Regulation timeline
When the key MedTech laws, rules and standards took effect, from 1972 to the deadlines still ahead. Each milestone links to its term page for the full definition and primary sources.
1970s
- US
Anti-Kickback Statute enacted
The Social Security Amendments of 1972 made it a crime to pay or receive anything of value to induce referrals of federally funded business.
- US
Medical Device Amendments signed
Expanded FDA authority over medical devices, established three risk classes and the premarket notification and approval framework.
Official sourceSource checked:
1980s
- US
IDE regulation takes effect
21 CFR Part 812 set the rules for investigational device exemptions, letting unapproved devices be used in clinical studies.
- US
CLIA '88 signed
The Clinical Laboratory Improvement Amendments established federal quality standards for laboratories testing human specimens for diagnosis, prevention or treatment; research-only testing is outside that clinical scope.
Official sourceSource checked:
- US
Stark Law enacted
The Ethics in Patient Referrals Act barred physician self-referral for Medicare-covered services, later expanded in 1993.
1990s
- US
Safe Medical Devices Act signed
Added device user reporting, postmarket surveillance authority and the Humanitarian Device Exemption.
- US
HIPAA signed
The Health Insurance Portability and Accountability Act laid the base for federal privacy and security rules for health data.
- US
Quality System Regulation takes effect
21 CFR Part 820 added design controls to device good manufacturing practice requirements.
- US
FDAMA creates De Novo
The FDA Modernization Act created the De Novo route for novel low to moderate risk devices with no predicate.
Official sourceSource checked:
2000s
- US
First device user fees (MDUFMA)
The Medical Device User Fee and Modernization Act introduced user fees tied to FDA review performance goals, renewed every five years.
- International
IEC 62304 published
First edition of the software life cycle standard for medical device software.
Official sourceSource checked:
- US
HITECH Act signed
Strengthened HIPAA enforcement and introduced breach notification duties for health data.
Official sourceSource checked:
2010s
- US
Physician Payments Sunshine Act
Passed within the Affordable Care Act, requiring manufacturers to report payments to physicians and teaching hospitals.
- US
UDI final rule published
FDA required unique device identifiers on labels and GUDID submissions, phased in by device class.
Official sourceSource checked:
- US
NIST Cybersecurity Framework 1.0
A voluntary framework for managing cybersecurity risk, widely used by manufacturers and hospitals. Version 2.0 followed in February 2024.
Official sourceSource checked:
- International
ISO 13485:2016 published
The current edition of the medical device quality management system standard.
Official sourceSource checked:
- US
21st Century Cures Act signed
Codified the Breakthrough Devices Program and clarified which software functions are not devices.
- EU
MDR and IVDR enter into force
Regulations (EU) 2017/745 and 2017/746 replaced the device directives, with multi-year transition periods and EUDAMED.
Official sourceSource checked:
- International
Health Canada requires MDSAP
Health Canada transitioned quality-system evidence for Class II, III and IV medical device licences to MDSAP; Class I devices do not require a medical device licence.
Official sourceSource checked:
- International
ISO 14971:2019 published
Third edition of the risk management standard for medical devices.
Official sourceSource checked:
2020s
- EU
EU MDR date of application
The MDR became generally applicable, including Article 117 for drug-device combinations, with separate conditional transition periods for eligible legacy devices.
Official sourceSource checked:
- International
IEC 81001-5-1 published
Security activities for the health software product life cycle, now a key reference for device cybersecurity.
Official sourceSource checked:
- EU
EU IVDR date of application
The IVDR became applicable, with staggered transition deadlines by risk class.
Official sourceSource checked:
- EU
MDR transition extended
Regulation (EU) 2023/607 extended MDR transition periods for legacy devices to 2027 or 2028, depending on class.
Official sourceSource checked:
- US
Section 524B cyber requirements apply
Under FDORA, submissions for cyber devices must include a cybersecurity plan, design controls and an SBOM.
Official sourceSource checked:
- US
eSTAR required for 510(k)s
FDA began requiring 510(k) submissions in the electronic eSTAR format.
- EU
EU AI Act enters into force
Regulation (EU) 2024/1689 set risk-based rules for AI, with obligations phased in over several years.
- US
TCET final notice published and effective
CMS published its final TCET procedural notice, effective the same day, for certain eligible FDA-designated Breakthrough Devices. The pathway was announced on August 7, 2024.
CMS final TCET noticeSource checked:
- US
Initial final PCCP guidance for AI devices
FDA issued its initial final AI-enabled device PCCP guidance, subsequently updated on August 18, 2025. Guidance recommendations are nonbinding.
FDA PCCP guidance: original and revised issue datesSource checked:
- US
Court vacates FDA LDT rule
A federal court set aside FDA's rule that would have regulated laboratory-developed tests as devices.
Official sourceSource checked:
- UK
UK post-market surveillance rules apply
Strengthened Part 4A PMS requirements apply to individual devices placed on the market or put into service in Great Britain from June 16, 2025, including CE- and UKCA-marked devices, subject to exclusions. Earlier individual devices remain under prior rules; Northern Ireland follows EU rules.
Official sourceSource checked:
- US
FDA updates AI device PCCP guidance
FDA issued updated final recommendations for predetermined change control plans for AI-enabled device software functions, replacing the December 4, 2024 version. This is guidance issuance, not a new statutory effective date.
FDA updated PCCP guidanceSource checked:
- US
FDA implements LDT rule vacatur
FDA published a final rule, effective the same day, restoring the pre-May 2024 wording of 21 CFR 809.3(a) following the March 31, 2025 court vacatur.
FDA rule implementing the LDT vacaturSource checked:
- US
QMSR takes effect
FDA's Quality Management System Regulation replaced the QSR, incorporating ISO 13485:2016 by reference.
Official sourceSource checked:
- EU
First four EUDAMED modules become mandatory
Actor, UDI/Device, Notified Bodies & Certificates and Market Surveillance modules became mandatory, with applicable transition provisions. Market Surveillance is for competent authorities and the Commission; the remaining modules are not yet mandatory.
European Commission EUDAMED overviewSource checked:
- International
Australian UDI first phase begins
UDI labelling and AusUDID data requirements began for in-scope Class IIb and III devices, subject to exclusions and transition arrangements. Other classes are phased in later.
TGA UDI commencementSource checked:
- EUUpcoming
AI Act high-risk rules for devices
Regulation (EU) 2026/1744 amended the AI Act timetable: Article 6(1) high-risk systems tied to Annex I products, including qualifying MDR/IVDR devices requiring third-party assessment, apply from August 2, 2028, rather than the original August 2, 2027 date.
Regulation (EU) 2026/1744: amended AI Act timetableSource checked:
Dates show when a rule was signed, published or took effect, as described. Always confirm against the official text. See also the regulator matrix.