ISO 14155:2026 vs. ISO 14155:2020: What Actually Changed, and What It Means for Your Studies

The fourth edition of ISO 14155, the GCP standard for clinical investigations of medical devices, cancels and replaces the third edition from 2020. The new edition is a technical revision, not an editorial refresh. Several of the changes affect how studies must be designed, how risks must be managed, and which committees a sponsor needs to think about before enrolling the first subject.

There is one piece of regulatory irony worth noting up front. The 2020 edition, in its European form EN ISO 14155:2020+A11:2024, only recently achieved formal harmonization under EU MDR 2017/745. It was the first ISO 14155 version harmonized since the MDR entered into force. The fourth edition now supersedes it almost immediately. Until the 2026 edition is itself harmonized, sponsors face a familiar tension: the harmonized standard and the state of the art are no longer the same document. ISO standards apply from publication, with no built-in transition period, so the practical answer is to work to the 2026 edition and document where you stand against both.

The Changes That Matter Most

1. Risk management is restructured into two distinct streams

This is the most substantive change in the fourth edition, and it resolves a conceptual weakness of the 2020 text. The standard now draws a clear line between two categories of risk (Clause 6.2.1):

First, risks related to the use of the investigational device itself. These continue to be managed under ISO 14971, following the established pathway in Clause 7.4.4 and Annex H, including predefined risk acceptability thresholds that trigger a formal risk assessment when reached or exceeded.

Second, risks related to clinical procedures required by the CIP that fall outside routine clinical practice, for example additional imaging, biopsies or follow-up visits that exist only because of the study. This category gets its own clauses (6.2.3 and 7.4.5), and the standard states explicitly that managing these risks differs from the principles of ISO 14971 and Annex H. A descriptive, risk-based assessment proportionate to the burden on the subject is required instead.

A third element, risks related to the clinical investigation process itself (data integrity, consent process, monitoring), is addressed in the new Clause 6.2.4 and likewise sits outside the ISO 14971 framework.

In addition, the 2026 edition makes the assessment of residual risks an explicit requirement (Clause 6.2.2). Residual risks must be evaluated proportionate to the sample size and population, disclosed in the IB and instructions for use, and the risk-benefit information must be aligned across IB, IFU, CIP and informed consent form.

The practical consequence: risk management files and CIP templates built on the 2020 logic, where everything funnelled into one ISO 14971 process, need restructuring. The adverse event categorization in Annex F has been updated accordingly. There is now a separate category for events related to CIP-required procedures outside routine practice, and when an adverse event is associated with a device deficiency, both categorization charts (Figures F.1 and F.2) apply.

2. Estimands arrive in the device world

The 2026 edition imports the estimand framework from ICH E9(R1) into device GCP. Clause 6.4, the CIP requirements in Clauses A.5 to A.7 and the new Annex K introduce the concept: a precise description of the treatment effect, defined through five attributes (treatment, population, variable, population-level summary, and the handling of intercurrent events such as death, treatment switching or withdrawal).

For pharmaceutical statisticians this is familiar territory since 2019. For many device sponsors it is new, and it raises the bar for CIP authorship. Objectives must now translate directly into pre-specified, operationalized primary endpoints, and where applicable into estimands, which requires interdisciplinary input to define intercurrent events and analysis strategies before the study starts.

Clause A.7 also tightens the statistical requirements in two specific places. Non-inferiority margins must be smaller than the effect size and justified, where applicable with reference to the effect of the comparator. Handling of missing data, imputation methods and sensitivity analyses to test the robustness of results against different missing-data approaches are spelled out as CIP content.

3. Clinical Events Committees are formally introduced

The fourth edition adds a definition (Clause 3.8) and a dedicated section (Clause 6.12) on the Clinical Events Committee, the independent expert body for adjudicating endpoints and safety events across sites. The sponsor must consider establishing a CEC before the study starts, and if one is established, a charter must document the adjudication methods, the criteria for determining whether events meet CIP endpoint definitions, and the classification of events as related to device use or to CIP-required procedures.

The Data Monitoring Committee requirements were sharpened in parallel. The DMC charter must now confirm the conditions for suspending or stopping the investigation where relevant for safety management (Clause 6.11), and notably, the absence of DMC involvement must be justified in the CIP (Clause A.14). Doing nothing is still an option, but it is no longer a silent one.

4. Smaller but consequential clarifications

Several changes are individually modest but operationally relevant.

The definition of clinical performance (Clause 3.12) was rewritten. It now ties performance to the intended purpose as claimed by the manufacturer and links it explicitly to clinical benefit, with a note acknowledging that not all investigations carry direct benefit for subjects, such as those with healthy volunteers.

Deviations from eligibility criteria are not permitted. If a sponsor wants to enrol outside the inclusion and exclusion criteria, the route is a CIP amendment, not a deviation request (Clause 5.6.4). This closes a practice that was common but always questionable.

