Our regulatory foundations

The internationally recognized standard for quality management systems in the medical device industry. It defines how a company designs, develops, manufactures, and maintains medical devices in a controlled, documented, and auditable way — covering everything from design controls to corrective actions.

The standard that governs how medical device manufacturers identify, evaluate, and control risks throughout a product's life — from initial design through post-market use. It ensures that every known hazard has been assessed and that residual risks are acceptable relative to the product's benefits.

A software-specific standard that defines the processes required to safely develop and maintain medical device software — including planning, requirements, architecture, testing, and ongoing maintenance. It also governs how third-party and open-source software components are managed within a regulated product.

A newer standard focused specifically on integrating cybersecurity into the software development lifecycle for health software. It addresses how security risks are identified and mitigated alongside safety risks, reflecting the growing importance of protecting connected health technologies.

The standard governing how medical devices and software are designed to be safe and effective for their intended users. It requires structured evaluation of how real users interact with a product, to minimize the risk of use errors that could affect patient safety.

A globally recognized standard for information security management systems (ISMS). It provides a framework for protecting sensitive data — including how organizations assess security risks, implement controls, and continuously improve their security posture.

The European Union's comprehensive data protection law. It governs how personal data — including health data — is collected, processed, stored, and shared, and grants individuals specific rights over their own data.

US federal legislation that sets standards for protecting sensitive patient health information. It governs how healthcare-related data is handled by covered entities and their business associates in the United States.

The regulatory framework governing the safety, performance, and market approval of medical devices sold in the European Union, including software-based devices (SaMD). It defines classification rules, clinical evidence requirements, and conformity assessment procedures.

The US Food and Drug Administration's requirements for the quality systems used to design and manufacture medical devices sold in the United States. QMSR represents FDA's move toward harmonizing these requirements with the international ISO 13485 standard.

FDA regulation governing the use of electronic records and electronic signatures, ensuring they are trustworthy, reliable, and equivalent to paper records and handwritten signatures within regulated industries.

Guidance developed by the International Medical Device Regulators Forum specifically for Software as a Medical Device (SaMD). It provides a shared international framework for classifying SaMD risk and defining the clinical evidence expected to support its safety and effectiveness.