Medical Device Clinical Investigations in 2026: What ISO 14155, IDE Studies and EU MDR Annex XV Demand From EDC, eCOA and Site Oversight

TL;DR

Takeaway: A device investigation differs from a Phase 3 drug trial in shape, and a build that treats it as one will miss the records that device inspections ask for. Across 10,362 industry device investigations started between 2015 and 2026, 39.1% use randomized allocation against 61.4% of 45,837 industry drug trials, 56.3% use a single-group model against 23.5%, 73.4% are open label against 54.7%, and 94.4% carry "not applicable" in the phase field against 1.4% [1]. The data-capture, safety-event, device-accountability and monitoring configuration should be derived from that shape, from the inspection record and from the three regulatory texts, not inherited from a drug template.

The inspection record says where device studies are cited. Across FDA Form 483 workbooks for fiscal years 2006 to 2025, 21 CFR Part 812 accounts for 2,803 citation appearances on the Devices program sheets. Investigator case histories and device records under 812.140(a) are 29.3% of them, investigator compliance with the agreement and investigational plan under 812.100 and 812.110(b) another 34.5%, and sponsor monitoring and general responsibility under 812.40, 812.46 and 812.25(e) 8.7% overall and 13.1% in fiscal years 2021 to 2025 [2]. The three warning letters found by this subject-based screen in 2024 to 2026 that cite Part 812 sections all cite 812.40, and FDA's wording in them is about missing written monitoring plans, missing interim monitoring reports, unevaluated unanticipated adverse device effects and incomplete device shipment and disposition records.

Three clocks now run at different speeds. ISO published the fourth edition, ISO 14155:2026, which "cancels and replaces" the 2020 edition and adds clinical events committees, residual-risk assessment, estimand principles, equipment calibration and an adverse event associated with a device deficiency [3][4]. On 13 September 2026 the FDA recognized consensus standards database still listed only the 2020 edition, recognition number 2-282 [5], and the EU harmonised reference updated in January 2026 is EN ISO 14155:2020 with amendment A11:2024 [6]. MDR Article 80 already requires serious adverse event and device deficiency reporting through the Article 73 electronic system, while the EUDAMED clinical investigation module remains "under analysis" [7][8].

This report converts those three facts into a regulation-to-data-capture matrix and a configuration checklist for sponsors, device CROs and data managers building a first pivotal device study.

What a device investigation looks like in the public record

Takeaway: In registry records, an industry device investigation is usually a single-group, open-label study at one facility with no phase label. The randomized parallel template that drug EDC libraries assume fits fewer than four in ten device records.

The comparison uses interventional studies registered on ClinicalTrials.gov with a start year between 2015 and 2026, read through the AACT relational copy of the registry [1]. The device cohort holds studies with at least one device intervention and no drug or biological intervention; the drug cohort holds the reverse; 3,505 studies that combine both were excluded. Among industry lead sponsors that leaves 10,362 device and 45,837 drug or biologic records, with 10,696 industry Phase 3 and Phase 2/3 drug records as the reference for what a pivotal drug template assumes. Registry fields describe submitted records. They say nothing about how a study was run, monitored or inspected, and every share below is a share of records.

Randomized allocation appears in 39.1% of industry device records (4,047 of 10,362) against 61.4% of industry drug records (28,157 of 45,837) and 82.9% of industry Phase 3 drug records [1]. A single-group model appears in 56.3% of device records against 23.5% and 14.7%. No masking appears in 73.4% against 54.7% and 33.7%. The outcomes assessor is masked in 14.4% of device records against 25.7% and 40.8%. A sham comparator arm appears in 5.2% of device records (540) against 0.4% of drug records (173). The phase field reads NA in 94.4% of device records against 1.4% of drug records; the device pathway is described instead by FDA's exploratory, pivotal and postmarket stages, and 453 industry device records register their primary purpose as device feasibility.

Arm counts and footprints follow the same pattern. Industry device records list one arm in 5,547 cases, two arms in 4,026 and three or more in 712; industry drug records list 10,831, 17,896 and 17,072 [1]. The median industry device record has one facility (75th percentile 5, 90th percentile 13) against three for drug records (18; 57) and 23 for Phase 3 drug records (74; 161). More than one country appears in 14.8% of device records (1,531) against 29.0% of drug records (13,283) and 48.6% of Phase 3 drug records. A data monitoring committee is declared for 25.3% of industry device records against 31.3% of industry drug records.

A separate subset uses the registry flag for an unapproved device. Confirm FDA IDE, significant-risk status, US jurisdiction and pivotal intent separately from this screening proxy. The flag was largely blank before 2017 (2,266 of 2,835 device records starting in 2015 have no value, 14 in 2018, none in 2026), so it is read from 2018 onward. Across all sponsors 3,604 device records carry it; 2,179 are industry led [1]. Those industry IDE-proxy records are randomized in 34.1% of cases and single group in 61.2%, open label in 73.9%, multinational in 18.6%, with a median enrollment of 55 (75th percentile 167, 90th 358) at a median of two facilities (8; 21). This flagged subset is more often single-group and open label than the overall device cohort; it cannot identify the design appropriate for a particular pivotal study.

The configuration consequence is direct. A drug EDC library carries treatment-arm logic, blinded dispensing and assessor-blinding workflows that most device records leave unused, and lacks the objects most device records need: a visit schedule anchored to an index procedure, a procedure form, operator identity and role, and a unit-level device record. The randomized template remains necessary for the 39.1% of records that use it, and the approved protocol should determine whether that path is used. Choose the control strategy from the scientific question and agreed protocol. The build multipliers that drive workload in drug studies are covered in EClinCloud's analysis of protocol complexity and study-build burden; this report leaves them there.

Endpoints devices actually register

Takeaway: Device-specific endpoint wording (procedural success, freedom from major adverse events, adverse device effects, performance goals, learning curve) appears in 27.9% of industry device records and 0.8% of industry drug records, and its share has risen every year since 2021. Each family needs its own fields and derivation rules, and where masking is impossible the independent-assessor record becomes the endpoint's evidence.

