ISO 14155:2026 What’s Changed and What It Means for Your Clinical Investigation

The fourth edition of the international GCP standard for medical device clinical investigations is now in effect, with no transition period. Here is what sponsors, investigators, and CROs need to know.

ISO 14155:2026 was published in March 2026. 

It replaces ISO 14155:2020 as the global benchmark for Good Clinical Practice (GCP) in medical device clinical investigations, covering everything from trial design and risk management to informed consent and safety reporting. There is no defined transition period. If your study is in planning, you are expected to comply now.

Data	Status
Current edition	ISO 14155:2026 (4ª edition), March 2026
Transition Period	None, applies immediately
EU MDR harmonisation	EN ISO 14155:2020 remains the harmonised standard; 2026 harmonisation in progress
Last Update	10 June 2026

A Standard That Has Been a Long Time Coming

ISO 14155 has been the GCP reference for medical device clinical investigations since its first edition in 2003. The third edition, published in July 2020, made significant strides in aligning the standard with the EU Medical Devices Regulation (MDR 2017/745) and the ICH E6(R2) framework. But five years of practical implementation exposed gaps, particularly around risk management, study oversight structures, and statistical planning.

The fourth edition directly addresses those gaps. It introduces more prescriptive requirements, clearer distinctions between types of risk, new formal oversight structures, and a statistical annex that brings medical device investigations much closer to the rigour expected in pharmaceutical trials.

⚠ No transition period, requirements apply immediately

One timing point worth noting: ISO 14155:2020 had only just achieved formal harmonisation with the EU MDR when the fourth edition arrived, an unusual situation that has created legitimate questions for sponsors about the harmonisation status of the new standard. As of publication, EN ISO 14155:2020 remains the harmonised standard for MDR conformity purposes. The harmonisation process for ISO 14155:2026 is ongoing. Sponsors should monitor the EU Official Journal for updates.

Sponsors preparing an EU MDR application can use our MDCG 2024-5 Investigator’s Brochure checklist to align the IB with Annex XV and the current Good Clinical Practice framework.

The Key Changes: What’s New in ISO 14155:2026

1. Risk Management: A Clearer, More Structured Framework

If applying ISO 14971 risk management principles to clinical investigations has been a grey area in your organisation, the fourth edition addresses this directly.

The key distinction introduced is the separation of two categories of risk:

Device-related risks: including residual risks relevant to the specific study population, sample size, and indication, must be evaluated using full ISO 14971 methodology. The standard recognises that adverse device effect rates during an investigation can differ from post-market use. A small trial population amplifies ethical impact; risks must be contextualised accordingly.

Procedure-related risks: arising from non-routine clinical procedures required by the Clinical Investigation Plan (CIP) but outside standard clinical practice, require a descriptive risk assessment.

A risk based monitoring approach should be defined to manage the oversight of risks associated with the clinical investigation.

The standard clarifies how general device risk management principles translate into study-specific considerations, with focus on investigational device risks, especially residual risks relevant to the study population, sample size, and indication. These updates will require greater rigour when conducting and documenting risk assessments, but the result will be sponsors having more robust, better-documented risk management files tailored to each investigation.

Kirsty Macleod, Head of Clinical Research, MDx CRO

2. Data Monitoring Committees and Clinical Events Committees: Formal Requirements for Both

Study oversight structures receive significant attention in the fourth edition, but the role of a Data Monitoring Committee should not be reduced to a simple device-risk-class rule.

ISO 14155:2026 uses Data Monitoring Committee (DMC) as the main term and also recognises Data and Safety Monitoring Board (DSMB) among the equivalent terms. The 2026 edition adds a requirement to justify the absence of DMC involvement in the Clinical Investigation Plan (CIP). Where a DMC is established, it also strengthens governance by requiring the committee to confirm the conditions under which the clinical investigation would be suspended or stopped.

Practical perspective

“For the DSMB, my experience is that the first question is not ‘Do we need a DSMB because this is a Class III device?’ but rather ‘Does the risk profile and study design justify independent safety oversight?’”

David Tomé, President at MDx CRO

In practice, that assessment should consider the characteristics of the individual investigation rather than device classification alone. Relevant factors include:

• The novelty and invasiveness of the device
• Whether the intervention is reversible
• The characteristics and vulnerability of the patient population
• The seriousness of anticipated adverse events
• The level of uncertainty around the existing safety profile
• Whether interim analyses or predefined stopping criteria are planned

When a DMC or DSMB is appropriate, independence is critical. A practical multidisciplinary model will typically include clinicians with relevant therapeutic and device expertise together with a biostatistician, with potential conflicts of interest identified and controlled.

