Medical Device Standards and Regulations: FDA, EU MDR and India

First Separate Law, Authority, Standards and Guidance

These sources are related, but they are not interchangeable. A regulation can impose a binding duty. A regulator or competent authority administers that framework. A consensus standard supplies technical requirements or methods. Guidance usually describes a recommended interpretation and is commonly nonbinding. A notified body assesses conformity for relevant EU devices but is not the European equivalent of FDA.

The Core Medical Device Standards Stack

The three standards below answer different questions. They should operate as one controlled system, not as three detached reports.

ISO 13485:2016 — quality-management control

The ISO catalog record for ISO 13485:2016 identifies Edition 3 as current and states that it was reviewed and confirmed in 2025. It governs the quality-management system used to control design and development, suppliers, production, documents, records, nonconformity, CAPA and changes. For biological safety, its practical role is to preserve an authoritative device and material definition and to make sure evidence is reviewed, approved and revised under control.

A biological evaluation cannot remain reliable if the QMS cannot show which formulation, supplier, cleaning process, packaging system or sterilization condition the evidence represents. The detailed operational handoffs are covered in ISO 13485 and biological evaluation.

ISO 14971:2019 — risk-management logic

The ISO catalog record for ISO 14971:2019 identifies Edition 3 as current and states that it was reviewed and confirmed in 2025. It provides the process for identifying hazards, estimating and evaluating risks, implementing and verifying risk controls, evaluating residual risk, reviewing benefit-risk where applicable, and using production and post-production information.

Biological risks belong inside this device risk-management process. Material selection, processing controls, chemical characterization, toxicological assessment and biological testing may all inform risk-control or residual-risk decisions. The biological evaluation should therefore connect to the risk-management file rather than merely sit beside it. See the focused guide to ISO 14971 and ISO 10993 integration.

ISO 10993-1:2025 — biological safety within risk management

ISO 10993-1:2025 is Edition 6, published in November 2025. It sets requirements and general principles for evaluating biological safety within a risk-management process. The evaluation must be grounded in the defined device, nature and duration of body contact, materials and manufacturing information, exposure, available evidence, biological hazards, uncertainty, remaining gaps and lifecycle changes.

ISO 10993-1 is the governing part of a broader series; it is not a universal test checklist. Relevant parts address matters such as sample preparation, chemical characterization, toxicological risk assessment and particular biological effects. Device-specific standards can also change the route—for example, standards addressing breathing-gas pathways or dentistry. Use the ISO 10993 biological evaluation strategy guide for the deeper evidence workflow.

How the Core Stack Hands Evidence Forward

A reviewer should be able to follow the same device configuration across these layers. The documents may have different owners, but their factual basis and change state must agree.

• ISO 13485 establishes control: approved specifications, supplier and process records, design outputs, verification evidence, document versions and change decisions define the device being evaluated.
• ISO 14971 establishes the risk chain: hazards, sequences of events, hazardous situations, risk controls and residual-risk conclusions identify what the evidence must support.
• ISO 10993 establishes biological evaluation: contact, exposure, material and process information, existing data, chemistry, toxicology and testing are evaluated against the biological hazards.
• The market file translates the conclusion: FDA, EU and India dossiers present or cross-reference the evidence according to the applicable route, terminology and source status.
• Post-market and change information close the loop: complaints, vigilance, manufacturing trends, literature and design changes can trigger reassessment across every layer.

United States: FDA QMSR, Guidance and Recognition Records

FDA's Quality Management System Regulation became effective on February 2, 2026. The revised 21 CFR Part 820 incorporates ISO 13485:2016 by reference, together with Clause 3 of ISO 9000:2015. The FD&C Act and FDA-specific regulatory provisions still control where there is a conflict. A standards register should therefore identify both the incorporated ISO source and the additional U.S. requirements, rather than equating ISO 13485 certification with complete FDA compliance.

