Regulatory Coverage

40+ regulatory frameworks

From quality management to market access. Every framework structured into requirements, documents, and traceability entities.

Risk Management

Risk analysis and management frameworks

ISO 14971:2019ISO 14971:2019 specifies the terminology, principles, and a process for the risk management of medical devices, including in vitro diagnostic (IVD) medical devices. It provides a framework for manufacturers to identify hazards, estimate and evaluate risks, control risks, and monitor the effectiveness of controls throughout the product lifecycle.

Software

Software lifecycle and validation standards

IEC 62304:2006 - Software life-cycle processesThis international standard defines the lifecycle requirements for medical device software, establishing a structured framework for safe design and maintenance. It mandates specific processes for development, risk management, and configuration control to ensure the software functions reliably within a medical context.IEC 82304-1:2016IEC 82304-1 defines the requirements for the lifecycle of health software products, covering software that is not part of a medical device but is intended for use in healthcare. It addresses the full lifecycle from design and development through maintenance and decommissioning, establishing quality and safety requirements for standalone health software.

Clinical

Clinical investigation and evaluation frameworks

21 CFR Part 812 — Investigational Device Exemptions21 CFR Part 812 governs the conduct of clinical investigations of medical devices in the United States under Investigational Device Exemptions (IDEs). It establishes the procedures and requirements for sponsors and investigators to study devices that have not yet received market clearance or approval, balancing the need for clinical evidence with patient safety protections.ISO 14155:2020ISO 14155:2020 specifies the requirements for the design, conduct, recording, and reporting of clinical investigations carried out to assess the safety and performance of medical devices in human subjects. It establishes good clinical practice (GCP) principles specific to medical device investigations, ensuring subject protection and data integrity.

EU MDR

European Medical Device Regulation 2017/745

Technical DocumentationThe EU MDR 2017/745 Technical Documentation requirements define the comprehensive documentation package that manufacturers must compile and maintain for medical devices. This covers Annexes II and III of the regulation, specifying the device description, design and manufacturing information, safety and performance data, benefit-risk analysis, and product verification and validation evidence.Special DevicesThe EU MDR 2017/745 establishes specific provisions for certain categories of medical devices that require additional or adapted requirements beyond the general framework. These include devices incorporating medicinal substances, devices made from tissues or cells of animal origin, implantable devices, devices with a measuring function, and custom-made devices, among others.Registration and UDIThe EU MDR 2017/745 establishes a comprehensive registration and Unique Device Identification (UDI) system for medical devices in the European market. It mandates that manufacturers assign UDI codes to their devices, register in the European database on medical devices (EUDAMED), and maintain traceability from manufacturer through to the end user.PMS and VigilanceThe EU MDR 2017/745 establishes a comprehensive post-market surveillance (PMS) and vigilance system requiring manufacturers to proactively monitor device performance, collect and analyze data from the field, and report serious incidents and field safety corrective actions. These obligations span the entire lifecycle of the device and feed into the ongoing benefit-risk assessment.Market AccessThe EU MDR 2017/745 defines the requirements for placing medical devices on the European market, including conformity assessment procedures, CE marking, and the EU declaration of conformity. It establishes the roles and responsibilities of economic operators, the involvement of notified bodies, and the conditions under which devices may be legally made available on the EU market.General Safety and Performance RequirementsAnnex I of the EU MDR 2017/745 establishes the General Safety and Performance Requirements (GSPRs) that all medical devices must meet. These requirements cover fundamental safety principles, design and manufacturing requirements, information requirements, and specific requirements for particular device types. Compliance with GSPRs is the foundation of the conformity assessment process.Economic OperatorsThe EU MDR 2017/745 defines the obligations of all economic operators in the medical device supply chain, including manufacturers, authorized representatives, importers, and distributors. Each category of economic operator has specific responsibilities to ensure that only compliant devices reach the market and that traceability and regulatory obligations are maintained throughout the distribution chain.Clinical InvestigationThe EU MDR 2017/745 establishes the regulatory framework for conducting clinical investigations of medical devices in the European Union. It defines the requirements for clinical investigation applications, sponsor and investigator obligations, informed consent, ethics committee review, and the reporting of adverse events during investigations, ensuring subject safety and data integrity.Clinical EvaluationThe EU MDR 2017/745 requires manufacturers to conduct and document a clinical evaluation for every medical device, demonstrating conformity with the General Safety and Performance Requirements through clinical evidence. The regulation specifies the clinical evaluation process, including data sources, assessment methodology, and post-market clinical follow-up requirements.ClassificationThe EU MDR 2017/745 establishes the classification system for medical devices based on their intended purpose, inherent risks, and invasiveness. Annex VIII defines the classification rules that assign devices to one of four risk classes (I, IIa, IIb, III), which determines the conformity assessment route, the level of regulatory scrutiny, and the obligations of the manufacturer.

