Global medical device regulations
- United States of America: Food and Drug Administration (FDA), FDA Medical Devices regulates medical devices under the Federal Food, Drug, and Cosmetic Act (FD&C Act), and the Medical Device Amendments of 1976
- European Union: European Medicines Agency (EMA), EMA Medical Devices regulated under the Medical Devices Regulation (MDR) 2017/745 and the In Vitro Diagnostic Medical Devices Regulation (IVDR) 2017/746
- Australia: Therapeutic Goods Administration, TGA Medical Devices regulates medical devices under the Therapeutic Goods Act 1989 and the Therapeutic Goods (Medical Devices) Regulations 2002
- Canada: Health Canada, Health Canada Medical Devices regulates medical devices under the Food and Drugs Act and the Medical Devices Regulations
- Japan: Pharmaceuticals and Medical Devices Agency (PMDA) regulated under the Pharmaceutical Affairs Law (PAL) and the Medical Device Regulations (MDR)
- United Kingdom: Medicines and Healthcare products Regulatory Agency, MHRA Medical Devices oversees medical devices regulation through the Medical Devices Regulations 2002 continuing from the date of separation from the EU
- South Korea: Ministry of Food and Drug Safety, MFDS regulates medical devices under the Medical Devices Act
- China: National Medical Products Administration, NMPA, formerly known as the China Food and Drug Administration (CFDA) regulates medical devices through the State Administration for Market Regulation (SAMR) decrees
- India: Central Drugs Standard Control Organization, CDSCO regulated under the Drugs and Cosmetics Act, 1940, and the Medical Device Rules, 2017
- Brazil: Agência Nacional de Vigilância Sanitária, ANVISA regulates medical devices under Resolução de Diretoria Colegiada (RDC) No. 185/2001 and RDC No. 16/2013
- South Africa: South Africa Health Products Regulatory Authority, SAHPRA regulates medical devices under the Medicines and Related Substances Act, 1965
- ASEAN Medical Device Directive, AMDD is a harmonised medical device regulation applicable across the Southeast Asian Nations (ASEAN) countries (Brunei Darussalam, Cambodia, Indonesia, Lao People’s Democratic Republic, Malaysia, Myanmar, Philippines, Singapore, Thailand, Vietnam)
World Health Organization (WHO) prequalification (WHO-PQ)
The WHO prequalification (WHO-PQ) for in vitro Diagnostics (IVDs) and Male Circumcision Devices (MCDs) is a process through which specific priority medical device products are assessed for their quality, safety, and performance.
The WHO-PQ programme aims to facilitate access to medical devices meeting the 5As criteria, particularly in low-resource settings and during public health emergencies. Medical device manufacturers may apply to the WHO Prequalification Team, which reviews the technical documentation, audits the Quality Management System (QMS), and commissions performance or clinical evaluations of products. The evidence is reviewed by a team of independent experts who evaluate the submitted data and audit reports to ensure that the product meets the WHO’s prequalification criteria prior to listing.
WHO prequalification status provides assurance to countries, procurement agencies, and donors that a product has undergone a thorough evaluation and meets international quality standards. As such, WHO-PQ approval and listing are often required by donors and organisations operating in low and middle-income countries (LMICs). However, only a small number of products are eligible for WHO-PQ as historically, the most focus has been on IVDs for infectious diseases and Male Circumcision Devices (MCDs), which are critical commodities supporting the delivery of priority disease area programmes (HIV/AIDS, Tuberculosis and Malaria). Recently, IVDs for cardiometabolic diseases have become eligible for WHO-PQ. The first digital health product, computer-assisted diagnosis of X-ray medical images, is expected to be included in the WHO-PQ programme in 2024.
What other regulations impact medical devices?
In addition to specific medical device regulations, other regulations and standards can impact medical device production and use. These regulations address general product safety, clinical studies, environmental impact, digital and cybersecurity, and data management. Each section contains a list of examples of relevant legislation in major markets.
Clinical Trials Regulations
Clinical trials regulations encompass legal frameworks that govern the conduct, ethics, and oversight of clinical research involving human participants to ensure safety, efficacy, and ethical standards are upheld.
- Good Clinical Practice (GCP) is an international ethical and scientific quality standard for designing, conducting, recording, and reporting clinical trials involving human subjects.
