ISO 14155:2026 is the international standard for Good Clinical Practice (GCP) in the clinical investigation of medical devices for human subjects. Published on March 23, 2026, it is the fourth edition of the standard and replaces ISO 14155:2020 with no transition period. Its predecessor was recognized by the FDA as a consensus standard, and ISO 14155 is accepted as the governing GCP framework for CE-mark clinical investigations, referenced across virtually every major regulatory pathway that requires clinical evidence from a device manufacturer.
The standard separates compliance obligations clearly between two parties: the sponsor (Clause 9) and the principal investigator (Clause 10). These are not interchangeable. Even when a sponsor contracts out day-to-day conduct of the investigation to a CRO or clinical team, Clause 9 is explicit that the sponsor retains overall responsibility. Audit findings that originate with a contracted investigator remain the sponsor's findings.
This guide is organized by that same division, with pre-study requirements separated from ongoing study requirements within each part. The timing of compliance matters as much as the substance of it.
BONUS RESOURCE: Click here to download the ISO 14155:2026 compliance checklist.
Part 1: Sponsor responsibilities (Clause 9)
The sponsor is responsible for initiating, managing, and financing the clinical investigation. Clause 9 covers the full scope of sponsor obligations, from study design and CIP preparation through to the final clinical investigation report. For teams looking for a broader orientation to running a compliant medical device clinical investigation, the complete guide to medical device clinical trials covers the full lifecycle from planning through close-out.
Pre-study
Clinical investigation plan
The clinical investigation plan (CIP) is the most scrutinized document in any ISO 14155 compliance review. Annex A is normative, meaning its requirements carry regulatory weight, and the CIP must be complete before the investigation begins.
The CIP must include a documented benefit-risk justification and fully specified inclusion and exclusion criteria. The statistical design section must cover four elements: the estimand per Section 6.4, the sample size calculation, the missing data strategy, and non-inferiority margins where applicable. Section 6.4 requires the methods and timing for data analysis to be addressed explicitly in the CIP. The estimand has five required attributes: the treatment being studied, the population the question applies to, the endpoint variable and when it is measured, the population-level summary of the treatment effect, and the handling of intercurrent events such as participant withdrawal, treatment switch, or death. For guidance on getting the sample size calculation right before the investigation begins, the sample size calculation guide for medical device studies covers the key decisions and common errors.
The CIP must also address equipment calibration requirements, implant card obligations where devices will be implanted, and a participant follow-up and continued care plan for suspension or termination scenarios, including care that differs from routine clinical practice. If any section of the standard is deemed not applicable, a written justification must appear in the CIP per Annex I. If reduced adverse event recording or reporting is planned, that too must be justified in the CIP and pre-approved by the ethics committee or IRB.
Governance bodies
ISO 14155:2026 requires two governance structures to be addressed before the study begins.
The first is the Clinical Events Committee (CEC), governed by Section 6.12. Sponsors are required to consider establishing an independent CEC. In multi-center studies, similar events can be classified differently by different investigators, and a CEC standardizes that classification and protects data reliability. Where a CEC is established, the charter must be in place before study initiation and must document the methods for central review and event classification, the criteria for determining whether events meet the CIP's endpoint definitions, the approach to statistical standardization of outcomes, and the management of independence and conflicts of interest. Where a CEC is not used, the standard does not explicitly require a formal CIP justification, but for multi-center studies, documenting the rationale is good practice.
The second is the Data Monitoring Committee (DMC). Sponsors must either establish a DMC or formally justify in the CIP why one is not needed. This is a hard requirement. Where a DMC is established, the criteria for triggering study modification, suspension, or termination must be defined and agreed before the study starts, with the DMC involved in confirming those conditions.
Risk management
ISO 14155:2026 requires sponsors to manage risk throughout the investigation, with device-related and procedure-related risks treated as distinct obligations.
Device-related risks must be assessed explicitly following ISO 14971, with residual risks formally evaluated and documented in the risk management file. Procedure-related risks are handled separately: any procedure outside standard clinical care that the study protocol requires must have a descriptive risk assessment on file, documented in the CIP. For multi-country studies, what constitutes routine clinical practice differs across regions, and those differences must be explicitly identified in the CIP. A benefit-risk analysis for the investigation as a whole must also be documented in the CIP per Annex A.
