A Contract Research Organisation (CRO) can execute the literature review, appraisal, analysis, and CER drafting work required under MDR Annex XIV Part A, and can run a clinical investigation under MDR Articles 62-82 and EN ISO 14155:2020+A11:2024. What a CRO cannot do is take over the manufacturer's legal responsibilities under MDR Article 10. Intended purpose, clinical claims, benefit-risk conclusions, and final sign-off of the Clinical Evaluation Report stay on the manufacturer's desk, even when every page was written by a supplier. The right call for a startup is usually a hybrid: own the CEP and the intended purpose in-house, outsource literature review execution and CER drafting to a qualified CRO, and run clinical investigations through a specialist CRO because you will not build that muscle in-house for a first device. The wrong call is treating the CRO as a place to dump the problem.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • Under MDR Article 10, the manufacturer carries legal responsibility for the clinical evaluation. A CRO is a supplier, not a substitute.
  • A CRO can execute literature review, appraisal, analysis, CER drafting, and full clinical investigations under Articles 62-82 and EN ISO 14155:2020+A11:2024. It cannot own your intended purpose, your clinical claims, or your benefit-risk argument.
  • For most non-implantable, non-Class III startups, the right split is in-house CEP plus outsourced literature-and-drafting support. Full outsourcing is rarely the cheapest path and never the lowest risk.
  • For pre-market clinical investigations under MDR Article 61(4), a specialist CRO is almost always the right call. Building sponsor-GCP capability in-house for one study is not a sensible use of runway.
  • A CRO must be qualified as a critical supplier under EN ISO 13485:2016+A11:2021 Section 7.4 and under your own supplier controls. The qualification file is part of your technical documentation.
  • The RFP is where the relationship is won or lost. Scope, deliverables, acceptance criteria, change-control, and the Notified Body response process must all be in the contract before signing.

Why this decision matters more than founders think

The scene repeats itself several times a year. A founder walks into a meeting with three CRO quotes in hand, picks the cheapest one, signs a statement of work written by the CRO, and hands over "the CER." Fourteen months later the Notified Body returns findings on the CER, the CRO says "we delivered what was in the contract," the founder says "I thought you were handling the clinical evaluation," and nobody is wrong. The contract was silent on who owns the response to findings. The CEP was written by the CRO after the intended purpose had been written by the founder in a slide deck. The benefit-risk argument was assembled from templates. No one has a coherent picture of the clinical evidence for the device as a whole.

This is not a CRO failure. It is a scoping failure. CROs are suppliers, and suppliers execute what they are asked to execute. The manufacturer's job, under MDR Article 10, is to decide what should be asked for and to retain ownership of the regulatory substance. This post is about how to make that call cleanly: what a CRO actually does, what stays with you no matter what, how to decide what to outsource, and how to run the selection so you do not discover the contract gaps in month fourteen.

What a CRO actually does for clinical evaluation

A CRO in the medical device context is a supplier that can take on parts of the clinical evaluation workload defined by MDR Annex XIV Part A and, where applicable, the conduct of clinical investigations under Articles 62-82 and Annex XV in accordance with EN ISO 14155:2020+A11:2024. The scope they can legitimately cover looks like this.

For the CER (Annex XIV Part A): literature search design and execution across PubMed, Embase, and Cochrane; title/abstract and full-text screening; data extraction; appraisal against pre-specified criteria; data analysis against acceptance criteria; drafting the CER document itself against the structure required by Annex XIV Part A; drafting the response to Notified Body findings when instructed.

For equivalence work (MDCG 2020-5, April 2020): technical, biological, and clinical dimension-by-dimension comparison; compiling the "sufficient levels of access" evidence under MDCG 2023-7, December 2023; drafting the equivalence argument.

For clinical investigations (Articles 62-82, Annex XV, EN ISO 14155:2020+A11:2024): investigation plan drafting; Investigator's Brochure; ethics committee and competent authority submissions; site selection, contracting, and initiation; monitoring; data management; statistical analysis; clinical study report drafting; serious adverse event handling and reporting support.