The informed consent clauses were clarified: consent from a legally designated representative is addressed more precisely (Clause 5.8.1), and subjects must be given the opportunity to discuss participation with others, for example family members, before deciding (Clause 5.8.2).

The CIP procedure section now requires methods and timing for assessing, recording and analysing variables, plus arrangements for calibration of the equipment used to assess study variables (Clause A.6.4). Subject follow-up and continued care arrangements that differ from normal practice must be addressed in the CIP (Clause A.16). The sponsor must prepare an implant card template where appropriate (Clause 9.2.2), and the role of the local representative was clarified for better alignment with national requirements (Clause 9.2.1). The IB requirements now include precautions, information on device training, and in-silico tests among the preclinical evidence (Annexes B.2, B.3 and B.5). Situations of reduced adverse event reporting, relevant mainly for post-market studies, were clarified in Clause 7.4.2, and the suspension and termination process in Clause 8.2 was aligned with the risk assessment flow in Clause 7.4.4 and Figure H.1.

A Compact Comparison

Topic	ISO 14155:2020	ISO 14155:2026
Risk management	Single ISO 14971-centred framework	Device-use risks (ISO 14971) separated from CIP-procedure and process risks (risk-based, explicitly outside ISO 14971)
Residual risks	Implicit	Explicit assessment, disclosure and cross-document alignment required
Statistical framework	Hypotheses and endpoints	Estimands and intercurrent events added (Annex K); non-inferiority margins and missing data clarified
CEC	Not addressed	Defined, with charter requirements (3.8, 6.12, A.14)
DMC	To be considered	Must additionally confirm stop/suspend conditions; absence must be justified in the CIP
Eligibility deviations	Handled via deviation processes in practice	Not permitted; CIP amendment required
Clinical performance	Older definition	Redefined around manufacturer's claimed intended purpose and clinical benefit
AE categorization	Annex F, device-centred	Updated with CIP-procedure-related category; F.1 and F.2 both apply when an AE involves a device deficiency

What This Means in Practice

For studies in early planning, the answer is simple: write the CIP against the 2026 edition. The estimand framework, the two-stream risk management, the DMC justification and the CEC consideration should be designed in from the start. Retrofitting an estimand onto a finished CIP is more painful than building one in.

For ongoing studies, a targeted gap review is the proportionate response. Most conduct-level requirements carry over from 2020 unchanged, so wholesale amendments are rarely justified. The areas worth checking are the risk documentation (does it conflate device risks with procedure risks?), the statistical analysis plan (are missing data and sensitivity analyses pre-specified?), and the committee governance. Whatever is decided, document the rationale.

For sponsor-investigators and investigator-initiated studies, the picture I described in my November post does not improve. The estimand requirement in particular assumes access to biostatistical expertise that most academic study teams do not have in-house. The fourth edition continues the trajectory of the 2020 revision: the standard becomes more scientifically rigorous and, for under-resourced sponsors, harder to meet.

For the EU regulatory context, expect Notified Bodies to treat the 2026 edition as state of the art well before formal harmonization catches up. Clinical evaluation and investigation documentation referencing the 2020 edition will not become invalid overnight, but reviewers will ask whether the new requirements, particularly on risk separation and statistical design, have been considered.

The Bottom Line

ISO 14155:2026 is an evolution, not a revolution. Nothing in it contradicts the 2020 edition; it sharpens it. The two genuinely substantive shifts are the separation of device-use risks from study-procedure risks, and the introduction of estimands into device trial design. Both push the standard in the same direction: away from formal compliance and toward methodological precision.

That direction is correct. Device clinical investigations have historically lagged behind pharmaceutical trials in statistical discipline, and the 2026 edition closes part of that gap. The cost, as so often, lands on those with the least infrastructure. Sponsors who update their templates, train their teams and budget for biostatistical input early will find the transition manageable. Those who treat the new edition as a citation update in the document header will find out otherwise at their next audit.

Key References

ISO 14155:2026. Clinical investigation of medical devices for human subjects — Good clinical practice. Fourth edition. International Organization for Standardization.
ISO 14155:2020. Clinical investigation of medical devices for human subjects — Good clinical practice. International Organization for Standardization. [Withdrawn, replaced by ISO 14155:2026]
EN ISO 14155:2020+A11:2024. Harmonized European version under Regulation (EU) 2017/745.
ICH E9(R1). Statistical Principles for Clinical Trials. Addendum: Estimands and Sensitivity Analysis in Clinical Trials. 2019.
ISO 14971:2019. Medical devices — Application of risk management to medical devices. International Organization for Standardization.
Regulation (EU) 2017/745 of the European Parliament and of the Council (EU MDR). Article 62, Annex XV.

Dr. Marc Harms
MH-Analytics