A Contract Research Organization (CRO) can run the operational machinery of an MDR clinical investigation — sites, monitoring, data management, statistics — but under MDR Article 71 the sponsor obligations stay with the manufacturer. You can delegate the work. You cannot delegate the accountability.

By Tibor Zechmeister and Felix Lenhard.

TL;DR

  • A CRO is useful when your startup needs a clinical investigation under MDR Article 62 but lacks the in-house clinical operations, monitoring, and data management infrastructure to run it properly.
  • MDR Articles 70–77 place sponsor obligations on the manufacturer. A CRO can perform tasks, but the sponsor remains legally responsible for investigator selection, protocol compliance, adverse event reporting, and data integrity.
  • EN ISO 14155:2020+A11:2024 is the Good Clinical Practice standard MDR clinical investigations must follow. Your CRO must demonstrably work to it, not to a generic pharma GCP framework.
  • A competent CRO should produce a written delegation log, SOPs aligned with ISO 14155, and clean monitoring reports. If they cannot show you these artefacts, they are not ready to run an MDR study.
  • Common startup failure: signing a CRO contract before the Clinical Investigation Plan is stable, then paying for every protocol amendment as a change order.
  • Oversight you cannot outsource: reading monitoring reports yourself, signing off on serious adverse event reports, and owning the final Clinical Investigation Report.

Why this matters

Most first-time MedTech founders discover CROs the way they discover notified bodies — too late, under time pressure, and with a funding round tied to an unmovable clinical milestone. By that point, the CRO is no longer a strategic partner. It is a lifeline, and lifelines are expensive.

Tibor has sat on both sides of this table. As a notified body lead auditor, he has read Clinical Investigation Reports where the CRO ran the study cleanly but the sponsor had no idea what was happening — and the notified body rejected the submission because the sponsor could not defend its own data. As founder of multiple MedTech companies, he has also hired CROs and learned the hard way which parts of a clinical investigation you can push out and which parts must stay inside the startup's four walls.

This post is the honest version of that lesson.

What MDR actually says

Clinical investigations in the EU are governed by Chapter VI of the MDR — Articles 62 through 82 — and by Annex XV, which sets out the documentation and conduct requirements. The harmonised standard for the conduct of these investigations is EN ISO 14155:2020+A11:2024.

Article 62(1) sets out when a clinical investigation is required: principally for Class III and implantable devices to demonstrate conformity with the general safety and performance requirements, and for any device where the sponsor chooses to generate clinical data through investigation rather than literature.

Article 70 describes the application procedure. The sponsor submits the application through the electronic system referred to in Article 73. The sponsor — not the CRO — is the legal entity on that application.

Article 71 addresses Member State assessment. Nothing in that article shifts responsibility to a third party performing tasks on behalf of the sponsor.

Article 72 requires the sponsor to ensure that the clinical investigation is conducted in accordance with the clinical investigation plan and with the applicable requirements of Annex XV and EN ISO 14155. Again — the sponsor ensures. The CRO performs.

Article 74 governs substantial modifications. Any substantial modification to the investigation requires notification to the Member States concerned. If your CRO proposes a protocol amendment, that amendment is your legal event, not theirs.

Article 80 covers the recording and reporting of adverse events and device deficiencies. Reporting timelines (immediate for events leading to death or unanticipated serious deterioration of health, within specified days for other serious adverse events) apply to the sponsor.

The pattern is unambiguous. MDR treats the manufacturer-sponsor as the responsible party throughout. A CRO is a subcontractor under EN ISO 14155 GCP, and the manufacturer's quality management system under EN ISO 13485:2016+A11:2021 must treat the CRO as a supplier subject to qualification and oversight.

A worked example

A seven-person cardiovascular startup in Vienna is developing a Class IIb implantable monitoring accessory. The notified body has confirmed that literature equivalence under MDR Annex XIV Part A is not defensible for their specific intended purpose, so a pre-market clinical investigation is required under Article 62. Target: 60 patients, three sites across Austria and Germany, 12-month follow-up.

The startup has one clinical lead, one regulatory lead, two engineers, and three commercial hires. They have exactly zero people who have ever run a multi-site clinical investigation under EN ISO 14155.

They face three options:

  1. Hire a clinical operations team in-house. Estimated cost: four new hires over 18 months, roughly EUR 600k fully loaded, plus recruitment lag of three to six months.
  2. Find a freelance clinical project manager and piece together monitoring, data management, and biostatistics from specialists. Cheaper on paper, fragile in execution, and the sponsor oversight burden lands entirely on the regulatory lead.
  3. Contract a MedTech-experienced CRO for study conduct, keep the clinical lead and regulatory lead as the sponsor oversight function, and use the CRO's SOPs under a delegation log.

Option 3 is usually the right answer for this size and stage — but only if the CRO is MedTech-experienced. Pharma CROs have deeper GCP muscle but often treat EN ISO 14155 as an afterthought, and they are priced for Phase III drug trials, not 60-patient device studies. A dedicated MedTech CRO, or the MedTech division of a larger CRO, is worth the due diligence.

Budget reality for this scenario: a lean, well-run MDR clinical investigation at three sites for 60 patients typically lands in the low-to-mid six figures for CRO fees alone, before site payments, insurance under Article 69, and device costs. Startups who budget half of that end up renegotiating every six months.

The Subtract to Ship playbook

Work through these steps in this order. The order matters — each step removes risk from the next.

