In 2026, medical device and IVD manufacturers are navigating a moving-target regulatory landscape. In the EU, MDR/IVDR implementation continues while EUDAMED enters a mandatory-use phase. In the U.S., FDA’s Quality Management System Regulation (QMSR) is now in effect, aligning 21 CFR Part 820 more closely with ISO 13485. Across both regions, regulators are raising expectations for software and AI evidence, cybersecurity, and post-market surveillance. Below is a practical outlook on what is changing…and what actions manufacturers should take.
EU MDR/IVDR: Transitional deadlines and EUDAMED ramp-up
The MDR transitional extension gives many legacy devices additional time on the EU market (typically until 31 December 2027 or 31 December 2028), but only if specific conditions are met, such as timely notified body engagement, no significant design changes, and an MDR-compliant QMS in place. For 2026 planning, the more significant operational shift is EUDAMED. The European Commission has declared the first four modules functional, triggering mandatory use from 28 May 2026 for actor registration, UDI and device registration, notified bodies and certificates, and market surveillance.
Compliance considerations:
Reconfirm your device portfolio transition plan and document continued eligibility for transitional extensions.
Ensure technical documentation traceability from intended purpose through GSPR, clinical or performance evaluation, and PMS/PMCF.
Prepare for mandatory EUDAMED use by assigning data ownership, defining governance procedures, and testing data submissions in advance.
U.S. FDA: QMSR now in effect
The FDA Quality Management System Regulation (QMSR) became effective on 2 February 2026. It incorporates ISO 13485:2016 by reference while retaining FDA-specific regulatory requirements. In practice, manufacturers must ensure their QMS procedures, records, and internal audits demonstrate ISO-aligned processes and clearly address FDA expectations during inspections.
Compliance considerations:
Perform a QMSR / ISO 13485 gap assessment and convert findings into a structured remediation plan.
Update the internal audit program to reflect process-based auditing, including supplier controls, design controls, risk management, and CAPA effectiveness.
Review inspection readiness documentation, including DHF, DMR, complaint handling, CAPA, and management review records.
Software and AI: Higher expectations for lifecycle evidence
Regulators increasingly treat software and AI/ML functions as core safety and performance elements rather than add-ons. In the EU, the EU AI Act introduces phased obligations for high-risk AI systems, with initial requirements applying from August 2026. These add governance, transparency, and lifecycle controls on top of MDR/IVDR. In the U.S., FDA continues refining expectations for SaMD, clinical decision support, data integrity, and validation evidence.
Compliance considerations:
Classify software functions early and map evidence requirements for usability, verification and validation, clinical performance, and cybersecurity.
Strengthen AI governance, including data representativeness, bias monitoring, controlled model updates, and risk-based explainability.
Maintain clear traceability linking hazards, software requirements, tests, and residual risk.
Cybersecurity: Security by design as a regulatory baseline
For connected medical devices, cybersecurity is now expected as objective regulatory evidence. In the U.S., FD&C Act Section 524B requires cybersecurity information, including a Software Bill of Materials (SBOM), in premarket submissions for cyber devices. In the EU, MDR/IVDR guidance increasingly expects a secure development lifecycle, threat modeling, and post-market security maintenance.
Compliance considerations:
Maintain an up-to-date SBOM and a defined vulnerability management and disclosure process.
Apply threat modeling linked to risk controls and verification activities such as penetration testing and secure update validation.
Align labeling and IFU content with the device’s security posture and supported configurations.
Post-Market Surveillance: Closing the regulatory feedback loop
Both EU and U.S. regulators expect active post-market surveillance with a clear feedback loop into risk management and CAPA. In the EU, PMS, PMCF, and vigilance timelines must be reflected in procedures and KPIs. In the U.S., complaint handling and MDR reporting remain core FDA inspection topics, particularly for software changes and cybersecurity events.
Compliance considerations:
Define PMS KPIs that trigger management action and escalation.
Implement a closed-loop process from PMS signals to risk file updates, CAPA, and effectiveness verification.
Maintain a concise PMS audit evidence set, including PSURs, PMCF outputs, trend analyses, and documented decisions.
Conclusion
In 2026, MedTech manufacturers that approach compliance as an engineering discipline are best positioned for success. A focused roadmap covering EUDAMED readiness, QMSR alignment, software and AI lifecycle control, and cybersecurity-driven post-market surveillance reduces regulatory friction and strengthens trust with authorities.
At D.med Technologies, we work closely with medical device and IVD manufacturers to translate evolving regulatory requirements into practical, audit-ready implementations. From MDR/IVDR transition support and EUDAMED data readiness, to QMSR and ISO 13485 alignment, software and AI validation, and cybersecurity and PMS integration, our teams support both compliance and long-term product scalability.
If you are preparing for upcoming regulatory milestones in 2026 and beyond, now is the right time to assess gaps and define a realistic execution roadmap.
Get in touch with D.med Technologies to discuss your regulatory and technical readiness.
Antonios is a Senior Quality & Regulatory Affairs Manager, an accomplished expert in quality management and regulatory compliance regarding development and production of medical devices with over 20 years of experience supporting startups, SMEs and multinational manufacturers.
Antonios specializes in ISO 13485, MDR, and FDA regulations, guiding organizations in the development and implementation of robust quality management systems. Acknowledging Regulatory requirements in a fast paced global environment. His hands-on approach and in-depth knowledge of technical documentation, risk management, software lifecycle management, usability engineering and clinical evaluation ensure that innovations are brought to market efficiently and in full compliance with global standards.
Dedicated to delivering sustainable outcomes, he works closely with partners to enable secure international market access with confidence.