A regex family scan over primary and secondary outcome titles and descriptions finds device-specific language in 27.9% of industry device records (2,891 of 10,362) against 0.8% of industry drug records (357 of 45,837), and in a primary outcome in 12.7% (1,314) against 0.3% (132) [1]. In the industry IDE-proxy subset the shares are 33.1% and 19.2%. The families are keyword indicators: they miss alternative wording and can also produce false positives. Without validated precision and recall, their counts are not a proven lower bound on device-specific endpoints.

The trend is monotonic since 2021. Among industry device records started in 2015, 23.0% used device-specific wording in any outcome and 11.6% in a primary outcome; for 2025 starts the shares are 34.0% and 16.0%, and the partial 2026 cohort reads 36.5% and 19.9% [1]. Drug records across all sponsors stay between 0.8% and 1.6% throughout. A device build made today should assume the endpoint model is device-shaped, because the registry shows sponsors writing it that way more often each year.

The family counts show what the fields are. Procedural, technical or device success appears in 994 industry device records, freedom from major adverse events in 695, device-related adverse event in 584, adverse device effect terms in 506, usability or human factors in 504, device deficiency in 294, sensitivity and specificity or percent agreement in 172, learning curve or operator in 109, an explicit performance goal in 51 and an objective performance criterion in 6 [1]. A record can match more than one family.

FDA's pivotal design guidance explains why the last two counts are small. It describes an objective performance criterion as a numerical target derived from historical data, notes that "there are currently very few validated OPCs", and states that an OPC "typically cannot be developed by a single company using only their data" [9]. A performance goal "provides a level of evidence that is inferior to an OPC", "It is not generally recommended that a PG originate with a sponsor", and "Sponsors wishing to utilize a PG in a pivotal clinical study should have discussion and concurrence with FDA staff prior to study initiation" [9]. The same guidance sets the earlier stage: an early feasibility study evaluates a device "in a small number of subjects (generally fewer than 10 initial subjects)" [10].

Operator and learning-curve variables are the endpoint's hidden covariates. The pivotal guidance says that "When a learning curve is evident during the pivotal study, it is important to consider how information gathered during this learning curve period are considered in the protocol (e.g., by clearly defining which subjects in the study are part of the learning curve period) and how results will be reported in the Statistical Analysis Plan", and that selecting only tertiary sites "could lead to a biased assessment of device performance" [9]. MDCG 2024-3 asks the clinical investigation plan for "The rationale for the number of procedures to be performed by a single user as part of the learning curve and how these data are to be analysed, if applicable" [11]. The methodological literature has made the same point for two decades: the IDEAL-D framework organises device evaluation by development stage rather than by drug-style phase [12], and Cook, Ramsay and Fayers noted that improvements in technical performance over time "may distort comparisons" and proposed models to adjust trial results for a learning-curve effect [13]. Only 109 industry device records name a learning curve or operator in an outcome; its frequency beyond registered outcome wording remains unknown.

Masking is the other structural gap. FDA "recommends that blinding be considered and attempted if at all possible" and, where blinding of subjects and investigators is impossible, that evaluators of measurements and endpoints be blinded to assignment [9]. Although 14.4% of industry device records report masked outcomes assessors, the frequency of independent evaluators or core laboratories remains unknown. Where the protocol uses one, preserve its assessments, blinding and linkage to source data. EClinCloud's review of independent review charters in oncology covers the charter mechanics; the device-specific point is that the read must be traceable to the procedure record and the device unit.

Configuration consequences for the endpoint layer:

1. A procedure or index-event form that records the device unit, operator identity and role, procedure date and time, deployment outcome and the pre-specified success definition's components.
2. Component-level fields for composite endpoints such as freedom from major adverse events, with adjudication status per component rather than a single derived flag.
3. For single-group designs, the performance-goal or objective-performance-criterion value, its source and the analysis population, stored in the study's specification and derivation layer so the primary analysis can be reproduced.
4. Operator sequence numbers per site so the learning-curve subjects the protocol defines can be identified in the analysis dataset.

Enrollment, follow-up and geography: what to size the build for

Takeaway: The typical industry device record enrolls about 50 participants at one facility with a primary time frame under six months, but 21.0% of records with a parsable primary-outcome time frame specify at least twelve months. That field is not total follow-up duration, and implant traceability can apply even when the primary endpoint is earlier.

Median enrollment is 51 for industry device records (25th to 75th percentile 21 to 129, 90th percentile 271) against 64 for industry drug records (26 to 190; 460) and 305 for industry Phase 3 drug records (125 to 576; 1,035) [1]. Device enrollment bands are 3,682 records at 30 or fewer, 3,451 at 31 to 100, 2,366 at 101 to 300, 675 at 301 to 1,000 and 187 above 1,000. The registry field is enrollment as submitted, anticipated or actual.

The primary time frame was parsed as the longest duration written in the primary-outcome time-frame field, for the 8,466 industry device and 32,192 industry drug records with a parsable value. The device median is 2.76 months (75th percentile 6, 90th 12) against 3.0 months for drug records (18; 36) and 9.0 for Phase 3 drug records (30; 52) [1]. In band form, 36.5% of device records fall under one month, 29.3% between one and six months and 13.2% between six and twelve months; 65.8% of the parsable device records specify a primary-outcome time frame under six months; actual endpoint resolution and total follow-up require separate evidence. The long tail is 15.1% between twelve and 24 months, 4.5% between 24 and 60 months and 1.3% at 60 months or beyond, so 21.0% specify a primary-outcome time frame of twelve months or longer against 33.9% of industry drug records and 44.6% of Phase 3 drug records.

