The ultimate guide to ISO 14155:2026 for medical devices

ISO 14155 is the standard clinical teams reach for the moment a study touches human subjects. ISO published a fourth edition in March 2026, replacing the third edition from 2020.

The 2026 edition does more than update a few clauses. It splits risk management into two distinct tracks. It adds a formal clinical events committee alongside the long-standing data monitoring committee. It tightens the rules around informed consent and eligibility deviations, and it introduces an entirely new annex on statistical estimands.

The rest of this guide covers what ISO 14155:2026 requires, what changed from the 2020 edition, and how to apply it, whether you are planning a first-in-human feasibility study or running post-market clinical follow-up.

Note: “Clinical investigation,” “clinical trial,” and “clinical study” are all synonymous here, and will be used throughout the guide.

Table of Contents

FREE EBOOK: Click here to download your PDF copy of the Ultimate Guide to ISO 14155:2020 for Medical Devices.

ISO 14155:2026 overview

ISO 14155:2026 is the international standard for Good Clinical Practice in medical device clinical investigations. It sets requirements for how sponsors and investigators design, conduct, record, and report studies that assess a device's clinical performance, effectiveness, or safety in human subjects.

The standard exists to protect subjects' rights, safety, and well-being. It also keeps the resulting science and data credible, and it spells out who is accountable for what, from the sponsor down to the investigation site team. Ethics committees, regulatory authorities, and conformity assessment bodies all treat it as a shared reference point.

ISO published this fourth edition in March 2026, replacing the third edition, ISO 14155:2020. In the US, FDA maintains ISO 14155:2020 on its list of recognized consensus standards, as recognition of a specific standard typically lags behind publication. In the EU, the 2020 edition, along with a 2024 amendment, is the version currently harmonized under MDR. The fourth edition had not yet gone through that harmonization process as of this writing, even though it already represents the current state of the art.

What's new in the ISO 14155:2026 fourth edition

The fourth edition rewrites some of the standard's core assumptions rather than just refining language. Here are the changes most likely to affect day-to-day clinical operations:

• Risk management now runs on two tracks. The standard separates risks tied to the investigational device's use, still managed through ISO 14971, from risks tied to clinical procedures the CIP requires outside routine clinical practice, which get a separate descriptive risk assessment. Clause 6.2 lays out both tracks, and the CIP has to address each one independently.

• A clinical events committee joins the data monitoring committee. Section 6.12 introduces the CEC as a body sponsors can establish to review and classify safety or effectiveness endpoints consistently across sites. Establishing a DMC was already a consideration under the prior edition. Now, if a sponsor chooses not to establish one, Annex A.14 requires that decision to be justified in writing.

• Informed consent gets more explicit. Subjects, or their legally designated representatives, must be given the chance to discuss participation with family members before consenting. The standard also clarifies how the consent process works when a representative is involved.

• Eligibility deviations require a CIP amendment, not a deviation log entry. A site cannot simply enroll a subject who falls outside the inclusion or exclusion criteria. Under Clause 5.6.4, that is a protocol change, and it goes through the same amendment and approval process as any other CIP change.

• Adverse event categorization now has a dedicated path for device deficiencies. Annex F still separates non-device-use, device-use, and procedure-related adverse events. The fourth edition adds a new Figure F.2 for events associated with a device deficiency, which applies alongside the existing Figure F.1 whenever an event and a deficiency are linked.

• A new annex covers estimands. The estimand framework is formalized in Section 6.4 and Annex A (Clauses A.5 through A.7), giving sponsors a structured way to define exactly what a clinical investigation measures and how to handle dropouts, deaths, and other complications in the analysis. The new informative Annex K supplements this with a worked example.

• The investigator's brochure expects more. Annex B now calls for in-silico test data, device training requirements, and device-specific precautions alongside the usual preclinical and clinical summaries.

• Implant cards and equipment calibration are explicit requirements. Where a device is implanted, sponsors now prepare an implant card template during pre-study document preparation. Annex A.6.4 requires the CIP to address equipment calibration directly.

None of these changes are cosmetic. Each shows up in how a CIP gets written, how a DMC or CEC charter gets drafted, and how a monitoring plan gets scoped.

