Timeline sources

1. Oct 30, 1972 · US

   Anti-Kickback Statute enacted

   The Social Security Amendments of 1972 introduced criminal penalties for specified kickbacks, bribes and rebates connected with Medicare and Medicaid services.

   View timeline milestone

   AKS

   The original law establishes enactment, not every element of today's broader Anti-Kickback Statute.

   • Social Security Amendments of 1972, Public Law 92-603

     U.S. government (govinfo.gov)

     https://www.govinfo.gov/content/pkg/STATUTE-86/pdf/STATUTE-86-Pg1329.pdf

   No recorded date check

2. May 28, 1976 · US

   Medical Device Amendments signed

   Expanded FDA authority over medical devices, established three risk classes and the premarket notification and approval framework.

   View timeline milestone

   510(k)PMA
   • FDA: Medical Device Amendments signed

     FDA

     https://www.fda.gov/about-fda/fda-history-research-tools/selected-food-drug-cosmetic-device-and-tobacco-laws

   Recorded source check: 2026-11-01

3. Jul 16, 1980 · US

   IDE regulation scheduled to take effect

   21 CFR Part 812 set the rules for investigational device exemptions, letting unapproved devices be used in clinical studies.

   View timeline milestone

   IDE

   Printed page 3732 onward. The rule states July 16, 1980 subject to OMB approval; the subsequent approval notice has not been verified.

   • FDA IDE final rule, 45 FR 3732 (January 18, 1980)

     U.S. government (Federal Register)

     https://archives.federalregister.gov/issue_slice/1980/1/18/3693-3761.pdf

   No recorded date check

4. Oct 31, 1988 · US

   CLIA '88 signed

   The Clinical Laboratory Improvement Amendments established federal quality standards for laboratories testing human specimens for diagnosis, prevention or treatment; research-only testing is outside that clinical scope.

   View timeline milestone

   CLIA
   • CMS: CLIA '88 signed

     CMS

     https://www.cms.gov/newsroom/fact-sheets/medicare-program-clinical-laboratory-improvement-amendments-clia-1988-fees-cms-3356-nc

   Recorded source check: 2026-11-01

5. Dec 19, 1989 · US

   Stark Law enacted

   The Ethics in Patient Referrals Act barred physician self-referral for Medicare-covered services, later expanded in 1993.

   View timeline milestone

   Stark Law

   The original prohibition concerned clinical laboratory services. Enactment is distinct from application, and the codified text includes later amendments.

   • OBRA 1989, Public Law 101-239: approval date

     U.S. government (ssa.gov)

     https://www.ssa.gov/OP_Home/comp2/F101-239.html

   • 42 USC 1395nn: physician referral prohibition and statutory history

     U.S. government (govinfo.gov)

     https://www.govinfo.gov/content/pkg/USCODE-2010-title42/html/USCODE-2010-title42-chap7-subchapXVIII-partE-sec1395nn.htm

   No recorded date check

6. Nov 28, 1990 · US

   Safe Medical Devices Act signed

   Added device user reporting, postmarket surveillance authority and the Humanitarian Device Exemption.

   View timeline milestone

   HDE

   Enactment date, not a common application date for all implementing requirements.

   • Safe Medical Devices Act of 1990, Public Law 101-629

     U.S. government (govinfo.gov)

     https://www.govinfo.gov/content/pkg/STATUTE-104/pdf/STATUTE-104-Pg4511.pdf

   No recorded date check

7. Aug 21, 1996 · US

   HIPAA signed

   The Health Insurance Portability and Accountability Act laid the base for federal privacy and security rules for health data.

   View timeline milestone

   HIPAA

   HIPAA enactment, not issuance or compliance dates of the later Privacy and Security Rules.

   • HIPAA, Public Law 104-191

     U.S. government (govinfo.gov)

     https://www.govinfo.gov/content/pkg/PLAW-104publ191/html/PLAW-104publ191.htm

   No recorded date check

8. Jun 1, 1997 · US

   Quality System Regulation takes effect

   21 CFR Part 820 added design controls to device good manufacturing practice requirements.

   View timeline milestone

   QSR / 21 CFR 820

   Published October 7, 1996, effective June 1, 1997. See Section IV for design-control compliance details.

   • FDA Quality System Regulation final rule, 61 FR 52602

     U.S. government (govinfo.gov)

     https://www.govinfo.gov/content/pkg/FR-1996-10-07/html/96-25720.htm

   No recorded date check

9. Nov 21, 1997 · US

   FDAMA creates De Novo

   The FDA Modernization Act created the De Novo route for novel low to moderate risk devices with no predicate.

