ISO 14155 and the Sponsor-Investigator: When the Standard Meets the Ward

ISO 14155 is the GCP standard for medical device clinical investigations. It defines how studies should be designed, conducted, monitored, recorded, and reported. It is clear, structured, and comprehensive.

It was also written primarily for industry sponsors with dedicated clinical operations teams, regulatory departments, and six- to seven-figure study budgets.

The problem is that a growing number of medical device clinical investigations are not run by industry. They are run by clinicians — surgeon-scientists, academic researchers, university hospital departments — who simultaneously hold the roles of sponsor, principal investigator, and often the entire study team. ISO 14155 calls this person the sponsor-investigator.

This post examines what that dual role actually demands under ISO 14155:2020, where the standard collides with the reality of academic clinical research, and what this means for the evidence ecosystem that EU-MDR depends on.

What ISO 14155 Requires — And Who It Was Written For

ISO 14155 (current edition: 2020, replacing the 2011 version you may still encounter in legacy study documentation) establishes GCP for medical device investigations. It is referenced by EU MDR 2017/745, recognized by the FDA, and aligned with ICH E6(R2).

The standard separates responsibilities cleanly into two roles:

Role	Core Responsibilities (ISO 14155:2020)
Sponsor (Clause 9)	Clinical quality management, CIP preparation, monitor selection, safety evaluation, regulatory submissions, device accountability, insurance, document retention, outsourcing oversight
Principal Investigator (Clause 10)	CIP compliance, informed consent, medical care of subjects, safety reporting, data integrity at site level

The 2020 revision added significant requirements beyond the 2011 edition:

13 GCP principles (Clause 4) — harmonizing with ICH E6(R2)
Clinical quality management (Clause 9.1) — formal QMS for clinical operations
Risk-based monitoring (Clause 6.7) — replacing one-size-fits-all on-site monitoring
Public registration of clinical investigations before first subject enrollment
Annex H — explicit integration of ISO 14971 risk management into the investigation
Annex I — clarifying applicability across clinical development stages (pre-market, post-market, PMCF)
Enhanced statistical requirements — driven by Notified Body expectations under MDR
Electronic clinical data system requirements (Clause 7.8.3) — validation, audit trails, access controls

These are not minor administrative updates. They represent a fundamental shift toward industry-grade quality management for all device investigations.

The Sponsor-Investigator Problem

ISO 14155 does not define the term "sponsor-investigator" explicitly. But the concept is implicit: when a clinician initiates a study, that clinician assumes all sponsor responsibilities under Clause 9 in addition to their investigator responsibilities under Clause 10.

This means a single person — typically a surgeon or physician-researcher at a university hospital — is simultaneously required to:

Implement a clinical quality management system

Prepare and maintain the CIP, IB, CRFs, informed consent forms

Appoint and supervise a qualified monitor independent from the investigation site

Ensure validated electronic data capture with audit trails

Conduct ongoing safety evaluation and regulatory reporting

Maintain device accountability and traceability

Ensure document and data control per Clause 7.8

Register the investigation publicly

Arrange insurance coverage

Write the clinical investigation report

And simultaneously:

Conduct the clinical investigation day-to-day

Obtain informed consent

Provide medical care to subjects

Ensure CRF completeness and source data consistency

Report adverse events and device deficiencies

This is not a manageable workload for a clinician who also has a surgical schedule, teaching obligations, and grant applications to write. The standard does not scale down its requirements for smaller operations. It does not distinguish between a 500-patient RCT run by a multinational and a 30-patient single-center feasibility study run by a department of surgery.

Where Investigator-Initiated Studies Systematically Fail

Having worked with investigator-initiated studies (IIS) across Europe for over 15 years, I can identify the failure patterns with reasonable confidence. They are predictable, recurrent, and structural — not a function of investigator incompetence.

1. Electronic Data Capture and Audit Trails

ISO 14155:2020, Clause 7.8.3 requires that electronic clinical data systems are validated, maintain audit trails, prevent data deletion, control access, and ensure data attributability and completeness.

