ISO 14155 is not a protocol checkbox. Under 21 CFR 812.28 the FDA asks whether a Latin American device investigation is validatable. That means an inspectable file — ethics, consent, device accountability, trial importer of record, monitoring — not a PDF of the protocol.
The quietest way to waste a first-in-human study in Latin America is to treat ISO 14155 as a sentence on page two of the protocol. Ethics stamped it. INVIMA, ANVISA, COFEPRIS, ANMAT, or MINSA stamped the study. The investigator signed. Six months later a US reviewer asks for the file that proves the investigation was conducted, recorded, and monitored — and the sponsor hands over a translated protocol plus a slide deck.
That is not what 21 CFR 812.28 is asking. The regulation lets the FDA accept outside-US device data to support an IDE, 510(k), De Novo, or PMA when the investigation was conducted under good clinical practice — including independent ethics-committee review and informed consent — and when the FDA can validate the data, including by on-site inspection if necessary. Eligibility of foreign clinical data is not FDA clearance of any device. See Does the FDA accept clinical data from Latin America? and the agency page, Acceptance of Data from Clinical Investigations for Medical Devices.
ISO 14155 — Clinical investigation of medical devices for human subjects — Good clinical practice — is the device-specific GCP standard. The FDA recognizes it as the consensus GCP for medical-device investigations; conformance is how a Latin American first-in-human (FIH) or early feasibility study (EFS) demonstrates the GCP prong of 812.28. Short definition: glossary.
What a reviewer is actually looking for
FDA reviewers do not “grade ISO 14155.” They ask three operational questions, which match the concerns already laid out in bioaccess®’s LATAM-to-FDA FIH guide and the knowledge-base answer Does the FDA accept Latin American clinical trial data?:
- Was this investigation reviewed and approved by an independent ethics committee before first patient, with a consent process that can be reconstructed subject by subject?
- Is the investigational article identical to — or adequately compared with — the device in the US submission, with a chain of custody that survives an inspection?
- Can the FDA validate the data from records, or from an on-site inspection of the foreign site if the agency decides it needs one?
If the answer to the third question is “the protocol is ISO 14155-aligned,” you do not have an inspectable file. You have a claim. The file is the set of contemporaneous artifacts that let a stranger reconstruct what happened without calling the principal investigator on a Saturday.
Seven folders that have to exist before first patient — not after database lock
ISO 14155 tells you to design, conduct, record, and report. The inspectable object is the recording. For a Latin American device FIH I tell sponsors to keep one English index and the country-language originals side by side. Do not wait for the clinical study report to invent the index.
- Protocol and amendments. Version that matches the stamped ethics letter and the stamped regulator letter. Every amendment with the reason, the ethics re-approval, and whether it was implemented before or after the next patient. A US protocol with a Spanish cover sheet is not a LATAM protocol.
- Ethics and regulator letters. Independent ethics-committee (CEI / IRB / CNBI-registered committee) approval before enrollment. National authority authorization where the country requires it. Certified English translations retained with the originals. Continuing review if the committee required it. This is the 812.28 IEC prong, not a courtesy PDF.
- Consent. Committee-approved local-language form, all required elements, documented process, re-consent after amendments. If a reviewer cannot pair a subject ID with a dated consent, the investigation is not inspectable on the human-subject side.
- Investigator and site file. Current CV, medical license, GCP / ISO 14155 training, financial disclosure, delegation log, and a site qualification that shows the facility can actually do the procedure — imaging, recovery, emergency response. FIH site criteria are written out in Early feasibility study in Latin America: regulatory requirements and site criteria.
- Device accountability and trial import. Model, lot/serial, sterile barrier, software version if it is part of the investigational article, quantity reconciled to the protocol plus spares, disposition. The consignee on the crate is the trial importer of record, not the future commercial holder. Import is its own calendar — see Investigational device import is the LATAM FIH bottleneck nobody puts on the Gantt.
- Monitoring and source. Monitoring plan, visit reports, query logs, source-document verification. Complete, contemporaneous, legible, original, accurate source at the site. Primary-endpoint data that cannot be traced to source is not validatable data.
- Safety. Definitions that match the protocol and the consent. SAE clocks the site actually used. Narratives, causality, committee and regulator notifications. A spreadsheet with “no SAEs” and no process behind it is not a safety file.
Those seven folders are the ISO 14155 file. The clinical study report is the narrative that points into them. If the CSR is written first and the folders are assembled later, you are reconstructing, not inspecting.
Country letters are not interchangeable artifacts
Latin America is not one ethics desk. The inspectable file has to hold the letter that the named country actually issued — not a generic “LATAM IRB approval.”
- Colombia (INVIMA). CEI approval in parallel with the INVIMA clinical-trial authorization. Those are two stamps. The import permission tied to the authorized study is a third. Do not file the CEI letter and call INVIMA done. INVIMA: invima.gov.co. Trial-clock context: INVIMA approval timeline.