   View timeline milestone

   De Novo
   • FDA: FDAMA creates De Novo

     FDA

     https://www.fda.gov/about-fda/fda-history-research-tools/selected-food-drug-cosmetic-device-and-tobacco-laws

   Recorded source check: 2026-11-01

10. Oct 26, 2002 · US

    First device user fees (MDUFMA)

    The Medical Device User Fee and Modernization Act introduced user fees tied to FDA review performance goals, renewed every five years.

    View timeline milestone

    MDUFA

    Supports original enactment and the fee framework, not subsequent five-year reauthorizations.

    • Medical Device User Fee and Modernization Act of 2002, Public Law 107-250

      U.S. government (govinfo.gov)

      https://www.govinfo.gov/link/plaw/107/public/250

    No recorded date check

11. May 2006 · International

    IEC 62304 published

    First edition of the software life cycle standard for medical device software.

    View timeline milestone

    IEC 62304
    • ISO: IEC 62304 published

      ISO

      https://www.iso.org/standard/38421.html

    Recorded source check: 2026-11-01

12. Feb 17, 2009 · US

    HITECH Act signed

    Strengthened HIPAA enforcement and introduced breach notification duties for health data.

    View timeline milestone

    HITECH
    • HHS: HITECH Act signed

      HHS

      https://www.hhs.gov/hipaa/for-professionals/special-topics/hitech-act-enforcement-interim-final-rule/index.html

    Recorded source check: 2026-11-01

13. Mar 23, 2010 · US

    Physician Payments Sunshine Act

    Passed within the Affordable Care Act, requiring manufacturers to report payments to physicians and teaching hospitals.

    View timeline milestone

    Physician Payments Sunshine Act

    Enactment within the ACA, not the start of Open Payments reporting or disclosure.

    • Affordable Care Act section 6002: physician payment transparency

      U.S. government (govinfo.gov)

      https://www.govinfo.gov/content/pkg/PLAW-111publ148/html/PLAW-111publ148.htm

    No recorded date check

14. Sep 24, 2013 · US

    UDI final rule published

    FDA required unique device identifiers on labels and GUDID submissions, phased in by device class.

    View timeline milestone

    UDI
    • U.S. government (govinfo.gov): UDI final rule published

      U.S. government (govinfo.gov)

      https://www.govinfo.gov/content/pkg/FR-2013-09-24/html/2013-23059.htm

    Recorded source check: 2026-11-01

15. Feb 12, 2014 · US

    NIST Cybersecurity Framework 1.0

    A voluntary framework for managing cybersecurity risk, widely used by manufacturers and hospitals. Version 2.0 followed in February 2024.

    View timeline milestone

    NIST CSF
    • NIST: NIST Cybersecurity Framework 1.0

      NIST

      https://www.nist.gov/publications/framework-improving-critical-infrastructure-cybersecurity-version-10

    Recorded source check: 2026-11-01

16. Mar 2016 · International

    ISO 13485:2016 published

    The current edition of the medical device quality management system standard.

    View timeline milestone

    ISO 13485
    • ISO: ISO 13485:2016 published

      ISO

      https://www.iso.org/standard/59752.html

    Recorded source check: 2026-11-01

17. Dec 13, 2016 · US

    21st Century Cures Act signed

    Codified the Breakthrough Devices Program and clarified which software functions are not devices.

    View timeline milestone

    BDD

    Enactment, not the dates of subsequent FDA implementation or guidance.

    • 21st Century Cures Act, Public Law 114-255, sections 3051 and 3060

      U.S. government (govinfo.gov)

      https://www.govinfo.gov/link/plaw/114/public/255

    No recorded date check

18. May 25, 2017 · EU

    MDR and IVDR enter into force

    Regulations (EU) 2017/745 and 2017/746 replaced the device directives, with multi-year transition periods and EUDAMED.

    View timeline milestone

    MDRIVDREUDAMED
    • European Commission UDI system brochure, page 1: MDR/IVDR commencement dates

      European Commission

      https://health.ec.europa.eu/document/download/add107c5-0ca8-45d3-b049-63bb84c4ce31_en

    Recorded source check: 2026-11-01

19. Jan 1, 2019 · International

    Health Canada requires MDSAP

    Health Canada's CMDCAS program ended on January 1, 2019 as manufacturers of Class II, III and IV devices sold in Canada transitioned to MDSAP. Existing licence holders had to submit documented transition evidence by December 31, 2018; accepted arrangements allowed some MDSAP audits to take place during 2019.

    View timeline milestone

    MDSAP

    Health Canada's transition FAQ, questions 1, 3 and 8, distinguishes the January 1, 2019 program change from the December 31, 2018 evidence deadline. Question 7 exempts distributors, retailers and private-label manufacturers from needing their own MDSAP certificate, while their original equipment manufacturer remains subject to the requirements. This is a Canadian requirement, not a common implementation date for Japan or the other MDSAP countries.

