How to Write the Statistics Section of a Clinical Evaluation Report (CER)

The most frequently confused point in CER writing is this: a "Clinical Evaluation Report" looks like a quality management document but in essence it is a scientific evidence synthesis document. When a notified body or a TITCK reviewer opens a CER, the first place they look is not the cover page but the Stage 2 appraisal table: which data did you accept and why, which did you exclude and why, and what is the methodological strength of the evidence supporting your clinical claims.

In this article I explain how the statistical/clinical-data core of the CER is built, what MEDDEV 2.7/1 Rev 4 and EU-MDR Annex XIV expect from this section, and exactly where a biostatistician touches it (and where they do not).

A CER is not a QMS document: where it sits

A CER is not a quality record, it is the analytical document that establishes the link between intended purpose and clinical evidence. Let us clarify the confusion:

• QMS / ISO 13485: Shows how processes are controlled. It ties the process of writing the CER to a procedure but does not write its content.
• Technical Documentation (EU-MDR Annex II/III): The CER is a part of this, but its format/filing is a separate discipline.
• Clinical Evaluation Plan (CEP): Comes before the CER. The scope, clinical claims, search strategy, appraisal criteria, and accept-reject thresholds are predefined here. If there are no criteria in the CEP, the choices in the CER are considered "post-hoc" and draw criticism.
• The core of the CER: Identification of the clinical data, its appraisal (methodological quality + evidence value), and its synthesis. This is entirely a methodological/statistical task.

The biostatistician works exactly in this core. We do not produce the QMS structure, the technical file format, or the product registration paperwork: that is a separate regulatory/quality specialty. We take ownership of the part that builds the appraisal and synthesis of the evidence.

The four stages of MEDDEV 2.7/1 Rev 4 and where statistics fit

MEDDEV 2.7/1 Rev 4 is still the de facto reference skeleton for CER structure (used together with EU-MDR, with the MDCG 2020-1, 2020-5, 2020-6 guidances as complements). The four stages:

• Stage 0, Scope: Definition of the device, intended purpose, the list of claims, and the clinical questions to be evaluated. Each clinical claim is decomposed here: performance claim, safety claim, benefit claim.
• Stage 1, Identification of data: Systematic literature search (a PICO-like search strategy, databases, date range, inclusion-exclusion criteria), the manufacturer's own clinical data, PMS/PMCF data, and, where applicable, equivalent device data.
• Stage 2, Appraisal: The methodological quality and clinical evidence value of each data source are scored using a predefined scoring scheme. This is the statistical heart of the CER.
• Stage 3, Analysis: The appraised data is synthesized so as to support each clinical claim; it is compared with the state-of-the-art; the benefit-risk balance and residual risk are assessed; gaps are bridged to the PMCF plan.

Stage 1's search strategy mirrors systematic review methodology exactly: a PRISMA-like flow diagram, deduplication/removal of duplicates, two independent screeners, and resolution of disagreements must be recorded. The reviewer asks "is the search reproducible?"

Stage 2 appraisal: the predefined scoring scheme

Appraisal is the section of the CER that draws the most criticism and requires the most methodology. Two dimensions are scored:

• Suitability: How suitable is the data for this device's intended purpose? (Is it the same device, equivalent, the same indication, the same population.)
• Data contribution / quality (evidence value and methodological quality): Study design (RCT vs observational vs case series), sample size, risk of bias, adequacy of statistical reporting.

In practice, well-known risk-of-bias tools come into play here. For diagnostic performance studies QUADAS-2, for prediction/AI models PROBAST (and PROBAST-AI for AI devices), and for randomized studies Cochrane RoB 2 provide the methodological basis for the appraisal. When assessing reporting adequacy for an AI/ML-based SaMD, the TRIPOD-AI and, for clinical decision support, DECIDE-AI checklists are embedded into the appraisal criteria.

The critical point: the appraisal criteria and threshold scores must be defined in advance in the CEP. Saying "we accepted this study for such-and-such reason" after seeing the data is a red flag for the reviewer. A predefined, reproducible scoring rubric is the strongest defense.

