What medical device compliance means in 2026
Medical device compliance is the ongoing work of meeting every legal requirement that applies to a device from design through retirement. In the US that means FDA’s requirements under the Federal Food, Drug, and Cosmetic Act and 21 CFR. In Europe it means the Medical Device Regulation (EU) 2017/745 (MDR) or the In Vitro Diagnostic Regulation (IVDR).
The meaning of compliance has shifted in 2026 for three reasons:
- The quality system rules changed. FDA’s Quality Management System Regulation (QMSR) took effect February 2, 2026, incorporating ISO 13485:2016 by reference (FDA).
- Inspections changed with them. FDA’s revised compliance program, CP 7382.850, now organizes inspections around six QMS areas and evaluates risk management throughout (FDA).
- The regulator is stretched. FDA lost roughly 21% of its staff, more than 4,400 people, and device makers report less consistent reviewer feedback (MedTech Dive). Clear, complete documentation matters more when there is less time for back-and-forth.
Compliance across the device lifecycle
FDA lists the basic regulatory requirements device manufacturers must meet: establishment registration, device listing, premarket notification or approval, investigational device exemption for clinical studies, the quality system regulation, labeling requirements and medical device reporting (FDA, Overview of Device Regulation). Mapped to the lifecycle, they look like this:
| Lifecycle stage | US (FDA) requirement | EU MDR equivalent | Key evidence |
|---|---|---|---|
| Classification | 21 CFR 860; product codes | Annex VIII classification rules | Classification rationale |
| Design | Design controls (ISO 13485 clause 7.3 via QMSR) | Annex II technical documentation | Design and development file, risk file |
| Clinical | IDE (21 CFR 812) | Clinical evaluation and investigations | Clinical evaluation report, study data |
| Market entry | 510(k), De Novo or PMA | Conformity assessment and CE marking | Submission, certificates |
| Registration | Establishment registration and listing (Part 807) | EUDAMED actor and device registration | Registration records |
| Production | QMSR (Part 820) | QMS per Article 10 and Annex IX | Process validation, device records |
| Labeling | Parts 801, 830 (UDI), §820.45 | Annex I Chapter III, UDI | Labeling review and release records |
| Postmarket | MDR (Part 803), corrections and removals (Part 806) | Vigilance, PMS, PSUR | Complaint, reporting and trend records |
Two details are easy to miss. First, most low-risk devices still carry obligations even if they need no premarket review: FDA notes that “Approximately 572 or 74% of the Class I devices are exempt” from 510(k), but exemptions are limited and most devices remain subject to QMS and reporting rules (FDA). Second, Part 806 requires reports of certain corrections and removals within 10 working days, so postmarket compliance depends on fast decisions backed by good records.
What compliance costs to enter the market
FDA user fees rose again for fiscal year 2027, which began October 1, 2026 (Federal Register):
| Fee | FY2027 standard | FY2027 small business |
|---|---|---|
| 510(k) | $28,653 | $7,163 |
| De Novo | $191,020 | $47,755 |
| PMA | $636,732 | $159,183 |
| Annual establishment registration | $13,785 | No small business discount |
A refused or deficient submission means paying for rework in time as well as fees, which is why submission quality is a compliance issue, not just a regulatory affairs task.
Seven compliance changes to plan for
| Change | Date | What to do |
|---|---|---|
| QMSR in effect | Feb 2, 2026 | Remap procedures to ISO 13485 and Part 820; retire QSR-era checklists |
| Internal audit, management review and supplier audit reports open to FDA | Feb 2, 2026 | Write reports as if an investigator will read them (FDA QMSR FAQ) |
| CP 7382.850 inspection model | Feb 2, 2026 | Organize evidence by the six QMS areas |
| Computer Software Assurance guidance updated | Feb 3, 2026 | Apply risk-based assurance to production and QMS software (FDA) |
| eSTAR mandatory for De Novo | Oct 1, 2025 (510(k) since Oct 1, 2023) | Build submissions in eSTAR and submit through the CDRH Portal (FDA) |
| EUDAMED mandatory modules | May 28, 2026 | Register actors and devices; legacy device registration is due by Nov 28, 2026 (TÜV NORD) |
| MDUFA VI negotiation | Reauthorization due by Sep 30, 2027 | Watch proposed fees and review goals (RAPS) |
In Europe, the MDR transition deadlines extended in 2023 still apply, with legacy higher-risk devices due by December 31, 2027 and lower-risk devices by December 31, 2028. A broader MDR and IVDR reform is moving through the legislative process: Emergo by UL reports that the European Parliament’s IMCO and BUDG committees voted in favor in September 2026, with a plenary vote expected in the first quarter of 2027 and adoption targeted for mid-2027 (Emergo). Until it is adopted, comply with the MDR as written.
