How to select a medical device CRO in Europe, in 2026.

01 / 14

Notified Body expertise, real versus claimed

Start here, because it is the single filter that decides most of the rest. Many medical device CROs will tell you they have submitted dossiers to Notified Bodies on behalf of clients. That is not the same as employing people who sat on the other side of the table and assessed technical files for a living. The difference shows up in whether a CRO can anticipate the deficiencies an assessor will raise, and design the evidence to answer them from protocol version one, rather than restructuring everything after the deficiency letter lands.

A medical device CRO that can name the person, the body and the class is giving you something checkable. One that answers in marketing language is telling you the expertise is decorative. At Eclevar, a founding clinician, Prof. Mark DaCosta, was a senior reviewer at a Notified Body, TÜV SÜD, named publicly with his class focus on the leadership page. When Nihon Kohden needed to clear Notified Body deficiencies on a Class IIa EEG device, the work began by anticipating the deficiencies an assessor would raise, because the person structuring the response had performed that assessment professionally.

02 / 14

The criteria that changed in 2026

This is where most older selection guides are now out of date. The question is no longer just whether a CRO can run a study, but whether it understands the regulatory environment your device now sits in.

EUDAMED is now mandatory, the legacy transition was extended to 2027 and 2028 under Regulation (EU) 2024/1860 without softening the MDR evidence bar, the AI Act and MDR now interact for software under MDCG 2025-6, Notified Body scrutiny of PMCF quality has tightened, and the European Health Data Space is arriving. A CRO that cannot speak fluently to these is selling you last year's service.

03 / 14

Regulatory foresight, not just compliance

A capable medical device CRO keeps you compliant with the rules as they are. A valuable one tells you where they are heading, because the cost of being caught flat is measured in months. The live example is the Commission's proposal to revise the MDR and IVDR (COM(2025) 1023, December 2025), which introduces a formal definition of a well established technology device and threads that concept through the conformity assessment provisions.

Commission Delegated Regulation C(2026)1798, adopted 20 March 2026, replaces the Article 61(6)(b) list in its entirety with an expanded version, retaining the original devices and adding many new types. The trajectory is toward a criteria-based logic aligned with the four criteria of MDCG 2020-6, but the mechanism remains an enumerated list expanded by delegated act, not open-ended self-assessment. At a regulatory session at CSI Frankfurt 2026, a Commission representative estimated three to four years before this becomes law, though manufacturer and Notified Body pressure may accelerate it. Until then, the original and expanded lists remain the accepted reference.

04 / 14

ISO 14155:2026, the status your CRO must explain

The fourth edition of ISO 14155 was published on 23 March 2026 and superseded the 2020 version, with no defined transition period. The main changes are in risk management, in the governance of Clinical Events Committees and Data Monitoring Committees, and in study design and statistical planning. New investigations are expected to follow it now.

Here is the nuance that separates a CRO genuinely on top of this from one that merely announced the new edition: for presumption of conformity with the EU MDR, the harmonised standard is still EN ISO 14155:2026. Until the 2026 edition is harmonised in the Official Journal, both realities coexist. You conduct to the latest edition while preserving your MDR conformity presumption through the still harmonised 2020 version, and that affects protocol design, risk-management documentation, monitoring plans and committee charters.

05 / 14

Legal representative, data protection, quality

These items quietly expose a sponsor when a medical device CRO is thin, and they rarely appear in a sales pitch. A manufacturer based outside the EU needs a locally based representative under MDR. Data processing agreements, controller and processor mapping, transfer safeguards and a data protection impact assessment must be in place. The quality system should be operational, not a binder of documents.

Legal representation, data protection and quality are closely linked. During an audit or inspection, regulators and Notified Bodies do not assess these in isolation; they assess whether they operate together as part of a functioning quality system, with clear accountability, controlled processes, documented training and traceable records. Inspection readiness, CAPA traceability and audit history should be the default state, not a pre-audit sprint.

06 / 14

ISO 13485 and the CRO as a critical supplier

This is the criterion sponsors most often overlook, and a Notified Body never does. When you outsource clinical evaluation, investigation, PMCF or technical documentation, you outsource a process that is part of your device lifecycle and your quality system. Under the purchasing and supplier control requirements of ISO 13485, and under MDR, you remain accountable for that process. You cannot subcontract the responsibility, only the work.

That makes the CRO a critical supplier, not a convenience. An auditor will look at how you select, qualify, monitor and re-evaluate it, and any weakness in its quality system surfaces as your non-conformity, on your certificate, on your timeline. A CRO that is itself ISO 13485 certified gives you documented supplier control, an audit-ready system with document control, CAPA and traceability, and processes that already speak the language your Notified Body expects, as set out in the guide on what ISO 13485 means for your CRO.

07 / 14

Who actually runs your trial inside the CRO

This question most cleanly separates a specialist from a broker. The majority of medical device CROs externalise biometry, data management and biostatistics to subcontractors, which is exactly where data integrity and timelines slip, because the people running your statistics are not the people accountable for your trial.

The alternative is a CRO that keeps biometry and data management in house under a named Chief Data Officer, runs its own platform, and fields its own clinical research associates rather than a subcontracted network, as set out on the operational infrastructure page. When one organisation owns the data, the statistics and the monitoring, there is one party answerable for integrity, and nowhere for a problem to hide between subcontractors.