To build the CER statistical core and appraisal scheme of your medical AI/SaMD device together, request a 15-minute free scoping.

Stage 3 synthesis: quantitatively linking the claim to the evidence

After appraisal is complete, an evidence synthesis is done for each clinical claim. The concrete outputs of the biostatistician here:

• Definition of the state-of-the-art: The data that sets the comparison bar. EU-MDR Annex XIV explicitly requires comparison with the SoTA. This does not mean "what exists in the literature," it means "what is the accepted clinical performance range," and it is expressed with numerical ranges (e.g., sensitivity/specificity distributions, the AUC-ROC band).
• Pooled or qualitative synthesis: If there is sufficient homogeneous data, quantitative synthesis (a meta-analytic summary and heterogeneity assessment where appropriate), otherwise a structured qualitative synthesis. If heterogeneity is high, pooling is not done, and this is explicitly justified.
• Appropriate reporting of performance metrics: For a diagnostic device, not a point estimate but sensitivity, specificity, PPV/NPV with a 95% confidence interval (with the note that these depend on prevalence), and calibration where possible. A single AUC figure is inadequate for a CER.
• Benefit-risk and residual risk: A structured assessment demonstrating that the clinical benefit outweighs the residual risks. It must be consistent with the risk management file (ISO 14971 outputs), but we do not write the risk file: we ensure statistical consistency with it.
• Clinical evidence gaps: Which claim has weak evidence? This is written explicitly and bridged to the PMCF plan. The right approach is to manage the gap, not to hide it.

EU-MDR, EU AI Act, and the PMCF bridge

Under EU-MDR the CER is a "living document": it is updated periodically with PMS/PMCF data. For Class III and implant devices it is tied to the PSUR, and for lower classes to a planned update cycle. Every gap flagged in Stage 3 of the CER must turn into a data collection objective in the PMCF plan; otherwise the gap remains "open and unmanaged."

For an AI-based medical device there is one more layer: the EU AI Act introduces data governance obligations (Article 10) for high-risk AI systems that begin to apply from 2 August 2026; the representativeness of training/validation/test data and the bias assessment must be consistent with the CER's clinical data discussion. On the Turkey side, TITCK's framework, which transposes EU-MDR one-to-one, likewise expects similar standalone clinical validation evidence from CDSS/clinical decision support software. A single consistent methodological narrative feeds the three files (EU-MDR CER, TITCK CDSS, FDA dossier) from the same evidence core.

Common Mistakes

• Defining appraisal criteria after seeing the data: Accept-reject thresholds not predefined in the CEP are considered post-hoc; this is the reviewer's first target. The criteria and scoring rubric must be written from the very start.
• Using an equivalence (equivalent device) claim without proving it: EU-MDR requires similarity demonstrated across all three of technical, biological, and clinical characteristics for equivalence; saying "a similar product" is not enough. Most CERs fall here.
• Skipping the state-of-the-art or mistaking it for a literature summary: Annex XIV requires comparison with the SoTA. A "here are the relevant publications" list is not the SoTA; it is the numerical definition of the accepted clinical performance bar.
• Leaning on a single performance figure: Sensitivity/specificity without a confidence interval, AUC without calibration, or PPV presented independently of prevalence are inadequate for the reviewer. Reporting uncertainty is not a weakness, it is methodological strength.

Related Articles

• How to Design a SaMD Clinical Validation Study
• How to Prepare a TITCK CDSS Clinical Validation Report
• TRIPOD-AI and PROBAST-AI: Reporting AI Diagnostic Models

The CER statistics section is not about filling out a form, it is about establishing the link between your clinical claims and the existing evidence with a reproducible methodology. The notified body or TITCK reviewer looks at the robustness of this section; if the appraisal scheme is weak, the rest of the CER, no matter how neatly formatted, receives a major finding. Building this core with the signature of a named methodologist produces the most defensible part of your file.

The scope, timeline, and budget differ for every file; we clarify these in a free scoping call. To determine which layer you need:

Free Scoping Call