EU IVDR

European In Vitro Diagnostic Regulation 2017/746

Technical DocumentationThe EU IVDR 2017/746 Technical Documentation requirements define the comprehensive documentation package that manufacturers must compile and maintain for in vitro diagnostic (IVD) medical devices. Covering Annexes II and III of the regulation, these requirements specify the device description, design and manufacturing information, safety and performance data, benefit-risk analysis, and product verification and validation evidence specific to IVD devices.Special DevicesThe EU IVDR 2017/746 establishes specific provisions for certain categories of IVD medical devices that require additional or adapted requirements. These include companion diagnostics, devices for self-testing, devices for near-patient testing, and devices manufactured and used within health institutions, each subject to tailored regulatory requirements reflecting their unique risk profiles and use contexts.Registration and UDIThe EU IVDR 2017/746 establishes a comprehensive registration and Unique Device Identification (UDI) system for in vitro diagnostic medical devices in the European market. It mandates that manufacturers assign UDI codes to their IVD devices, register in the European database on medical devices (EUDAMED), and maintain traceability throughout the supply chain.PMS and VigilanceThe EU IVDR 2017/746 establishes a comprehensive post-market surveillance (PMS) and vigilance system requiring IVD device manufacturers to proactively monitor device performance, collect and analyze field data, and report serious incidents and field safety corrective actions. These obligations are continuous throughout the device lifecycle and integrate with post-market performance follow-up activities.Performance StudiesThe EU IVDR 2017/746 establishes the regulatory framework for conducting performance studies of IVD medical devices. It defines the requirements for performance study applications, sponsor and investigator obligations, subject protection, ethics committee review, and the reporting of adverse events and device deficiencies during performance studies conducted to generate clinical evidence.Performance EvaluationThe EU IVDR 2017/746 requires manufacturers to conduct and document a performance evaluation for every IVD medical device, demonstrating conformity with the General Safety and Performance Requirements through scientific validity, analytical performance, and clinical performance evidence. The regulation specifies the performance evaluation process, data sources, and post-market performance follow-up requirements.Market SurveillanceThe EU IVDR 2017/746 establishes the framework for market surveillance of IVD medical devices by competent authorities of EU Member States. It defines the powers, activities, and coordination mechanisms for authorities to monitor compliance of IVD devices on the market, take corrective actions for non-compliant devices, and ensure ongoing safety and performance through proactive and reactive surveillance activities.Market AccessThe EU IVDR 2017/746 defines the requirements for placing IVD medical devices on the European market, including conformity assessment procedures, CE marking, and the EU declaration of conformity. It establishes a risk-based classification system (Classes A, B, C, D) that determines the conformity assessment route, the involvement of notified bodies, and the regulatory obligations of manufacturers.General Safety and Performance RequirementsAnnex I of the EU IVDR 2017/746 establishes the General Safety and Performance Requirements (GSPRs) that all IVD medical devices must meet. These requirements cover fundamental safety principles, design and manufacturing requirements, performance and analytical requirements specific to IVD devices, and information requirements. Compliance with GSPRs is the foundation of the conformity assessment process for IVD devices.Economic OperatorsThe EU IVDR 2017/746 defines the obligations of all economic operators in the IVD medical device supply chain, including manufacturers, authorized representatives, importers, and distributors. Each category of economic operator has specific responsibilities to ensure that only compliant IVD devices reach the market and that traceability and regulatory obligations are maintained throughout the distribution chain.ClassificationThe EU IVDR 2017/746 establishes a risk-based classification system for IVD medical devices across four classes (A, B, C, D), replacing the list-based approach of the former IVD Directive. Annex VIII defines seven classification rules based on the intended purpose of the device, the risks associated with incorrect results, and the impact on individual patients and public health.