That tail has its own rules. MDR Annex XV requires the clinical investigation plan to state "Criteria and procedures for follow-up of subjects following the end, temporary halt or early termination of an investigation, for follow-up of subjects who have withdrawn their consent and procedures for subjects lost to follow-up. Such procedures shall for implantable devices, cover as a minimum traceability" [7]. MDCG 2024-3 adds that the plan should say whether devices remain implanted or are explanted at the end of the study, how traceability is achieved, and how serious adverse events with a causal relationship to the device that are still ongoing at study end will be followed [11].

Results posting is the one measure where the device cohort keeps pace. Among completed records with primary completion by June 2024, 45.6% of industry device records (2,088 of 4,576) have posted results against 43.8% of industry drug records (8,826 of 20,141); the industry IDE-proxy subset posts 59.2% (476 of 804) and Phase 3 drug records 71.6% (3,192 of 4,461) [1].

Sizing consequences: a visit model with dense acute-phase capture around the procedure and sparse long-horizon follow-up; database-lock and extraction paths that allow a primary analysis at the short time frame while follow-up continues; and, for implantables, a traceability/retention plan that addresses site changes, withdrawal choices and applicable legal duties. Withdrawal does not automatically authorize further participant contact or new data collection.

Where device sponsors and investigators are cited

Takeaway: Two-thirds of Part 812 citations on Form 483s are about investigator case histories, device records and protocol compliance; the sponsor citations that follow are about monitoring, and the three recent warning letters quote missing monitoring plans, unevaluated unanticipated adverse device effects and incomplete shipment and disposition records. These are data objects the build can produce or fail to produce.

FDA publishes a workbook of Form 483 citations for every fiscal year. In the published workbooks Part 812 citations appear on the Devices program sheets; the sheets labelled BIMO carry Parts 50, 56, 58 and 312 only [2]. The Devices sheets hold 4,766 rows for fiscal years 2006 to 2025, of which 720 rows cite Part 812, for 2,803 citation appearances. The workbooks give no count of device clinical-investigation inspections, so everything below is a count of citations, not a rate.

The series fell from 364 citation appearances in fiscal year 2008 to 51 in 2019, 42 in 2020, 26 in 2021 and 18 in 2022, then rose to 34 in 2023, 34 in 2024 and 56 in 2025, the highest since 2018 (99) [2]. The pandemic years coincide with the trough and are a candidate explanation, not a demonstrated cause. Part 812 was 2.11% of all Devices program citation appearances in 2025 (56 of 2,660), against 1.43% in 2024 and 1.40% in 2023; the rest is dominated by Part 820.

Three sections carry the record. Across all twenty years, 812.140(a) investigator records account for 822 appearances (29.3%), 812.100 investigator general responsibilities for 527 (18.8%) and 812.110(b) investigator compliance with the investigational plan for 439 (15.7%) [2]. Sponsor sections follow: 812.40 general responsibilities including monitoring 161 (5.7%), 812.140(b) shipment and disposition records 146 (5.2%), 812.150(a) investigator reports including unanticipated adverse device effects 132 (4.7%), 812.43(c) investigator agreements and financial disclosure 111 (4.0%), 812.150(b) sponsor reports 106 (3.8%), 812.46(a) securing compliance 48 (1.7%), 812.140(d) retention 30 and 812.25(e) written monitoring procedures 28. In fiscal years 2021 to 2025 the mix is unchanged: 812.100 and 812.140(a) at 40 each, 812.110(b) at 33 and 812.40 at 15 of 168 appearances; investigator protocol and records themes together are 113 of the 168. The drug-side inspection footprint under Part 312 is analysed in EClinCloud's report on FDA investigator records and site monitoring and stays there.

What 812.140(a) asks for is concrete. The investigator keeps "Records of receipt, use or disposition of a device that relate to: (i) The type and quantity of the device, the dates of its receipt, and the batch number or code mark. (ii) The names of all persons who received, used, or disposed of each device. (iii) Why and how many units of the device have been returned to the sponsor, repaired, or otherwise disposed of", plus case histories including "a record of the exposure of each subject to the investigational device, including the date and time of each use, and any other therapy" and the protocol "with documents showing the dates of and reasons for each deviation" [14]. 812.100 and 812.110(b) require the investigator to conduct the investigation in accordance with the signed agreement, the investigational plan, Part 812 and the conditions of approval [15].

Warning letters are rarer and sharper. The FDA warning-letter index holds 3,643 letters issued from 2021 through July 2026, 220 of them from CDRH [16]. A subject-based screen for investigational device, clinical investigator, sponsor and bioresearch monitoring letters returns 121; reading them all finds three that cite specific Part 812 sections, each addressed to a sponsor. The 40 letters filed under IDE and PMA "adulterated device" are marketing-without-approval letters, and the 33 filed under "Clinical Investigator" are almost all drug letters under Part 312.

Nobles Medical Technology II (26 January 2024) was cited under 812.40 and 812.43. FDA wrote of a "Lack of a written monitoring plan and procedures describing how you will monitor the investigation, including how to handle protocol deviations and investigator noncompliance", and that "Site monitoring reports do not include the documents reviewed, associated findings, and communications with site personnel, including whether your site monitoring included a comparison of source documents with Case Report Forms (CRFs), an essential component of a monitoring plan to ensure data integrity"; it also noted "inadequate investigational device tracking" at the study's largest site [17].

United Health Products (24 March 2025) was cited under 812.20, 812.40, 812.46, 812.100, 812.140 and 812.150 as well as Part 50. FDA wrote that the sponsor "did not have an effective and implemented CMP during study conduct" and that "there was no interim monitoring report" for logged visits; that for one subject "Information for this UADE was recorded in an Adverse Event (AE) Form; however, there is no documentation to show that the UADE was evaluated as required by 21 CFR 812.46(b)(1)"; and, as a separate observation, "Failure to maintain accurate, complete, and current device shipment and disposition records [21 CFR 812.140(b)(2)]" [18]. The letter also records FDA's view that the study should have had an IDE because the device was significant risk, and that the sponsor's procedures should be corrected to reflect that the 812.150(b)(1) reporting requirement "also apply to non-significant risk studies subject to abbreviated requirements per 812.2(b)".