For biological safety, FDA's final ISO 10993-1 guidance was issued in September 2023. It addresses PMA, HDE, IDE, 510(k) and De Novo submissions for devices with direct or indirect body contact. It remains a guidance document, and its general recommendations must be read alongside product-specific guidance, special controls and the current recognition database.

FDA recognition of ISO 10993-1:2025 is partial

FDA entered Recognition 2-313 for ISO 10993-1:2025 on May 25, 2026. The record identifies partial recognition, excludes specified text in Clause 6.5.11.3 and Clause 6.9, and contains implementation notes, including a potential mismatch for additional genotoxicity evaluation in some prolonged-contact situations. FDA recommends contacting the relevant review office about identified implementation questions before beginning an evaluation.

The same record states that FDA will accept declarations of conformity to the 2018 edition during a transition period until July 1, 2029. This does not make the editions interchangeable. The team should record which edition supports the submission, whether a declaration of conformity is being used, the extent of FDA recognition, and how any exclusion or difference is addressed. For practical presentation issues, see FDA biocompatibility expectations in 2026.

European Union: MDR Duties and Harmonised-Standard Status

Regulation (EU) 2017/745 is the legal framework. Annex I contains the general safety and performance requirements, including risk management and Section 10 on chemical, physical and biological properties. Annex II requires technical documentation to be clear, organised, readily searchable and unambiguous. Annex III addresses post-market surveillance documentation, while clinical evaluation and PMCF are governed through Article 61 and Annex XIV.

Under MDR Article 8, conformity with the relevant parts of a harmonised standard whose reference is published in the Official Journal provides presumption of conformity only for the requirements covered by that citation. Use remains generally voluntary. The manufacturer may use another justified method, but must still demonstrate conformity with the law.

The European Commission harmonised-standards page is the appropriate current-status starting point. As checked on August 9, 2026, it listed several 2026 amendments to the MDR decision, including Commission Implementing Decision (EU) 2026/1231. Do not infer that the newest international ISO edition is harmonised in Europe; verify the cited EN edition, date, amendments and precise scope in the live OJEU record.

MEDDEV 2.7/1 Rev.4 should not appear in a standards register as an MDR standard. It is legacy clinical-evaluation guidance from the Directives era. The MDR text is the legal anchor, supplemented by applicable current MDCG guidance. The Commission's background note to MDCG 2020-6 identifies particular MEDDEV sections that remain relevant when applying that guidance to legacy devices; that limited relationship should not be broadened into a universal MDR requirement. For the biological-safety evidence chain, see EU MDR Annex I GSPR 10.

India: Medical Devices Rules, 2017 and CDSCO Context

India's Medical Devices Rules, 2017 are the legal starting point. They establish device classification, licensing and import or manufacturing routes, quality and dossier requirements, and responsibilities that vary by class and activity. CDSCO and the Central Licensing Authority have central functions, while State Licensing Authorities retain functions for relevant routes. “CDSCO requirement” should therefore not be used as a substitute for identifying the actual authority and rule applicable to the device.

The official CDSCO Medical Devices Rules page lists the Rules and amendments. The device-specific register should also check current CDSCO classifications, notices, guidance, licence route and dossier schedule. Where standards support safety or performance, record the applicable Indian standard and any ISO or IEC source relied on; do not copy FDA recognition or EU harmonisation status into the India column.

For patient-contacting devices, the scientific core may still draw on the applicable ISO 10993 evidence, but the dossier must be organized for the India route. Device description, materials, physical and chemical information, biological or toxicological evidence, risk documentation and test reports should agree. The CDSCO biocompatibility expectations guide explains this focused documentation question, while CDSCO vs FDA vs EU MDR shows where a shared scientific core needs different market-facing framing.

