Medical device regulatory monitoring: the complete method

A medical device that complies on the day it is CE marked may no longer comply two years later, without anything having changed at the manufacturer. All it takes is a revised harmonised standard, an MDCG document clarifying a requirement, or an export country changing its rules. Regulatory monitoring is how you see it in time. This guide explains what it must cover, how to organise it and how to prove it.

Why regulatory monitoring is mandatory

Monitoring is not an optional good practice. Three texts require it, directly or by consequence:

• MDR Article 10(9): the manufacturer's quality management system must take into account, "adequately and in a timely manner", changes in device design and changes in the harmonised standards or common specifications against which conformity is declared. The IVDR contains the same requirement.
• ISO 13485:2016 requires the organisation to document its role under applicable regulatory requirements (§ 4.1.1) and to determine those that apply to each product (§ 7.2.1).
• MDR Annex I requires devices to take account of the generally acknowledged state of the art. And the state of the art moves with standards and guidance.

In practice, an ISO 13485 auditor or a notified body will sooner or later ask: "How do you know your regulatory requirements are up to date?"

What to monitor

1. EU texts

The Official Journal of the European Union, available on EUR-Lex, publishes regulations, their amendments (such as Regulation (EU) 2023/607 on the MDR transition or Regulation (EU) 2024/1860 on the IVDR and EUDAMED), implementing acts and the decisions publishing references of harmonised standards, such as Implementing Decision (EU) 2026/1231 of June 2026. This is the source that changes the law.

2. MDCG documents

The Medical Device Coordination Group publishes interpretive guidance (software classification, clinical evaluation, vigilance, EUDAMED…). It is not legally binding, but notified bodies and authorities apply it: any deviation must be justified.

3. National authorities

In France: the ANSM (decisions, notices, safety information), Légifrance (decrees and orders of the Public Health Code) and the HAS for reimbursement. Every country where the device is sold has its competent authority.

4. ISO and IEC standards

A revised standard, or a draft standard put to enquiry, signals a change in the state of the art even before publication. Horizontal standards (ISO 13485, ISO 14971, IEC 62304, IEC 62366-1, ISO 10993) and those of your device family come first.

5. Export markets

If the device is sold outside the EU: the FDA in the United States (Federal Register, guidance), the MHRA in the United Kingdom, Health Canada, Swissmedic, the TGA, the PMDA, ANVISA… Each publishes its own rules and timelines.

6. Notified bodies

Your notified body and their European association Team-NB publish positions and practical requirements that weigh directly on your files.

The method in five steps

Step 1 — Define the scope

List your devices, their classes, their families (EMDN), the applicable regulations (MDR, IVDR, AI Act if the device embeds AI), the markets where they are sold and the standards on which their conformity rests. This scope determines everything else.

Step 2 — List and justify sources

For each source: why it is relevant, how often it is checked, and by whom. A "source, frequency, owner" table is enough, provided it is updated whenever the scope changes.

Step 3 — Collect

Subscriptions, RSS feeds, e-mail alerts, website checks… or a platform that centralises sources. The risk is not missing texts, but drowning in them: collection must be filtered on the scope.

Step 4 — Assess and analyse impact

For each publication kept, three questions: does it apply to our devices? What does it require, and by when? What is the impact on the technical documentation, risk management, labelling, clinical evaluation or procedures? Criticality (critical, moderate, information) sets the priority.

Step 5 — Act and keep records

An applicable change triggers an action: document update, change control, action plan, informing the notified body where needed. The decision and the action are recorded in the log, and major changes go to management review.

The monitoring log: what it must contain

The log is the core of the evidence. For each publication kept:

Field	Example
Date identified	18 June 2026
Source and reference	EUR-Lex, Implementing Decision (EU) 2026/1231
Summary	New harmonised standards under the MDR
Applicability	Yes: two standards in our list of standards
Criticality	Moderate
Impact and action	Gap analysis against the new version, update of the list of standards
Owner and deadline	Regulatory affairs manager, 30 September 2026
Status	Closed, evidence linked

A timestamped log, exported regularly and filed in the quality system, directly answers the auditor's question. Our guide on proof of monitoring for ISO 13485 audits details what is expected.

Common mistakes

1. Real monitoring that is not recorded: impossible to prove in an audit.
2. Incomplete sources: following the national authority but not the EU Official Journal, or ignoring an export market.
3. No impact analysis: the publication is logged without saying what it changes.
4. Monitoring that depends on one person: it vanishes with a departure or an absence.
5. A frozen scope: a new device or market adds sources.

Manual, outsourced or tool-based?

• Manual monitoring: subscriptions and a spreadsheet. Cheap in money, costly in time, and fragile as the scope grows.
• Monitoring outsourced to a consultancy: useful for expert analysis, often less responsive on the daily flow.
• Specialised platform: automatic collection, filtering on the scope, timestamped log. This is what MedQara does, the medical device regulatory monitoring platform: 64 sources monitored, including 49 official authorities and institutions, criticality ranking, and a timestamped PDF export ready for the quality system.

Whatever the approach, the rule is the same: monitoring is only worth its records.

To follow texts as they come out, see also our medical device regulatory news page, which gathers the official texts of the last 60 days.