ExThera Medical (6 February 2026) was cited under 812.35, 812.40, 812.46, 812.5 and 812.7. The first observation concerned devices shipped for compassionate use without prior approval of a change to the investigational plan, with FDA noting the potential for "inadequate device accountability" [19].

Read together, the citation series and the letters describe a short list: case histories with device exposure dates and times, a deviation log with dates and reasons, unit-level receipt, use and disposition records at site and sponsor, a written monitoring plan that is executed and reported, and an evaluation record for every unanticipated adverse device effect. These are record-completeness and oversight questions. Software validation supports reliable capture; activity records must separately show that required study procedures occurred.

The device safety-event model

Takeaway: An unmodified drug SAE form may lack a stand-alone device deficiency, device-versus-procedure causality and the US device-reporting clocks. The US, EU and ISO definitions overlap without being identical, and the EUDAMED clinical-investigation route is not yet available, so the event model needs its own objects and two reporting configurations.

Under 21 CFR 812.3(s) an unanticipated adverse device effect is "any serious adverse effect on health or safety or any life-threatening problem or death caused by, or associated with, a device, if that effect, problem, or death was not previously identified in nature, severity, or degree of incidence in the investigational plan or application... or any other unanticipated serious problem associated with a device that relates to the rights, safety, or welfare of subjects" [20]. The clocks are in working days. The investigator reports to the sponsor and the reviewing IRB "as soon as possible, but in no event later than 10 working days after the investigator first learns of the effect" [21]. The sponsor "shall immediately conduct an evaluation of any unanticipated adverse device effect" and, if it presents an unreasonable risk, terminate the affected investigations "not later than 5 working days after the sponsor makes this determination and not later than 15 working days after the sponsor first received notice of the effect" [22]; the results of the evaluation go to FDA, all reviewing IRBs and participating investigators "within 10 working days after the sponsor first receives notice of the effect" [21]. The United Health Products letter shows what an inspector looks for: the event was on an AE form, and there was "no documentation to show that the UADE was evaluated" [18].

The EU vocabulary is wider. MDR Article 2 defines an adverse event as any untoward medical occurrence "in subjects, users or other persons, in the context of a clinical investigation, whether or not related to the investigational device", a serious adverse event by its outcomes (death, life-threatening illness or injury, permanent impairment, hospitalisation or prolongation, intervention to prevent those, chronic disease, and foetal or congenital outcomes), and a device deficiency as "any inadequacy in the identity, quality, durability, reliability, safety or performance of an investigational device, including malfunction, use errors or inadequacy in information supplied by the manufacturer" [7]. Article 80 requires the sponsor to record adverse events the plan identifies as critical, all serious adverse events, "any device deficiency that might have led to a serious adverse event if appropriate action had not been taken, intervention had not occurred, or circumstances had been less fortunate", and new findings; and to report "without delay" through the Article 73 system serious adverse events with a causal relationship to the device, comparator or procedure "or where such causal relationship is reasonably possible", such device deficiencies and new findings, with the rule that "The period for reporting shall take account of the severity of the event" [7]. Events in third countries under the same plan are reportable (Article 80(3)); for the Article 74(1) investigations specified in Article 80(5), vigilance provisions apply instead, but Article 80(6) retains clinical-investigation reporting for a serious event causally linked to the preceding investigational procedure.

ISO 14155:2026's public definitions carry the third vocabulary: adverse device effect, serious adverse device effect, unanticipated serious adverse device effect ("not been identified in the current risk assessment"), and a device deficiency that now includes "usability" and "labelling" [3]. The foreword lists among the edition's changes an "adverse event associated with a device deficiency" added to the event figures, clarified "situations of reduced adverse events reporting requirements", and "management of risks related to clinical procedures required by the CIP" [3]. MDCG 2024-3 asks the plan to list the definitions, a "list of foreseeable adverse events and anticipated adverse device effects, together with their likely probability of occurrence, mitigation, or treatment", the time frames for investigator-to-sponsor and sponsor-to-authority reporting, and the presence or justified absence of a data monitoring committee [11].

The route matters as much as the vocabulary. Article 73 names the electronic system that Article 80 reporting uses, and the Commission's EUDAMED page in September 2026 lists four modules as mandatory since 28 May 2026 and the clinical investigations and performance studies module as "under analysis", with no voluntary-use period planned before it becomes mandatory [8]. Until that changes, sponsors use the applicable national channels. MDCG 2020-10/1 Rev.1 specifies immediate reporting with outer limits of 2 calendar days for reportable events requiring prompt action to address imminent risk, and 7 calendar days for other reportable events, subject to agreed specific arrangements. Investigator-to-sponsor reporting should be immediate and within 3 calendar days under that guidance [23].

Configuration consequences for the safety layer:

1. Separate event objects for adverse event, adverse device effect, serious adverse device effect, unanticipated (serious) adverse device effect and device deficiency, with the device deficiency object able to exist without a subject injury.
2. Causality recorded separately against the investigational device, the comparator or sham, and the investigation procedure, because Article 80(2) and the ISO definitions distinguish them.
3. An evaluation record attached to every unanticipated adverse device effect, with the sponsor's determination, date and the outbound notifications, since 812.46(b) and 812.150(b)(1) are cited on the evaluation, not the event.
4. Separate US working-day clocks from the EU guidance’s 2/7-calendar-day sponsor deadlines and 3-calendar-day investigator deadline; implement earlier immediate reporting where needed and each authority’s accepted format [23].

Device accountability and exposure records

Takeaway: Device accountability is source data, not a binder. 812.140 asks for unit-level receipt, use and disposition records at both site and sponsor and for the date and time of each exposure; MDR Annex XV asks for control of access and return of unused, expired or malfunctioning devices; all three selected letters discuss device tracking, shipment/disposition or accountability concerns.

