ISO 14155:2020 Audit-Readiness Rubric — Clinical Investigation of Medical Devices (GCP)

What this is: Clinical investigation of medical devices for human subjects — Good clinical practice. The device-specific counterpart to Regscribe's existing EMA GCP inspection framework (drug trials). Relevant wherever a customer runs a pre-market clinical investigation, a Post-Market Clinical Follow-up (PMCF) study, or any other device clinical investigation under EU MDR Article 62 or Article 82, or under an FDA Investigational Device Exemption (IDE, 21 CFR Part 812).

Sourcing note: ISO 14155's full clause/annex text is copyrighted and sold by ISO (the standard runs 90+ pages across 10 clauses and 10 annexes; iso.org sells it, no free preview was fetched this session). No verbatim clause text is used below — this is structure and paraphrase built from secondary sources cross-checked across multiple independent providers: Greenlight Guru's "Ultimate Guide" and CIP/SAE guides, Johner Institute's DIN EN ISO 14155 blog and MDR clinical-investigations blog, Qualio's overview, CCMO (Dutch national ethics-review body) investigator guidance pages, IntuitionLabs' ISO 14155-vs-ICH-GCP comparison, and ClinicalLeader's ISO 14155 primer. Where a source could not be fetched cleanly (two PDF fetches — a Drexel University investigator-guidance PDF and the European Commission's MDCG 2024-5 guidance PDF — returned corrupted/binary content this session and were not used) that gap is flagged explicitly rather than filled with guessed content. eCFR.gov's own pages for 21 CFR 812 redirected to a bot-block page (unblock.federalregister.gov) and were not followed per this session's fetch policy; the FDA IDE (21 CFR 812) material below is therefore sourced from search-result snippets that explicitly quote the regulatory text (e.g. §812.150 UADE timelines), not a direct primary-source fetch — flagged as weaker sourcing than a clean eCFR read, worth a follow-up direct fetch before production use.

One item surfaced by two independent secondary sources but could not be corroborated and is explicitly not relied upon below: references to an "ISO 14155:2021" version number (Johner Institute) and to "the 2026 edition" of ISO 14155 introducing Clinical Events Committees / an estimand framework (IntuitionLabs). ISO's own catalog record (iso.org/standard/71690.html, seen in search results) identifies the current published edition as ISO 14155:2020 with no superseding edition confirmed. Treat any "2021" or "2026 edition" reference as likely error/speculation in the secondary source, not fact, until independently verified against iso.org directly.

Rubric legend

Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern

Part A — Structure and scope of ISO 14155:2020

The standard is organized as 10 clauses plus annexes. Clauses 1–3 (Scope, Normative references — including ISO 14971 — and Terms/definitions) are reference-only, not independently auditable. Clauses 4–10 are the substantive requirements, confirmed convergently across Greenlight Guru, Johner Institute, and Qualio:

Normative annexes (i.e., these carry requirements, not just guidance): Annex A — Clinical Investigation Plan (CIP) content, 18 sections (A.1–A.18); Annex B — Investigator's Brochure (IB) minimum content; a Clinical Investigation Report content annex; and an essential-documents annex. Informative annexes (guidance, not mandatory content): Case Report Form (CRF) guidance, an adverse-event categorization annex (commonly cited as "Annex F"), an ethics-committee-responsibilities annex ("Annex G"), an ISO 14971 risk-management-application annex ("Annex H"), a clinical-development-stage/applicability annex ("Annex I" — covers pre-market, PMCF, and both interventional and observational investigation types, explicitly rebutting the misconception that "the device is already CE-marked, so the standard doesn't apply"), and a clinical-investigation-audit-guidance annex ("Annex J"). Flag: the specific letter-to-content mapping for the informative annexes (F/G/H/I/J) is consistent across the two sources that enumerated it (Greenlight Guru, Qualio) but was not independently verified against the standard itself — treat annex letters as reasonably confident, annex numbering exhaustiveness (i.e., whether there are exactly 10 annexes, A–J, with nothing skipped or renumbered) as unconfirmed.

