Selecting an ISO 14155-compliant CRO requires more than checking whether the standard appears in a proposal or capabilities presentation. Sponsors should verify how the CRO applies Good Clinical Practice to study design, risk management, monitoring, safety reporting, data management, vendor oversight and the final clinical investigation report.
An ISO 14155-compliant CRO should be able to demonstrate its processes, responsibilities and study records. A general statement of compliance is not sufficient evidence of operational readiness.
What Does ISO 14155 Compliance Mean for a Medical Device CRO?
ISO 14155 defines Good Clinical Practice for the design, conduct, recording and reporting of clinical investigations involving medical devices and human subjects.
The standard is intended to protect the rights, safety and well-being of subjects, support scientifically sound investigations, ensure credible results and define the responsibilities of sponsors and principal investigators.
For a CRO, compliance should be visible in the systems and controls used to perform delegated clinical investigation activities. Depending on the scope of work, this may include:
- Study design and Clinical Investigation Plan development
- Risk-based planning and oversight
- Ethics committee and competent authority submissions
- Site selection, qualification and initiation
- Monitoring and protocol compliance
- Informed consent controls
- Safety and device-deficiency reporting
- Data management and statistical planning
- Vendor and subcontractor oversight
- Clinical investigation reporting
- Corrective and preventive action management
- Document control and record retention
The sponsor may delegate activities to a CRO, but delegation does not remove the need to define responsibilities and maintain appropriate oversight.
ISO 14155:2026 and the EU MDR
ISO 14155:2026 is the current international edition of the standard. It was published in March 2026 and replaced ISO 14155:2020.
The standard provides a recognised GCP framework, but it does not replace the legal requirements of Regulation (EU) 2017/745, applicable national requirements, ethics approvals or competent authority decisions.
Sponsors should confirm:
- Which edition is applicable to the planned investigation
- The harmonisation status relevant to the EU MDR
- Whether contracts, approvals or internal procedures reference an earlier edition
- How the CRO has assessed and implemented the 2026 changes
- Whether ongoing investigations require a documented gap assessment
For a detailed review of the new edition, read ISO 14155:2026: What Changed and What It Means for Your Clinical Investigation.
Evidence to Request from an ISO 14155 CRO
A CRO should be able to demonstrate how ISO 14155 requirements are incorporated into its clinical operations. The evidence should be relevant to the services being delegated and the risk profile of the investigation.
Quality System and Procedures
Request the list of controlled procedures that apply to the proposed project. Relevant procedures may cover protocol development, submissions, site management, monitoring, safety reporting, data management, statistics, vendor oversight, deviations, CAPA and document retention.
Confirm that the procedures are current, approved, version controlled and supported by training records.
Allocation of Responsibilities
Request a responsibility matrix that distinguishes:
- Responsibilities retained by the sponsor
- Activities delegated to the CRO
- Responsibilities assigned to investigators and sites
- Activities performed by laboratories, central vendors or subcontractors
- Escalation and approval responsibilities
The scope of work, contract, Clinical Investigation Plan and responsibility matrix should be consistent.
Risk-Based Clinical Investigation Planning
Ask how the CRO identifies risks to subject safety, data integrity and investigation objectives.
The CRO should be able to explain how identified risks affect monitoring, data review, escalation thresholds, vendor oversight and corrective actions. A generic monitoring plan that does not reflect the device, procedure, population or endpoints is a warning sign.
Monitoring and Site Oversight
Review how the CRO:
- Selects and qualifies investigation sites
- Trains investigators and site personnel
- Verifies informed consent
- Reviews protocol compliance
- Assesses source data and critical data
- Manages deviations
- Escalates safety or quality concerns
- Documents monitoring findings and follow-up
- Confirms site close-out and record retention
The monitoring approach should be proportionate to the investigation’s risks and critical data.
Safety Reporting and Device Deficiencies
Confirm that the CRO can distinguish and manage adverse events, serious adverse events and device deficiencies under the applicable MDR and clinical investigation requirements.
The sponsor and CRO should agree who assesses events, who submits reports, which timelines apply and how follow-up information is obtained and documented.
Data Management and Statistical Controls
Request evidence that the CRO’s data-management and statistical processes are defined before data collection begins.
This should include, where applicable:
- eCRF design and validation
- Data-management planning
- Edit checks and query management
- Medical coding
- Database access controls
- Audit trails
- Data review and cleaning
- Statistical Analysis Plan development
- Protocol-deviation handling
- Database lock
- Data transfer and archiving
The statistical methods should be aligned with the investigation objectives, endpoints and sample-size assumptions.