Broader Standards Should Be Selected by Device Need

ISO 13485, ISO 14971 and ISO 10993 are not a complete list for every device. Build outward from the intended purpose, technology, energy source, materials, sterility state, packaging, software functions, user interface, patient population and target markets. Typical families to screen include:

• Electrical safety and electromagnetic compatibility: the applicable IEC 60601 general, collateral and particular standards.
• Software and cybersecurity: IEC 62304, IEC 81001-5-1 and current jurisdiction-specific cybersecurity requirements and guidance.
• Usability engineering: IEC 62366-1 and any connected risk, labelling and human-factors expectations.
• Sterilization and microbiological control: standards such as ISO 11135, ISO 11137, ISO 17665 and ISO 11737, selected for the process and product.
• Sterile-barrier packaging: the ISO 11607 series, together with relevant transport, ageing and package-test methods.
• Clinical investigation: ISO 14155 alongside the binding jurisdictional clinical-investigation rules.
• Information supplied and symbols: ISO 20417 and ISO 15223-1, adapted to market-specific labelling law.
• Technology-specific biological safety: sources such as the ISO 18562 series for breathing-gas pathways or ISO 7405 for dentistry where applicable.

These are screening examples, not an automatic compliance list. The current edition, amendments, national adoption, transition, device scope and market status must be verified before inclusion.

Build an Applicable-Standards Register That Can Be Audited

A useful register is a decision record, not a bibliography. Give every entry an owner and enough context for another qualified reviewer to understand the inclusion, exclusion and evidence route.

• Define scope first: device family, intended purpose, variants, accessories, software, sterility, patient contact, markets and submission route.
• Identify the legal basis: cite the applicable regulation, rule, classification provision, special control, common specification or other binding source.
• Record the complete designation: standard number, title, edition, amendments, corrigenda and adopted national or European prefix where relevant.
• Record market status separately: incorporated, FDA-recognised and extent, EU harmonised and covered requirements, applicable Indian standard, contractual use or justified state-of-the-art use.
• Capture limitations: exclusions, transition dates, product-specific conflicts, deviations and the rationale for any alternative method.
• Map evidence: test report, procedure, risk control, design output, declaration, certificate or technical-document location that supports the claim.
• Control maintenance: owner, approval, last source check, next scheduled review and event triggers such as a design change, new guidance or standards revision.

For multi-market use, keep one controlled register with jurisdiction-specific columns rather than three unsynchronised lists. The scientific evidence can be shared where appropriate, while legal status and submission use remain explicit for each market.

Lifecycle Example: A Polymer-Supplier Formulation Change

Consider a supplier notification stating that a patient-contacting polymer retains the same commercial grade name but has a modified additive package. The change cannot be closed merely because the drawing and part number are unchanged.

1. Quality-system control: supplier and change-control procedures capture the notification, affected lots, implementation date, specifications, certificates and verification plan.
2. Device definition: the team determines which configurations, manufacturing steps, sterilization cycles and patient-contacting components are affected.
3. Risk management: the ISO 14971 process evaluates whether new or changed constituents, residuals, degradation behaviour or exposure can alter biological hazards or existing controls.
4. Biological evaluation: the ISO 10993 assessment reviews material information, comparability, chemistry, toxicology, existing tests and uncertainty to decide whether the current conclusion remains supported or additional evidence is needed.
5. Market assessment: FDA, EU and India records are reviewed separately for submission, notification, technical-documentation or licence implications; one market's conclusion is not assumed to decide the others.
6. Controlled closure: approvals, updated reports, evidence locations and post-market monitoring are recorded before the change is treated as implemented for the affected device.

The same logic applies to new colorants, cleaning agents, mould-release agents, packaging contact, manufacturing sites, reprocessing instructions and sterilization conditions. See material changes that trigger biological re-evaluation for the focused decision process.

Final Review Before Claiming a Standard Applies

• The device, variants, accessories, intended purpose and markets are clearly defined.
• The legal requirement is distinguished from the technical method used to meet it.
• The exact edition, amendment and transition position have been verified from a controlled source.
• FDA recognition, EU harmonisation and India applicability are recorded independently.
• Partial recognition, OJEU scope, product-specific guidance and justified deviations are visible.
• Every conformity statement points to controlled evidence for the current device state.
• Change control and post-market inputs have defined reassessment triggers.
• The register has an owner, approval, source-check date and scheduled review interval.

Frequently Asked Questions