within that device was built, trained, and governed. Both apply simultaneously to AI-powered SaMD from 2026–2027 onwards.

Frequently Asked Questions: EU AI Act and Medical Devices

What is the difference between the EU AI Act and the MDR for medical device AI?

The MDR (Medical Device Regulation) governs the safety, efficacy, and quality of medical devices, including those powered by AI. The EU AI Act is a separate regulatory framework that addresses the risks and accountability of AI systems themselves. The AI Act focuses on how the AI system was built, trained, validated, and deployed, while MDR focuses on the clinical performance of the device. Both apply simultaneously to AI-powered SaMD from August 2026 onwards.

Does the AI Act apply to all machine learning models in medical devices?

Yes, if you use any form of machine learning, deep learning, or statistical inference to generate clinical outputs, the AI Act applies. This includes supervised learning, convolutional neural networks for medical imaging, natural language processing for clinical documentation, and Bayesian classifiers. It does NOT apply to traditional rule-based software with fixed logic and no learning or inference capability

What does ‘high-risk AI’ mean under the EU AI Act?

High-risk AI includes AI systems that are themselves medical devices or safety components of medical devices regulated under MDR, or AI systems regulated under IVDR. If your SaMD is CE-marked or classified as a medical device, it is automatically classified as high-risk AI. High-risk AI must comply with all AI Act obligations: risk management, data governance, technical documentation, transparency, human oversight, and conformity assessment.

What are the data governance requirements under the AI Act?

The AI Act requires explicit documentation that training, validation, and testing datasets are relevant, representative, free of errors and bias, and sufficiently complete. Demographic and geographic representativeness must be documented, particularly important for medical AI to ensure performance across age, sex, ethnicity, and geography. This is more explicit than MDR alone.

What are the human oversight requirements under the AI Act?

High-risk AI systems must be designed to enable human oversight and intervention. Users must be able to override, disregard, or reverse the AI’s decision, and the system must not undermine this ability. For clinical SaMD, this typically means the AI operates in decision-support mode and clinicians retain authority to override recommendations.

When do I need to comply with the AI Act?

August 2026 is the key deadline for medical device AI. From this date, all new AI-powered SaMD placed on the EU market must comply with high-risk AI requirements, Notified Bodies will incorporate AI Act assessments into MDR/IVDR reviews, and technical documentation must include AI-specific content.

Need to align your AI Act and MDR/IVDR technical documentation?

Talk to our Software, Digital Health & AI team

Diego Rodriguez Muñoz

View all articles →

Industry Insights & Regulatory Updates

FDA Human Factors Guidance 2026: What the Final Guidance Means for Your Submission

FDA Regulation of In Vitro Diagnostic Devices: The Complete Guide for US Market Entry

MDCG 2021-24 Rev.1: What Changed in EU MDR Device Classification (April 2026)

ISO 10993-1:2025 From Checkbox Compliance to Risk-Based Biocompatibility

FDA Companion Diagnostics: A Complete Regulatory Guide to CDx Development, Approval, and Co-Development Strategy

EU MDR 2017/745 for Dental Devices: Complete Guide (2026)

Written by Alberto Bardaji de Qixano Published on 02.03.2026 Last updated on 15.07.2026

March 2, 2026

Dental device regulation under EU MDR 2017/745 has increased the level of scrutiny applied to manufacturers, particularly in three areas: classification decisions, clinical evidence, and Notified Body (NB) review readiness. The practical consequence is simple: submissions that lack internal consistency generate more questions, longer review cycles, and avoidable delays.

In the 2026 webinar delivered by regulatory experts from MDx CRO, the discussion focused on the most common challenges and the most reliable strategies for dental device manufacturers. The insights were grounded in real-world regulatory work supporting more than 500 CE-marked devices, with an emphasis on reducing regulatory risk and building submissions that remain defensible under NB assessment.

Request the webinar replay

receive classification examples, common NB pitfalls, and an NB-ready evidence pack checklist.

Manufacturer priorities under EU MDR: what drives timelines and outcomes

EU MDR does not typically create delays because manufacturers do not have documents. Delays occur when documentation does not form a single, defensible position. Notified Bodies escalate questions when claims, classification rationale, risk controls, clinical evidence, and post-market plans do not support the same intended purpose and performance narrative.

Key priorities for dental device manufacturers under EU MDR:

Establish and maintain a consistent intended purpose and claim set across the file (labeling, IFU, CER, and technical documentation).
Build a classification rationale that is explicit, referenced, and difficult to misinterpret.
Demonstrate clinical evidence proportionality, clearly linked to risk, novelty, and claims.
Prepare for NB review with a coherent evidence package, including traceability from hazards to controls to verification.
Ensure PMS and PMCF are designed to confirm performance and safety in real use, not to satisfy a formal requirement.