08 / 14

Country-specific expertise and local presence

A submission in France is not a submission in the UK, and neither is Germany. Each country has its own competent authority, ethics committee process, language requirements, site contracting norms and timelines. A medical device CRO that treats Europe as one undifferentiated market will stumble at the first national gate. Real capability shows up as country-specific SOPs and work instructions, in-house clinical research associates who actually sit in each country, and a study start-up function that knows the local route.

The sharpest test of genuine presence is structural. A local subsidiary running a real payroll in France, Germany or the UK is hard evidence, far stronger than coverage delivered by monitors flown in or subcontracted. It is what lets a CRA handle a French CPP and ANSM submission, or a UK pathway, in the local language and to local timelines, rather than learning each national system on your study.

09 / 14

Depth in your therapeutic area

Generic device experience is not experience in your device. A Notified Body has specific endpoint standards and PMCF requirements for cardiovascular and structural heart, for orthopaedics and spine, for dental and for wound care, and they do not transfer freely between areas. Depth can be demonstrated in only three ways: client success stories in that exact area with named devices and outcomes, an in-house clinician who actually leads the relevant department, and a study team whose track record sits in your field. If a CRO can show all three, the depth is real. If it can show none, the claim is marketing.

In practice that looks like a dental materials CER and equivalence programme for Shofu, and structural heart and orthopaedic PMCF for Meril, with a senior cardiac surgeon and former Notified Body team leader heading cardiovascular and structural heart and a specialist heading orthopaedics and spine, gathered on the client success stories page, and in recorded clinician interviews where the people who would design your study explain what their area actually demands.

10 / 14

Proof and clinical trial track record

A specialist medical device CRO should be able to show, not just assert: published case studies and outcomes in your area, examples of clinical evaluation reports or documentation that passed Notified Body review, and references you can actually verify. Logos on a wall are not proof, and the complete absence of any published client outcome is itself a signal worth heeding.

Independent recognition carries particular weight, because it comes from outside the company. It should be genuinely independent and externally judged, not a self-awarded label, and scoped accurately to what was actually awarded rather than stretched into a claim to be the best CRO in a region. In the xShare and EUCROF Open Call, the Platinum Award went to Milo Health by Eclevar, announced by xShare and EUCROF as the awarding bodies, reported independently by award partner CVBF, with the full account on the Eclevar page. The awarding bodies carry the weight; the company's own page only provides the detail.

11 / 14

Technology and data in the CRO

Complex investigations raise the bar under MDR. A pivotal or multi-country clinical trial needs an EDC that is not just functional but demonstrably validated and connected: 21 CFR Part 11 for electronic records and signatures, ISO 27001 for information security, and hosting and processing that satisfy GDPR. It also means real integration partnerships already in place, randomisation, eCOA and ePRO, central laboratory, imaging and core lab, and registry connections, because for a complex trial these cannot be improvised mid-study.

Ask the CRO to show it, not state it. A CRO that can produce the validation file and name its established integrations is ready; one that cannot is offering you a tool, not a platform. Enterprise technology partnerships are one external marker, since admission to a major vendor's clinical technology programme signals a system that meets that vendor's validation and integration bar, as in the Oracle and Eclevar collaboration.

12 / 14

Financial stability, the risk nobody prices in

This is the criterion sponsors discover too late. A medical device CRO that becomes insolvent in the middle of your investigation leaves you with open sites, enrolled patients, a frozen database and a transfer scramble that can cost months and put the trial at risk. It happens more often than the industry likes to admit, and to CROs that looked busy. Before you commit a multi-year programme, you are entitled to ask whether the partner will still be standing at database lock.

Two signals matter, and they are different. External validation, whether the CRO attracts investors and public or European funding, shows that independent parties examined the business and judged it viable. Internal governance, whether there is an in-house Chief Financial Officer running the finances with discipline, is the one too often missing, because some of the most heavily funded CROs are exactly the ones that collapsed. You want both, as set out on the funding and investors page, with a named in-house CFO responsible for financial stewardship.

13 / 14

The clinical trial budget reality

Cost is where sponsors are most often misled, in both directions. Ask for a quote you can compare fairly, with a clear statement of what is and is not included, because the cheapest bid is frequently the one that omits the work you will need. A misaligned medical device CRO can add six to twelve months to a programme, which dwarfs any saving on the proposal.

Look closely at how the price is built, not just the total. A partner willing to expose its hourly rate and per-activity breakdown is one you can hold accountable; one that hides it in an opaque fixed fee is asking you to trust a black box. Transparency then has to be matched by flexibility, reallocating effort across activities as recruitment and monitoring needs change. And be wary of a CRO that sells the avoidance of a clinical investigation as a virtue when the evidence genuinely requires one, because you may only discover it when the Notified Body rejects the path you were advised to follow. Compare line by line and country by country, against real hospital tariffs, as in the European clinical trial cost model.

14 / 14

Red flags to walk away from

Some answers should end the conversation. A generalist deflects each of these into reassurance, and any one of them left unanswered is reason enough to keep looking.