Europe
- EU Clinical Trials Regulation (EU) No 536/2014: Harmonises clinical trial procedures across EU Member States, introducing a single submission portal and assessment procedure.
United States: -21 CFR Part 312 �" Investigational New Drug Application: Governs the use of investigational new drugs in clinical trials, outlining procedures for submission and review by the FDA.
Canada:
- Food and Drugs Act (RSC, 1985, c. F-27): Establishes the legal framework for drug regulation in Canada, including provisions for clinical trials.
- Guidance Document: Part C, Division 5 of the Food and Drug Regulations: Provides detailed requirements for conducting clinical trials involving human subjects.
United Kingdom:
- The Medicines for Human Use (Clinical Trials) Regulations 2004: Governs the conduct of clinical trials in the UK, implementing EU directives prior to Brexit.
- Clinical Trials Regulations Reform: Outlines upcoming changes to clinical trial regulations in the UK, effective from 28 April 2026.
Australia:
- Australian Clinical Trial Handbook: Provides guidance on legislative, regulatory, and Good Clinical Practice (GCP) requirements for conducting clinical trials in Australia.
- Clinical Trials: Regulates the use of unapproved therapeutic goods in clinical trials to ensure safety and compliance.
China:
- Drug Administration Law of the People’s Republic of China: Regulates the administration of drugs, including provisions for clinical trials.
- Clinical Research Regulation For China: Provides an overview of clinical research regulations in China, including oversight by the National Medical Products Administration (NMPA).
Good Manufacturing Practice (GMP)
Software, Data and Cybersecurity Standards
Standards and regulations that address the use and cybersecurity of technology, ensuring protection against data breaches, misuse and cyber threats. This category also include data management and protection legislation, which govern the processing and protection of personal data, which is especially relevant for medical devices that collect or process patient information.
Europe:
- The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a comprehensive European Union (EU) law that governs the collection, processing, and protection of personal data of individuals within the EU and European Economic Area (EEA).
- The EU AI Act (Regulation (EU) 2024/1689) is a regulatory framework aimed at governing artificial intelligence (AI) systems within the European Union, ensuring they are developed and used in a manner that upholds fundamental rights and societal values.
- The EU Cyber Resilience Act (CRA) is legislation aimed at enhancing cybersecurity resilience across the European Union, focusing on critical sectors such as healthcare, energy, and transport.
U.S.A:
- The Health Insurance Portability and Accountability Act (HIPAA) ensures the protection of patient data and privacy, relevant to medical device manufacturers handling health information.
- HITECH Act strengthens HIPAA enforcement and security standards for health IT.
- The Federal Information Security Modernisation Act (FISMA) is legislation that mandates federal agencies to implement comprehensive cybersecurity programs to protect their information and information systems.
- The NIST Cybersecurity Framework is not mandatory, but often used for device/software cybersecurity best practices.
Canada:
- PIPEDA (Personal Information Protection and Electronic Documents Act) is the federal privacy law for handling personal health information in software.
- There are also Provincial Health Privacy Laws (e.g., Ontario’s PHIPA, Alberta’s HIA), which apply in those provinces. Absolutely! Here’s your content reformatted in the style you requested:
China
- Cybersecurity Law (CSL) & Data Security Law (DSL): These laws establish frameworks for data storage, localization, and security, including health data, emphasising national security and data protection.
- Personal Information Protection Law (PIPL): Regulates the collection, use, and transfer of personal data, including health information, aligning with global data protection standards.
Japan
- Act on the Protection of Personal Information (APPI): Governs the handling of personal data, including health information, with strict consent and data transfer provisions.
- METI Cybersecurity Guidelines: Provide industry standards for cybersecurity in connected medical technologies, including SaMD.
India:
- Digital Information Security in Healthcare Act (DISHA) (Proposed): Aims to standardize and regulate the collection, storage, transmission, and use of digital health data, ensuring privacy and security.
- Information Technology Act, 2000: Provides a legal framework for electronic records, cybersecurity, and sensitive personal data protection.
Singapore
Health Products Act & HSA SaMD Guidance: Regulate medical software under the Health Sciences Authority, including classification and compliance requirements.
Personal Data Protection Act (PDPA): Governs the collection, use, and disclosure of personal data, including health information, ensuring data protection standards.