A submission is reviewed as an argument supported by evidence. When the argument changes between sections of the file, the NB must resolve the conflict through questions. That process is where time is lost.

Step 1. Classify your dental device correctly (Annex VIII)

Classification under Annex VIII is the point where regulatory strategy becomes operational. A small change in intended purpose or in device characteristics can shift the class and materially change clinical evidence expectations, NB involvement, and post-market obligations.

In the webinar, the discussion repeatedly returned to the importance of early discipline around intended purpose. Dental manufacturers often broaden claims for commercial reasons (for example, broad “compatibility” claims or biologically ambitious performance language). Under MDR, that approach frequently increases the burden of proof.

Practical classification anchors in dental:

Implants and implantable devices frequently fall under Rule 8, with class outcomes dependent on specific characteristics and risk context.
Resorbable materials often face elevated scrutiny because performance and safety evolve as the product degrades and interacts with tissue.
Custom-made versus patient-matched frequently causes misclassification and incorrect pathway selection, particularly in digital workflows.
Software classification under Rule 11 can change significantly based on clinical impact and decision influence.

A defensible classification process typically answers these questions explicitly:

What is the intended purpose and what claims are being made?
Is the device invasive, and if so, what level of invasiveness applies?
What is the duration of use and the relevant contact type?
Is the device implantable, resorbable, or otherwise associated with long-term biological interaction?
Does the device incorporate a medicinal substance with an ancillary action?
Is any element of the product regulated as software influencing clinical decisions?

Classification is assessed as a justification, not a label. A strong justification reduces NB discretion and stabilises the remainder of the submission.

Step 2. Conformity assessment route by class, and how Notified Bodies evaluate risk

Manufacturers often plan around the conformity assessment route, but Notified Bodies allocate effort based on what drives residual risk and uncertainty. Under MDR, two devices of the same class can attract different levels of scrutiny when novelty, claim strength, or evidence quality differs.

In dental, common drivers of NB scrutiny include:

Novel materials and surface treatments particularly where particulate generation, chemical residues, coating stability, or long-term performance need stronger justification.
Compatibility and system claims, especially for implant components and abutments, where broad claims are difficult to support without precise system definition and evidence.
Borderline product categorisation, such as semi-finished CAD/CAM materials, where intended purpose determines medical device status.
Digital workflows, where the manufacturer controls design parameters and outputs are patient-specific within defined constraints.

From a submission strategy perspective, the objective is to reduce uncertainty for the reviewer. That is achieved by ensuring the file communicates a consistent position:

The intended purpose and claims are consistent and reflected in labeling and IFU.
The classification rationale is explicit and mapped to Annex VIII logic.
Risk controls are linked to verification and validation evidence.
Clinical evaluation is proportionate and aligned to claims.
PMS and PMCF demonstrate control over real-world performance.

The NB review process accelerates when the documentation structure allows rapid verification of consistency. It slows down when the reviewer has to reconcile contradictions between sections.

Step 3. Clinical evidence strategy for dental devices: CER, PMCF, and clinical investigations.

Clinical evidence is typically the largest schedule and cost driver under MDR. The core issue is not volume; it is relevance and alignment to the intended purpose, claims, and risk profile.

A manufacturer-ready clinical evidence strategy generally combines:

A Clinical Evaluation Report (CER) anchored to intended purpose and claims.
Literature appraisal aligned with state of the art and device technology.
Post-market surveillance (PMS) data, including complaint trending and failure mode monitoring.
A PMCF approach proportionate to risk and uncertainty, designed to confirm performance and safety in clinical use.

The webinar highlighted a recurring decision point for manufacturers: when “well-established technology” is an appropriate foundation for clinical justification, and when novelty requires additional clinical evidence.

Practical examples discussed in dental context:

Implantables may be approached differently depending on the maturity of the technology, materials, and the presence of novel surface engineering or expanded clinical claims.
Resorbable grafting materials and membranes often require particular attention to degradation behaviour, degradation by-products, biological response, and performance endpoints over time.
Legacy devices require a structured assessment of whether existing data remains fit for MDR expectations and current clinical practice.

Notified Bodies evaluate clinical evidence against the totality of the file. Evidence is rarely accepted in isolation if risk management, claims, and verification logic do not support it.

How to pass a Notified Body Assessment as a dental device manufacturer

In practice, manufacturers do not lose time because they miss a single document. They lose time when their file is not reviewable as a system. Notified Bodies move more efficiently when traceability is clear and when the submission reads as one coherent position.

