Interpreting ISO 18969, the First International Standard for EU Clinical Evaluation: How Should It Be Used Together with EU MDR and MDCG?

ISO/DIS 18969:2025 Clinical Evaluation Standard: How to Use It Together with MDR + MDCG

I. Why ISO 18969 Is Worth Studying Now

ISO/DIS 18969:2025 is a draft standard specifically focused on “how to conduct medical device clinical evaluation”This draft standard does not simply restate the MDR requirements; rather, it breaks clinical evaluation into an executable process: from early development through continuous post-market updates, turning the work you do every day“search, screening, appraisal, justification, conclusions, gaps, next steps” into a clearly articulated evidence chain in more consistent language.

If you prepare a CER under the EU MDR framework, you will be very familiar with the requirements of Article 61 and Annex XIV. The value of 18969 lies in the fact that:

it translates “clinical evaluation must span the full lifecycle” into process maps and clear allocation of responsibilities.
It emphasizes using a “quantifiable/verifiable” approach to defineclinical benefit and evaluation criteria (outcome parameters + evaluation criteria), moving many points of debate upstream into the planning stage.
It brings the inescapable new elements of recent years (such as software/AI, digital evidence, real-world data, and bias control) into a single framework, giving you an explainable and traceable way of writing.

II. The Structure of the Standard: What Process Does 18969 Actually Describe?

18969 breaks clinical evaluation into six “modules” and emphasizes that this is an iterative process:planning—execution—overall assessment—conclusion—supplementary activities—update. It also specifically reminds readers that not every requirement applies to every device or every stage; the key is to clearly explain “why this is done / why this is not done.”

1) Starting with the objective: the four questions clinical evaluation must answer

Safety: Are there any new hazards, hazardous situations, or harms? Can the clinical data support the estimates of residual risk in the risk management file?
Clinical performance/effectiveness:Does the device achieve its claimed clinical performance or effectiveness, and does it deliver clinical benefit?
Benefit-risk:When the benefits are assessed in the context of standard of care, comparable technologies, and alternative options, is the benefit-risk profile still acceptable?
Is the evidence sufficient? If not, where are the gaps, and what should be added next (clinical studies, PMCF, additional RWD, additional non-clinical evidence, etc.)?

2) The key to making it actionable: define the evaluation criteria first

At the planning stage, ISO 18969 already requires you to define the “clinical outcome parameters” and the “evaluation criteria”:In other words, which metrics will you use to demonstrate safety and performance/effectiveness, and what threshold must each metric meet to be considered “acceptable”?

This may sound straightforward, but it addresses the two most common pain points in clinical evaluation:

Pain point A:You only realize at the end of writing the CER that the evidence cannot be integrated into a single logical framework, because the metrics and thresholds were not clearly defined from the outset.
Pain point B:When the Notified Body/expert panel asks, “What is your basis for concluding that this is sufficient?”, you can only fall back on “general industry practice,” but without traceable justification.

In the context of ISO 18969, evaluation criteria are not arbitrary,but should be derived from “available knowledge,” including standard of care, guidelines, comparable/similar devices, and the actual performance and risk profiles of other treatment/diagnostic options.

3) “Available knowledge” is not a box-ticking exercise: it requires you to build the clinical benchmark

Many teams tend to turn SOTA/available knowledge into a “literature review.” From the ISO 18969 perspective, it is closer to “building a clinical benchmark”: you need to identify the medical and non-medical alternatives for the same indication and target population,and summarize their advantages and disadvantages, clinical benefits, and risks, so that the safety and performance level the DUE (device under evaluation) needs to achieve can be clearly defined.

It also explicitly reminds you that standard of care varies by region, and that guideline quality is uneven, so you should confirm applicability to your intended use setting before citing them.

4) Create an inventory of data sources: lay out all the evidence you have on the table

ISO 18969 divides data sources into two broad categories:

Data sources for “available knowledge” (literature databases, clinical trial registries, guidelines, HTA, product standards, adverse event databases, etc.);
Data sources for the “DUE itself”: non-clinical (verification and validation, animal studies, usability, human factors, simulation, digital evidence, etc.) + clinical (studies, post-market data, RWD, complaints/vigilance, third-party data, etc.).