Vendor and Subcontractor Oversight
Identify which activities will be subcontracted and how the CRO qualifies, contracts, supervises and evaluates those vendors.
The use of subcontractors should not create gaps in accountability. The sponsor should know which organisation performs each critical activity and how performance issues will be escalated.
Audit, CAPA and Inspection Readiness
Ask for the CRO’s processes for internal audits, investigation-specific audits, root-cause analysis, CAPA and inspection support.
The CRO should be able to explain how significant deviations or recurring findings are investigated, corrected and prevented from recurring.
Questions to Ask Before Selecting an ISO 14155 CRO
Use the following questions during qualification and proposal review:
- Which ISO 14155:2026 requirements are directly relevant to the activities you will perform for this investigation?
- How have your SOPs, templates and training been updated for the 2026 edition?
- Which responsibilities will remain with the sponsor, and which will be delegated to your team?
- How will you identify and manage risks to subject safety and data credibility?
- How will the monitoring strategy be adapted to our device, procedure, endpoints and investigation sites?
- Who is responsible for serious adverse event and device-deficiency assessment, reporting and follow-up?
- Which activities will be subcontracted, and how will those vendors be qualified and overseen?
- What experience does the proposed project team have with our device type, risk class and therapeutic area?
- How are protocol deviations, monitoring findings and quality issues escalated?
- Which records will be available to demonstrate compliance during an audit or regulatory inspection?
The answers should be supported by project-relevant documents, named personnel and defined responsibilities.
ISO 14155 Compliance Is Not Just a Certificate
ISO develops and publishes standards but does not certify organisations itself. If a CRO presents a third-party certificate or assessment, the sponsor should still verify its scope, issuing organisation, validity and relevance to the activities being delegated.
A certificate does not replace a project-specific qualification. The sponsor should assess whether the CRO’s procedures, personnel, systems and oversight model are appropriate for the planned clinical investigation.
Warning Signs During CRO Qualification
Further review is warranted when a CRO:
- Describes ISO 14155 compliance without providing supporting procedures or records
- Uses pharmaceutical trial processes without adapting them to medical devices
- Cannot explain the responsibilities retained by the sponsor
- Proposes the same monitoring model for every investigation
- Has no defined process for device deficiencies
- Cannot identify the personnel who will perform the work
- Subcontracts critical activities without a documented oversight model
- Makes approval, timeline or cost guarantees that cannot be substantiated
- Cannot explain how it has addressed ISO 14155:2026
These findings do not necessarily disqualify a CRO, but they should be resolved before responsibilities are delegated.
ISO 14155 and IVD Performance Studies
ISO 14155:2026 applies to clinical investigations of medical devices. It does not apply directly to in vitro diagnostic medical devices.
IVD performance studies are addressed through the IVDR and ISO 20916, together with other applicable regulatory and study-specific requirements. Sponsors conducting combined or complex studies should define which framework applies to each device and activity.
How MDx Supports ISO 14155 Clinical Investigations
MDx supports medical device sponsors across the clinical investigation lifecycle, including:
- Clinical strategy and feasibility
- Clinical Investigation Plan development
- Competent authority and ethics submissions
- Site identification and qualification
- Project management
- Monitoring
- Safety reporting coordination
- Data management and biostatistics
- Clinical investigation reporting
- EU legal representation
The project scope and allocation of responsibilities are defined with the sponsor before study execution.
For broader commercial and operational capabilities, visit our medical device CRO services.
Frequently Asked Questions
ISO 14155 provides the international Good Clinical Practice framework for medical device clinical investigations. The legal obligations for an EU investigation derive from the MDR, applicable national requirements and the relevant approvals. Sponsors should confirm the applicable edition and harmonisation status for their investigation.
A sponsor can delegate clinical investigation activities, but the allocation must be documented and appropriately supervised. Delegating an activity does not remove the sponsor’s need to ensure that the investigation is properly planned, conducted and reported.
Not by itself. Sponsors should review the certificate’s scope and validity, if one is presented, but should also examine the CRO’s procedures, personnel, systems, experience and project-specific controls.
ISO 14155 addresses clinical investigations of medical devices. ISO 20916 addresses clinical performance studies using specimens from human subjects for in vitro diagnostic medical devices.
The sponsor should assess the applicable regulatory, contractual and approval requirements and document any gaps between the study’s current processes and the new edition. Changes to an authorised investigation may require controlled implementation and, where applicable, assessment as a substantial modification.
Evaluate Your Medical Device CRO
CRO qualification should establish how the proposed team will protect subjects, generate credible data and fulfil the activities delegated by the sponsor.
MDx can review your clinical investigation requirements, define the project responsibilities and support execution under the applicable MDR and ISO 14155 framework.