Part B — Clinical Investigation Plan (CIP) requirements (Annex A)

Annex A is confirmed (Greenlight Guru) to run 18 sections (A.1–A.18) across roughly 9 pages. The section-by-section content below was recovered for A.1 through A.8, A.13, and A.14 from a direct fetch of Greenlight Guru's CIP guide; content for A.9–A.12 and A.15–A.18 was not recoverable this session (not found in any successfully-fetched source) and is not guessed — flagged as a gap below rather than filled with invented section titles. Based on the general shape of comparable CIP/protocol standards and the topics ISO 14155 clauses 5–8 must feed into, A.9–A.18 almost certainly cover items such as safety/AE definitions and reporting procedures in more detail, deviation handling, publication policy, and administrative/signature pages, but this is inference, not a confirmed source-backed list — do not present it to a customer as verified.

Gap, flagged explicitly: Annex A.9–A.12 and A.15–A.18 content was not recovered from any source successfully fetched this session. Recommend a follow-up pass specifically targeting a legally-obtained copy of ISO 14155:2020 (e.g. via a paid ANSI/AAMI or BSI purchase) before treating the CIP rubric section as complete — roughly 8 of 18 Annex A sections are undocumented above.

Part C — Investigator's Brochure (IB) requirements (Annex B)

Confirmed convergently (Greenlight Guru, CCMO, Qualio) that Annex B is normative and specifies minimum IB content. The IB's purpose is to give the principal investigator and site team sufficient safety/performance data to justify human exposure to the investigational device and to justify the investigation proposed in the CIP.

Sourcing caveat: the European Commission's MDCG 2024-5 guidance document on IB content (referenced by multiple sources as the current EU interpretive guidance layered on top of Annex B) was fetched this session but returned corrupted/binary PDF content and could not be read — its specific content expectations are not reflected above. Recommend a follow-up direct fetch or manual download from health.ec.europa.eu before treating IB scoring as complete against current EU expectations, since MDCG guidance is where regulators typically add prescriptive detail beyond the ISO text.

Part D — Adverse event / device deficiency reporting (and how it differs from drug-trial AE reporting)

Definitions, confirmed convergently (Greenlight Guru's SAE guide, IntuitionLabs comparison, general search-result convergence):

• Adverse Event (AE): any untoward medical occurrence, unintended disease/injury, or untoward clinical sign in a subject, user, or other person — whether or not related to the device, whether anticipated or unanticipated.
• Serious Adverse Event (SAE): an AE resulting in death, life-threatening illness, permanent impairment, hospitalization (or prolongation), or fetal distress/congenital abnormality.
• Adverse Device Effect (ADE): an AE related to use of the investigational device, including events from inadequate instructions, device malfunction, or use error.
• Serious Adverse Device Effect (SADE): an ADE meeting SAE severity criteria; sub-categorized as Anticipated (ASADE) or Unanticipated (USADE) depending on whether it was already identified in the pre-study risk assessment.
• Device Deficiency: inadequacy of the device regarding identity, quality, durability, reliability, usability, safety, or performance — includes malfunctions, use errors, and inadequate labelling. Per ISO 14155:2020 §7.4.2 (cross-referenced to §9.2.5 and §10.8), a device deficiency that did not lead to an AE but could have led to a SADE must still be reported — this is the key device-specific reporting trigger with no direct drug-trial equivalent.

Part E — Documents / evidence needed for audit readiness

Compiled from the clause/annex mapping above, cross-checked for internal consistency against the CIP/IB annex content in Parts B–C:

• Trial-design/authorization documents: approved Clinical Investigation Plan (CIP) and all amendments; ethics committee (EC)/IRB approval letters and continuing-review records; national competent authority authorization or notification records (EU MDR Art. 62/70 authorization, or Art. 82/74 notification, as applicable); FDA IDE approval (if a significant-risk device study under 21 CFR 812) or IRB-only approval (if non-significant-risk).
• Device-specific documentation: Investigator's Brochure (current version, with revision history); Medical Device File / device technical documentation cross-reference (ISO 13485 §4.2.3 tie-in); device shipping/traceability logs; device accountability records (receipt, use, return/destruction per subject/site); device labelling used in the investigation; instructions for use (IFU) provided to sites.
• Site/investigator agreements: signed investigator agreements defining responsibilities; investigator CVs/qualifications and delegation-of-authority logs; site initiation/training records (device-specific, not generic GCP training only).
• Subject-level documents: signed/dated informed consent forms (ICFs) — including any re-consent triggered by new safety information; case report forms (CRFs) with source-data-verification evidence; subject screening/enrollment logs; withdrawal/discontinuation records with reasons.
• Safety documents: AE/ADE/SAE/SADE log with causality assessments; device deficiency log (including deficiencies that did not cause an AE but could have caused a SADE); UADE reports (US IDE studies) with date-of-awareness vs. date-of-notification fields; sponsor safety evaluations and any resulting CIP/risk-file amendments; Data Monitoring Committee records if applicable.
• Monitoring documents: monitoring plan (risk-based, per §A.6.5); monitoring visit reports; source data verification records; centralized-monitoring records where used in place of/alongside on-site visits.
• Quality/data-integrity documents: data management plan; EDC/eCRF system validation records specific to the study build (§7.8.3); audit trail exports; deviation/protocol-non-compliance log with root-cause/CAPA where applicable.
• Close-out documents: Clinical Investigation Report (per the normative report-content annex); final device accountability reconciliation; document retention confirmation; any suspension/termination rationale and notifications, if applicable.