1. Stabilise the Clinical Investigation Plan before you go to market. Every founder is tempted to issue a CRO RFP as soon as the clinical strategy is roughed out. Don't. A CRO prices against your CIP. If your CIP shifts after contract, every shift is a change order. Get the CIP to at least draft v0.8 — endpoints locked, sample size defended by your statistician, inclusion/exclusion criteria agreed with at least one principal investigator — before you even issue the RFP.

2. Qualify the CRO as a supplier under your QMS. Your ISO 13485 clause 7.4 supplier control applies to CROs. That means a supplier questionnaire, evidence of their quality system, evidence they work to EN ISO 14155:2020+A11:2024 specifically (not a generic pharma GCP), a look at their monitoring SOPs, and a reference check with at least one MedTech sponsor they have served.

3. Write a proper delegation log. This is the document that maps every clinical investigation task to either "sponsor" (you) or "CRO" (them). Not a paragraph in the contract — a structured log covering: site selection, site qualification visits, investigator brochure maintenance, CIP amendments, regulatory submissions under Article 70, ethics committee interactions, informed consent under Article 63, monitoring frequency and scope, data management, safety reporting under Article 80, statistical analysis, and the Clinical Investigation Report under Annex XV. Every line has an owner. No "both" entries.

4. Budget for sponsor oversight time. A common mistake: founders treat the CRO contract as if it replaces sponsor work. It does not. Your clinical lead will spend roughly 30–50 percent of their time reading monitoring reports, attending site calls, approving protocol deviations, and signing off on safety reports. Budget that time. If your clinical lead is also your regulatory lead and also your head of product, you have a problem no CRO can fix.

5. Never delegate safety reporting sign-off. Under Article 80, the sponsor reports serious adverse events and device deficiencies to the Member States concerned within the timelines of Article 80(2). The CRO drafts. The sponsor signs. Always. Tibor has seen audits where the CRO's safety officer was the sole signatory on SAE reports — that is a finding, and a severe one.

6. Build the Clinical Investigation Report collaboratively, but own the final draft. Annex XV requires a Clinical Investigation Report summarising the investigation results. The CRO will produce an excellent operational draft. The sponsor must own the clinical interpretation and the link back to the Clinical Evaluation Report. The notified body will interrogate the sponsor on both. If the only person who can defend the report is the CRO's medical writer, your submission is in trouble.

7. Plan the exit. CRO contracts end. Clinical investigations do not — post-market clinical follow-up continues under MDR Annex XIV Part B. Make sure your contract specifies data return, trial master file handover, and a minimum archival period consistent with Annex XV section 3 and with your own retention policy.

Reality Check

Answer honestly. Every "no" is a gap you need to close before signing a CRO contract.

  1. Have we written a Clinical Investigation Plan stable enough that amendments would be the exception, not the rule?
  2. Can our clinical lead read a monitoring report and tell whether the CRO is actually catching protocol deviations?
  3. Do we have a written delegation log — not a contract clause — mapping every Article 62–82 responsibility to a named owner?
  4. Have we qualified the CRO under our ISO 13485 clause 7.4 supplier control process, with evidence filed?
  5. Can we name the CRO's specific SOPs that demonstrate alignment with EN ISO 14155:2020+A11:2024, as opposed to generic pharma GCP?
  6. Have we budgeted at least 30 percent of our clinical lead's time for sponsor oversight during the active investigation phase?
  7. Do we know who, inside our company, will personally sign the Article 80 serious adverse event reports?
  8. Does our contract specify trial master file handover and data return at study close?

Frequently Asked Questions

Do we legally need a CRO for an MDR clinical investigation? No. Nothing in MDR Articles 62–82 requires a sponsor to use a CRO. The requirement is that the investigation is conducted in accordance with the CIP, Annex XV, and EN ISO 14155:2020+A11:2024. If you can do that in-house, a CRO adds no regulatory value. Most startups cannot.

Can a CRO act as the sponsor instead of us? No, not for a startup manufacturer. The sponsor under MDR Article 2(49) is the person, company, institution or organisation taking responsibility for the initiation, management and setting up of financing of the clinical investigation. For a commercial device, that is the manufacturer. CROs are vendors to the sponsor, not substitutes for the sponsor.

What is the difference between a pharma CRO and a MedTech CRO? Pharma CROs are built around ICH-GCP for drug trials. MedTech CROs are built around EN ISO 14155 for device investigations. The difference is not cosmetic — device investigations have different risk profiles, different endpoint structures, different statistical approaches, and different notified body scrutiny. Hire MedTech-experienced people.

How much oversight is "enough"? Enough that you could defend every decision in the Clinical Investigation Report in front of a notified body auditor without the CRO in the room. If you cannot, you have outsourced your sponsor duties beyond what MDR permits.

When should we bring the CRO in — pre-submission or post-submission? Pre-submission, ideally as the CIP stabilises. A good CRO will flag operational issues in the protocol that you would otherwise discover during site start-up, which is the most expensive place to discover them.

Can we change CROs mid-study? Yes, but it is painful and regulatorily visible. A CRO change is a substantial modification trigger under Article 74 if it materially affects the conduct of the investigation. Budget months, not weeks.

Sources

  1. Regulation (EU) 2017/745 on medical devices, consolidated text. Articles 62, 70, 71, 72, 74, 75, 77, 80; Annex XV.
  2. EN ISO 14155:2020+A11:2024 — Clinical investigation of medical devices for human subjects — Good clinical practice.
  3. EN ISO 13485:2016+A11:2021 — Medical devices — Quality management systems — clause 7.4 Purchasing.