A practical Assessment-readiness checklist:

Intended purpose and claims are consistent across IFU, labeling, CER, and technical documentation.
Classification is justified with explicit Annex VIII logic and references.
Risk management is device-specific and connects hazards to controls and to verification evidence.
Verification and validation are planned around worst cases, critical characteristics, and real-use conditions.
Clinical evaluation is aligned to claims and supported by appropriate PMS/PMCF.
PMS/PMCF plans are measurable, realistic, and proportionate.

The NB-ready evidence pack (manufacturer checklist)

For internal alignment and faster NB interaction, a compact evidence pack is often effective. A practical NB-ready pack includes:

Device description, intended purpose, and claim list (single source of truth)
Annex VIII classification memorandum (rule logic and rationale)
GSPR checklist with clear evidence references
Risk management file (ISO 14971) and traceability to controls
Verification and validation plan and reports (including worst-case rationale)
Biological evaluation strategy (ISO 10993) and, where relevant, extractables and leachables considerations
Mechanical performance evidence, acceptance criteria, and justification of test conditions
Clinical evaluation (CER), literature strategy, and equivalence rationale when applicable
PMS plan and PMCF plan/report (tailored to failure modes and risk profile)
Labeling and IFU, including UDI readiness and EUDAMED considerations as applicable

The evidence pack is not a marketing summary. It is a reviewer tool. Its value is to reduce time spent locating and reconciling information across the file.

How to categorise dental devices under EU MDR (classification shortcuts by product type)

Dental manufacturers rarely struggle with the existence of Annex VIII. The difficulty is applying it consistently across a portfolio that mixes implantables, materials, digital workflows, and patient-specific outputs. A practical way to reduce ambiguity is to group dental devices by product type first, then confirm the applicable MDR rules and evidence expectations.

Dental implants and abutments
Typical focus areas include the Annex VIII rationale (often centred on implantability), the scope of compatibility claims (system-specific definition), mechanical performance evidence, and the regulatory impact of surface treatments and coatings.
Resorbable grafting materials, membranes, and hemostats
These products often require careful justification of degradation behaviour, degradation by-products, biological response over time, and clinically relevant endpoints. Evidence expectations frequently increase with resorption and biological interaction.
Restoratives and CAD/CAM materials (including semi-finished products)
Categorisation often depends on intended purpose and how the manufacturer positions the product (medical device versus material). Performance claims, manufacturing controls, and labeling language typically drive both classification stability and clinical evidence requirements.
Custom-made versus patient-matched devices
The practical distinction is design control. Custom-made devices require a prescription-led pathway with specific documentation, while patient-matched outputs often operate within a validated design envelope controlled by the manufacturer. This distinction materially affects technical documentation and lifecycle obligations.
Dental software, AI, and digital workflows
Software categorisation under Rule 11 depends on how the software influences clinical decisions and outcomes. Validation, cybersecurity, and change control become central, and AI governance requirements can intersect with technical documentation expectations.

Common dental device categories to review:

A structured categorisation approach helps manufacturers align intended purpose, classification rationale, verification planning, and clinical evidence strategy across the full file, which reduces clarification cycles during review.

To learn more about dental device regulation and compliance support, read: Regulatory Compliance for Dental Products.

PMS, PMCF, UDI/EUDAMED, and legacy devices: maintaining market access

Under MDR, post-market obligations are part of the evidence lifecycle. PMS and PMCF support the ongoing demonstration of safety and performance and can become decisive during renewals and significant changes.

Practical PMS and PMCF considerations in dental:

Define and monitor meaningful signals: failures, revisions, fractures, loosening, complaint patterns, and trends linked to known failure modes.
Ensure PMCF is proportionate and focused on remaining uncertainty, rather than generic data collection.
Maintain a controlled approach to labeling updates, complaint handling, and vigilance reporting.

For legacy devices, manufacturers should perform a structured assessment of whether existing clinical and post-market data remains sufficient for current claims, current clinical practice, and MDR expectations. Where gaps exist, a targeted plan that links risk management to clinical evaluation and post-market follow-up reduces uncertainty and supports continuity of market access.

MDR transition in practice: Argen dental alloys case study

Many MDR transitions fail for predictable reasons: legacy documentation does not meet MDR expectations, clinical evaluation lacks alignment to intended purpose and risk management, and post-market systems are not mature enough to support lifecycle obligations. A recent example from dental materials demonstrates what a structured transition can look like in practice.

Argen transitioned a legacy dental alloy portfolio to Regulation (EU) 2017/745 for use in fabricating full-cast and ceramic-veneered restorations (including crowns, bridges, and removable partial dentures). The project required closing historical Notified Body non-conformities and strengthening core regulatory processes to achieve an audit-ready MDR position

What the work focused on:

Strengthening the clinical evaluation framework
Structuring the PMS system
Aligning risk management with MDR and ISO 14971
Establishing MDR-compliant biological evaluation
Aligning essential technical documentation

To read the full case study, click here: Case Study: How MDx Enabled Argen’s Successful Transition to MDR CE Marking for Dental Alloys.