Part F — Common failure patterns

Sourcing caveat, stated up front: no source located this session provides a named, quantified deficiency database specific to device clinical investigations the way MHRA's published GMP/GDP deficiency-trend PDFs anchor Regscribe's GMP/GDP rubric. FDA's own Bioresearch Monitoring (BIMO) program inspects clinical investigators, sponsors, IRBs, and CROs across drug, biologic, and device studies together, and the one detailed secondary source fetched this session (Goodwin Law's BIMO violations summary) explicitly does not break its findings out by device vs. drug — it states devices are part of the ~79% "drug, biologic, or medical device" inspection population without device-specific statistics. The patterns below are therefore a mix of (a) general BIMO/clinical-investigator findings that are directly applicable to device studies since the same regulations (21 CFR Parts 50, 56, 812) govern them, and (b) device-specific structural gaps called out by ISO 14155 secondary-source commentary. Flagged as qualitative, not a quantified named database, consistent with how Regscribe's ISO 13485 rubric already flags this same class of gap.

1. Informed consent deficiencies — missing signatures, use of outdated ICF versions, enrollment before consent is properly obtained. Applies identically to device and drug studies under 21 CFR Part 50. (FDA BIMO general finding, Goodwin Law summary; FIU IRB warning-letter compendium referenced but not readable this session — flagged)
2. Failure to follow the investigational plan / CIP — protocol deviations not properly captured, evaluated, or reported; this is FDA's #1-cited BIMO finding category across investigator inspections generally. (Goodwin Law, FDA BIMO)
3. Inadequate case history / study records — incomplete or inaccurate CRFs and source documentation. (Goodwin Law, FDA BIMO)
4. Device accountability gaps — the device-specific analogue of drug accountability findings: incomplete receipt/use/disposition records for the investigational device, weaker device traceability than the standard's Annex A.2/CIP requirement calls for.
5. Safety reporting failures — AEs/device deficiencies not reported, or not reported within the CIP-defined or regulatory timeline; this is the category where the two-stage UADE clock (investigator→sponsor, then sponsor→FDA/IRBs/sites, Part D above) is most likely to slip at the second hop. (Goodwin Law, FDA BIMO; UADE-specific structure per 21 CFR 812.150)
6. Sponsor monitoring/oversight gaps — FDA's stated expectation is that sponsors detect and correct site-level non-compliance through monitoring; lack of supervision over sub-investigators/coordinators is cited as a recurring root cause. (Goodwin Law, FDA BIMO)
7. Device-specific training gaps — organizations applying generic GCP training to device trial staff without device-specific operation/deficiency-recognition training; flagged by ISO 14155 secondary-source commentary (ClinicalLeader primer) as a frequently-overlooked compliance gap distinct from drug-trial GCP training.
8. Risk file / CIP drift — risk management file and CIP not kept current as the investigation surfaces new device deficiencies or AEs, mirroring the same "risk file frozen at initial approval" pattern already flagged in Regscribe's ISO 13485 rubric (§7.1) — this is a structural risk that recurs across the device-QMS and device-clinical-investigation rubrics because both trace back to the same ISO 14971 risk management file.
9. IB/CIP evidence-base inconsistency — the Investigator's Brochure's clinical-data summary and the CIP's design-justification section (Annex A.3) citing different or inconsistent sets of prior evidence — a cross-document consistency check that plays directly to Regscribe's document-comparison capability.

