ISO 14155:2026 – What You Need to Know

If applying risk management principles to clinical investigations has been a grey area in your organization, this edition addresses that directly.

The new standard draws a clear line between two categories of risk:

• Risks related to device use, including residual risks, must be evaluated specifically against your study's sample size, population, and indication. The rate of Adverse Device Effects during an investigation can differ materially from post-market use, and the standard now formally recognizes this distinction.
• Risks from non-routine clinical procedures required by the CIP but outside standard clinical practice now require only a descriptive risk assessment. Full ISO 14971 methodology does not apply to these.

One practical note for multi-country studies: what counts as routine clinical practice varies by region. Those differences must be identified and documented in your CIP.

The fourth edition introduces a dedicated section on Clinical Events Committees for the first time. CECs are independent committees of clinical experts, established by the sponsor, to ensure consistent event assessment across participating sites.

The reason this has been added is straightforward. In multi-centre studies, different investigators can characterize similar events very differently, which undermines data integrity. Where a CEC is in place, sponsors must now integrate it into study planning from the outset and formally document independence requirements, conflicts of interest, and bias risks.

DMC requirements have been tightened. Sponsors must now document that the DMC has confirmed conditions under which the study would be suspended or stopped, and where no DMC has been established, the absence must be formally justified.

This moves DMC governance from a discretionary decision to something that requires documented rationale either way. Your QMS needs to reflect this.

A new informative annex, Annex K, on clinical investigation design references FDA, MHRA, and ICH E9(R1) guidance, including the estimand framework.

In practical terms, this means protocols need to be better defined from the start, with clearer thinking on intercurrent events, missing data, and how the study population relates to the intended use population. For teams that work across both device and pharmaceutical regulatory requirements, this closer alignment between the two frameworks is genuinely useful.

Requirements around eligibility, consent, health data handling, subject withdrawal, and the clarity of participant information have all been strengthened. Consent documentation should be reviewed against the revised requirements, with particular attention to vulnerable populations and cross-border data transfers.

The new edition introduces a more proportionate approach to AE collection and reporting. Where the rationale is clearly set out in the CIP, certain adverse events may be exempted from routine collection or reporting requirements. This is not a reduction in standards; it is a more structured way of applying them.

Clinical investigation procedures, templates, and SOPs that reference the 2020 edition need to be revised, particularly around CEC and DMC governance and risk management requirements.

Studies in early planning should incorporate the new requirements directly. Studies already underway need a targeted review to identify where gaps exist. Whatever decisions are made, the rationale should be documented.

The risk management changes in particular are substantive and not self-explanatory. Sharing the updated standard text is not enough. Structured training for clinical affairs, regulatory affairs, and quality teams is the right approach.

The FDA recognizes ISO 14155 and accepts clinical data collected outside the US when the standard has been followed. Compliance with ISO 14155:2026 continues to support that. For teams working across combination products, companion diagnostics, or both pharma and device requirements, the closer alignment with ICH guidance reduces friction.