Request the webinar replay

receive classification examples, common NB pitfalls, and an NB-ready evidence pack checklist.

Frequently Asked Questions About Dental Device Regulation

Do legacy (MDD) dental devices require new clinical data under EU MDR 2017/745?

Not automatically. The decision depends on risk profile, intended purpose, claims, and whether the technology can be justified as well established using appropriate literature, PMS data, and alignment with the state of the art.

Custom-made vs patient-matched in dentistry: what is the practical difference, and what does it change?

The practical difference is design control. Custom-made devices rely on a written prescription and patient-specific specifications defined by the healthcare professional. Patient-matched devices are typically produced within a validated “design envelope” controlled by the manufacturer. This distinction affects documentation expectations, validation logic, and lifecycle obligations.

What validation evidence is expected for patient-matched dental devices?

Manufacturers should define a validated design envelope, identify worst-case configurations within that envelope, and validate the worst case in its final condition. This approach supports a defensible argument that the full envelope remains safe and performs as intended.

Why do resorbable grafts and membranes face higher scrutiny, and what evidence is usually questioned?

Because risk and performance evolve over time as the device degrades. Evidence discussions often focus on degradation behaviour, degradation by-products, biological response, and clinically relevant performance endpoints across the functional period.

When does dental software fall under MDR Rule 11, and what is the fastest way to reduce Notified Body back-and-forth?

When software influences clinical decisions or outcomes, Rule 11 can apply and classification may increase, triggering stronger validation and control expectations. To reduce review cycles, manufacturers should maintain consistency across intended purpose and claims, classification rationale, risk management, verification evidence, clinical evaluation, and PMS/PMCF. Inconsistencies are a major driver of clarification rounds and timeline slippage

Written by:

Alberto Bardaji de Qixano

Master of Engineering with close to 20 years of international experience in product development, regulatory affairs and market access of Medical Devices. Authorized MDR and ISO 13485 QMS Auditor.

View all articles →

Industry Insights & Regulatory Updates

FDA Regulation of In Vitro Diagnostic Devices: The Complete Guide for US Market Entry

ISO 10993-1:2025 From Checkbox Compliance to Risk-Based Biocompatibility

Making IVDR Work in Combined Studies: Scientific & Operational Lessons from 40+ Programs

ISO 14155:2026 What’s Changed and What It Means for Your Clinical Investigation

Portugal’s New Clinical Trials Law No. 9/2026: What Sponsors Need to Know

FDA QMSR Gap Analysis: Compliance Guide for IVD and CDx Manufacturers

Written by Joana Martins Published on 20.02.2026 Last updated on 04.06.2026

February 20, 2026

Joana Martins

On February 2, 2026, the U.S. Food and Drug Administration (FDA) implemented the new Quality Management System Regulation (QMSR), formally replacing the former Quality System Regulation (21 CFR Part 820). With this transition, the FDA incorporated ISO 13485:2016 by reference into U.S. law and introduced a new inspection model under Compliance Program 7382.850.

This article focuses on that second question. It explains how to structure a QMSR gap analysis, which areas almost always reveal gaps in practice, particularly for IVD and companion diagnostic manufacturers, and what FDA inspectors are finding in the first wave of QMSR inspections.

The insights below draw directly on MDx CRO’s quality and regulatory affairs experience supporting IVD manufacturers through QMSR readiness assessments.

Key point: ISO 13485 certification does not equal QMSR compliance. FDA-specific requirements remain fully enforceable, and under QMSR, inspectors now access records they previously could not.

Why the FDA QMSR Matters Beyond the February 2026 Deadline

The February deadline was the starting point, not the finish line. FDA’s Compliance Program 7382.850 is now the active inspection model. Manufacturers operating under the assumption that QMSR readiness was a one-time transition exercise are exposed to a different enforcement environment than the one they prepared for.

Under the former QSR model, inspections used QSIT subsystem checklists. Under QMSR, investigators evaluate how quality processes function as an integrated lifecycle framework, not whether each subsystem satisfies an individual checklist. That structural shift changes what inspectors look for and what they find.

Inspection change: FDA inspectors can now access internal audit reports, management reviews, and supplier audits. Under the previous QSR model, these records were largely outside inspection scope. Many manufacturers are unaware of this shift and have not reviewed the quality or completeness of these documents with inspection readiness in mind.

MDSAP Audit Approach 2026: How It Differs from FDA Inspections Under QMSR

MDSAP audits and FDA inspections serve fundamentally different regulatory functions and must not be conflated.

An MDSAP audit is conducted by an FDA-recognized Auditing Organization. It assesses conformity with harmonized quality management system requirements — ISO 13485 and the regulatory requirements of participating authorities including FDA. It is scheduled, structured, and conformity-focused. Participation remains voluntary.

