First In Human Studies Under MDR: What Actually Changed
I reviewed a clinical investigation application last month where the sponsor used their old ISO 14155:2011 templates and called it MDR-compliant. The Notified Body rejected it in the first round. The issue was not a small detail. It was a fundamental misunderstanding of what MDR expects from First In Human studies.
In This Article
- The Core Shift: From Clinical Investigation to Clinical Evaluation Integration
- Risk Management Integration: ISO 14971 Is No Longer Optional
- Informed Consent: Transparency Has Legal Teeth
- Participant Safety Monitoring: Real-Time Expectations
- Data Transparency and EUDAMED
- What This Means for Your Next FIH Application
- Where the Friction Comes From
- Final Thought
Many clinical and regulatory teams assume that because they ran successful FIH studies under the MDD, they know how to handle them under MDR. That assumption causes delays, rejections, and sometimes complete restarts of clinical programs.
The regulatory framework has shifted. The expectations around risk management, informed consent, participant selection, and clinical data transparency have all moved. What worked in 2016 does not pass review in 2024.
This post walks through what actually changed and why it matters for your next FIH application.
The Core Shift: From Clinical Investigation to Clinical Evaluation Integration
Under the MDD, a First In Human study was often seen as a standalone activity. You designed a study. You collected safety data. You wrote a clinical investigation report. You submitted it as part of your technical file.
Under MDR, FIH studies are no longer standalone. They are the first data block in an integrated clinical evaluation that starts before the study and continues throughout the device lifecycle.
Article 62 of MDR requires that clinical investigations are part of the clinical evaluation process. This is not just a documentation shift. It changes how you design the protocol, how you justify the study design, and how you interpret the results.
Your FIH protocol must now explicitly reference the clinical evaluation plan. The study objectives must align with the evidence gaps identified in the preliminary clinical evaluation. Reviewers expect to see this connection documented.
In practice, this means your clinical evaluation report exists before the FIH study starts. It is preliminary. It identifies what is known, what is unknown, and what the FIH study is designed to resolve.
Most deficiencies I see come from sponsors who write the CER after the study is complete. By then, the disconnect is visible and difficult to justify.
Risk Management Integration: ISO 14971 Is No Longer Optional
Under the old framework, you could run an FIH study with a basic risk assessment. You listed known risks. You defined stopping rules. You got ethics approval.
MDR ties FIH studies directly to risk management under ISO 14971. Annex XIV and Article 61 require that clinical investigations address residual risks that cannot be managed through design or labeling alone.
This changes participant selection criteria. If your risk management file shows a specific risk in a subpopulation, your FIH protocol must either exclude that subpopulation or justify why it is included and how the risk is monitored.
Notified Bodies now cross-check the risk management file against the inclusion and exclusion criteria in the protocol. Any mismatch triggers a question. Any unaddressed residual risk in the FIH population triggers a major deficiency.
Sponsors submit FIH protocols with generic inclusion criteria copied from a previous study. The Notified Body compares this to the risk management file and finds that identified risks for diabetic patients are not addressed in the protocol. The application is rejected until the sponsor either excludes diabetics or adds specific safety monitoring.
This is not theoretical. I see it in every second FIH review.
Informed Consent: Transparency Has Legal Teeth
Informed consent under MDR is governed by Article 63. The requirements are more explicit than they were under the Clinical Trials Directive or MDD.
Participants must be informed about the risks, the benefits, the alternatives, and the right to withdraw. But MDR adds a critical layer: participants must understand that they are part of a First In Human study where long-term risks are not yet known.
The informed consent form must state this clearly. It cannot hide behind technical language. It cannot dilute the uncertainty.
Ethics committees now ask to see how uncertainty is communicated. They ask how the sponsor plans to update participants if new risks emerge during the study. They ask what happens if the device fails or harms the participant.
The consent process is also documented differently. MDR requires that consent is part of the clinical investigation documentation reviewed by the Notified Body. This was not standard practice under MDD.
If your informed consent form does not reflect the actual risk profile documented in your risk management file, the Notified Body will flag it. If it does not explain how participants will be informed of emerging risks, it will be rejected.
Participant Safety Monitoring: Real-Time Expectations
Under the old system, adverse event reporting followed ISO 14155. Serious adverse events were reported within defined timelines. The sponsor compiled a safety report at intervals.
MDR raises the expectation. Article 80 requires that serious adverse events and serious adverse device effects are reported to the competent authority and the Notified Body immediately. But it also expects that the sponsor has systems in place to detect, assess, and respond to safety signals in real time.
For FIH studies, this is not always straightforward. When you are the first to implant a device or use a new material, every unexpected event could be a signal. The challenge is distinguishing between expected variation and true safety concerns.
Sponsors often underestimate what this means for resourcing. You need someone who can assess events as they occur. You need a mechanism to escalate decisions. You need a process to update the risk management file and inform participants if a new risk emerges.
Notified Bodies ask to see this process documented in the clinical investigation plan. They want to know who makes decisions, how fast, and what triggers a protocol amendment or study pause.
Your FIH application must include a clear safety escalation process. Describe who reviews adverse events, how quickly, and what criteria trigger sponsor decisions or regulatory notifications. Vague language here leads to deficiencies.
Data Transparency and EUDAMED
MDR introduces a new expectation around transparency. Article 73 requires that clinical investigation data is registered in EUDAMED. For FIH studies, this means that before you enroll the first participant, your study is visible.
