The protocol question I get most from first-in-human device teams isn’t about endpoints. It’s this: after the first patient, what has to happen before we treat the second one? Ethics committees in Latin America ask the same thing, usually in the first review letter. If the protocol answers it with “per investigator judgment”, expect a query.
I am Julio Martinez-Clark, CEO of bioaccess®. This page sets out how I write stopping rules, staggered enrollment and safety oversight into a first-in-human (FIH) or early feasibility device protocol, using what the FDA guidance, 21 CFR Part 812 and Brazil’s ANVISA RDC 837/2023 actually say. It sits next to our early feasibility studies page, the FIH protocol template and the FIH basics article. This is operator guidance, not legal advice.
One-sentence answer
A defensible FIH device protocol enrolls a small sentinel group one subject at a time, names the event types that pause enrollment, gives a named reviewer (a medical monitor, safety committee or data monitoring committee) the decision to resume, and maps every pause to the reporting clocks of each regulator involved: 10 working days for unanticipated adverse device effects under 21 CFR 812.150, and 24 hours from investigator to sponsor plus 7 or 15 calendar days to ANVISA under RDC 837/2023.
What FDA’s early feasibility guidance says
FDA’s guidance on investigational device exemptions for early feasibility studies, issued 1 October 2013, is still the clearest public text on this. Section 7.1 lists risk-mitigation measures FDA expects to see weighed against the uncertainty of an early device. The list reads like a protocol checklist:
- sites with the expertise to manage the adverse events you anticipate;
- investigators who are qualified and trained on the device;
- limiting the number of subjects, with 5 to 10 initial subjects given as an example;
- more frequent follow-up than standard care;
- timely reporting of serious adverse events, after each occurrence;
- non-sequential enrollment, for example treating patients with more favorable anatomy first;
- a pre-specified plan for assessing outcomes before enrolling more patients, which can be as frequent as after each use.
Section 7.3.2 adds the IRB side. Reviewing boards may look at an early study more often than once a year, review after a small target number of subjects, or use graduated enrollment based on a safety analysis of the preceding subjects. Section 7.4.2 says a data monitoring committee of clinicians, scientific experts and people with ethics expertise can serve as a risk-mitigation element. The guidance’s Appendix 4 example describes up to 10 subjects at up to 3 sites, with each subject evaluated before the next is enrolled.
None of that is binding, and FDA says so. But when a US reviewer later looks at your Latin American FIH data, this is the yardstick in their head.
The binding clocks in 21 CFR Part 812
If the study runs under an IDE, or you want the data to support a US submission, three provisions shape the stopping rule:
- Definition (812.3(s)). An unanticipated adverse device effect (UADE) is a serious effect on health or safety, a life-threatening problem or a death caused by or associated with the device, if it wasn’t identified in nature, severity or incidence in the investigational plan, or any other unanticipated serious problem tied to the device that relates to subjects’ rights, safety or welfare.
- Reporting (812.150). The investigator reports a UADE to the sponsor and the reviewing IRB as soon as possible and no later than 10 working days after first learning of it. The sponsor reports the results of its evaluation to FDA, all reviewing IRBs and participating investigators within 10 working days after first receiving notice.
- Evaluation and termination (812.46(b) and (c)). The sponsor evaluates a UADE immediately. If it presents an unreasonable risk to subjects, the sponsor terminates all investigations, or the parts that carry the risk, as soon as possible and no later than 5 working days after making that determination and no later than 15 working days after first receiving notice. For a significant-risk device, resuming needs IRB and FDA approval.
For studies outside the United States, 21 CFR 812.28 lets FDA accept the data if the investigation is well designed, well conducted and follows good clinical practice, including independent ethics committee review. Writing the stopping logic to the Part 812 standard costs nothing at the protocol stage and removes an argument later.
What Brazil adds under RDC 837/2023
ANVISA’s RDC 837 of 13 December 2023 governs device clinical investigations in Brazil. It is more specific than most sponsors expect:
- Data monitoring committee (Art. 57). Before the study starts, the sponsor considers a DMC based on its risk analysis of the device and of study participation. Pivotal studies of Class III and IV devices must have one, and its recommendations go to ANVISA as an amendment (aditamento) within 30 calendar days. The DMC’s functions belong in the clinical investigation plan, and if you decide not to set one up, the plan has to justify that.
