Most of the manufacturers I talk with are running their first clinical study with a team that has never run one before. A design engineer becomes the de facto study lead. A regulatory affairs hire from a different device class gets handed a protocol and a spreadsheet. Nobody on staff has managed site relationships, query resolution, or an audit trail before, and the study is already on the calendar.
That combination, real regulatory stakes and zero institutional memory, is what makes the first study different from every study that follows. Teams that have run five trials know where the friction sits. Teams running their first one are learning that in real time, on a live study, with a submission timeline attached. Some of the hardest lessons show up early, which is why the common mistakes in the first-in-human study process tend to repeat across companies that have never done this before.
I have spent years on the clinical data side of medical device development, first with Smart-Trial and now inside Greenlight Guru Clinical. The pattern I see most often is not a lack of regulatory knowledge. Teams entering their first study usually know that ISO 14155 and 21 CFR Part 11 exist. What trips them up is translating that knowledge into how the study actually gets set up, who touches the data, and what happens to the evidence after the study closes.
If you have just been handed a protocol and told the company needs clinical data, this guide is for you. Clinical evidence is the data your study generates to show a device is safe and performs as intended, and it has to hold up in front of the FDA or a notified body years after the study closes. The decisions that determine whether it holds up are the ones you make before you enroll subject one: what you collect the data in, who controls that data, and how well the study is structured to meet ISO 14155 and 21 CFR Part 11.
What spreadsheets, generic EDC, and CROs cost a first-time study team
Three defaults show up again and again in first-time studies, and each one feels reasonable in the moment.
The first is spreadsheets. A small team with a small study and a tight budget reaches for what everyone already knows how to use. Spreadsheets have no audit trail, no field-level validation, and no structured way to demonstrate to a notified body or the Food and Drug Administration (FDA) that a data point was entered correctly the first time and never altered without a record. The problems that come from running clinical data in paper and Excel rarely show up during the study. They show up during the submission review, when fixing them costs far more than building the structure would have cost at the start.
The second default is a generic electronic data capture (EDC) platform built for pharmaceutical trials. These tools are not wrong, but they were designed around large multi-site drug trials with dedicated data management staff. A five-person device company configuring a pharma-first EDC for a 20-subject feasibility study spends weeks on setup that a device-native platform would have handled with a template. It helps to understand how EDC systems for clinical trials differ before you commit, and setting up a study to comply with FDA regulations takes real planning even with the right tool. With the wrong one, the planning time doubles before a single subject is enrolled.
The third default, and the one I want to spend the most time on, is handing the entire data question to a contract research organization (CRO) and assuming ownership follows automatically. It does not.
Working with a CRO does not mean giving up your data
Manufacturers are ultimately responsible for the clinical evidence a study produces, whether that evidence supports a 510(k), a De Novo request, or a CE mark under the European Union Medical Device Regulation (EU MDR). A CRO can execute the study. A CRO cannot absorb that regulatory responsibility, and it should not absorb your ability to see, query, and export your own data while the study is running.
I have watched manufacturers realize months into a study that they cannot pull their own enrollment numbers without asking their CRO for a report and waiting a week for it. That is not a data problem. It is a visibility problem, and it starts on the day you select a vendor, not on the day you decide to switch systems mid-study. Choosing a CRO is as much a data-access decision as it is a service decision, and first-time teams tend to evaluate it purely on cost and site network.
The fix is not avoiding CROs. Boutique and mid-size CROs bring execution expertise that a lean device company does not have in-house and should not try to build from scratch for a single study. The fix is making sure the platform holding the data belongs to the manufacturer, not the CRO, so that access, export, and reuse are never contingent on the relationship staying smooth. Ownership of the system is what keeps ownership of the evidence with you.
What first-time study teams should set up before subject one
A first study rewards planning more than almost any other part of early device development, because the cost of changing course climbs the moment data starts flowing in. Five things are worth settling before enrollment opens.
Start with data ownership and export rights. Confirm in writing that your team can access the live data at any point, export it in a usable format, and retain it after the study and after any vendor relationship ends. If a contract or a platform makes your own data conditional on a service agreement, that is the moment to renegotiate, not two years later when you need the dataset for a follow-up submission.
Build the audit trail in from the start. 21 CFR Part 11 and Annex 11 both expect a record of who entered or changed a value, what changed, and when, and the FDA guidance on electronic records and signatures in clinical investigations spells out what that looks like in practice. An audit trail cannot be added retroactively to a spreadsheet. A system that captures it automatically removes an entire category of submission risk, and it does so without adding work for the person entering data.