Investigator's brochure
Annex B of ISO 14155:2026 is normative. The investigator's brochure (IB) must address in-silico data from preclinical testing, device training requirements, and device-specific precautions, and must be finalized, version-controlled, and distributed to all relevant investigators before the investigation begins. The MDCG 2024-5 guidance on investigator brochures provides additional EU MDR-specific IB context.
Site and regulatory approvals
Before enrollment begins, the sponsor must verify that investigator qualifications and site capabilities are adequate per Clause 9. Written agreements between the sponsor and all investigators must define responsibilities. Where a CRO is involved, delegation must be documented alongside the sponsor's oversight mechanism. Ethics committee or IRB approval must be obtained before the first subject is enrolled.
Electronic data systems
Any electronic data capture system used in the study must be validated to evaluate the authenticity, accuracy, reliability, and consistent intended performance of the system. Section 7.8.3 requires 12 written procedures, covering items a through l, to be in place before the system is used. Where the study falls under FDA oversight, compliance with 21 CFR Part 11 must also be confirmed, and CRF completion guidelines must be drafted and ready for site staff before enrollment begins. The CDMS evaluation guide covers what to look for in a system built for ISO 14155 compliance. GG Clinical is purpose-built for medical device investigations and comes with pre-validated EDC that meets Section 7.8.3 requirements out of the box.
Ongoing study
Monitoring and oversight
Risk management is not a pre-study activity. ISO 14155:2026 requires it to be maintained continuously throughout the investigation. Source data verification must be conducted per the monitoring plan, and clinical quality management must be applied across the full investigation lifecycle per Section 9.1. Where a DMC is in place, interim reviews must be conducted and suspension or termination criteria assessed per the DMC charter. Where a CEC is in place, events must be reported to it promptly and completely.
Data management
All data must be recorded directly and promptly in the CRFs per the CIP. The EDC audit trail must be active and must capture all data changes with the user, timestamp, and reason. Data transfer and export processes must be executed per documented procedures, and data must be backed up per documented procedures. The data management requirements for FDA-regulated clinical trials covers additional FDA-specific expectations where applicable.
Adverse event reporting
Annex F of ISO 14155:2026 defines three adverse event categories: non-device-use related, device-use related, and non-routine protocol-related. A fourth category covers adverse events associated with a device deficiency, captured in Figures F.1 and F.2. All adverse events must be recorded and categorized per this structure, with device deficiency-associated events captured regardless of whether a serious adverse device effect (SADE) occurred. Sponsor reporting procedures must cover notification of the ethics committee and relevant regulatory authorities. For EU studies, SAE reporting must align with EU MDR Article 80; for US studies, AE reporting must align with 21 CFR Part 803 as applicable. A detailed breakdown of serious adverse event tracking requirements covers the Annex F categorization framework in full, and the EU vs. US adverse event reporting comparison covers how ISO 14155 requirements interact with each regulatory framework.
CIP amendments
Any change to inclusion or exclusion criteria must be processed through a formal CIP amendment. A protocol deviation log entry is not sufficient for eligibility changes. All CIP amendments must be submitted to and approved by the ethics committee and regulatory authorities before implementation.
Close-out and reporting
Section 8 of ISO 14155:2026 governs study suspension and close-out, with suspension and premature termination as distinct procedures carrying separate requirements for proportionate response, participant follow-up, and communication obligations.
Site close-out visits must be completed and documented, with all study materials accounted for. Investigational device accountability must be complete, covering devices used, returned, or disposed of. Participant follow-up and continued care must be confirmed, including care that differs from routine clinical practice. All essential documents must be archived per the applicable regulatory body's retention requirements.
The clinical investigation report (CIR) must present results in full with no selective omission, and all protocol deviations must be disclosed with impact assessment per Annex D (normative), Section D.7 f) 2). The statistical analysis must follow the documented estimand and analysis plan, with any deviations from the plan explained. The CIR must be signed by both the sponsor and the principal investigator.
Part 2: Principal investigator responsibilities (Clause 10)
The principal investigator is responsible for implementing and managing the day-to-day conduct of the investigation at the site, ensuring data integrity, and safeguarding the rights, safety, and wellbeing of participants. Where there are multiple investigators at a site, the principal investigator is accountable for all of them. A thorough review of GCP compliance requirements for clinical data collection covers the specific GCP obligations that apply at the investigator level.