- Brazil (ANVISA). The clinical file and the import license are different objects. Portuguese originals stay in the file. A US commercial invoice in the TMF does not prove investigational entry. ANVISA: gov.br/anvisa.
- Mexico (COFEPRIS). Protocol authorization is not a Permiso Sanitario de Importación. Both letters belong in the file, and the import permission has to describe the investigational lots. COFEPRIS: gob.mx/cofepris.
- Argentina (ANMAT). Trial authorization and the investigational-product import permission sit next to each other. HELENA is the commercial desk; it does not undock a FIH crate or replace an ethics letter. ANMAT: argentina.gob.ar/anmat.
- Panama (MINSA / CNBI). MINSA authority plus ethics review by a CNBI-registered committee. The inspectable file needs both identities named, not “Panama IRB.”
Ethics-committee clocks in the region are a median of 4–8 weeks in bioaccess®’s experience; the comparable US pathway (IDE + IRB + site activation to first patient) typically runs 6–12 months. Those are planning figures, not a promise from any committee. See Latin America first-in-human benchmarks 2026 and llms.txt.
Do not mix the manufacturing QMS with the clinical file
QMSR — the FDA quality-management-system regulation that incorporates ISO 13485:2016 into 21 CFR 820, effective 2 February 2026 — is the manufacturing quality file. ISO 14155 is the clinical-investigation file. A 812.28 reviewer is asking whether the investigation is inspectable, not whether the plant CAPA board is pretty.
ISO 13485 (and now QMSR) still matters before first human use: the investigator’s brochure and the device-identity comparison need a manufactured article that came out of a controlled process. Put the QMS certificates and the device-comparability table in the submission. Do not dump the entire plant DHF into the trial master file and call the TMF “inspectable.” Two files. Two inspectors. Two calendars.
Calendar, not folklore
I do not publish a fake “TMF is inspection-ready on Friday” number. What is inside your control is when each artifact starts existing:
- Week 0, with site selection. Name the trial IOR, the ethics committee, and the national authority. If you cannot name the importer, you do not have a country — and you do not have device accountability.
- Same week the CEI pack is submitted. Open the seven folders. Drop the protocol version, the draft consent, the IB, the investigator CV, and the import-dossier templates. Do not wait for the approval letter to invent the filing system.
- On ethics + regulator approval. File the stamped letters (original + certified English). File import immediately. First-patient-in is a hospital calendar; inspectability is a records calendar. They only meet if you started both.
- Before first patient. Delegation log signed. Consent process dry-run. Device in the accountability log at the site, not at a distributor “learning the product.” Monitoring visit 0 closed.
- During enrollment. Source contemporaneous. Deviations documented and reported. SAE clocks actually run. Protocol amendments re-approved before they are used.
- After last patient. Close investigational inventory. Lock the index. Write the CSR so that every claim points to a folder, not to a memory. Leftover lots do not become commercial stock — that is a new sanitary registration and a new commercial import.
OUS FIH data can support an IDE or a device marketing submission when the investigation meets 812.28. A missing import trail is how you lose device identity (812.28(a)(2)). A missing consent trail is how you lose the IEC prong. A missing monitoring trail is how you lose “the FDA is able to validate the data.”
Three file mistakes I still see after the ethics letter
- English-only TMF, originals “at the site.” An inspection of a foreign site is a records inspection. If the CEI letter, the consent, and the INVIMA or COFEPRIS authorization exist only in a coordinator’s drawer, the sponsor does not have an inspectable file. Keep originals accessible at the site and a complete copy in the sponsor file, with certified translations where the US submission will need English.
- Device accountability that starts at implant. Chain of custody starts at manufacture-to-consignee. If the lot cannot be walked from the packing list through the trial IOR into the site log, 812.28(a)(2) is a speech, not a record.
- Calling the protocol “ISO 14155-compliant” in the CSR with no monitoring reports behind it. Conformance is demonstrated by conduct. The statement without the visit reports is the sentence on page two again.
This week: one page, seven rows (the folders above), four columns — document exists (Y/N), language on file, date it first existed, owner. If quality, regulatory, and the person who signs freight cannot point to the same device identity and the same IOR, you are hoping, not inspecting.
Further reading: FIH study basics · First-in-human clinical trials · glossary.
Disclosure: I am CEO of bioaccess®, a first-in-human / early-feasibility medical-device CRO with US regulatory anchoring and Latin American execution. The inspectable-file sequence above is how I tell sponsors to make a LATAM device FIH validatable under 21 CFR 812.28; it is not a guarantee of FDA inspection outcome, clearance, or approval, and it is not a CRO hard-sell. Self-reported ~40% faster / ~30% lower per-patient cost figures used elsewhere on bioaccessla.com are experience since 2010, not a formal study. Grounding: llms.txt.