The DMC or DSMB charter should define, at a minimum:

• Committee membership and responsibilities
• Conflicts-of-interest requirements
• Access to blinded or unblinded data
• Meeting frequency
• Triggers for additional or unscheduled review
• Statistical monitoring principles
• Predefined stopping or suspension criteria
• How recommendations are communicated to the Sponsor

During the investigation, the committee can review cumulative safety data together with clinical performance or effectiveness data, as applicable, to determine whether the overall benefit-risk picture is changing. Its recommendations may be to continue the investigation as planned, modify it, temporarily suspend it or stop it.

The DMC remains advisory. Responsibility for decisions concerning the clinical investigation ultimately remains with the Sponsor.

A Clinical Events Committee (CEC) serves a different purpose. The 2026 edition adds a dedicated CEC section covering an independent group of clinical experts that can be established to support consistent assessment of clinical events across participating centres. This is particularly relevant in multi-centre investigations where differences in event classification between investigators could introduce variability.

In practical terms, the distinction is:

• DMC/DSMB: reviews accumulating study-level data and advises on whether the investigation should continue, change, suspend or stop.
• CEC: supports consistent clinical event assessment or adjudication across sites.

Where a CEC is used, its independence, responsibilities and conflict-of-interest controls should therefore be defined separately from the DMC governance structure.

3.Informed Consent: Strengthened Expectations and Ethics Committee Implications

The fourth edition introduces more operational requirements around ethics, subject rights, and consent.

Specific updates include a prohibition on deviations from eligibility criteria without a formal CIP amendment; clearer requirements for explaining future use of health data to subjects; and expanded protection requirements for vulnerable populations and cross-border studies.

Ethics committees will scrutinise these more closely. Sponsors referencing ISO 14155:2026 compliance in submissions should expect greater attention to consent documentation, the consent process itself, and how protocol deviations are governed.

Ethics committees will have altered expectations when sponsors state compliance with the revised standard. Any mismatches between the risk management file and the informed consent form, downplaying known residual risks, using generic language, are routinely flagged during ethics review. The risk file and the consent must tell the same story, in plain language.

Kirsty Macleod, Head of Clinical Research, MDx CRO

4. Design Considerations: The Estimand Framework Arrives

The introduction of Annex K, a new informative annex on clinical investigation design considerations, brings the device world significantly closer to the statistical expectations long standard in pharmaceutical development.

In practice, this means study protocols are expected to more precisely define the clinical question being answered, including how intercurrent events (patient dropouts, treatment switches, protocol deviations) are handled in the primary analysis. Missing data strategies must be planned prospectively, not fixed post-hoc.

For organisations working across both medical devices and pharmaceuticals, this alignment reduces friction. For teams accustomed to simpler device trial designs, it will require additional investment in biostatistics at the planning stage.

5. Clinical Performance: A Sharper Definition With Real Consequences

The definition of “clinical performance” has been updated to more explicitly link device performance to measurable clinical benefit resulting from technical or functional characteristics. This is not a minor editorial change. It has direct implications for how endpoints are selected and justified in the CIP, and how clinical evidence is structured in Clinical Evaluation Reports (CERs).

Sponsors designing new studies need to ensure their primary endpoints map directly to the updated definition. For CER authors, it adds another layer of alignment to consider when assessing clinical data generated under different versions of the standard.

The Most Common Mistakes Sponsors Make regarding ISO 14155, and How to Avoid Them

When running and overseeing clinical investigations, the same errors appear repeatedly when sponsors try to apply risk management requirements to active studies. The fourth edition makes some of these errors significantly harder to ignore during regulatory or ethics review.

