What has changed in the last weeks? Global regulatory developments

Europe 

MDCG revises IVD classification guidance, Rule 7 clarified 

Regulatory update: The Medical Device Coordination Group published Revision 5 of MDCG 2020-16, its guidance on the classification rules for in vitro diagnostic medical devices under the IVDR, in September 2026. 

Coverage: The revision updates the rationale and revises the examples provided for Rule 7, one of the classification rules most frequently subject to notified body queries. 

Potential impact: Manufacturers whose IVDs approach this classification boundary should review the revised examples against their device's intended purpose, as an altered reading of Rule 7 may affect the applicable conformity assessment route. Read the full document here

Cyber Resilience Act reporting obligations now in force 

Regulatory update: From 11 September 2026, manufacturers of products with digital elements became subject to mandatory reporting obligations under the Cyber Resilience Act (Regulation (EU) 2024/2847). 

Coverage: Actively exploited vulnerabilities and severe incidents must be reported through the CRA Single Reporting Platform, coordinated in Germany by CERT-Bund within the Federal Office for Information Security (BSI), within a 24-hour early warning window, a 72-hour follow-up report, and a final report within 14 days. 

Potential impact: This obligation applies with immediate effect, well ahead of the CRA's full compliance requirements in December 2027, and may extend to companion apps and cloud portals connected to a medical device, even where the device itself falls outside the CRA's scope under its medical device exemption. Read the full document here

Americas 

FDA reissues its human factors and usability guidance 

Regulatory update: On 3 August 2026, the FDA reissued its guidance, "Applying Human Factors and Usability Engineering to Medical Devices," superseding the version originally issued on 3 February 2016. 

Coverage: The revision updates the guidance's definitions and revises Section 9 (Documentation) for consistency with FDA's separate guidance on the "Content of Human Factors Information in Medical Device Marketing Submissions," and removes the previous Appendix A. 

Potential impact: Manufacturers preparing a US submission that includes human factors evidence should ensure their documentation reflects the current Section 9 requirements rather than those of the 2016 version. Read the full document here

ANVISA publishes two new regularisation manuals 

Regulatory update: On 25 August 2026, Brazil's health regulatory agency, ANVISA, published two orientative manuals for manufacturers, importers and legal representatives. 

Coverage: One manual addresses the regularisation of in vitro diagnostic medical devices under RDC 830/2023; the other addresses the notification regime for Class I and Class II health-use materials under RDC 751/2022. 

Potential impact: Both manuals are intended to standardise the preparation of petitions, which should reduce the technical queries and refusals that inconsistent submissions tend to generate. Read the full document here

Asia-Pacific 

HSA revises its cybersecurity guidance for devices 

Regulatory update: Singapore's Health Sciences Authority updated its Best Practices Guide on Medical Device Cybersecurity (GL-10-R1) in August 2026. 

Coverage: The revised guidance reflects HSA's current expectations for how manufacturers manage device cybersecurity across the full product lifecycle, from design through post-market monitoring. 

Potential impact: Manufacturers supplying the Singapore market should regard this as the prevailing standard against which their device's cybersecurity practices will be assessed. Read the full document here

HSA's product registration guidance reaches Revision 15 

Regulatory update: HSA's core guidance on medical device product registration, GN-15, has undergone two further revisions since March 2026: Revision 14, effective 14 September 2026, and Revision 15, effective 1 October 2026. 

Coverage: Revision 14 introduced a declaration on device labelling, adverse events and field safety corrective actions (Annex 4) across Class B, C and D registration routes. Revision 15 introduces a further documentary requirement, a Premarket Submission Checklist. 

Potential impact: Applicants preparing a Singapore registration dossier should confirm they are working from Revision 15, rather than an earlier version, to avoid a submission being returned for incomplete documentation. Read the full document here

TGA clarifies how manufacturers must demonstrate evidence against the Essential Principles 

Regulatory update: Australia's Therapeutic Goods Administration retitled its guidance from "Demonstrating compliance with" to "Demonstrating evidence to comply with" the Essential Principles, as part of its transition to a standardisedguidance format. 

Coverage: The guidance confirms that manufacturers are responsible for generating, collating, assessing and maintaining scientific and engineering evidence demonstrating that their devices meet the Essential Principles, and that such evidence must be relevant to the device's intended purpose and be objective, sufficient and robust. 

Potential impact: As the regulatory framework does not prescribe a specific method for demonstrating compliance, manufacturers retain flexibility in constructing their evidence file as device technology continues to evolve. Read the full document here

TGA sets out what counts as prominently displayed advertising information 

Regulatory update: TGA guidance addresses Parts 4 and 5 of the Therapeutic Goods Advertising Code, and the TGA is separately proposing changes to strengthen these requirements through an Advertising Code consultation, with the outcome not yet published. 

Coverage: The guidance sets out what information must be prominently displayed or communicated in advertisements for therapeutic goods, including medical devices; the consultation proposes reinstating an explicit "stand out" requirement and introducing new disclosure rules for software as a medical device and AI. 

Potential impact: Manufacturers advertising a device in Australia should be familiar with the current requirement and monitor the consultation outcome, which may tighten what constitutes "prominent" in practice. Read the full document here

TGA's clinical evidence guidelines set the evidence bar for devices and IVDs 

Regulatory update: The TGA maintains clinical evidence guidelines for medical devices, including in vitro diagnostics, developed in consultation with stakeholders and aligned with international frameworks including GHTF, IMDRF, EU MEDDEV and MDCG documents. 

Coverage: The guidelines set out what constitutes acceptable clinical evidence by device type and risk classification, including circumstances in which substantial equivalence to a predicate device is sufficient, and serve both industry in preparing evidence and regulators in assessing it. 

Potential impact: Reviewing a device against these guidelines prior to finalising an evidence package can help pre-empt a submission being challenged for insufficient or inappropriate evidence. Read the full document here

TGA explains how it selects device applications for compliance audits 

Regulatory update: TGA guidance sets out the four criteria by which the agency selects medical device applications for non-mandatory compliance audits. 

Coverage: Certain high-risk device categories are subject to mandatory audit, while other applications are assessed against the four risk-based criteria, including the kinds of devices subject to recent regulatory reforms, such as software and AI-enabled devices. 

Potential impact: A clear understanding of these criteria in advance can help manufacturers anticipate which aspects of an application are likely to attract closer scrutiny, and prepare accordingly. Read the full document here

IMDRF 

IMDRF finalises global principles for software change plans 

Regulatory update: On 6 August 2026, IMDRF's Software as a Medical Device Working Group published IMDRF/SaMD WG/N90 FINAL: 2026, "Essential Principles and Content of Predetermined Change Control Plans" (PCCPs). 

Coverage: A PCCP enables a manufacturer to obtain authorisation for certain planned software changes in advance, such that their subsequent implementation does not require a further regulatory submission, provided the changes remain within the device's original intended use. The document identifies five essential principles for a robust PCCP (focused and bounded, risk-based, evidence-based, transparent, and developed from a Total Product Lifecycle perspective) together with the three elements a PCCP should comprise (a Description of Changes, a Change Plan, and an Impact Assessment). 

Potential impact: As non-binding guidance intended to support international convergence, this document does not itself impose new requirements, and not all jurisdictions currently accept PCCPs; manufacturers of AI or ML-enabled software should therefore treat it as an indication of the direction regulatory thinking is taking, rather than an obligation in force today. Read the full document here