Part G — FDA IDE (21 CFR Part 812) overlay — how it layers on ISO 14155

Analogous to how Regscribe's ISO 13485 rubric documents the FDA QMSR incorporation of ISO 13485 by reference, ISO 14155 is not itself a binding US regulation — it is a voluntary, internationally-recognized standard that EU MDR treats as a harmonized standard, while FDA does not legally mandate ISO 14155 for IDE studies but expects GCP-consistent conduct and separately regulates the same activities directly through 21 CFR Part 812 (device studies), Part 50 (informed consent), and Part 56 (IRBs). Per the IntuitionLabs comparison (single-sourced, not independently cross-checked this session), where ISO 14155 and FDA regulations differ, the more stringent requirement is expected to apply — flagged as a claim worth verifying against FDA's own IDE guidance before it is presented to a customer as settled FDA policy.

Practical implication for Regscribe's positioning: a device sponsor running a global (EU + US) clinical investigation needs a CIP built to ISO 14155 Annex A that is also consistent with 21 CFR 812's investigational plan requirements (812.25) and reporting timelines (812.150) — directly analogous to the "Evidence Type" layer already recommended in the GMP/GDP rubric's Part C. A single ISO 14155-anchored gap analysis, with a bounded FDA-IDE overlay module for US-specific items (UADE 10-working-day dual-stage reporting, Form FDA 1572-equivalent site agreements, IRB-specific significant-risk/non-significant-risk determinations), should serve both EU/international and US-market device-trial customers from largely the same evidence base.

Gaps / follow-ups

1. ISO 14155:2020 Annex A, sections A.9–A.12 and A.15–A.18 (roughly 8 of 18 CIP sections) were not recoverable from any source successfully fetched this session — flagged explicitly in Part B rather than filled with invented content. Needs a legally-obtained copy of the standard (ANSI/AAMI or BSI purchase) for completeness.
2. MDCG 2024-5 (EU guidance specifically on Investigator's Brochure content) returned corrupted/binary PDF content on fetch and could not be read — flagged in Part C. This is the document EU regulators use to add prescriptive detail beyond Annex B's minimum, so it matters for EU-market scoring accuracy.
3. 21 CFR 812.150 (UADE reporting) primary text was not directly fetched — eCFR.gov redirected to a bot-block page this session. The 10-working-day timelines in Part D/row 22 are sourced from search-result snippets quoting the regulation, not a direct read. Recommend a follow-up fetch via federalregister.gov's eCFR mirror or a manual read.
4. No named, quantified device-clinical-investigation deficiency database (FDA BIMO device-specific breakout, or EU Notified Body/competent-authority clinical-investigation inspection findings) was located this session — flagged in Part F, consistent with the same class of gap already flagged in Regscribe's ISO 13485 rubric. Worth a follow-up pass on FDA's Form 483/Warning Letter database filtered to device clinical investigators specifically (as opposed to drug/biologic), and/or individual EU competent authorities' (BfArM, MHRA-equivalent-for-devices) published inspection findings if any exist.
5. Annex letter-to-content mapping (F–J) for the informative annexes (adverse event categorization, ethics committee guidance, ISO 14971 application, applicability/development-stage guidance, audit guidance) is confirmed only by two convergent secondary sources (Greenlight Guru, Qualio), not independently verified against the standard — flagged in Part A.
6. "ISO 14155:2021" and "2026 edition" references found in two secondary sources were explicitly not incorporated into this rubric as fact — flagged in the top-level sourcing note. If Regscribe later confirms via iso.org that a new edition has actually been published or is imminent, this entire rubric should be revisited against the new edition/DIS text.
7. Relationship to Regscribe's existing EMA GCP (drug-trial) rubric — Part D above synthesizes the SUSAR-vs-device-deficiency distinction from a single comparison source (IntuitionLabs) rather than re-deriving the drug-trial side from Regscribe's own EMA GCP rubric directly. Recommend a follow-up pass that opens the EMA GCP rubric file itself and does a clause-by-clause reconciliation (the way the GMP/GDP rubric's Part C reconciles Annex 11 against Part 11), rather than relying on a third-party's characterization of both frameworks.
8. Certification/inspection process mechanics (who inspects device clinical investigations — national competent authorities under MDR, FDA BIMO under IDE, both — and what a typical inspection scope/duration looks like) was not separately researched this session beyond what's captured in Parts D/F/G. Flagged as a possible follow-up if Regscribe wants an "inspection readiness" section analogous to the ISO 13485 rubric's certification-process section.