An FDA inspection is a statutory enforcement activity conducted directly by FDA investigators. Its objective is not certification — it is the evaluation of compliance with US legal requirements and the identification of potential violations, systemic weaknesses, or public health risks.

MDSAP audit	FDA inspection (CP 7382.850)
Conformity-focused	Compliance-driven and enforceable
Scheduled and structured	Risk-based, for-cause, or routine
Bound by MDSAP task structure	Not limited by MDSAP scope or sampling
Outcome: certification report	Outcome: Form 483 / warning letter / no action
Internal records may not be reviewed	Internal audits, supplier audits, management reviews now in scope

Strong MDSAP performance may influence FDA surveillance planning. It does not eliminate the possibility of inspection, nor does it guarantee a favourable outcome when one occurs.

Common Assumptions That Increase Inspection Risk

Several structural misconceptions remain widespread. Under QMSR, these assumptions translate directly into inspection exposure.

“MDSAP replaces FDA inspections.” It informs surveillance planning. It does not limit FDA’s statutory authority.
“If the MDSAP auditor didn’t find it, FDA won’t pursue it.” FDA investigators are not constrained by MDSAP audit depth or task sequencing.
“ISO 13485 certification ensures FDA compliance.” ISO 13485 is incorporated by reference into QMSR, but FDA-specific requirements — UDI, MDR, device listing, labeling controls — remain fully enforceable and are not covered by ISO 13485 alone.
“QMSR was a documentation update.” For ISO-certified manufacturers, many gaps are substantive — missing FDA-required record content, incomplete UDI integration, absent MDR linkage — not cosmetic.

QMSR vs QSR vs ISO 13485: What Actually Changed

QMSR incorporates ISO 13485:2016 by reference into US law. That is a structural alignment, not a reduction in FDA enforcement authority. Obligations related to UDI, MDR, device listing, and labeling controls continue to apply in full.

Element	Former QSR (21 CFR 820)	FDA QMSR (2026)	ISO 13485:2016
Legal status	US regulation	US regulation (ISO 13485 incorporated by reference)	International standard
Inspection model	QSIT subsystem checklists	CP 7382.850 — lifecycle, risk-based	Certification audit
Internal audit access	Limited under §820.180(c)	Internal audits and management reviews reviewable	Auditor access at certification
CAPA focus	Procedural compliance	Demonstrated effectiveness + root cause verification	Effectiveness required
FDA-specific requirements	Fully embedded	UDI, MDR, labeling still fully enforceable	Not included

Takeaway: ISO 13485 alignment does not eliminate FDA-specific compliance obligations. A manufacturer can hold ISO 13485 certification and still have substantive QMSR gaps.

FDA Compliance Program 7382.850: How Inspections Work

As of 2 February 2026, FDA retired QSIT and implemented Compliance Program 7382.850. Inspections are now organised around six integrated QMS areas and four Other Applicable FDA Requirements (OAFRs).

Six QMS areas	Four OAFRs
Change Control	Unique Device Identification (UDI)
Design & Development	Medical Device Reporting (MDR)
Management Oversight	Corrections & Removals
Outsourcing & Purchasing	Tracking
Production & Service Provision
Measurement, Analysis & Improvement

Under this model, FDA evaluates how quality subsystems operate as an interconnected framework — not as isolated elements. Inspectors assess whether risk information, design decisions, post-market data, and management oversight are aligned throughout the product lifecycle.

The Four Areas That Almost Always Reveal Gaps

Across QMSR gap assessments conducted on IVD and medical device manufacturers, four areas surface as gaps with consistent regularity — even in organisations that have maintained ISO 13485 certification for years.

1. Complaint handling and servicing records

Many companies aligned with ISO 13485 underestimate the level of record detail FDA expects. Under QMSR, complaint and servicing records must include specific, enumerated data fields that ISO 13485 does not explicitly define. Records are often incomplete from an FDA perspective even when they satisfy the certification standard.

2. UDI traceability and record integration

UDI compliance is not simply a matter of having a UDI assigned and registered in GUDID. QMSR requires the UDI to be consistently recorded across multiple record types: complaints, servicing records, and batch or device history records. That level of cross-system integration is frequently missing — particularly in manufacturers who completed UDI registration without reviewing how UDI flows through their quality records.

3. Labeling and packaging controls

FDA maintains specific requirements for label content — including UDI, expiry dates, and handling instructions — and expects documented procedures designed to ensure accuracy and prevent mix-ups. These requirements are often handled informally or through processes that do not meet FDA’s explicit documentation expectations, even when the labels themselves are technically correct.

