FDA · United States
In Force February 2, 2026
The Standard Became the Law
21 CFR Part 820 now incorporates ISO 13485:2016 by reference, with
ISO 9000:2015 for terminology. The FDA retired the QSIT inspection technique on the same
day and replaced compliance programs 7382.845 and 7383.001 with 7382.850. There was no
transition period.
So what
If you already hold an ISO 13485 certificate, most of your system already complies. The
gap is in what the FDA deliberately kept outside the standard — the § 820.35 record and
complaint-file duties, labeling, UDI, and the reporting parts — and in an inspection
that now takes a different route through your files.
ISO · International
Published September 16, 2026
Evolutionary, and Still a Three-Year Job
The sixth edition of ISO 9001 keeps the Harmonized Structure and the core requirements.
What is new sits in climate relevance, ethical behavior and quality culture, and it
touches clauses 4 through 10. Certified organizations get three years from publication.
So what
Three years sounds generous until you count audits. September 2029 is two surveillance
visits and one recertification away, and your certification body will want to see a
transition plan well before the last of them. Start at clause 5, where the new
expectations land on top management rather than on the quality manager.
ISO · All MSS
In Force February 2024
One Sentence, Added to Every Standard You Hold
ISO amended clauses 4.1 and 4.2 of every management system standard at once — 9001,
13485, 14001, 45001, 27001, and the rest — so that the relevance of climate change has
to be considered, and the expectations of interested parties about it recorded. It took
effect immediately, with no transition.
So what
This is the cheapest finding to close and one of the most common to be written up for.
It is a paragraph in your context-of-the-organization record, and an auditor can ask for
it at your next surveillance visit whatever standard you are certified to.
EU · MDR
Mandatory May 28, 2026
The Database Stops Being Voluntary
Commission Decision (EU) 2025/2371 makes four EUDAMED modules mandatory — Actor
registration, UDI/Device, Notified Body and Certificates, and Market Surveillance.
Devices already on the market have until November 28, 2026 to be
registered; certificates issued before the switch, until May 28, 2027.
So what
Registration is a data exercise rather than a quality exercise, which is exactly why it
gets underestimated. The work is in making your device data agree across the technical
file, the label, and the UDI record — before any of it is published where a competent
authority can compare the three.
EU · GPSR
Applies December 13, 2024
A Technical File for Products That Never Had One
Regulation (EU) 2023/988 on general product safety applies to non-food consumer
products, repealing Directive 2001/95/EC and Directive 87/357/EEC. It asks for an
internal risk analysis, technical documentation, an economic operator established in
the EU, and traceability back through the supply chain.
So what
If you sell a consumer product into the EU and it is neither a medical device nor a toy,
you may need a documented risk file for the first time. The discipline is the one a
device manufacturer already runs under ISO 14971; only the vocabulary is different.
CPSC · United States
Mandatory April 20, 2024
The Toy Standard Moved Under Everyone's Feet
The CPSC's mandatory consumer product safety standard for toys is now
ASTM F963-23. Children's product certificates issued on or after that
date have to cite it, and the third-party testing behind them has to be against it.
So what
The exposure is in the certificate, not the toy. A Children's Product Certificate still
naming F963-17 is a compliance defect on its face, whether or not the product itself
would pass the current edition. Certificates are the first thing a recall investigation
asks for.
IAQG · International
Expected 2026
Aerospace Renumbers Its Standards
The International Aerospace Quality Group is preparing to reissue the standards behind
AS9100, AS9110, AS9120, and AS9145 as a single IA9100 series. It was planned
for 2026 but had not been published by October 2026; a two-to-three-year transition is
expected once it is.
So what
Mostly a document-control exercise: every procedure, form, flowdown clause and
certificate that cites the old numbers has to be reissued. Mostly — but a renumbering
is the one moment when somebody reads all of those procedures again, and finds what
else has drifted since they were written.
FDA · United States
Compliance July 20, 2028
Traceability, Postponed but Not Softened
The Food Traceability Rule under FSMA section 204 now has a compliance date of
July 20, 2028, extended from January 20, 2026. The requirements did not move with the
date: Key Data Elements recorded at Critical Tracking Events, and records produced to
the FDA as an electronic sortable spreadsheet within 24 hours of a request.
So what
The extension bought time for the data plumbing, not for the decision about who owns it.
Firms that run this as an IT project rather than a records-control project with an IT
component tend to discover the difference during the first mock recall.