The US text was quoted above: type, quantity, dates, batch or code mark, the persons who received, used or disposed of each device, why and how many units were returned, repaired or disposed of, and the date and time of each subject's exposure [14]. The sponsor mirrors it with "Records of shipment and disposition", including consignee, type and quantity, date and batch or code mark, and the reasons for and method of disposal [14]. A request that an investigator return, repair or dispose of units must be notified to FDA and reviewing IRBs "within 30 working days after the request is made" [21]. Records are kept for two years after the later of study end or the date they are no longer needed to support a marketing submission [14].

The EU text puts the same objects in the plan. Annex XV item 3.11 requires "Accountability regarding the device, in particular control of access to the device, follow-up in relation to the device used in the clinical investigation and the return of unused, expired or malfunctioning devices", and Article 72(6) requires "a procedure for emergency situations which enables the immediate identification and, where necessary, an immediate recall of the devices used in the investigation" [7]. ISO 14155 lists "device accountability records" among its examples of source documents, and the 2026 edition adds an implant card requirement [3].

The inspection record shows the objects failing. 812.140(a) is the single most cited Part 812 section, 812.140(b) the fifth [2]; the Nobles letter records "inadequate investigational device tracking", the United Health Products letter a stand-alone 812.140(b)(2) observation, and the ExThera letter FDA's concern about "inadequate device accountability" when units left the approved plan [17][18][19]. Paper and electronic logs can both be adequate when controlled and reconciled. An integrated ledger can reduce duplicate entry, but its links, permissions and reconciliation still require verification.

Configuration consequences: a site inventory ledger keyed to lot or serial number (and unique device identifier where one exists) that records receipt, use, return, repair and disposal with the persons involved; a procedure form that selects the unit from that ledger so exposure date and time are captured once; and explant, return and destruction transactions that close the ledger and feed the sponsor's disposition record. The related question of how electronic records themselves are inspected is covered in EClinCloud's report on computerized-system inspection signals.

Monitoring and oversight under 21 CFR 812 and MDR Article 72

Takeaway: Both regimes make monitoring a sponsor obligation with a written plan, and the EU guidance names three contents the plan needs: an outline, an independent monitor, and the monitor's access to source data and extent of source data verification. The recent letters were written against exactly those contents.

Under 812.25(e) the investigational plan includes "Monitoring procedures. The sponsor's written procedures for monitoring the investigation and the name and address of any monitor" [24]. Under 812.43 the sponsor selects investigators and monitors "qualified by training and experience" [25]. Under 812.46(a) a sponsor who discovers non-compliance "shall promptly either secure compliance, or discontinue shipments of the device to the investigator and terminate the investigator's participation in the investigation" [22]. The non-significant-risk abbreviated requirements incorporate 812.46 monitoring by reference, so the obligation survives the absence of an IDE filing [26].

MDR Article 72(2) requires the sponsor to "ensure adequate monitoring", with "The extent and nature of the monitoring... determined by the sponsor on the basis of an assessment that takes into consideration all characteristics of the clinical investigation including the following: (a) the objective and methodology of the clinical investigation; and (b) the degree of deviation of the intervention from normal clinical practice" [7]. MDCG 2024-3 turns that into plan contents: "A general outline of the monitoring plan. A description of the appointment of a monitor that is independent from the investigational site. A description of the monitor's access to source data and the extent of source data verification planned" [11].

FDA's 2023 risk-based monitoring questions and answers apply to devices and cite 812.40 and 812.46. They describe centralized monitoring as "a systematic analytical evaluation of study conduct across multiple clinical sites, carried out by sponsor personnel or representatives", able to review study-wide data for inconsistencies, verify source data and "determine which clinical sites need on-site review", and they treat source data verification as something that "may be a part of a risk-based monitoring approach" [27]. For an industry device record at a median of one facility, cross-site comparison has little to work with; centralized checks fall back on within-site consistency, such as consent date and time against procedure date and time, and procedure records against the device ledger.

The letters supply the failure modes. FDA cited Nobles for the lack of "a written monitoring plan and procedures", for monitoring reports silent on whether source documents had been compared with CRFs, and for not showing that investigators and monitors were "qualified by training and experience" [17]. It cited United Health Products because a monitoring plan promised in the protocol was never "effective and implemented" and interim visits had no report [18]. Both are documentation of a plan and its execution, which is what a clinical trial management system exists to hold: the plan version, the monitor's independence and qualification, the visit log, and a report structure that records documents reviewed, subjects verified, findings and the CRF-to-source comparison performed.

Electronic records sit under all of this. FDA's October 2024 questions and answers on electronic systems in clinical investigations, which cover Part 812 studies, expect risk-based validation and audit trails that "must capture electronic record activities including all changes made to the electronic record, the individuals making the changes, and the date and time of the changes and should include the reasons for the changes", with the components "(1) the date and time..., (2) the individual making the change..., and (3) the old value and the new value" [28]. MDR Article 72(3) requires information to be recorded and stored "in such a way that it can be accurately reported, interpreted and verified" [7].

Three clocks: ISO 14155:2026, FDA recognition and EU harmonisation

Takeaway: ISO's fourth edition replaces the 2020 text, FDA's database still recognises the 2020 edition, and the EU harmonised reference is the 2020 edition with a 2024 amendment. A plan that says "ISO 14155" without an edition is ambiguous in 2026; the practical answer is to state the edition per regulator and assess the 2026 changes against the study and record a justified implementation plan.