4. Linkage between ISO processes and FDA regulatory requirements

This is the gap that most consistently surprises ISO-certified organisations. A company may have complaint handling aligned with ISO 13485 clause 8.2.2 and consider that requirement closed — but fail to explicitly connect that process to Medical Device Reporting obligations under 21 CFR Part 803. FDA does not treat ISO conformity as a substitute for regulatory linkage. Each process must demonstrably connect to the applicable FDA requirement in the documentation.

“Companies often assume that having a robust ISO-aligned procedure is sufficient. What we find in practice is that the procedure exists — but there is no explicit documented connection between that procedure and the FDA-specific obligation it is meant to fulfil. That gap is invisible until an inspector asks for it.”

Joana Martins, QA/RA Specialist, MDx CRO

Why QMSR Gap Analysis Is More Complex for IVD and CDx Manufacturers

ISO 13485 and QMSR do not formally distinguish between device types. However, the nature of IVDs fundamentally changes which gaps are most consequential and how difficult they are to close.

Illustration of FDA inspection process emphasizing quality management systems, risk-based audits, and manufacturer readiness in MedTech industry.

A QMSR gap analysis for an IVD manufacturer must extend beyond traditional quality system elements. It needs to integrate scientific validity, analytical performance, and clinical evidence into the assessment framework. Where a general medical device gap analysis evaluates whether a product is designed, manufactured, and controlled to ensure safety and functional performance, an IVD-focused analysis must additionally verify that the product generates clinically reliable results under real-world biological variability.

Area	General medical device	IVD / CDx — additional complexity
Design controls	User needs, design inputs, outputs, V&V	Intended use, specimen type, analyte definition, performance claims must link to analytical and clinical data
Risk management	Device failure modes	Must also cover false positive and false negative results, diagnostic decision risks, interfering substances, matrix effects
Production controls	Process validation, specifications	Lot-to-lot variability of biological materials must be validated against clinically relevant performance criteria
Post-market surveillance	Complaint handling, MDR	Must detect performance drift — shifts in sensitivity or specificity — not just product failures
Purchasing controls	Supplier qualification	Supplier variability can directly affect assay performance outcomes

“For IVDs, failures may not manifest as product defects — they manifest as clinically incorrect results. That is a more insidious form of non-compliance, and it means the risk management and design control documentation needs to work harder than it does for a general medical device.”

Joana Martins, QA/RA Specialist, MDx CRO

What FDA Is Finding in QMSR Inspections: Warning Letter Patterns

Recent warning letters issued by CDRH following QMSR inspections show a consistent pattern. Deficiencies are not isolated — they are interconnected, reflecting a failure to operate an effective integrated quality system rather than individual documentation gaps.

Finding category	Most common deficiency pattern
CAPA	Procedures not defined or inadequate; failure to investigate root causes; CAPAs not verified for effectiveness
Complaint handling	Complaints not properly documented or evaluated; failure to assess whether complaints are reportable under MDR; no complaint trending or statistical analysis
Design controls	Lack of design verification and validation; poor documentation of design changes and their impact; no design and development plan or procedure
Supplier controls	Lack of defined quality requirements that suppliers must meet; no risk-based audit justification
Process validation	Manufacturing processes not validated; no revalidation after changes; validation protocols incomplete or not scientifically justified
Management responsibility	Management not actively involved in QMS; no effective management review with documented decisions and follow-up

Important: The FDA has clarified that if previous inspections were conducted under the QS Regulation (prior to 2 February 2026), any corrective actions proposed or implemented must now be pursued pursuant to QMSR requirements — not the former QSR standard.

What FDA Inspectors Scrutinize Most

Based on regulatory inspection support experience, three documentation areas present heightened exposure under QMSR.

1. Internal audits, supplier audits, and management review records

Under QMSR, FDA inspectors may review internal audit reports, supplier audit outcomes, and management review records. Investigators evaluate whether quality processes function effectively in practice — not merely whether procedures formally exist. Records must clearly demonstrate identified issues, root cause analysis, corrective actions, and documented closure. Incomplete or draft audit records increase inspection risk.

2. Design controls and traceability (ISO 13485 clause 7.3)

Manufacturers must demonstrate full traceability across user needs, design inputs, design outputs, verification and validation, and residual risks. Traceability weaknesses frequently arise at the interfaces between risk management files, labeling claims, UDI triggers, and MDR criteria. For companion diagnostics, this alignment is especially critical because intended use, biomarker claims, and clinical evidence directly impact regulatory risk classification.

3. CAPA and effectiveness verification

CAPA remains one of the most enforcement-sensitive areas under QMSR. The most common weakness is the absence of documented effectiveness verification following corrective actions. Closing a CAPA administratively — marking it complete without objective evidence that the root cause was eliminated — is insufficient. Investigators expect evidence demonstrating that actions prevented recurrence.