The registration includes the study objectives, the device description, the participating sites, and the expected number of participants. This is public information.
For some sponsors, this is uncomfortable. They worry about competitor visibility or intellectual property exposure. But MDR does not allow exceptions for FIH studies. The registration is mandatory.
What many sponsors miss is that EUDAMED registration is also checked during Notified Body review. If your registration does not match your protocol, the Notified Body will ask for clarification. If you delay registration, you delay the study start.
Operationally, this means you need to finalize your protocol earlier in the process. You cannot submit a draft protocol to the ethics committee and refine it later. The version you register in EUDAMED must be the version you intend to execute.
What This Means for Your Next FIH Application
The changes are not cosmetic. They affect timeline, resourcing, and documentation.
First, start your clinical evaluation before the FIH study. Document what is known, what is uncertain, and why the study is necessary. This becomes the foundation for your protocol justification.
Second, integrate your risk management file into the protocol design. Make sure your inclusion and exclusion criteria reflect the identified risks. Make sure your safety monitoring plan addresses residual risks.
Third, write informed consent forms that communicate uncertainty honestly. Do not hide behind technical language. Explain what is unknown and how participants will be informed if new information emerges.
Fourth, build a real-time safety monitoring process. Define who reviews events, how quickly, and what triggers action. Document this in your clinical investigation plan.
Fifth, plan for EUDAMED registration early. Finalize your protocol before you submit to ethics. Make sure your registration matches your protocol exactly.
Sponsors submit FIH applications with a preliminary CER written after the protocol was finalized. The Notified Body asks how the study objectives were derived if the clinical evaluation had not yet identified the evidence gaps. The sponsor cannot answer. The application is put on hold until the CER is rewritten.
These are not theoretical risks. They are the reasons why FIH applications take longer under MDR than they did under MDD.
Where the Friction Comes From
The underlying issue is that MDR treats clinical investigation as part of a continuous process, not a one-time event. This requires a different mindset.
Under MDD, you could think of an FIH study as a discrete project. You designed it. You executed it. You reported it. You moved on.
Under MDR, the FIH study is a milestone in an ongoing clinical evaluation. The data you collect feeds into the CER. The CER feeds into PMCF. PMCF feeds into periodic updates. Every piece connects.
This integration is logical, but it is operationally demanding. It requires coordination between clinical, regulatory, and quality teams. It requires that your documentation is structured to support this flow.
Most delays I see come from teams who treat these as separate activities and try to connect them after the fact. By then, the gaps are visible and difficult to close.
Final Thought
If you are planning a First In Human study under MDR, the biggest change is not in the study itself. It is in how the study fits into the broader clinical evaluation framework.
The protocol must connect to the preliminary CER. The CER must connect to the risk management file. The risk management file must connect to informed consent and safety monitoring. EUDAMED must reflect the final protocol.
Each connection is a potential deficiency point if not managed correctly.
The sponsors who move through FIH applications smoothly are the ones who structure their documentation with this integration in mind from the start. The ones who struggle are the ones who try to retrofit the connections after submission.
Start with the clinical evaluation. Build the protocol from the evidence gaps. Align risk management with participant selection. Write consent forms that communicate uncertainty. Plan for real-time safety monitoring. Register early in EUDAMED.
That is what changed. That is what matters.
Peace,
Hatem
Clinical Evaluation Expert for Medical Devices
Follow me for more insights and practical advice.
Frequently Asked Questions
What is a Clinical Evaluation Report (CER)?
A CER is a mandatory document under MDR 2017/745 that demonstrates the safety and performance of a medical device through systematic analysis of clinical data. It must be updated throughout the device lifecycle based on PMCF findings.
How often should the CER be updated?
The CER should be updated whenever significant new clinical data becomes available, after PMCF activities, when there are changes to the device or intended purpose, and at minimum during annual reviews as part of post-market surveillance.
What causes CER rejection by Notified Bodies?
Common reasons include inadequate equivalence demonstration, insufficient clinical data for claims, poorly structured SOTA analysis, missing gap analysis, and lack of clear benefit-risk determination. Structure and logical flow are as important as the data itself.
Which MDCG guidance documents are most relevant for clinical evaluation?
Key documents include MDCG 2020-5 (Equivalence), MDCG 2020-6 (Sufficient Clinical Evidence), MDCG 2020-13 (CEAR Template), MDCG 2020-7 (PMCF Plan), and MDCG 2020-8 (PMCF Evaluation Report).
Need Expert Help with Your Clinical Evaluation?
Get personalized guidance on MDR compliance, CER writing, and Notified Body preparation.
✌
Peace, Hatem
Your Clinical Evaluation Partner
Follow me for more insights and practical advice.
– MDR 2017/745 Article 61 (Clinical investigations)
– MDR 2017/745 Article 62 (General requirements regarding clinical investigations)
– MDR 2017/745 Article 63 (Informed consent)
– MDR 2017/745 Article 73 (European database on medical devices)
– MDR 2017/745 Article 80 (Serious incident reporting)
– MDR 2017/745 Annex XIV (Clinical evaluation and post-market clinical follow-up)
– ISO 14971:2019 (Risk management for medical devices)
– ISO 14155:2020 (Clinical investigation of medical devices for human subjects)
Deepen Your Knowledge
Read Complete Guide to Clinical Evaluation under EU MDR for a comprehensive overview of clinical evaluation under EU MDR 2017/745.