For PMCF (Annex XIV Part B): PMCF plan drafting; PMCF study design and execution; PMCF evaluation report drafting.

That is a genuinely long list, and a good CRO will execute most of it competently. None of it removes the manufacturer's responsibility under Article 10.

What Article 10 does not let you outsource

MDR Article 10 lays out the general obligations of manufacturers. Three of those obligations are the ones founders need to internalise before any CRO conversation.

Under Article 10(1), manufacturers must ensure that their devices are designed and manufactured in accordance with the requirements of the Regulation. Under Article 10(3), manufacturers shall draw up and keep up to date the technical documentation, including the clinical evaluation referred to in Article 61 and Annex XIV. Under Article 10(9), manufacturers shall establish, document, implement, maintain, keep up to date, and continually improve a quality management system. (Regulation (EU) 2017/745, Article 10.)

That is the law. What it means for CRO relationships is specific and unforgiving.

The intended purpose is yours. A CRO cannot decide what your device is for, cannot adjust it to make the literature easier, and cannot reword it to fit a template. When a CRO asks for the intended purpose, the founder must already have the answer.

The clinical claims are yours. Every claim the device will make on its label, in the IFU, and in the CER has to be substantiated and defensible, and deciding which claims are worth fighting for is a manufacturer decision, not a supplier decision.

The benefit-risk conclusion is yours. The CER concludes that the benefits outweigh the risks for the intended purpose, or it does not. Signing that conclusion off is a manufacturer act. A CRO can write the words. Only the manufacturer can own them.

The response to Notified Body findings is yours. The CRO can draft responses. The manufacturer decides what to concede, what to defend, and what to rework. A contract that hands "response to findings" to the CRO without manufacturer review is a contract the Notified Body will eventually notice.

The supplier qualification file is yours. The CRO itself is a critical supplier under EN ISO 13485:2016+A11:2021 Section 7.4, and maintaining the qualification file is a manufacturer obligation. See supplier qualification under MDR and ISO 13485 for the full mechanics.

These five items are the ones that collapse CRO relationships when they are not explicit in the contract. They are not negotiable.

Test: the decision matrix

The in-house versus CRO decision is not a single call. It is five calls. For each phase of the clinical evaluation, the question is the same: who executes, who reviews, who owns the substance.

Phase 1: Clinical Evaluation Plan (CEP). Execute in-house. Always. The CEP defines intended purpose, scope, research question, appraisal criteria, and acceptance criteria. A CRO can comment on a draft, but the draft has to come from the manufacturer. A CRO-written CEP signed off by a founder who has not thought through the intended purpose is the single most expensive shortcut in the clinical evaluation process.

Phase 2: Literature review execution. Outsource where budget allows. This is the phase where a competent CRO adds the most value per euro. Search design, screening, and data extraction are labour-intensive, methodologically structured, and auditable. Exactly the kind of work a CRO with a trained team can do faster and more consistently than a two-person startup. The manufacturer reviews the search strategy before execution and the included-study list before appraisal.

Phase 3: Appraisal and analysis. Hybrid. The CRO can execute the appraisal against the criteria in the CEP. The manufacturer must review the appraisal output before the analysis starts, because this is where weak claims and intended-purpose problems first become visible. Handing this phase to a CRO without review is how founders discover in month fifteen that their claims are not supported.

Phase 4: CER drafting. Outsource where budget allows. The CRO drafts the document against the analysed data. The manufacturer reviews every section against the CEP, owns the benefit-risk conclusion, and signs off the final version.

Phase 5: Clinical investigation. Outsource almost always. Running a pre-market clinical investigation under Article 61(4), Articles 62-82, Annex XV, and EN ISO 14155:2020+A11:2024 requires sponsor-GCP infrastructure that a startup will not build in-house for a single study. The exception is a founder team that has run investigations before and already has the sponsor quality system in place. For everyone else, a specialist investigations CRO is the correct call and trying to run it in-house is where runway goes to die. Match this decision against the timeline ranges in post 151 on clinical evaluation timelines for startups and the budget ranges in post 150 on clinical evaluation budget planning.