Inspection Risk Indicators

Risk area	Typical vulnerability
CAPA	Repeated issues without documented effectiveness verification
Design controls	Incomplete traceability between risk analysis and design inputs
Management review	Minutes lacking documented decisions, metrics, or follow-up actions
Supplier oversight	No risk-based justification for audit scope; missing quality requirements for suppliers
Post-market surveillance	Complaint trends not connected to CAPA or design updates
UDI	Not consistently recorded across complaints, servicing records, and device history records
MDR linkage	Complaint handling procedures not explicitly connected to MDR reporting obligations

How to Conduct a QMSR Gap Analysis: Process and Timeline

ISO 13485 certification does not automatically confirm FDA QMSR compliance. A structured gap analysis identifies the regulatory overlays and inspection exposure points that ISO conformity alone leaves unaddressed.

What a QMSR gap analysis covers

A thorough assessment works through four stages:

Clause mapping: Map ISO 13485 clauses to QMSR references. Confirm terminology alignment. Identify where the QMSR adds FDA-specific requirements beyond the ISO standard.
FDA-specific overlay identification: Verify explicit incorporation of UDI requirements across all applicable record types, MDR reporting triggers and their linkage to complaint handling, labeling obligations under 21 CFR Part 801, and device listing and registration controls.
Documentation exposure review: Assess internal audit completeness and whether records are inspection-ready, CAPA effectiveness evidence, management review decision traceability, and supplier risk classification and audit justification.
Risk prioritisation and remediation planning: Each gap is assessed for potential impact on quality, business continuity, and regulatory standing. Higher-risk gaps — those most likely to generate Form 483 observations or warning letters — are prioritised for remediation with assigned ownership and timelines.

How long does it take?

A gap analysis typically takes 4–6 weeks, provided documentation is made available at the outset. Implementation of corrective actions depends on the number and severity of findings and on the responsiveness of the internal team.

For manufacturers with both QMSR and ISO 13485 gaps, implementation may take 4–5 months. Where gaps are limited to QMSR-specific requirements in an otherwise ISO-aligned system, the timeline is typically shorter.

The ISO 13485 certification gap — what ‘compliant’ actually means

A persistent scenario in QMSR readiness work: a manufacturer holds ISO 13485 certification, has documented procedures that appear robust, and believes ISO alignment is sufficient. Gaps emerge in missing FDA-required data fields in records, incomplete UDI implementation, and failure to link ISO processes to FDA regulatory requirements.

They are structurally compliant with ISO but not fully aligned with FDA expectations. The distinction matters: an FDA inspector is not evaluating conformity to a certification standard. The inspector is evaluating compliance with US law and assessing whether the quality system actually functions as an integrated framework.

Medical device quality management and inspection process with team training, data-driven review, and inspection narratives for FDA compliance.

Download

QMSR Gap Assessment Checklist for IVD and CDx Manufacturers — A structured reference document developed by the MDx CRO quality team.

Download the FDA QMSR Gap Assessment Checklist

Practical Implications for Manufacturers

Inspection scope may be data-driven. FDA may use pre-inspection data reviews to target areas of concern, increasing scrutiny where trends or inconsistencies are identified.

FDA inspectors are evaluating how quality processes work together in practice — not whether each subsystem satisfies a checklist in isolation.

Previously internal records are now fair game. Internal audit reports, supplier audit outcomes, and management review records may be reviewed. These documents must reflect issues identified, decisions made, and actions taken.

Risk management must be continuous and demonstrable. FDA expects risk to be actively monitored and linked to CAPA, design changes, supplier controls, and post-market surveillance — not treated as a static exercise.

Post-market data is a primary inspection focus. Complaint trends, MDR, recalls, UDI, and tracking data are increasingly used to assess whether the quality system is effective and responsive.

How MDx Supports FDA QMSR Readiness: Expert Insight

Transitioning from QSR to FDA QMSR requires more than updating terminology. It demands structural alignment, inspection-oriented preparation.

Based on field experience supporting manufacturers through inspection preparation and regulatory alignment projects, Joana Martins, QA/RA Specialist at MDx, emphasizes that the most frequent vulnerabilities do not stem from missing procedures, but from insufficiently demonstrated system effectiveness.

According to Joana’s inspection readiness experience, organizations often underestimate three exposure points during FDA inspection preparation:

The depth of documentation review now permitted under QMSR
The need for traceability between risk management, design controls, and post-market data
The importance of documented effectiveness verification within CAPA systems

To address these exposure points, MDx supports medical device manufacturers through:

Independent QMSR-aligned readiness assessments focused on inspection exposure
Structured QMSR gap analysis incorporating FDA-specific regulatory overlays
Mock FDA inspections aligned with Compliance Program 7382.850
Strategic support for companies developing FDA companion diagnostics, where design traceability, labeling controls, and lifecycle data integration require heightened regulatory coherence

Rather than approaching FDA QMSR as a documentation update, MDx works with organizations to ensure their quality systems demonstrate operational integrity, risk-based decision-making, and inspection resilience.