Cybersecurity Act (2018): Establishes a framework for the protection of critical information infrastructure, including healthcare systems.
U.K.: The UK Online Safety Bill is legislation designed to establish a regulatory framework aimed at tackling harmful content and behaviours online, ensuring digital platforms take responsibility for user safety. Although not directly related to medical devices, some digital health applications with social or communication features could fall under the scope of the Act.
Environmental Regulations
Compliance with environmental regulations or national laws concerning environmental impact assessments may be required to manufacture and dispose of medical devices.
Examples:
- The European Green Deal is a comprehensive plan by the European Union to achieve climate neutrality by 2050 while promoting sustainable growth and reducing greenhouse gas emissions.
- WEEE Directive (Waste Electrical and Electronic Equipment) mandates the proper disposal and recycling of electronic devices, including medical devices.
- Packaging and Packaging Waste Directive (94/62/EC)
- Canadian Environmental Protection Act (CEPA) is federal legislation in Canada aimed at protecting the environment and human health by regulating pollutants and substances that pose risks to these areas.
Hazardous Substance Regulations
Hazardous substance regulations in the context of medical devices are laws and standards that restrict or control the use of certain chemicals and materials that may pose risks to human health or the environment during manufacture, use, or disposal of devices. These rules often limit substances such as lead, mercury, cadmium, phthalates, and certain flame retardants, and they may require manufacturers to declare or substitute safer alternatives.
Examples:
- RoHS Directive (Restriction of Hazardous Substances) (Directive 2011/65/EU) limits the use of certain hazardous substances in electrical and electronic equipment, including medical devices.
- REACH Regulation (Registration, Evaluation, Authorisation, and Restriction of Chemicals) (Regulation (EC) No 1907/2006) controls the use of chemical substances in manufacturing, ensuring safety and environmental protection.
- Biocidal Products Regulation (BPR) regulates biocidal products used to protect medical devices, ensuring they do not pose risks to human health or the environment.
- Regulation 2019/1021 on Persistent Organic Pollutants
- China RoHS for restriction of hazardous substances.
Electronics Regulations
Electronics regulations in the context of medical devices ensure that devices using electrical or electronic components are safe, reliable, and do not pose risks such as electrical shock, fire, electromagnetic interference, or software/hardware malfunctions. These regulations typically cover electrical safety, electromagnetic compatibility (EMC), radiofrequency use, and environmental compliance.
Examples:
- Radio regultions such as the Radio Equipment Directive (2014/53/EU) applies to devices with wireless communication and requires additional EMC testing and product information including wireless frequency specifications. Most countries have a national radio policy that is managed by a communications, ICT or innovation ministry or department.
- Battery Regulation (Proposal COM/2020/798) is relevant for devices with rechargeable or disposable batteries.
Telecommunications Regulations
Telecommunications regulations refer to rules and policies established by governments or regulatory bodies to govern the operation, management, and use of telecommunications networks and services within a country or region. They may be relevant for medical devices that use telecommunications technology. Examples:
- International Telecommunication Union (ITU) Standards
- Federal Communications Commission (FCC) regulations in the U.S.A.
Resources
Free Resources:
Three Golden Rules: The three golden rules you need to know to succeed in the medical device world.
Masterclass: Plan Smarter, Scale Faster: Medical device lifecycle planning
Masterclass: Winning the digital health race: Strategies for market access
Regulations:
Regulators:
- Medical Device Regulatory Authorities
- Notified Bodies
- How to select a Notified Body (NB): An insider’s guide to evaluating NBs.
Regulation: The rules, laws, standards, and requirements set by regulatory authorities to ensure the safety, efficacy, and quality of devices intended for medical use.
Regulatory Authority: An official body overseeing and enforcing laws, regulations, and standards within a specific industry or sector to ensure compliance and protect public interests. Also known as a Regulatory Authority. Also see Competent Authority and Notified Body.
Standard: A document that provides guidance, requirements, or specifications established by regulatory bodies, industry organisations, or international consensus groups.
Stringent Regulatory Authority (SRA): An established governmental agency or body that rigorously evaluates and monitors the safety, efficacy, and quality of medical devices through comprehensive regulatory frameworks and standards. Also see Regulatory Authority.
World Health Organisation (WHO): A specialised agency of the United Nations responsible for international public health.