The rule underneath all five calls: outsource execution, keep ownership. The more "I'll let the CRO handle it" creeps into the contract, the more Article 10 exposure creeps into the file.

Ship: the RFP playbook

The RFP is the moment where a CRO relationship is designed well or designed badly. A bad RFP produces three CRO quotes that cannot be compared because each one scoped the work differently. A good RFP produces three quotes that answer the same question and can be decided on substance.

Before the RFP goes out: your CEP is drafted, your intended purpose is fixed, your clinical claims list is written, your target classification under Annex VIII is known, and your Notified Body is either selected or clearly in the frame. If any of these are missing, you are not ready to RFP. See DIY vs. MDR consultant for the earlier call of whether you even need external help in the first place.

The RFP document must specify:

  • Exact scope per phase (literature search, screening, appraisal, analysis, CER drafting, findings response, investigation conduct) with clear in-scope and out-of-scope boundaries.
  • Deliverables per phase with acceptance criteria. "A CER" is not a deliverable. "A CER conforming to the structure of Annex XIV Part A, traceable to the attached CEP, with appraisal criteria pre-specified and acceptance criteria met for each GSPR in the attached list" is a deliverable.
  • Timelines per phase with dependency logic.
  • The manufacturer's review gates between phases, in writing. No CRO moves from one phase to the next without signed review.
  • Change-control process for scope changes, including price impact and timeline impact.
  • Notified Body findings response process: who drafts, who reviews, who signs, what the turnaround commitment is, what the price is per round.
  • Data handover format. The manufacturer must own the raw search results, screening decisions, extraction tables, and appraisal records. Not just the final CER PDF.
  • Confidentiality and IP. Everything the CRO produces for the project is the manufacturer's.
  • The quality management framework the CRO operates under, including certification status against EN ISO 13485:2016+A11:2021 where relevant and compliance with EN ISO 14155:2020+A11:2024 for investigations.

Supplier qualification runs in parallel with the RFP, not after:

  • Does the CRO have a documented QMS? Ideally EN ISO 13485:2016+A11:2021 certification, or a defensible equivalent.
  • Has the CRO been through Notified Body scrutiny of CERs they have drafted, and can they share anonymised examples of findings and how they were handled?
  • Who on their team will actually execute the work? CVs of the specific clinical evaluators, not the firm's brochure.
  • Reference checks with manufacturers who have gone through Notified Body review with this CRO's output. Ask specifically whether the CRO owned the response to findings or whether the manufacturer had to rescue it.
  • Conflict-of-interest declarations. A CRO that also works with your competitors needs an explicit firewall.
  • Data integrity and record retention commitments, including what happens to your files if the CRO goes out of business.

Before signing:

  • The contract names the specific humans who will execute the work and commits to notification if they are replaced.
  • The contract includes a termination clause that returns all raw data, drafts, and records to the manufacturer within a fixed window.
  • The price model is either fixed-price per deliverable with defined scope or time-and-materials with a hard cap. "Best efforts" is not a price model.
  • Tibor rule: if the CRO resists any of the above, that is the signal. Walk.

Reality Check. Where do you stand?

  1. Can you state your device's intended purpose in one sentence that matches the CEP, the IFU, and the label, before any CRO conversation begins?
  2. Have you written your own CEP, at least in draft form, before asking for CRO quotes?
  3. Do you know which of the five clinical evaluation phases you want to execute in-house and which you want to outsource, and why?
  4. Is your CRO qualification file started, under EN ISO 13485:2016+A11:2021 Section 7.4, or are you planning to "sort it out later"?
  5. Does your RFP specify acceptance criteria for each deliverable, or does it ask for "a CER"?
  6. Does your draft contract name the specific humans on the CRO side who will do the work?
  7. Does your draft contract explicitly assign ownership of the Notified Body findings response?
  8. If the CRO disappeared tomorrow, do you have the raw search results, screening decisions, and extraction tables in a format you can hand to another supplier?
  9. Have you checked references with at least two manufacturers who have gone through a full Notified Body cycle with this CRO's CERs?
  10. Do you understand, and can you articulate to your board, that Article 10 responsibility for the clinical evaluation stays with you regardless of what the CRO does?