Pre-study
Site preparation
Before the investigation begins, the principal investigator must confirm that their qualifications are appropriate to the investigation and documented, and that site capabilities are adequate. All sub-investigators and site staff must be identified, assigned roles, and have documented training records covering the protocol and study-specific procedures. Equipment calibration must be completed and documented per the CIP requirements.
Review of study documents
The principal investigator must review and understand the CIP and the IB before the investigation begins. The IB must be current per Annex B (normative). CRF completion guidelines must be received and reviewed by site staff before data collection begins.
Ethics committee and consent preparation
Ethics committee or IRB approval must be confirmed before the first subject is enrolled. Informed consent documents must include the future use of biological samples and the future use of health-related data per Section 5.8.4. The consent process must give all participants the opportunity to discuss participation with others, such as family members, before consenting per Section 5.8.2 e). This applies to all participants, including where a legally designated representative provides consent.
Ongoing study
Subject enrollment and conduct
Eligibility must be confirmed against the inclusion and exclusion criteria for every participant before enrollment, with any questions or borderline cases escalated to the sponsor. Changes to eligibility criteria require a formal CIP amendment, not a deviation log entry. Informed consent must be obtained and documented per Section 5.8.4 before any study procedures begin, and implant cards must be provided to participants receiving implanted devices.
Data collection and documentation
All data must be recorded directly, promptly, and accurately in the CRFs per the CIP. Corrections to paper CRFs must be made with a single line, dated and initialed, with the original entry left legible. Electronic system corrections must maintain a full audit trail. Protocol deviations must be identified, documented, and reported to the sponsor promptly, with categorization and impact assessment.
Adverse event reporting
Investigators are the primary source of adverse event data. The Annex F three-category structure and the device deficiency-associated category must be applied at the point of recording, not retrospectively. All adverse events must be identified, categorized, and reported to the sponsor within the timeframe specified in the CIP, including device deficiency-associated events even where no SADE occurred. SAE reports must include a causal relationship assessment between the event and the investigational device, and follow-up must be documented to resolution. Where the study has a CEC, events must be reported to the sponsor promptly and completely for central review.
Study design considerations for investigators
Investigators are often involved in study design discussions before a CIP is finalized. Two areas where investigator input directly affects compliance outcomes are worth flagging. The first is randomization: the guide to randomization in medical device trials covers the study design choices that must be locked before enrollment begins. The second is the EU regulatory framework: for studies conducted under EU MDR, MEDDEV 2.7/1 Rev 4 and the MDCG guidance under MDR sets out the clinical evidence requirements that the investigation is ultimately designed to satisfy.
Site oversight and close-out
Day-to-day investigation activities must be managed in accordance with the CIP, with sub-investigator activities supervised and data integrity maintained throughout. Source documents must be accessible and retrievable for monitoring visits and audit at all times.
At close-out, all site procedures must be completed per the CIP and sponsor instructions, with study materials, devices, and documents accounted for, returned, or archived as required. Participant follow-up must be completed per the CIP, including any care required after the investigation ends.
How GG Clinical supports ISO 14155:2026 compliance
Running a compliant study under ISO 14155:2026 requires documentation infrastructure that most general-purpose software was not built to provide. GG Clinical was built specifically for medical device investigations, reflecting the requirements of the standard at the system level from EDC validation through adverse event capture and archiving.
For sponsor-side data management under Section 7.8, the platform provides a pre-validated EDC environment with audit-ready documentation maintained by Greenlight Guru. For adverse event reporting under the Annex F category structure, it includes an integrated AE module with automated notifications and reporting workflows. For investigator-side data collection, CRF completion and correction workflows are built to meet the requirements of the standard. For teams evaluating the platform, GG Clinical pricing and capability details are available on the product site.
The governance requirements of ISO 14155:2026, including CEC charter documentation and DMC justification, create documentation obligations that compound across a study portfolio. Centralizing everything in a single validated environment is what makes compliance manageable at scale.
BONUS RESOURCE: Click here to download the ISO 14155:2026 compliance checklist.
BONUS RESOURCE:
ISO 14155:2026 compliance checklist
ISO 14155:2026 compliance checklist