How ISO 14155 applies across the product lifecycle

Clinical investigations are not limited to the pre-market phase. Annex I still organizes the standard's applicability by regulatory status, clinical development stage, investigation design, and burden to the subject, and that framework carries forward largely unchanged into the fourth edition.

Pre-market investigations run from first-in-human and early feasibility work through pivotal, confirmatory studies. Post-market investigations continue after a device is already available, whether that means a confirmatory interventional study or a fully observational one built on real-world use. Annex I.7 sets out how much of the standard applies at each stage. A pre-market confirmatory investigation follows the standard in full. A post-market observational investigation may reasonably exempt itself from requirements built for commercial products, such as certain device accountability logs or a duplicate investigator's brochure.

The catch has not changed: any exemption a sponsor claims still has to be justified and documented in the CIP. Auditors and regulators will ask why a requirement was skipped, and feeling low-risk is not, by itself, an acceptable answer.

Good Clinical Practice principles under ISO 14155

Section 4 still opens with a summary of Good Clinical Practice. Every one of its 13 principles has to be understood and applied at each stage of a clinical investigation, not treated as a preamble to skim past. A few carry particular weight:

• Investigations follow the ethical principles rooted in the Declaration of Helsinki, backed by sound science and a clearly detailed plan.
• Foreseeable risks have to be weighed against anticipated benefit before a study starts, and the study continues only while that balance holds.
• Subject rights, safety, and well-being outrank the interests of science or society.
• Freely given informed consent is required from every subject, with narrow exceptions for emergency circumstances.
• Medical decisions affecting subjects stay with qualified healthcare professionals. Everyone involved in the investigation has to be qualified by training and experience for their specific role.
• Records need to be accurate, accessible, and retrievable enough to support reporting, verification, and audit.

Section 5 builds on these with more practical ethical detail. It covers avoiding improper influence over subjects or investigators and the full process for communicating with the ethics committee. New in this edition: subjects must get real time to discuss participation with people outside the study before they sign anything.

Sponsor and principal investigator responsibilities

The standard keeps sponsor and principal investigator duties in separate clauses. Sponsor responsibilities sit in Clause 9. Principal investigator responsibilities sit in Clause 10.

The sponsor, typically the device manufacturer, owns clinical quality management for the whole investigation, including planning, resourcing, monitoring strategy, safety evaluation, and reporting to ethics committees and regulators. Contracting pieces of that work out to a CRO does not transfer accountability. If something goes wrong with a study a CRO is running, the sponsor still answers for it.

The principal investigator runs the day-to-day conduct of the investigation at their site. That means implementing the CIP, protecting subject rights and safety, and keeping the data coming out of that site accurate and complete. A PI can delegate tasks to a qualified investigation site team, but responsibility for the investigation never moves off the PI, even when pieces of that work get outsourced further.

Greenlight Guru’s electronic case report forms are built to keep that PI-level accountability visible. Signature workflows, correction audit trails, and query management all trace back to a named, qualified team member.

Planning a clinical investigation: CIP, IB, and CRFs

Planning documentation has not gotten any lighter in the new edition. Three documents anchor the planning stage.

• The clinical investigation plan (CIP) is still the master document. It covers objectives, design, and risk-benefit analysis, and now, explicitly, a justification for every design choice under Clause 6.3. Annex A lists everything a CIP needs to include. The fourth edition adds detail around equipment calibration, non-inferiority margins, and how an investigation's objectives translate into the estimands covered later in this guide.
  
  

• The investigator's brochure (IB) gives the principal investigator enough preclinical and clinical evidence to justify exposing human subjects to the investigational device. Annex B still governs its content, but now it expects in-silico test results, device-use training requirements, and device-specific precautions alongside the usual preclinical and clinical summaries. Our guide to the investigator's brochure under MDCG 2024-5 walks through how EU guidance lines up with Annex B.
  
  

• Case report forms (CRFs) capture subject and device data as the CIP requires, organized under Annex C. Whether a site uses paper or an electronic case report form, the goal stays the same: complete, accurate, attributable data with a defensible audit trail. Spreadsheets and paper forms make that harder to guarantee at scale. That is one reason more sponsors move to purpose-built eCRF software before a study starts, rather than after a monitoring visit flags a problem.