Two signals are particularly worth noting:

It explicitly places “digital evidence/computational modeling/AI analysis” within the context of clinical evidence, provided that you can demonstrate their relevance and validity---which is highly aligned with the updated content in the new MDR draft regarding Article 61(10).
It also lists “social media/patient feedback,” among others, as optional sources (of course, whether and how they can be used must ultimately come back to verifiability and bias control).

5) Appraisal is not just saying a source is “good/average”: criteria and weighting must be defined in advance

18969 is explicit about appraisal: it must be systematic, objective, performed against pre-defined criteria, and explain how you “classify/weight” different datasets.

The core point is this: clinical evaluation is not a simple sum of all data; it must explain why one type of evidence better supports a given conclusion. For example, with clinical data, randomized controlled trials, prospective cohorts, retrospective real-world data, and case series do not carry the same weight for different conclusions, and you must make that methodological difference clear.

6) Conclusions must be actionable: acknowledge limitations, identify gaps, and define actions

18969 spends considerable space on “limitations” and “additional activities”:

Limitations are not just boilerplate like “small sample size” or “short follow-up”; you need to assess their clinical relevance and decide whether action is needed.
Possible actions include: additional clinical study/PMCF, additional non-clinical evidence, design changes,adjusting claims??, adjusting IFU/labeling, etc.

This is really pushing us to write the CER as a decision document for the entire compliance package, not as a report written just to get through review.

3. Several strong signals from 18969: what will future clinical evaluation emphasize more?

Shift clinical evaluation earlier into development: the standard explicitly requires clinical evaluation activities to begin in the early design and development phase and to be tightly coupled with design development, risk management, clinical development, regulatory strategy, and PMS. -- Clinsota strongly agrees with this 👍.
Greater emphasis on expressing “clinical benefit” through patient-relevant outcomes: not just the performance metrics themselves, but how they translate into outcomes that matter to patients.
Greater emphasis on the comparator of “alternative options/standard of care”: your evidence is not assessed in a vacuum, but against “current medical practice.”
A more pragmatic view of “transferability/comparability”: the standard uses the concepts of “transferability/comparable device” and does not directly bind itself to the EU term “equivalence,” but it still requires a scientific justification.
Bring “bias control” and “reproducibility” into the open: literature searches, screening, exclusions, and deviations from the plan must all be traceable.
The update mechanism looks more like signal monitoring than periodic report writing: triggers for updates include new risks, changes in performance trends, design changes, manufacturing changes, regulatory changes, and changes in publicly available information.

4. How should 18969, MDR, and MDCG be weighed together?

1) First distinguish the roles: who is the “law,” who is the “method,” and who is the “interpretation”

MDR (Regulation (EU) 2017/745): the legal text that defines what requirements must be met --the baseline threshold.For example, Article 61, Annex XIV (clinical evaluation), and the GSPRs on benefit-risk, performance, and safety.
MDCG guidance: under the MDR, it provides enforcement/review-level interpretation and harmonized practice, and is a very practical source of review criteria for Notified Bodies --work instruction。
ISO 18969 is more like a methodological manual. It tells you how to organize clinical evaluation into a process that is auditable, reproducible, and communicable.

2) A practical sequence of use: work backward from the “regulatory questions” to the “standardized methodology”

We recommend linking the three through a problem-driven approach:

Step 1: Use the MDR to list the questions

For your device, within its intended purpose and target population, is there sufficient clinical evidence to demonstrate conformity with the GSPR?
If you intend to rely on equivalence, does it meet the MDR requirements for equivalence?
How will you continuously update the clinical evaluation after market placement?

Step 2: Use MDCG to lock in the focus points of EU review

- For example, how to substantiate equivalence (MDCG 2020-5), how to present “sufficient clinical evidence” for a legacy device (MDCG 2020-6), and what questions the Notified Body’s CEAR template is likely to ask (MDCG 2020-13).

Step 3: Use 18969 to make the methodology robust

How to define the literature search question and conduct reproducible searching and screening;
How to predefine standards and weighting for appraisal;
How to build the analysis around outcome parameters + evaluation criteria;
How limitations should drive the next evidence-generation plan.

3) Do not treat 18969 as a “new provision replacing the MDR”

Annex ZA of 18969 also states this very clearly: it is intended to support certain requirements of MDR Article 61 and Annex XIV Part A, but because it is not tied to a specific regulatory framework, many EU-specific requirements remain outside its scope (for example, the PMCF Plan, PMS Plan, SSCP, etc.).