Regulatory Submission

Premarket submission and registration requirements

21 CFR Part 807 — Establishment Registration and Device Listing21 CFR Part 807 sets forth the requirements for establishment registration and medical device listing with the FDA. It mandates that manufacturers, importers, and other establishments involved in the production and distribution of medical devices register annually and list their devices, enabling the FDA to maintain an up-to-date inventory of all marketed devices. The part also covers premarket notification (510(k)) submission requirements.21 CFR Part 814 — Premarket Approval of Medical Devices21 CFR Part 814 establishes the requirements for premarket approval (PMA) of Class III medical devices. It describes the process by which manufacturers must demonstrate reasonable assurance of safety and effectiveness before a high-risk device can be legally marketed in the United States, including application content, review procedures, and post-approval requirements.

Labeling

Device labeling and identification standards

21 CFR Part 801 — Labeling21 CFR Part 801 establishes the general labeling requirements for medical devices marketed in the United States. It specifies the information that must appear on device labels and labeling, including intended use, adequate directions for use, and warnings necessary for safe and effective use.21 CFR Part 830 — Unique Device Identification21 CFR Part 830 establishes the system for Unique Device Identification (UDI) of medical devices distributed in the United States. It requires that most medical devices bear a unique identifier on their label and packages, enabling more accurate reporting of adverse events, more efficient device recalls, and better tracking of devices throughout the supply chain.ISO 20417:2021ISO 20417:2021 specifies the requirements for information supplied by the manufacturer with a medical device, including the information on the label, in the instructions for use, and in technical descriptions. It provides a comprehensive framework for determining what information must be communicated and how it should be presented to ensure safe and effective use of the device.

Usability

Usability engineering and human factors standards

IEC 62366-1:2015+A1:2020IEC 62366-1 specifies a process for manufacturers to analyze, specify, develop, and evaluate the usability of medical devices as it relates to safety. The standard provides a framework for applying usability engineering to optimize the user interface of medical devices, reducing use errors that could compromise patient safety or treatment effectiveness.

Cybersecurity

Security requirements for connected medical devices

IEC 62443-4-1:2018IEC 62443-4-1 defines the requirements for a secure product development lifecycle for industrial automation and control systems (IACS) components. It specifies security practices that product suppliers must implement during the design, development, and maintenance of their products to reduce the likelihood of vulnerabilities and ensure defense-in-depth security capabilities.IEC 81001-5-1:2021IEC 81001-5-1 defines the activities and tasks necessary to maintain the security of health software throughout its lifecycle. It provides a comprehensive framework for health software manufacturers to implement security practices from design through decommissioning, covering threat modeling, secure coding, vulnerability management, and incident response specific to the healthcare domain.

Biocompatibility

Biological evaluation standards for medical devices

ISO 10993-1:2018ISO 10993-1:2018 provides a framework for planning the biological evaluation of medical devices within a risk management process. It specifies the general principles governing the biological evaluation of devices that come into direct or indirect contact with the body, guiding manufacturers in determining which biological tests or assessments are necessary based on device characteristics and intended use.ISO 10993-17:2023ISO 10993-17:2023 provides the framework for establishing allowable limits for leachable substances from medical devices using a toxicological risk assessment approach. It specifies the methods for calculating tolerable exposure limits and margins of safety for chemical substances that may be released from medical devices during clinical use.ISO 10993-18:2020ISO 10993-18:2020 specifies a framework for the chemical characterization of medical device materials and the identification and quantification of chemical substances that may be released from medical devices during clinical use. It guides manufacturers in analyzing extractable and leachable compounds as part of the overall biological evaluation process.

Quality

ISO 13485:2016ISO 13485:2016 establishes the criteria for a quality management system specifically tailored to the medical device industry, focusing on safety and efficacy. Its primary objective is to ensure that organizations can consistently provide medical products and related services that satisfy both customer needs and applicable regulatory mandates.21 CFR Part 820 - Quality System RegulationThis mandate outlines the essential quality management protocols that medical device developers must implement to guarantee product safety and efficacy. It governs the entire production lifecycle, ranging from initial design and manufacturing to final installation and servicing.

Don't see your framework?

We're constantly expanding coverage. Let us know what standards matter to your team.