What happens when compliance fails
FDA classifies inspection outcomes as No Action Indicated (NAI), Voluntary Action Indicated (VAI) or Official Action Indicated (OAI), where OAI means regulatory or administrative action will be recommended (FDA). Observations are recorded on Form FDA 483, and serious or unresolved issues can lead to warning letters, import alerts or injunctions.
Enforcement has not slowed with the staffing cuts. Hogan Lovells counted 19 device quality system warning letters in 2025 through September 4, compared with 12 in the same period of 2024, while noting an “overall decrease in the number of inspections over the past decade” (Hogan Lovells). FDA has also expanded unannounced inspections of foreign facilities (FDA). Fewer inspections, in other words, does not mean lower stakes when one happens.
Medical device compliance program checklist
Governance
- Regulatory requirements register covering every market you sell in, with an owner per requirement
- Regulatory intelligence process to track guidance, standards and fee changes
- Management review covers compliance status, audit results, CAPA and postmarket data
Quality system
- Procedures mapped to ISO 13485:2016 and Part 820 (QMSR)
- Risk management (ISO 14971) linked to design, production, complaints and CAPA
- Software used in production and the QMS assured with a risk-based CSA approach
- Supplier controls proportionate to risk, with quality agreements in place
Market access
- Classification rationale documented for each device and market
- Submissions built in eSTAR and checked for completeness before filing
- EU technical documentation, clinical evaluation and EUDAMED registration current
Postmarket
- Complaints assessed for MDR reportability with decisions documented
- Corrections and removals evaluated against Part 806 timelines
- EU vigilance, PMS plan and PSUR/PMS report current
Inspection readiness
- Evidence organized by FDA’s six QMS areas
- Front-room and back-room roles assigned; 483 response process defined
- Foreign sites and contract manufacturers ready for unannounced inspections
Check compliance evidence faster
Most compliance gaps are documentation gaps: a procedure that cites the wrong clause, a risk file that was never updated, a complaint without a reportability decision. AI document assessment can read procedures and records against QMSR, ISO 13485 or the EU MDR, flag what is missing, and cite the passage behind every finding.
Run a sample regulatory document assessment on one procedure or technical file. AskDona shows the evidence; your regulatory team decides.
FAQ
What is medical device regulatory compliance? Meeting all legal requirements for a device across its lifecycle, from classification and premarket review to quality systems, labeling and postmarket reporting (FDA).
Is ISO 13485 certification required in the US? No. QMSR incorporates ISO 13485:2016 requirements, but FDA does not require or issue certificates. FDA checks compliance through inspections.
What changed in FDA compliance in 2026? QMSR took effect February 2, 2026, alongside a new inspection compliance program (CP 7382.850) and an updated CSA guidance.
Are low-risk devices exempt from compliance? Many Class I devices are exempt from 510(k) review, but most still must register, list, report adverse events and follow applicable QMS requirements (FDA).
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| FDA: QS Regulation / QMSR | Regulator | 2026 | QMSR effective date |
| FDA: CP 7382.850 | Regulator | Feb 2, 2026 | Inspection model |
| FDA: QMSR FAQ | Regulator | 2026 | Records open to FDA |
| FDA: Overview of Device Regulation | Regulator | Current | Core requirements |
| FDA: Classify Your Medical Device | Regulator | Current | Class I exemptions |
| FDA: CSA guidance | Regulator guidance | Feb 3, 2026 | Software assurance |
| FDA: CDRH Portal | Regulator | Current | eSTAR dates |
| FDA: Inspection classifications | Regulator | Current | NAI/VAI/OAI |
| FDA: Unannounced foreign inspections | Regulator | May 6, 2025 | Foreign inspections |
| Federal Register: FY2027 device user fees | Regulator | 2026 | Fees |
| MedTech Dive: CDRH workloads | Trade press | Apr 1, 2026 | FDA staffing |
| Hogan Lovells: Device inspections in 2025 | Law firm | 2025 | Warning letter counts |
| RAPS: MDUFA VI draft commitment letter | Professional body | Jul 8, 2026 | MDUFA VI |
| TÜV NORD: EUDAMED mandatory use | Notified body | 2026 | EUDAMED deadlines |
| Emergo by UL: MDR/IVDR revision timing | Consultancy | Oct 9, 2026 | EU reform status |