A more appropriate positioning is therefore:

MDR = what you must demonstrate;
MDCG = how EU reviewers are likely to question it;
18969 = what methodology you use to make the evidence chain more able to withstand scrutiny.

V. From an industry practice perspective: 10 preparatory actions recommended before the standard formally takes effect

Conduct a “health check” of your clinical evaluation system: place the current CER, CEP, PMS/PMCF, RMF, and labeling claims matrix together and verify whether the evidence chain is closed-loop (claims → outcome parameters → evidence → conclusions → risk control/information communication).
Integrate clinical evaluation into QMS procedures: define version control, the list of interface documents, and cross-functional review checkpoints (R&D/medical/regulatory/quality/vigilance).
Establish a “reproducible search” template: search question (PICO, etc.), database selection, search strategy, time range, language, screening/exclusion rules, and PRISMA flowchart output.
Create an appraisal rubric and weighting logic: assess "relevance/transferability" separately from "methodological quality/risk of bias," and define weighting rules for different data types.
Build "alternatives/standard of care" into a long-term knowledge base: rather than scrambling for each CER, keep it continuously updated like competitive intelligence.
Express clinical benefit as "outcomes patients can understand": whenever possible, translate performance metrics into patient benefit or clinical decision-making benefit, especially for diagnostic and management devices.
Prepare a justification framework for "transferability/comparability": assess the impact of differences across technical, biological, and clinical dimensions, and identify which differences would result in "clinically significant differences."
Establish governance for RWD and PMS data: define data sources, data quality, missingness, bias, statistical methods, signal-detection thresholds, and update-trigger mechanisms, ideally formalized in an SOP in advance.
Create a dedicated section for software/AI-specific considerations: version iterations, training-data drift, cybersecurity updates, and performance monitoring metrics, and how these map to clinical evaluation "update triggers."

10. Training and role clarity: 18969 explicitly requires participating/review teams to have capabilities in research methodology, information retrieval, regulations, medical writing, and clinical and technical knowledge. Companies should incorporate these competency requirements into job roles and outsourcing management.

6. Written for reviewers, and for ourselves: what does a truly defensible CER look like?

If Annex A of 18969 is treated as a "table-of-contents reference":

Clearly describe the device and its claims: indications, target population, use environment, contraindications, warnings, expected lifetime, use in combination with other products, and so on.
Clearly describe the methods: how the literature search was conducted, how data were screened, how quality was appraised, how weighting was applied, and how the analysis was performed.
Clearly describe the decisions: what the conclusions are, what the limitations are, where the gaps are, what needs to be supplemented next, and how these feed back into risk management, labeling, and PMS/PMCF.

When written this way, a CER becomes more like an integrated chain linking technical and clinical evidence, rather than a narrative review.

7. Final reminder: do not wait until it becomes formally effective

18969 is currently still at the DIS (draft) stage, and the content may still change. For companies, however, the most valuable work to do in advance is not line-by-line, word-for-word implementation, but building the underlying methodological capabilities behind it:

Reproducible search and screening;
Explainable appraisal and weighting;
A justification framework centered on outcome parameters + evaluation criteria;
Lifecycle-based update mechanisms and signal monitoring.

Once these capabilities are in place, regardless of how the final text is fine-tuned, you will find that CERs are faster to write, attract fewer questions, and enable smoother team collaboration.

Finally, let me pose a question to stimulate reflection. In future EU clinical evaluation work, one topic that rule-makers, Notified Body reviewers, companies, and consultants should discuss, align on, and refine together is:How should we address and balance the relationship and differing emphases among MDR, MDCG, ISO8969, the new MDR draft, and EU2025/2086,With so many paths, how do we, in practice, arrive at a CER that can withstand scrutiny?

Finally, if you would like the full ISO18969 PDF, please reply with: ISO18969 to receive it automatically.

Appendix: Main sources cited in this article

ISO/DIS 18969:2025(en) Clinical evaluation of medical devices (full draft text)
Regulation (EU) 2017/745 (MDR), Article 61, Annex XIV, etc.
MDCG 2020-5 (equivalence), MDCG 2020-6 (sufficient clinical evidence for legacy devices), MDCG 2020-13 (CEAR template), etc.

How Will ISO 18969, the First International Standard for EU Clinical Evaluation, Affect Corporate Clinical Strategy?