Managing risk, adverse events, and device deficiencies

Risk management touches nearly every clause in Section 7. The fourth edition's two-track approach, device-use risk versus CIP-procedure risk, shows up clearly here.

For risks tied to the investigational device's use, Clause 7.4.4 and Annex H lay out a sequential process. Sponsors monitor against pre-set risk acceptability thresholds, run a preliminary assessment when something looks off, and escalate to a comprehensive ISO 14971 risk assessment if the preliminary review cannot resolve the concern. A confirmed unacceptable risk means enrollment stops. If the risk cannot be controlled, the investigation ends. For risks tied to CIP-required procedures that fall outside routine clinical practice, Clause 7.4.5 applies a parallel but distinct process, since those risks are not always a fit for ISO 14971's framework.

Adverse events and device deficiencies get documented and reported throughout the investigation, and Annex F's categorization table still separates non-device-use, device-use, and CIP-procedure-related events. The fourth edition adds Figure F.2 to cover events tied to a device deficiency, which applies alongside the existing Figure F.1 whenever an adverse event and a deficiency are linked. The categorization has to reflect that link at the point of recording, not after the fact.

Suspension and termination follow the same logic. A sponsor can suspend enrollment while investigating a possible unacceptable risk, resume the investigation once corrective action addresses it, or terminate it entirely if the risk cannot be brought back under control. Our guide to serious adverse events and GCP covers how this plays out in day-to-day monitoring. Our overview of adverse event reporting requirements in the EU and US covers the regulatory reporting side.

The new estimand framework for statistical design

The estimand framework, formalized in Section 6.4 and Annex A, gives sponsors a more precise way to describe what a clinical investigation actually measures. The new informative Annex K provides a worked example.

An estimand is a description of the treatment effect that matches the clinical question an investigation is trying to answer. It has five parts: the treatment condition under investigation, the target population, the variable or endpoint being measured, how the investigation handles intercurrent events such as a subject discontinuing treatment or dying partway through follow-up, and the population-level summary used to compare treatment conditions.

Two investigations built around the same primary endpoint can still produce different, defensible answers, depending on how each one handles a subject who drops out or switches treatment midstream. Defining the estimand up front, and carrying that definition through the statistical analysis plan in Annex A.7, keeps the CIP, the informed consent form, and the eventual clinical investigation report all answering the same question. The approach lines up with the estimands framework pharmaceutical sponsors already use under the ICH E9(R1) addendum, which should ease some friction for teams running combination product or device-drug studies.

Electronic data capture and compliance

Section 7.8.3 keeps its focus on electronic clinical data systems, and the requirements have not lightened even as the rest of the standard changed around them. Any electronic system used to create, modify, or transmit clinical investigation data has to be validated. That validation has to confirm the system's authenticity, accuracy, reliability, and consistent performance.

The standard still lists 12 written procedures a sponsor needs for any electronic clinical data system. They cover validation and functionality testing, data handling and security, audit trails that prevent deletion of entered data, backup and recovery, a maintained list of who has system access, and user training. Miss any one of those, and a monitoring visit or an audit will surface it.

Greenlight Guru’s EDC was built around exactly this list, with validation documentation, 21 CFR Part 11-aligned electronic signatures, and audit trails included from the start. A purpose-built system removes the guesswork around Section 7.8.3 compliance. Teams evaluating vendors before committing to a study should also see our guide to choosing an EDC system for medical device investigations, which walks through the ISO 14155-specific questions worth asking before signing.

FREE EBOOK: Click here to download your PDF copy of the Ultimate Guide to ISO 14155:2020 for Medical Devices.

Greenlight Guru is built specifically for medical device studies carried out under ISO 14155

ISO 14155:2026 asks more of sponsors and investigators than the version it replaced, particularly around risk management, informed consent, and the new estimand framework.

Greenlight Guru Clinical's eCRF and EDC platform is built for exactly this kind of moving target. It is purpose-built for device studies rather than adapted from pharma, with the validation, audit trail, and reporting infrastructure the standard expects already in place.

Get a demo of Greenlight Guru Clinical to see how the platform maps to ISO 14155:2026 before your next study starts.