    • Health Canada MDSAP transition FAQ: evidence deadline, 2019 transition options and end of CMDCAS

      Government of Canada

      https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/activities/international/notice-transition-plan-medical-device-audit-program.html

    Recorded source check: 2026-11-01

20. Dec 2019 · International

    ISO 14971:2019 published

    Third edition of the risk management standard for medical devices.

    View timeline milestone

    ISO 14971
    • ISO: ISO 14971:2019 published

      ISO

      https://www.iso.org/standard/72704.html

    Recorded source check: 2026-11-01

21. May 26, 2021 · EU

    EU MDR date of application

    The MDR became generally applicable, including Article 117 for drug-device combinations, with separate conditional transition periods for eligible legacy devices.

    View timeline milestone

    MDRMDR Article 117
    • European Commission UDI system brochure, page 1: MDR/IVDR commencement dates

      European Commission

      https://health.ec.europa.eu/document/download/add107c5-0ca8-45d3-b049-63bb84c4ce31_en

    Recorded source check: 2026-11-01

22. Dec 2021 · International

    IEC 81001-5-1 published

    Security activities for the health software product life cycle, now a key reference for device cybersecurity.

    View timeline milestone

    IEC 81001-5-1
    • ISO: IEC 81001-5-1 published

      ISO

      https://www.iso.org/standard/76097.html

    Recorded source check: 2026-11-01

23. May 26, 2022 · EU

    EU IVDR date of application

    The IVDR became applicable, with staggered transition deadlines by risk class.

    View timeline milestone

    IVDR
    • European Commission UDI system brochure, page 1: MDR/IVDR commencement dates

      European Commission

      https://health.ec.europa.eu/document/download/add107c5-0ca8-45d3-b049-63bb84c4ce31_en

    Recorded source check: 2026-11-01

24. Mar 20, 2023 · EU

    MDR transition extended

    Regulation (EU) 2023/607 extended MDR transition periods for legacy devices to 2027 or 2028, depending on class.

    View timeline milestone

    MDR
    • European Union (EUR-Lex): MDR transition extended

      European Union (EUR-Lex)

      https://eur-lex.europa.eu/eli/reg/2023/607/oj

    Recorded source check: 2026-11-01

25. Mar 29, 2023 · US

    Section 524B cyber requirements apply

    Under FDORA, submissions for cyber devices must include a cybersecurity plan, design controls and an SBOM.

    View timeline milestone

    524BSBOM
    • FDA: Section 524B cyber requirements apply

      FDA

      https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity

    Recorded source check: 2026-11-01

26. Oct 1, 2023 · US

    eSTAR required for 510(k)s

    FDA began requiring 510(k) submissions in the electronic eSTAR format.

    View timeline milestone

    eSTAR510(k)

    FDA's page identifies October 1, 2023 as the requirement date. The guidance revision is October 2, 2023 and includes waiver and exemption criteria.

    • FDA: Electronic Submission Template for Medical Device 510(k) Submissions

      FDA

      https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-submission-template-medical-device-510k-submissions

    No recorded date check

27. Aug 1, 2024 · EU

    EU AI Act enters into force

    Regulation (EU) 2024/1689 set risk-based rules for AI, with obligations phased in over several years.

    View timeline milestone

    EU AI Act

    Entry into force is distinct from the phased application of AI Act obligations.

    • European Commission: AI Act enters into force, 1 August 2024

      European Union

      https://commission.europa.eu/news-and-media/news/ai-act-enters-force-2024-08-01_en

    No recorded date check

28. Aug 12, 2024 · US

    TCET final notice published and effective

    CMS published its final TCET procedural notice, effective the same day, for certain eligible FDA-designated Breakthrough Devices. The pathway was announced on August 7, 2024.

    View timeline milestone

    TCETBDD
    • CMS final TCET notice

      U.S. government (Federal Register)

      https://www.federalregister.gov/documents/2024/08/12/2024-17603/medicare-program-transitional-coverage-for-emerging-technologies

    • Official GPO copy of the final TCET notice

      U.S. government (govinfo.gov)

      https://www.govinfo.gov/content/pkg/FR-2024-08-12/html/2024-17603.htm

    Recorded source check: 2026-11-01

29. Dec 4, 2024 · US

    Initial final PCCP guidance for AI devices

    FDA issued its initial final AI-enabled device PCCP guidance, subsequently updated on August 18, 2025. Guidance recommendations are nonbinding.