Frequently Asked Questions

Can a startup outsource its entire clinical evaluation to a CRO under MDR? Operationally yes, legally no. A CRO can execute every hands-on phase of the clinical evaluation, including CEP drafting, literature review, appraisal, analysis, CER drafting, and clinical investigations. Under MDR Article 10, the manufacturer retains responsibility for the clinical evaluation regardless of who executed the work, which means intended purpose, clinical claims, benefit-risk conclusions, and final sign-off cannot be delegated.

Is it cheaper to hire a CRO than to do clinical evaluation in-house? Usually not for the CEP and not for Notified Body findings responses, where in-house ownership is faster and better. Often yes for literature review execution and CER drafting, where a trained team at a CRO is more efficient than a two-person startup learning the process. Almost always yes for pre-market clinical investigations, where building sponsor-GCP capability in-house for one study is not economical.

How do I qualify a CRO as a supplier under MDR? Treat the CRO as a critical supplier under EN ISO 13485:2016+A11:2021 Section 7.4. The qualification file includes QMS evidence, CVs of the people who will do the work, references from prior Notified Body cycles, conflict-of-interest declarations, and data handover commitments. The file is part of your technical documentation and is reviewed by the Notified Body.

What is the biggest mistake startups make when hiring a CRO? Signing the CRO's standard contract without specifying who owns the Notified Body findings response. When the findings come back and the contract is silent, the manufacturer discovers that the CRO's scope ended at "CER v1.0 delivered" and that responding to findings is a new billable engagement the CRO is not obligated to prioritise.

Can a CRO sign the Clinical Evaluation Report? The clinical evaluator who drafted the CER typically signs as the evaluator, and that person can be employed by a CRO. The manufacturer must additionally sign off the CER as part of the technical documentation under MDR Article 10 and Annex XIV Part A. The evaluator signature and the manufacturer sign-off are different things, and both are required.

Does using a CRO for a clinical investigation change who the sponsor is? No. The manufacturer remains the sponsor of the clinical investigation under MDR Articles 62-82 and Annex XV, even when a CRO executes the study on the manufacturer's behalf under EN ISO 14155:2020+A11:2024. Sponsor obligations, including those in Article 15 for the person responsible for regulatory compliance, stay with the manufacturer.

When should a startup absolutely run clinical evaluation in-house? When the founder team includes a clinical affairs lead with prior MDR CER experience, when the intended purpose is still fluid, or when the clinical claims are unusual enough that an external supplier will not understand them without so much manufacturer input that outsourcing becomes a net cost.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 10 (general obligations of manufacturers), Article 15 (person responsible for regulatory compliance), Article 61 (clinical evaluation), Articles 62-82 (clinical investigations), Annex XIV Part A (clinical evaluation), Annex XIV Part B (post-market clinical follow-up), Annex XV (clinical investigations). Official Journal L 117, 5.5.2017.
  2. MDCG 2020-5. Clinical Evaluation. Equivalence: A guide for manufacturers and notified bodies, April 2020.
  3. MDCG 2023-7. Guidance on exemptions from the requirement to perform clinical investigations pursuant to Article 61(4)-(6) MDR and on 'sufficient levels of access' to data needed to justify claims of equivalence, December 2023.
  4. EN ISO 14155:2020 + A11:2024. Clinical investigation of medical devices for human subjects. Good clinical practice.
  5. EN ISO 13485:2016 + A11:2021. Medical devices. Quality management systems. Requirements for regulatory purposes, Section 7.4 (purchasing).

This post sits in the Clinical Evaluation & Clinical Investigations cluster of the Subtract to Ship: MDR blog. Authored by Tibor Zechmeister and Felix Lenhard. A CRO is a powerful lever when the manufacturer owns the substance and a liability when the contract is written to let the manufacturer off the hook. And the hook is the one thing Article 10 will never let you off.