What we have written, by framework
Every position paper and article, indexed by the instrument it references — 197 references across 12 frameworks.
EU MDR 2017/745
Classification, economic-operator roles, technical documentation and post-market obligations for any device placed on the EU market. In a trial it bites twice: a technology can meet the device definition on intended use alone, and supplying a CE-marked or commercial device to sites or participants can make the sponsor or CRO an importer or distributor under Chapter II without anyone deciding to become one. Investigational devices are not placed on the market; they follow the clinical-investigation rules instead.
35 documents →EU IVDR 2017/746
The regulation for in vitro diagnostic devices: products intended for the in vitro examination of specimens taken from the human body, such as blood, urine or tissue (IVDR Art. 2(2)). A wearable or sensor that measures in or on the body is never an IVD, whatever result it reports. Whether a product falls under IVDR or MDR is decided by the manufacturer’s intended purpose, not by the trial protocol.
26 documents →ICH E6(R3)
Good Clinical Practice as revised in 2025: data governance, computerised systems, and the sponsor's oversight of the vendors who operate them. It can reach a device the trial merely relies on, not only devices the trial is investigating — a case many programmes have not yet assessed.
22 documents →21 CFR Part 11
Electronic records and signatures held by FDA-regulated entities: audit trails, system validation and, where e-signatures are used, signature controls. FDA looks for those controls on the durable data repository, not on participant-owned hardware. Our risk view: when source data is captured on a participant’s own phone, the path from handset to repository still decides whether the record is attributable, legible, contemporaneous, original and accurate — the ALCOA principles of the data-integrity guidance.
17 documents →EU GMP Annex 11
Computerised systems under EU GMP Annex 11 — the European counterpart to Part 11 for manufacturing. For clinical trials, inspectors refer to the EMA 2023 guideline on computerised systems and electronic data in clinical trials. Validation is for the intended use in your environment: a supplier's validation pack is evidence, never a substitute.
3 documents →ISO 14971
Risk management across the device lifecycle: hazard identification, risk control, and the residual risk you accepted on the record before release. It is not a document written once — every firmware release, OS update and retrained model reopens it for the device that changed.
21 documents →IEC 62304
The software lifecycle for medical device software, from requirements through architecture to release and maintenance. It applies to the app on the phone and the algorithm in the cloud as squarely as to firmware on the wearable.
8 documents →IEC 62366-1
Usability engineering: use error, human factors, and validation with the population that will actually hold the device. These are the manufacturer’s obligations. A sponsor recruiting elderly or paediatric participants carries its own duty through fitness for purpose and GCP: checking that a vendor’s validation in healthy adults actually covers the people in the trial.
9 documents →ISO 13485
Quality management for medical devices, and the standard the FDA QMSR now incorporates by reference. For a sponsor it is the yardstick for what to expect of a vendor's QMS — and what to be able to show of your own when you are the manufacturer without having planned to be.
17 documents →FDA digital health guidance
FDA guidance on digital health technologies in clinical investigations — the December 2023 DHT guidance on fitness for purpose, verification and validation, IDE and significant-risk determinations — together with the related guidance on decentralised clinical trials, AI/ML-enabled device software and medical device cybersecurity. The questions they ask are the ones a reviewer asks about your endpoint.
23 documents →GDPR
Lawful basis, DPIAs, processors and cross-border transfer for personal and health data. A DHT programme can cross a border before anyone has written down which basis carries it, and the vendor cloud is often where that is discovered.
12 documents →EUDAMED
The European database on medical devices: what has to be registered, by whom, and when. Registration follows the economic-operator role — so the question of who registers is answered by the question of who you legally became.
4 documents →