What’s Changing in Medical Device Regulations for 2025–2026?
Key Updates from ISO 13485, MDSAP, FDA, and Health Canada
New US Gov administration means new rule and new ways of doing things. Here’s an update from TNext on what that means for Medical Device Manufacturers in Canada and the United States this year and next.
We are facing a rapidly evolving regulatory landscape. Whether you’re preparing for an audit, entering a new market, or reassessing your QMS, these are the updates you need to know for the year ahead.
1. The FDA Is Replacing 21 CFR Part 820 with the QMSR
Effective Date: February 2, 2026
The FDA has finalized the Quality Management System Regulation (QMSR) to replace the long-standing 21 CFR Part 820. This move harmonizes U.S. quality system requirements with ISO 13485:2016, the globally recognized medical device QMS standard.
What This Means for You:
- ISO 13485:2016 will be directly referenced in U.S. law.
- FDA inspections will begin evaluating systems against this new harmonized standard.
- You’ll have until early 2026 to update your systems — but don’t wait!
Next Step: Conduct a gap assessment between your current QMS and ISO 13485:2016.
2. MDSAP Audits Are Getting Tougher
Global Audits for One System
The Medical Device Single Audit Program (MDSAP) continues to be mandatory for Health Canada and accepted by the FDA. While the audit framework itself isn’t changing, regulators are sharpening their focus on:
- Corrective and Preventive Action (CAPA) effectiveness
- Post-Market Surveillance (PMS) documentation
- Cybersecurity and software lifecycle processes
Next Step: Ensure your CAPA, complaint handling, and PMS data are rock-solid and audit ready.
3. Health Canada: Stronger Focus on Digital & Cybersecurity Readiness
Driving Modernization in Compliance
Health Canada continues to require MDSAP certification for Class II, III, and IV devices — and they’re stepping up enforcement in a few key areas:
- Adoption of real-world evidence in clinical evaluations
- Transition to digital-first licensing and incident reporting
- Expectation of cybersecurity risk controls for connected devices
Next Step: Align your documentation and processes with Health Canada’s digital strategy and update your technical files to include cybersecurity risk management.
4. ISO 13485:2016 – No Revision, But New Guidance Is Coming
While no formal revision of ISO 13485:2016 is expected in the near term, the ISO/TC 210 technical committee is developing supplementary guidance documents covering:
- Risk-based QMS integration
- AI and software as medical devices (SaMD)
- Alignment with EU MDR and UDI requirements
Next Step: Monitor updates from ISO/TC 210 and the IMDRF to stay current with implementation best practices.
Summary: What Medical Device Companies Should Be Doing Now
| Regulation | Change | Your Action |
| FDA 820 → QMSR | Aligns with ISO 13485 | Begin gap assessment and training |
| MDSAP | Greater audit scrutiny | Strengthen CAPA & PMS systems |
| Health Canada | Digital & cybersecurity focus | Update processes and documentation |
| ISO 13485 | Guidance updates, not revisions | Monitor ISO/TC 210 communications |
Conclusions:
Now is the perfect time to review your quality management systems, update your SOPs, and get ahead of these changes. Whether you’re in regulatory affairs, quality assurance, or executive leadership, proactive compliance will be your competitive edge in 2025 and beyond.
Have a topic you want to hear about?
Please let us know if you are interested in our upcoming articles:
- Medical Device Regulations & the FDA under Trump 2.0
- Info Sec Global Perspective – SOC 2 vs. GDPR vs. ISO 27001 – Which is best for my business?
- GRC’s – The SME’s Low-Cost alternatives for SOC 1 and SOC 2 Compliance
- 2025/2026 Expected Amendments and Revisions of ISO Standards
- Environmental Regulations 2025 Update
- Pros and Cons of Integrating ISO Systems
- Not All Iso Certificates are Equal: The Quality (and Value) of YOUR ISO Certificate
Or feel free to let us know what you want to hear about. Email us at articles@tnextcomplance.com[MB1]
About TNext Compliance:
TNext Compliance is a Regulatory & Compliance Service providing expertise, guidance, and solutions for Cross-Border, Global, and International Regulatory & Compliance matters to Small-to-Medium-Enterprises for:
| Medical Devices : | MDSAP ISO 13485, Health Canada Regulations US FDA and EU Regulations |
| Quality Management, Health, Safety, and Environment: | ISO 9001 – Quality Management ISO 14001 – Environmental Management ISO 45001- Information Security. |
| Information Security & Privacy: | ISO 27001 – Information Security Management SOC 2 GDPR |
| Financial Controls: | SOC 1 |
For more information, please email us at info@transcendnext.ca, Or visit us at www.transcendnext.ca