ISO 14155:2026 states that "This fourth edition cancels and replaces the third edition (ISO 14155:2020), which has been technically revised" [3]; a trade notice dates the publication to 23 March 2026 [4]. The foreword's change list is the specification a data manager needs, and its items map to data objects: clarified that deviations from eligibility criteria are prohibited and handled through plan amendment (5.6.4); a clear distinction between risks of device use and risks of procedures required by the plan, with a required assessment of residual risks (6.2.1, 6.2.2); plan requirements moved from Annex A into clause 6.4; a requirement for the data monitoring committee to confirm conditions for suspending or stopping the investigation and a requirement to justify the absence of a committee (6.11, A.14); a new clinical events committee section (3.8, 6.12, A.14), defined as an independent committee "to ensure consistent event assessment across participating centres and mitigate inadequate reporting risks"; an updated procedure section "with methods and timing for assessing, recording and analysing variables and added requirement for calibration of equipment" (A.6.4); clarified non-inferiority margins and missing data (A.7); principles of estimands and their attributes (6.4, A.5 to A.7, Annex K); an implant card (9.2.2); information on training on the use of the investigational device (B.2); and the adverse event associated with a device deficiency category [3]. The normative reference is ISO 14971, so the risk file and the clinical plan are formally linked.

FDA recognition has not moved. A keyword search of the recognized consensus standards database on 13 September 2026 returns one ISO 14155 record: "14155 Third edition 2020-07", recognition number 2-282, date of entry 21 December 2020, extent of recognition complete [5]. A declaration relying on FDA recognition must identify the recognized edition and scope. A newer edition may be discussed as supporting evidence with an appropriate rationale; FDA recognition remains a separate decision. Data from investigations outside the United States are accepted under 812.28 when the investigation is "well-designed and well-conducted" and a statement is provided that it followed good clinical practice as that section defines it, which is a conduct standard rather than an edition citation [29].

The EU reference did move, to the amended 2020 edition. Commission Implementing Decision (EU) 2026/193 of 28 January 2026 lists at entry 39 "EN ISO 14155:2020" together with "EN ISO 14155:2020/A11:2024" [6]. Conformity with the relevant harmonised standard or its parts gives a presumption of conformity only for the MDR requirements those parts cover under Article 8, which extends to "clinical investigations" among the system and process requirements [7]. MDCG 2024-3, written before the fourth edition, says "Adherence with the ISO 14155:2020 standard is strongly recommended" and points to its data-management clauses [11].

The literature has followed the standard. Europe PMC returns 1,080 records mentioning "ISO 14155", 1,023 of them from 2015 onward, rising from 18 in 2015 to 167 in 2025; records mentioning "device deficiency" rise from 2 in 2015 to 113 in 2025 (561 in total) [30]. The counts are query-defined discovery measures, not prevalence, but the direction matches the registry: the device vocabulary is being written down more often each year.

Volume gives the clocks their weight. FDA received 353 original IDE applications in the fiscal year 2025 receipt cohort, a preliminary count that includes CBER, and 325 in the fiscal year 2024 cohort [31]. Each of those studies, and every EU investigation applying under Article 62, has to decide which edition its plan cites.

Configuration consequences: state the ISO edition per regulator in the plan and the declarations, and record why; assess applicable 2026 changes (clinical events committee charter and adjudication records, data monitoring committee justification, residual-risk assessment linked to the ISO 14971 file, estimand attributes in the statistical section, equipment calibration records, training records per operator) and plan any necessary configuration, validation and procedure changes; an edition transition may require more than a document update; and keep the national safety-reporting formats configured until the EUDAMED module is declared functional.

Requirement matrix and configuration checklist

Takeaway: The three regimes converge on the same objects under different names and clocks. The matrix maps each object to its US, EU and ISO clause; the checklist turns the evidence into a build audit.

The matrix is deliberately clause-level. Where a cell says "if applicable" or names the significant-risk condition, that qualifier comes from the text and should travel with the requirement into the plan. The convergences are the useful part: device accountability appears in 812.140, in Annex XV item 3.11 and in the ISO source-document examples; the monitoring plan appears in 812.25(e), Article 72(2) and MDCG 2024-3 section 3.6.6; the safety definitions appear in 812.3(s), Article 2 and ISO clause 3. The divergences are clocks and routes: working days against "without delay", and an FDA report against a Member State submission pending the Article 73 system.

Each checklist line names the object, the evidence that makes it necessary and the system that usually owns it. Ownership is the practical point for a data manager: the procedure record, endpoint components and safety-event objects belong in EDC; the device ledger in EDC or the trial management system with site access; the monitoring plan, visit log and reports in the trial management system; the committee charters and training records in the trial master file and training system; audit trails in every electronic clinical data system; and the edition statement with regulatory affairs. Named owners and verifiable records address these selected observation themes; they do not establish inspection readiness or compliance on their own.

Frequently asked questions

Does a non-significant-risk study still need a monitoring plan and device accountability?

Monitoring remains required under the abbreviated requirements, while recordkeeping is narrower than the full significant-risk regime. Do not apply every full-IDE ledger clause to NSR studies automatically. 812.2(b) treats an investigation of a device other than a significant risk device as having an approved IDE application when the sponsor labels the device, obtains IRB approval after "a brief explanation of why the device is not a significant risk device", ensures informed consent, "Complies with the requirements of § 812.46 with respect to monitoring investigations", keeps the records under 812.140(b)(4) and (5), makes the reports under 812.150(b)(1) through (3) and (5) through (10), and ensures investigators keep the 812.140(a)(3)(i) records and make the 812.150(a)(1), (2), (5) and (7) reports [26]. The United Health Products letter adds FDA's reminder that the unanticipated adverse device effect reporting requirement applies to non-significant-risk studies under 812.2(b) as well [18].

Can a drug trial SAE form be reused for a device study?

Review the existing form and workflow against device-specific needs: a separate deficiency record, causality to device/comparator/procedure, relevant identifiers and documented UADE evaluation. Extend only the missing elements; software labels do not determine adequacy. MDR Article 80 requires recording device deficiencies that might have led to a serious adverse event even when no injury occurred [7], and the FDA letter quoted above cites the absence of a documented evaluation rather than the absence of an AE entry [18]. The minimum is a device deficiency object that can exist without an injury and an evaluation record attached to the event.

