Clinical Investigation of Medical Devices (GCP)

ISO 14155 is the internationally recognized standard for Good Clinical Practice (GCP) in the clinical investigation of medical devices for human subjects. In plain terms, it is the rulebook for running a device clinical trial properly — one that protects the people who take part, and produces data that regulators and reviewers can actually trust. Its full title is often given as ‘Clinical investigation of medical devices for human subjects — Good clinical practice’.

It helps to be clear about what ISO 14155 is and is not. Like the GCP standards used for medicines, it is a practice standard you conduct your studies in compliance with, rather than a classic management-system certificate. You do not typically earn an ISO 14155 certificate to hang on the wall. Instead, your sponsor and investigators conduct the investigation according to the standard, and that compliance is demonstrated through study documentation, monitoring, audits and regulatory review. The result supports your regulatory submission — for example the clinical evidence expected under the EU MDR or by other health authorities.

Two ideas sit at the heart of the standard. The first is the protection of the rights, safety and well-being of the human subjects who take part, in line with the ethical principles of the Declaration of Helsinki. The second is scientific credibility — running the study so that its design, conduct and data are sound enough to support real decisions about the device.

ISO 14155 is relevant to anyone involved in generating clinical evidence for a medical device through a study on human subjects. If your device needs clinical data to reach or stay on the market, this is the standard your study will be judged against. Typical candidates include:

• Device manufacturers acting as sponsors of a clinical investigation, whether pre-market or post-market
• Clinical and regulatory affairs teams planning the clinical evidence for an EU MDR technical file or another submission
• Contract research organizations (CROs) running device studies on a sponsor's behalf
• Principal investigators and clinical sites conducting the investigation with patients
• Ethics committees and internal review functions overseeing subject protection
• Quality teams building GCP compliance into their processes and training

The need is regulatory and ethics driven. Health authorities and Notified Bodies expect device clinical investigations to be conducted in line with ISO 14155, and ethics committees will not approve a study that fails to protect its subjects. So while there is usually no certificate involved, conducting your study to ISO 14155 is effectively required if you want the resulting data to be accepted. A useful point on scope: the standard sets out the responsibilities of the sponsor and the principal investigator in detail, and getting that division of duties right from the outset is one of the foundations of a clean study.

ISO 14155 describes how to design, conduct, record and report a device clinical investigation so that subjects are protected and the data is credible. The main themes are:

• Ethical conduct — the study follows the principles of the Declaration of Helsinki, and subject protection comes before all else.
• Ethics committee approval and informed consent — no subject is enrolled without proper review and genuine, documented consent.
• A sound clinical investigation plan (CIP) — a well-designed protocol with clear objectives, endpoints and statistical thinking.
• Risk management — the risks to subjects are identified, weighed against the expected benefits, and managed throughout, linking to the wider device risk process.
• Defined responsibilities — clear duties for the sponsor and the principal investigator, and qualified people in every role.
• Investigator's brochure and essential documents — the information and records that let the study be understood, run and reconstructed.
• Monitoring and quality oversight — the sponsor checks that the study is being run as planned and that the data holds up.
• Adverse event and device deficiency reporting — safety events are captured, assessed and reported as required.
• Data integrity and record keeping — accurate, complete records that support the conclusions drawn.
• Clinical investigation report — an honest, complete account of what was done and what was found.

Compliance is confirmed not by a certification audit but through monitoring, sponsor and regulatory audits, and regulatory review of the study and its data. Subject protection and data integrity are the two areas where studies are most exposed.

A quick clarification on wording: with ISO 14155 you are not pursuing a certificate. What you are doing is running your clinical investigation to a recognized standard of good clinical practice. But the reasons to do it, and to do it well, are as compelling as any certification.

The first is usable evidence and market access. Clinical data generated outside ISO 14155 risks being questioned or rejected, which can stall an EU MDR technical file or another submission and leave a device unable to reach the market. Data collected to the standard is far more likely to be accepted the first time.

The second is subject protection and ethics. Running a study to ISO 14155 is how you honor your duty to the people who volunteer for it. A study that harms subjects, or that an ethics committee will not approve, is both an ethical failure and a practical dead end.

The third is reliability and reputation. Studies run to GCP produce cleaner data, fewer protocol deviations, and audits that do not turn into crises. Sponsors, Notified Bodies and partners take your evidence more seriously when it was generated to a standard they recognize — and a track record of well-run investigations is a durable asset in a field where credibility is everything.

We have spent more than 30 years helping companies build quality and regulatory systems, and we have guided 900+ organizations to successful outcomes with a 100% first-time pass rate on the audits and assessments we prepare them for. With ISO 14155 the target is a little different — there is no certificate, so what we build toward is a study, and the processes behind it, that are genuinely conducted to good clinical practice and ready to stand up to monitoring, sponsor audits and regulatory review.

Our proven 10-Step Approach adapts cleanly to this. We assess your current clinical and quality processes against ISO 14155, clarify the responsibilities of sponsor and investigator, and build the framework the standard expects — the clinical investigation plan, essential documents, informed consent process, risk management, monitoring plan, and adverse-event reporting. Because we do the work alongside your team, the practices reflect how your study will really run and belong to your people, not to a binder.

A hallmark of our work is documentation you will actually use — single-level documents, typically under 200 pages for the surrounding system — rather than the bloated procedures that confuse sites and auditors. We train your team on their GCP responsibilities, run internal audits and readiness checks so there are no surprises, and stand with you through monitoring visits and regulatory questions. For most programs the readiness work runs about 4 to 9 months, depending on the complexity of your study and how mature your existing clinical processes already are.

• Informed consent gaps. Consent that is incomplete, poorly documented, or obtained without genuine understanding — one of the most serious ethical and regulatory failures a study can have.
• A weak clinical investigation plan. Vague objectives, unclear endpoints or thin statistical thinking that leave the data unable to support any real conclusion.
• Blurred responsibilities. Confusion over what the sponsor owns versus the principal investigator, so essential duties fall through the cracks.
• Under-monitoring. Too little oversight of how the study is actually running, so problems surface only at audit.
• Poor adverse-event handling. Safety events that are not captured, assessed or reported the way the standard and regulators require.
• Data-integrity problems. Records that are incomplete or cannot be reconstructed, undermining the credibility of the whole study.
• Disconnected risk management. A study risk assessment that does not link to the device's wider risk process.
• Treating GCP as paperwork. Procedures that look right on paper while the sites do something different, so the study and its documentation drift apart.