- Aggregate review (Art. 54). The sponsor, or an independent DMC, evaluates adverse events in aggregate, and that evaluation feeds the annual reports.
- Investigator to sponsor (Art. 62). Serious adverse events and deaths reach the sponsor within 24 hours.
- Sponsor to ANVISA (Arts. 63 and 64). Unexpected serious events in Brazil that are fatal or life-threatening, with possible, probable or definite causality to the device, go to ANVISA within 7 calendar days of the sponsor learning of them, with follow-up information added within 8 calendar days. All other unexpected serious events with that causality go within 15 calendar days.
- Pauses (Arts. 24 and 26). A temporary suspension taken as an immediate safety measure is notified within 7 calendar days. A sponsor decision to suspend or cancel the study, with its justification and follow-up plan for enrolled subjects, is notified within 15 calendar days.
- Restart (Art. 27). Reactivating a suspended study is a secondary petition to ANVISA, and the study restarts only after ANVISA approval is published in the Diário Oficial da União.
ANVISA’s adverse-event manual for device trials (2nd edition, 13 November 2024) explains the NotivisaEC form and uses the WHO-UMC causality categories. Use the same categories in your protocol so the investigator’s causality call maps straight onto the form. For the wider submission picture, see our ANVISA device clinical trial submission guide. If your sites are in Argentina, the clocks differ; see adverse event reporting to ANMAT in FIH trials.
How I write the stopping rule
A stopping rule that works has five parts. I write each one as a sentence the site coordinator can follow at 2 a.m.
- Sentinel cohort. Name the number of subjects treated one at a time. Use the guidance’s 5-to-10 range as a reference, not a target. The right number depends on how fast the device’s failure modes show up.
- Observation window. State how long each sentinel subject is followed before the next is treated, and why. The window comes from the device’s mechanism and the acute risk profile in your risk analysis, not from a template.
- Pause triggers. List them as event types, not judgment calls. Any UADE, any device-related death, any unexpected serious device effect, and any device malfunction that could have caused serious harm. Add device-specific triggers from the risk file, such as migration, embolization or loss of function.
- Who decides. Name the reviewer and say what they see. For a small single-country FIH study, an independent medical monitor or safety committee may be enough. Where Art. 57 applies, or the risk analysis points to it, a DMC with a written charter. Investigators and sponsor employees don’t vote on their own restart.
- Restart conditions. Say what evidence ends the pause: root-cause analysis, a protocol or IFU change if needed, ethics committee notification and, where a regulator requires it, agency approval before the next subject. In Brazil that means the Art. 27 reactivation petition.
Non-sequential enrollment is a design choice
The guidance’s suggestion to treat favorable anatomy first is easy to miss. In practice it means the first subjects are the ones in whom a failure is most likely to be the device’s fault, not the patient’s. Write the sentinel-cohort inclusion criteria tighter than the expansion cohort, and say so in the protocol. Committees read that as a sponsor thinking about subject safety, and it makes the first safety review easier to interpret.
Common mistakes I see
- Stopping rules written as “the sponsor may pause enrollment” with no triggers.
- A DMC charter that exists on paper but meets only after the last subject.
- Causality scales in the protocol that don’t match the regulator’s form.
- One reporting clock in the protocol when the study runs in two countries with different clocks.
- No plan for subjects already treated when the study pauses, which RDC 837 Art. 24 asks for.
How bioaccess® runs this
bioaccess® designs the safety-oversight section with the sponsor’s medical and clinical team: sentinel cohort, pause triggers, the reviewer and its charter, and a single reporting matrix that covers every country in the study. We set up independent safety reviewers, run the investigator-to-sponsor-to-agency chain and file pause and restart notices with ethics committees and regulators. Study scope and pricing are set at proposal. Start on our early feasibility studies page or clinical trials in Brazil, or book a call.
Operator checklist
- Write the sentinel cohort size and the observation window, with the reason for each.
- List pause triggers as event types drawn from 812.3(s) and your risk file.
- Name the reviewer who decides restarts and what data they see.
- Decide on a DMC against RDC 837 Art. 57, and justify it in the plan if you don’t set one up.
- Build one reporting matrix: 24 hours site to sponsor, 7 and 15 calendar days to ANVISA, 10 working days under 812.150.
- Use WHO-UMC causality categories so site calls map onto NotivisaEC.
- Write the follow-up plan for treated subjects before you need it.