Structure the study around ISO 14155 rather than treating the standard as a checklist you reconcile against at the end. ISO 14155 sets the expectations for good clinical practice in device investigations, from the clinical investigation plan and randomization through data handling and monitoring, and it works alongside the broader principles of good clinical practice (GCP) in clinical data collection. Teams that design their electronic case report forms and their data flow to match the standard spend the closing weeks of a study analyzing data. Teams that do not spend those weeks reconstructing it. The ISO 14155 compliance checklist is a practical place to pressure-test a plan before enrollment.
Design your electronic case report forms for the people entering data, not for the statistician reading it later. Field-level validation, required fields, and range checks catch errors at the point of entry, which is the only place errors are cheap to fix. Sound clinical data management starts with a form a site coordinator can complete without a training call, because a form like that produces clean data, and clean data is what shortens the gap between the last subject visit and a locked database.
Set up real-time visibility for your own team. You should be able to see enrollment, query status, and data completeness without filing a request. Visibility is not a reporting luxury. It is how a lean team catches a protocol deviation in week three instead of discovering a pattern of them at study close.
Your first study is the foundation for the clinical evidence that follows
The data you collect in your first study does not retire when the study closes. It feeds your submission, and then it feeds what comes after the submission. Evidence collected under a structured, ISO 14155-aligned system stays usable for post-market clinical follow-up and for the next study in the program, because it was captured with traceability and structure the first time.
The choice you made about spreadsheets comes back around here. A dataset built in a structured system can be queried, exported, and reused for years. A dataset built in a spreadsheet has to be cleaned and re-verified every time someone needs to defend it, and each round of cleanup is another chance to introduce the kind of discrepancy a reviewer will ask about. First-time teams tend to optimize for getting through the current study. The teams that do this well optimize for the study after that too, because they know the evidence has a longer life than the trial.
That longer view is also what connects clinical work back to the rest of the quality system. The clinical evidence that supports market access is the same evidence that supports post-market surveillance and future regulatory activity, which is why running medical device clinical trials on a platform built for the device lifecycle matters more than it appears to when the only goal in front of you is the first submission. It is also why the clinical evidence investors actually care about is the evidence that holds up under scrutiny, and why many teams eventually want their clinical data to sit alongside the quality management system where their design and regulatory records already live.
What owning your clinical evidence looks like for a lean team
None of this requires an enterprise clinical operations department. That is the point I most want first-time teams to hear, because the loudest assumption in this space is that control and simplicity cannot coexist for a small manufacturer. They can.
Loop Medical, a Class II device company running international studies, moved off a paper system that gave them little visibility and slowed everything down. Using Greenlight Guru Clinical, they set up a new study in a couple of weeks without anyone working on it full time, and real-time data access saved them time and money. As their clinical affairs manager, Alison Moran, put it, the platform "made data collection faster and easier and removed headaches." That is a lean team owning its evidence, not a large one.
The platform question underneath all of this is whether the system was built for medtech studies or adapted from something else. A platform purpose-built for medtech clinical data capture supports first-in-human, feasibility, pivotal, and post-market studies with the same structure, so the work you do to set up your first study is work you keep for every study after it.
If you are staring at your first protocol and a spreadsheet right now, the most valuable thing you can do this week is separate two decisions that first-time teams usually collapse into one. Deciding who executes the study and deciding who owns the data are not the same decision. Get the second one right before subject one, and the evidence you generate will still be working for you long after this study is done.
Keep reading
If you are setting up your first medtech clinical study, these guides go deeper on the pieces that matter most:
- Medical device clinical trials: regulatory pathways and study types
- The ultimate guide to ISO 14155
- How to set up clinical studies to comply with FDA regulations
- Writing a clinical investigation plan (CIP)
- EDC systems for clinical trials
- Post-market clinical follow-up under EU MDR
When you want to see what owning your clinical evidence looks like in practice, reach out for a demo. Get a demo of Greenlight Guru Clinical and we will walk through how first-time teams set up compliant studies while keeping control of their data.
BONUS RESOURCE:
15-in-1 Clinical Investigations Content Bundle
15-in-1 Clinical Investigations Content Bundle
.png?width=790&name=15-in-1%20clinical%20investigations%20content%20bundle%20(new).png)