Most IIS use Excel spreadsheets, paper CRFs, or ad-hoc REDCap setups without formal validation documentation. This is understandable — validated EDC systems cost money that grant budgets rarely cover — but it means the data is non-compliant from day one.

Consequence: If a manufacturer later wants to reference IIS data for a CER or PMCF report, the non-compliant data capture method is a disqualifying deficiency. The data exists but cannot be used for its most valuable regulatory purpose.

2. Monitoring

ISO 14155:2020 requires the sponsor to appoint a monitor who is independent from the investigation site (Clause 9.2.4). The monitor must conduct initiation visits, routine monitoring visits, and close-out activities. Even with risk-based monitoring (which permits reduced on-site presence), the minimum requirements include source data verification, CRF review, consent verification, and safety reporting checks.

Most IIS have no independent monitoring at all. The investigator "monitors" their own study, which is a direct violation of the independence requirement.

Consequence: Notified Bodies conducting clinical evaluation assessments (per MDCG 2020-13) will flag unmonitored studies. EU MDR Annex XV explicitly requires independent monitoring for all clinical investigations supporting conformity assessment.

3. Standard Operating Procedures

ISO 14155:2020, Clause 9.1 requires the sponsor to implement written clinical quality procedures. This means SOPs — for data management, safety reporting, monitoring, deviation handling, document control.

University research groups typically operate without device-investigation-specific SOPs. They may have general research ethics procedures, but these do not meet the specificity ISO 14155 demands.

4. Safety Reporting Architecture

The sponsor must classify adverse events, conduct ongoing safety evaluation, report USADEs to regulatory authorities within defined timelines, and communicate safety information to investigators and ethics committees (Clause 9.2.5).

In an IIS, the investigator who observes the adverse event is the same person who must classify it, evaluate the causal relationship, report it to themselves (as sponsor), and then report it to the ethics committee and competent authority. The conflict of interest is structural and unavoidable.

5. GDPR and Data Sharing

This is the trap that catches everyone. Investigators obtain informed consent from subjects for the investigation. But that consent typically does not include permission for a manufacturer to receive, process, or analyze the data. Under GDPR, the investigator cannot simply hand over the dataset to the device company post hoc.

Consequence: A manufacturer who co-funds an IIS expecting to use the data for regulatory purposes may discover — after the study is completed — that the data cannot legally be transferred. This is not a theoretical risk. It happens regularly.

The Industry-Academia Dynamic: Uncomfortable Truths

Medical device companies have a strong incentive to encourage investigator-initiated studies. IIS are cheaper than company-sponsored studies, they generate publications that support commercial narratives, and they create clinical champions who become speakers and advocates.

But there is a structural dishonesty in how this relationship often works in practice.

What Companies Want from IIS

Companies provide devices, sometimes funding, and often "scientific support" to investigators. In return, they expect data they can reference in CERs, PMCF reports, and marketing materials.

What Companies Actually Get

They get publications — which have value for literature-based clinical evaluation — but the underlying data often cannot be used for regulatory purposes because the study was not conducted in compliance with ISO 14155. The CIP was not structured per Annex A. There was no monitoring. The EDC was not validated. The safety reporting was informal. The consent forms did not include data transfer provisions.

The Uncomfortable Middle Ground

Many IIS programs exist in a grey zone: the manufacturer provides support that falls short of formal sponsorship (to avoid triggering the full regulatory obligations of EU MDR Article 62), while the investigator runs the study without the infrastructure to comply with ISO 14155. Both parties benefit from the ambiguity — until a Notified Body or competent authority asks pointed questions.

This is not a criticism of individual investigators or companies. It is a structural problem created by a standard that does not differentiate its requirements by study complexity or resource context, combined with a regulatory framework that demands ISO 14155 compliance for all clinical investigations used to demonstrate conformity.