Do in vitro diagnostic studies fall under ISO 14155?

ISO 14155 states that it "does not apply to in vitro diagnostic medical devices", while noting that users may consider whether specific sections or requirements apply depending on the device and national or regional rules; it also says its requirements apply "as far as relevant" to software as a medical device [3]. IVD performance studies follow the separate IVD regulation in the EU. The data-capture objects in this report that carry over to an IVD study are specimen-level rather than procedure-level, and the safety model depends on specimen collection, intervention and the study’s risks; its size depends on the study. Assess IVDR-specific requirements separately.

Can a submission cite ISO 14155:2026 today?

The plan can follow the 2026 edition, but the declarations should match the regulator's reference. FDA's database recognised only the 2020 edition on 13 September 2026 [5], and the EU harmonised reference is EN ISO 14155:2020 with amendment A11:2024 [6]. A plan built to the 2026 edition can be mapped to those references; the mapping should be written down.

How long are device investigation records kept?

Under 812.140(d), investigators and sponsors keep records "during the investigation and for a period of 2 years after the latter of the following two dates: The date on which the investigation is terminated or completed, or the date that the records are no longer required for purposes of supporting" a marketing application or submission [14]. Under MDR Annex XV Chapter III, the documentation "shall be kept for a period of at least 10 years after the clinical investigation with the device in question has ended, or, in the event that the device is subsequently placed on the market, at least 10 years after the last device has been placed on the market. In the case of implantable devices, the period shall be at least 15 years" [7]. A multi-region archive follows the longer rule.

Methodology and limitations

The registry lane reads ClinicalTrials.gov through the AACT relational copy (registry snapshot 25 July 2026, AACT copy 1 August 2026) [1]. The population is interventional studies with a start year from 2015 to 2026 (299,607 records). The device cohort has at least one device intervention and no drug or biological intervention (43,294; 10,362 industry led); the drug cohort the reverse (119,730; 45,837 industry led); 3,505 combination studies are excluded; industry means the lead sponsor's agency class. The IDE proxy is the registry flag for an unapproved device and is read from 2018 onward because it was largely blank earlier. Primary time frames are the longest duration written in the primary-outcome time-frame field; records without a parsable duration are excluded from duration denominators. Results posting is measured among completed records with primary completion on or before 30 June 2024. Device-specific language is a set of regular-expression families over outcome titles and descriptions and is an unvalidated keyword indicator with possible false positives and false negatives. Registry fields describe submitted records, not conduct.

The inspection lane uses FDA's Form 483 citation workbooks for fiscal years 2006 to 2025, restricted to the Devices program sheets and citations beginning "21 CFR 812" [2]. Frequency is the number of 483s on which a citation appeared in that year. The workbooks give no inspection denominator, so no rate is computed, and the sheets labelled BIMO were excluded because they carry Parts 50, 56, 58 and 312 only.

The warning-letter lane uses the FDA index of letters issued from 2021 through July 2026 (3,643 rows) [16]. Candidates were selected by subject wording, so a Part 812 letter filed under an unrelated subject would be missed; the three letters found were read in full and quoted verbatim. Warning letters are discretionary enforcement documents, not a sample of studies.

The regulatory lane quotes the e-CFR text of Part 812, the MDR consolidated text of 10 January 2025, MDCG 2024-3, Commission Implementing Decision (EU) 2026/193, the Commission's EUDAMED page, FDA guidances and the FDA recognized standards database, all read on 12 and 13 September 2026. ISO 14155:2026 is described only from its public foreword, scope and clause 3 definitions; clauses behind the paywall are left unparaphrased. Literature counts come from Europe PMC queries run on 13 September 2026 and are query-defined [30]. Dates of live pages are stated because the FDA recognition and EUDAMED positions can change.

Conclusion

The registry shows the shape: single group, open label, one facility, no phase, device-specific endpoints in a rising share of records [1]. The inspection record shows the objects: investigator case histories and device records, protocol compliance, sponsor monitoring, and the evaluation of unanticipated adverse device effects [2][17][18]. The texts show the clocks: ISO's 2026 edition, FDA's 2020 recognition, the EU's amended 2020 harmonisation, and an EU electronic reporting route that remains closed [3][5][6][8].

Three actions follow. Build the device objects first: the procedure record with operator and unit, the device ledger, the safety-event set with a stand-alone device deficiency and an evaluation record, and component-level endpoint fields. Write the monitoring plan the investigational plan promises, with independence, source-data access and verification extent stated, and produce reports that say what was reviewed. State the ISO edition per regulator and assess which 2026 changes require configuration or process updates.

EClinCloud's platform includes EDC, eCOA, CTMS and IRC products, and its services include study build and configuration and data and BI services [32]. Teams configuring a device investigation can use the matrix and checklist above as the audit against which any platform, including this one, is set up.

Sources

1. ClinicalTrials.gov via the AACT database (Clinical Trials Transformation Initiative), ClinicalTrials.gov and AACT downloads, registry snapshot 25 July 2026, AACT copy 1 August 2026. EClinCloud analysis of interventional studies started 2015 to 2026 (device versus drug cohorts), accessed September 2026.

2. U.S. Food and Drug Administration, Inspection Observations (Form FDA 483 citation workbooks, FY2006 to FY2025). EClinCloud analysis of 21 CFR 812 citations on the Devices program sheets, accessed September 2026.

3. International Organization for Standardization, ISO 14155:2026 (fourth edition), Online Browsing Platform preview: foreword, scope and terms, accessed 13 September 2026. "Cancels and replaces the third edition"; list of main changes; public definitions.

4. NSF, The fourth edition of ISO 14155 was published on March 23, 2026, and replaces the 2020 version (regulatory news, 14 April 2026), accessed 13 September 2026. Third-party dating of the publication day.