The mistake	What is expected instead
Reusing the post-market risk file unchanged Clinical investigations have different risk profiles, smaller populations, learning-curve users, investigational configurations. The ISO 14971 product risk file created for design verification does not translate directly.	A study-specific risk assessment clearly linked to the CIP, subject population, site capabilities, and operator experience. Justified differences between clinical investigation risk and intended-use risk.
Applying full ISO 14971 to procedure risks Sponsors apply the full methodology to blood draws, biopsies, imaging, and extra clinic visits, logging these as device risks. Regulators increasingly challenge over-engineered risk files because they obscure actual device risk.	Clear separation in documentation: device-related risks, ISO 14971 process; procedure-related risks, descriptive assessment. Explicit statement in the CIP explaining this distinction.
Freezing the risk file once the study starts Risk management is treated as a design artefact with no named responsibility during execution. Adverse events, near-misses, and protocol deviations that reveal new hazards are not fed back into risk assessment.	Defined triggers for risk review (SADEs, DMC recommendations, deviation trends). Documented updates showing how clinical findings feed back into hazard identification, risk estimation, and benefit-risk evaluation.
Weak linkage between risk file and consent form The informed consent form downplays known residual risks, uses generic language, or is inconsistent with what appears in the risk management file. Ethics committees view this as a red flag.	Clear mapping between residual risks and subject-facing explanations. Justification where technical risks are simplified or grouped. Immediate consent updates if risk understanding changes.
Risk controls that exist on paper but not in the study Controls are listed in the risk file but not implemented, training listed but not documented, IFU warnings not reflected in consent, monitoring controls not built into the protocol.	Traceability from risk, control, CIP section, training, monitoring. Cross-checks during monitoring that controls are actively applied. This is one of the most common audit findings.

Study procedures must also define how adverse events, device deficiencies and new safety findings will be assessed and communicated. Our guide to MDCG 2020-10/1 safety reporting explains the reportable-event criteria, causality rules, competent authority deadlines and MDCG 2020-10/2 reporting form.

What Happens to Studies Already Underway?

This is a frequently asked question by sponsors where the answer requires some nuance.

Studies initiated and approved under ISO 14155:2020 remain valid. The publication of the fourth edition does not retroactively invalidate work done in compliance with the previous version. A study designed, approved, and conducted in line with ISO 14155:2020 remains compliant with that version, and that data remains usable to support CE marking, clinical evaluation updates, and post-market evidence, provided it was compliant at the time of initiation.

Where things become more complex is with substantial amendments. If an ongoing study undergoes a significant change after March 2026, a protocol amendment, addition of new sites, introduction of a DMC or CEC, changes to the subject population, regulators and notified bodies may expect the affected areas to be brought into alignment with ISO 14155:2026. This is not a hard rule, but it is a risk-based expectation that should be assessed and documented.

In practice, authorities accept a clear, documented rationale: the clinical investigation was designed and initiated in compliance with ISO 14155:2020, which represented the state of the art at the time of study initiation. The publication of ISO 14155:2026 has been reviewed, and no changes were required that would materially impact subject safety, data integrity, or scientific validity. This approach is widely accepted, provided it is documented, risk-based, and justified.

Kirsty Macleod, Head of Clinical Research, MDx CRO

What Sponsors and Investigators Must Do Now

Given that there is no transition period, the question is not whether to act but how to prioritise. Here is a practical framework:

1. Run a formal gap analysis

Assess your current SOPs, CIP templates, risk management processes, and oversight structures against ISO 14155:2026. Focus first on risk management (device vs. procedure risk distinction), DMC/CEC governance, and statistical planning documentation.

2. Update your QMS and SOPs

Procedures, templates, and SOPs that reference ISO 14155:2020 need revision, particularly around CEC governance (new), DMC governance (strengthened), risk management integration, and informed consent processes.

3. Assess ongoing studies

Review active protocols or protocols in development. For studies with upcoming substantial amendments, prepare a documented assessment of whether and how ISO 14155:2026 requirements apply. Always document the rationale for decisions made, or not made.

4. Deliver structured training

Sharing the updated standard document is not sufficient. The risk management changes in particular require dedicated training for clinical affairs, regulatory affairs, and quality teams, not just a circulated PDF.

5. Monitor the harmonisation process

Keep an eye on the EU Official Journal for updates on the formal harmonisation of ISO 14155:2026 under the MDR. Until harmonised, EN ISO 14155:2020 remains the reference for MDR conformity presumption.

Key insight

The core principles of Good Clinical Practice for medical device investigations remain stable. What the 2026 revision adds is greater structure, clarity, and prescriptiveness, especially around risk management and ethical requirements. In the long run, this benefits patient safety, study design rigour, and the robustness of the evidence generated. The burden is front-loaded; the payoff is fewer audit findings and more defensible submissions.

    

Related articles

Investigator’s Brochure: MDCG 2024-5 and ISO 14155

Safety Reporting in Clinical Investigations

Clinical Investigation Reports and summaries under EU MDR

Clinical Development for Medical Devices: From Strategy to Submission