What the 2020 Revision Changes for Sponsor-Investigators

The 2020 edition made the situation harder, not easier, for sponsor-investigators. Specifically:

Change in ISO 14155:2020	Impact on Sponsor-Investigators
Clinical quality management (9.1)	Requires formal QMS — most academic groups lack this entirely
Risk-based monitoring (6.7)	Helpful in principle (reduces on-site visits), but still requires an independent monitor and a documented monitoring plan
Annex I applicability guidance	Clarifies that post-market studies (including PMCF) must follow ISO 14155 "as far as relevant" — but the burden of justifying exemptions falls on the sponsor-investigator
Enhanced statistical requirements	Notified Bodies now expect power calculations, predefined endpoints, and statistical analysis plans — not just descriptive summaries
Electronic consent provisions	Modernizes the consent process, but adds validation requirements for e-consent platforms
Public registration	Requires registration before first enrollment — a step many IIS skip
ISO 14971 integration (Annex H)	Requires documented clinical risk management — a competence most clinicians do not have

The one genuinely positive change for sponsor-investigators is the recognition of risk-based monitoring, which legitimizes reduced monitoring intensity for lower-risk studies. But even risk-based monitoring requires a documented rationale, a monitoring plan, and an independent monitor — resources most IIS budgets do not include.

A Practical Path Forward

If you are a clinician planning an investigator-initiated device study, or a company considering support for one, here is what I would recommend:

1. Decide upfront whether the data needs to be ISO 14155-compliant.

If the answer is yes — because it will support a CER, PMCF report, or regulatory submission — then the study must be resourced accordingly. This means budget for EDC, monitoring, SOPs, and regulatory support. If the budget is not available, the study can still generate valuable clinical knowledge and publications, but it should not be positioned as regulatory-grade evidence.

2. If the company is providing devices and funding, clarify the sponsorship model.

Either the company is the sponsor (with full Clause 9 responsibilities) or the investigator is the sponsor-investigator. The grey zone — where the company provides "unrestricted grants" and "scientific collaboration" while expecting regulatory-grade data — serves neither party well and creates compliance risk for both.

3. Address GDPR consent from day one.

If there is any possibility that the data will be shared with a manufacturer, the informed consent form must include explicit data processing provisions. This cannot be retrofitted.

4. Invest in monitoring — even if minimal.

A single independent monitor conducting risk-based remote monitoring with targeted on-site visits is vastly better than no monitoring. It costs a fraction of full on-site monitoring and can make the difference between compliant and non-compliant data.

5. Use a validated EDC — even a basic one.

ISO 14155-compliant EDC systems exist at various price points. Using one from the start avoids the most common and most damaging compliance gap in investigator-initiated studies.

The Bottom Line

ISO 14155 is a good standard. It protects subjects, ensures data quality, and provides a framework that — when followed — produces clinical evidence that regulators can trust.

But it was designed for a world where sponsors have infrastructure and investigators have support. When a single clinician must fulfill both roles without either, the standard becomes a compliance trap rather than a quality enabler.

The medical device industry needs investigator-initiated studies. They generate the real-world evidence, the creative hypotheses, and the clinical innovation that company-sponsored pivotal trials cannot. But the current framework — ISO 14155 applied without differentiation, combined with MDR's insistence on GCP compliance for regulatory evidence — is systematically producing studies that are scientifically valuable but regulatorily unusable.

The solution is not to lower the standard. It is to build the infrastructure that allows sponsor-investigators to meet it. That means dedicated IIS support programs within companies, university clinical trial units with device-specific competence, and realistic budgets that include monitoring, EDC, and regulatory expertise — not just device supply and publication fees.

Key References

ISO 14155:2020. Clinical investigation of medical devices for human subjects — Good clinical practice. International Organization for Standardization.
ISO 14155:2011. Clinical investigation of medical devices for human subjects — Good clinical practice. International Organization for Standardization. [Withdrawn, replaced by ISO 14155:2020]
Regulation (EU) 2017/745 of the European Parliament and of the Council (EU MDR). Article 62 (Clinical investigations), Annex XV (Clinical investigations).
ICH E6(R2). Guideline for Good Clinical Practice. International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. 2016.
MDCG 2020-13. Clinical evaluation assessment report template. Medical Device Coordination Group.
ISO 14971:2019. Medical devices — Application of risk management to medical devices. International Organization for Standardization.
Regulation (EU) 2016/679 (GDPR). General Data Protection Regulation. European Parliament and Council.

Dr. Marc Harms
MH-Analytics