5. U.S. Food and Drug Administration, Recognized Consensus Standards: Medical Devices database, keyword "14155", queried 13 September 2026. Record 2-282, ISO 14155 Third edition 2020-07, date of entry 21 December 2020, extent Complete.

6. EUR-Lex, Commission Implementing Decision (EU) 2026/193 of 28 January 2026 amending Implementing Decision (EU) 2021/1182 (harmonised standards under Regulation (EU) 2017/745), accessed 13 September 2026. Entry 39: EN ISO 14155:2020 and EN ISO 14155:2020/A11:2024.

7. EUR-Lex, Regulation (EU) 2017/745 on medical devices, consolidated text of 10 January 2025, accessed 12 September 2026. Articles 2(57) to (59), 8, 62, 72, 73, 80; Annex XV Chapters II and III.

8. European Commission, EUDAMED overview, read 13 September 2026. Four modules mandatory since 28 May 2026; clinical investigations and performance studies module "under analysis".

9. U.S. Food and Drug Administration, Design Considerations for Pivotal Clinical Investigations for Medical Devices (guidance, November 2013), accessed 12 September 2026. Development stages; learning curve; site diversity; objective performance criteria and performance goals; blinding.

10. U.S. Food and Drug Administration, Investigational Device Exemptions (IDEs) for Early Feasibility Medical Device Clinical Studies, Including Certain First in Human (FIH) Studies (guidance, October 2013), accessed 12 September 2026. "Generally fewer than 10 initial subjects".

11. Medical Device Coordination Group, MDCG 2024-3, Guidance on content of the Clinical Investigation Plan for clinical investigations of medical devices (March 2024), accessed 12 September 2026. Sections 3.6.6 monitoring plan; 3.7 statistics including learning curve; 3.8 data management; 3.14 safety definitions; 3.15 follow-up.

12. Sedrakyan A, Campbell B, Merino JG, Kuntz R, Hirst A, McCulloch P. IDEAL-D: a rational framework for evaluating and regulating the use of medical devices. BMJ. 2016;353:i2372. PMID 27283585.

13. Cook JA, Ramsay CR, Fayers P. Statistical evaluation of learning curve effects in surgical trials. Clin Trials. 2004;1(5):421-427. PMID 16279280.

14. Legal Information Institute (e-CFR), 21 CFR § 812.140 Records, accessed 12 September 2026. Investigator device receipt, use and disposition and case-history records; sponsor shipment and disposition records; retention.

15. Legal Information Institute (e-CFR), 21 CFR § 812.110 Specific responsibilities of investigators, accessed 12 September 2026. Read with § 812.100 general responsibilities.

16. U.S. Food and Drug Administration, Warning Letters index. EClinCloud analysis of 3,643 letters issued 2021 to 2026 and posted through 31 July 2026, accessed September 2026.

17. U.S. Food and Drug Administration, Warning Letter to Nobles Medical Technology II, Inc. (MARCS-CMS 673465, 26 January 2024), accessed 12 September 2026. 21 CFR 812.40, 812.43.

18. U.S. Food and Drug Administration, Warning Letter to United Health Products, Inc. (MARCS-CMS 697777, 24 March 2025), accessed 12 September 2026. 21 CFR 812.20, 812.40, 812.46, 812.100, 812.140, 812.150; Part 50.

19. U.S. Food and Drug Administration, Warning Letter to ExThera Medical Corporation (MARCS-CMS 715068, 6 February 2026), accessed 13 September 2026. 21 CFR 812.35, 812.40, 812.46, 812.5, 812.7.

20. Legal Information Institute (e-CFR), 21 CFR § 812.3 Definitions, accessed 12 September 2026. Significant risk device (m); unanticipated adverse device effect (s).

21. Legal Information Institute (e-CFR), 21 CFR § 812.150 Reports, accessed 12 September 2026. Investigator and sponsor reporting clocks.

22. Legal Information Institute (e-CFR), 21 CFR § 812.46 Monitoring investigations, accessed 12 September 2026. Securing compliance; evaluation of unanticipated adverse device effects.

23. Medical Device Coordination Group, MDCG 2020-10/1 Rev.1, Safety reporting in clinical investigations of medical devices (October 2022), accessed 13 September 2026. Sections 8.1-8.2: immediate reporting, 2/7 calendar-day sponsor outer limits and 3 calendar-day investigator outer limit; specified agreed arrangements.

24. Legal Information Institute (e-CFR), 21 CFR § 812.25 Investigational plan, accessed 12 September 2026. Paragraph (e), written monitoring procedures.

25. Legal Information Institute (e-CFR), 21 CFR § 812.43 Selecting investigators and monitors, accessed 12 September 2026.

26. Legal Information Institute (e-CFR), 21 CFR § 812.2 Applicability, accessed 12 September 2026. Significant-risk versus abbreviated (non-significant-risk) requirements.

27. U.S. Food and Drug Administration, A Risk-Based Approach to Monitoring of Clinical Investigations: Questions and Answers (guidance, April 2023), accessed 13 September 2026. Applies to devices; centralized monitoring; source data verification.

28. U.S. Food and Drug Administration, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (guidance, October 2024), accessed 13 September 2026. Q7 risk-based validation; Q12 audit trails.

29. Legal Information Institute (e-CFR), 21 CFR § 812.28 Acceptance of data from clinical investigations conducted outside the United States, accessed 13 September 2026.

30. Europe PMC, REST search service. EClinCloud query counts run 13 September 2026 ("ISO 14155", "device deficiency" and related device-methodology terms).

31. U.S. Food and Drug Administration, FY 2025 MDUFA Performance Report to Congress and FY 2024 MDUFA Performance Report to Congress, accessed 13 September 2026. Table B-1 in each: 353 original IDE applications in the FY2025 receipt cohort (preliminary, includes CBER) and 325 in the FY2024 cohort.

32. EClinCloud, EDC, eCOA, CTMS, IRC and Services pages, wording checked 13 September 2026. Product and service scope only; no performance or compliance claim.