Organizations preparing for FDA inspection or evaluating their QMSR alignment can benefit from early, structured assessment. Proactive evaluation reduces remediation timelines, minimizes inspection disruption, and strengthens regulatory confidence.

Frequently Asked Questions About FDA QMSR, MDSAP, and Inspections

What is the main difference between QSR and QMSR?

The main difference is structural alignment. Under QSR, FDA requirements were written directly into 21 CFR Part 820. Under QMSR, the FDA incorporates ISO 13485:2016 by reference into U.S. law while keeping FDA-specific obligations in force. In short, QMSR harmonizes structure with ISO 13485. However, it does not reduce FDA enforcement authority or eliminate U.S.-specific requirements such as MDR, UDI, or device listing.

Does ISO 13485 certification guarantee FDA compliance under QMSR?

No, it does not. Although ISO 13485 forms the backbone of QMSR, FDA-specific statutory requirements still apply. Manufacturers must comply with MDR, UDI, corrections and removals, and other U.S. obligations. Based on regulatory experience, companies often assume ISO certification closes all gaps. In practice, a targeted QMSR gap assessment is necessary to confirm full FDA alignment.

What replaced QSIT in FDA inspections?

FDA replaced QSIT with Compliance Program 7382.850, effective February 2, 2026. This new program aligns inspections with the QMSR framework. Instead of subsystem checklists, FDA now organizes inspections around six QMS areas and four Other Applicable FDA Requirements (OAFRs). As a result, inspections follow a more integrated, risk-based, lifecycle-focused approach.

Can FDA inspect internal audit reports under QMSR?

Yes. Under QMSR, FDA investigators may review internal audit reports, supplier audits, and management review records.
In practice, inspectors now verify whether issues were identified, documented, and effectively closed. They no longer focus only on whether procedures exist, they assess whether the system works as intended.
Incomplete or unverified audit actions may increase inspection risk.

What records are now receiving greater scrutiny during FDA inspections?

FDA now places greater scrutiny on:
– Internal and supplier audit reports
– Management review documentation
– Design control traceability records
– CAPA procedures and effectiveness checks
From inspection experience, CAPA effectiveness verification is a frequent weak point. Companies often implement corrective actions but fail to document objective evidence that the action resolved the root cause.
Under QMSR, effectiveness matters as much as documentation.

Why are companies that passed MDSAP still receiving FDA 483 observations?

Because MDSAP and FDA inspections serve different purposes. MDSAP evaluates conformity. FDA inspections assess legal compliance and public health risk. FDA investigators are not bound by MDSAP sampling methods or audit scope. If inspectors identify ineffective CAPA, weak traceability, or gaps between procedures and actual practice, they may issue Form 483 observations, even after a successful MDSAP audit.

How should manufacturers prepare for FDA inspections under QMSR?

Start early. Preparation often takes longer than expected. Then conduct a structured QMSR gap assessment. ISO 13485 compliance alone does not confirm full FDA alignment. Finally, train teams on Compliance Program 7382.850. Mock interviews and inspection simulations help identify weaknesses. Even documented remediation in progress demonstrates system control and reduces inspection risk.

When does FDA QMSR enforcement begin?

FDA QMSR enforcement began on February 2, 2026, when the new Quality Management System Regulation officially replaced the former Quality System Regulation (21 CFR Part 820). From that date, FDA inspections operate under Compliance Program 7382.850.

What are the FDA QMSR and ISO 13485 harmonization requirements for 2026?

Under the 2026 QMSR, ISO 13485:2016 is incorporated by reference into U.S. law. This means manufacturers must meet ISO 13485 requirements as part of FDA compliance. However, harmonization is not complete equivalence, FDA-specific obligations such as UDI, MDR reporting, device listing, and labeling controls remain fully enforceable and are not covered by ISO 13485 alone. See the QSR vs QMSR vs ISO 13485 comparison table above for a detailed breakdown.

Written by:

Joana Martins

View all articles →

Industry Insights & Regulatory Updates

FDA Human Factors Guidance 2026: What the Final Guidance Means for Your Submission

FDA Regulation of In Vitro Diagnostic Devices: The Complete Guide for US Market Entry

MDCG 2021-24 Rev.1: What Changed in EU MDR Device Classification (April 2026)

ISO 10993-1:2025 From Checkbox Compliance to Risk-Based Biocompatibility

FDA Companion Diagnostics: A Complete Regulatory Guide to CDx Development, Approval, and Co-Development Strategy