    View timeline milestone

    PCCP
    • FDA PCCP guidance: original and revised issue dates

      FDA

      https://www.fda.gov/media/166704/download

    Recorded source check: 2026-11-01

30. Mar 31, 2025 · US

    Court vacates FDA LDT rule

    A federal court set aside FDA's rule that would have regulated laboratory-developed tests as devices.

    View timeline milestone

    LDT
    • FDA: Court vacates FDA LDT rule

      FDA

      https://www.fda.gov/medical-devices/in-vitro-diagnostics/laboratory-developed-tests

    Recorded source check: 2026-11-01

31. Jun 16, 2025 · UK

    UK post-market surveillance rules apply

    MHRA guidance states that strengthened Part 4A PMS requirements apply to individual medical devices placed on the market or put into service in Great Britain from June 16, 2025, regardless of CE or UKCA marking. Earlier individual devices remain under prior PMS rules. Custom-made devices have a reduced set of obligations; Northern Ireland follows EU MDR and IVDR PMS requirements.

    View timeline milestone

    MHRA / UKCA

    MHRA explicitly states June 16, 2025. SI 2024/1368 was made December 16, 2024 and regulation 1(2) says it comes into force 6 months after the day it was made; the consolidated Part 4A annotation instead records June 17, 2025. The displayed date follows MHRA's operational guidance, not a resolution of this official one-day discrepancy. The guidance also excludes specified Secretary of State authorisations from these requirements and refers in-house manufacture to separate guidance.

    • MHRA PMS guidance: June 16, 2025 application date, individual-device scope and Northern Ireland

      UK government / MHRA

      https://www.gov.uk/government/publications/medical-devices-post-market-surveillance-requirements/introduction-and-scope

    • SI 2024/1368: made date and regulation 1(2) commencement formula

      UK government / MHRA

      https://www.legislation.gov.uk/uksi/2024/1368/made

    • UK MDR Part 4A: consolidated annotation records June 17, 2025

      UK government / MHRA

      https://www.legislation.gov.uk/uksi/2002/618/part/4A

    Recorded source check: 2026-11-01

32. Aug 18, 2025 · US

    FDA updates AI device PCCP guidance

    FDA issued updated final recommendations for predetermined change control plans for AI-enabled device software functions, replacing the December 4, 2024 version. This is guidance issuance, not a new statutory effective date.

    View timeline milestone

    PCCP
    • FDA updated PCCP guidance

      FDA

      https://www.fda.gov/media/166704/download

    Recorded source check: 2026-11-01

33. Sep 19, 2025 · US

    FDA implements LDT rule vacatur

    FDA published a final rule, effective the same day, restoring the pre-May 2024 wording of 21 CFR 809.3(a) following the March 31, 2025 court vacatur.

    View timeline milestone

    LDT
    • FDA rule implementing the LDT vacatur

      U.S. government (Federal Register)

      https://www.federalregister.gov/documents/2025/09/19/2025-18239/regulation-identification-number-0910-aj05-medical-devices-laboratory-developed-tests-implementation

    • Official GPO copy of FDA's LDT vacatur implementation rule

      U.S. government (govinfo.gov)

      https://www.govinfo.gov/content/pkg/FR-2025-09-19/html/2025-18239.htm

    Recorded source check: 2026-11-01

34. Feb 2, 2026 · US

    QMSR takes effect

    FDA's Quality Management System Regulation replaced the QSR, incorporating ISO 13485:2016 by reference.

    View timeline milestone

    QMSRQSR / 21 CFR 820ISO 13485
    • FDA: QMSR takes effect

      FDA

      https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr

    Recorded source check: 2026-11-01

35. May 28, 2026 · EU

    First four EUDAMED modules become mandatory

    Actor, UDI/Device, Notified Bodies & Certificates and Market Surveillance modules became mandatory, with applicable transition provisions. Market Surveillance is for competent authorities and the Commission; the remaining modules are not yet mandatory.

    View timeline milestone

    EUDAMEDUDI
    • European Commission EUDAMED overview

      European Commission

      https://health.ec.europa.eu/medical-devices-eudamed/overview_en

    Recorded source check: 2026-11-01

36. Jul 1, 2026 · International

    Australian UDI first phase begins

    UDI labelling and AusUDID data requirements began for in-scope Class IIb and III devices, subject to exclusions and transition arrangements. Other classes are phased in later.

    View timeline milestone

    TGAUDI
    • TGA UDI commencement

      TGA

      https://www.tga.gov.au/news/news-articles/new-udi-requirements-medical-devices-commence-1-july-2026

    Recorded source check: 2026-11-01

37. Aug 2, 2028 · EU

    AI Act high-risk rules for devices

    Regulation (EU) 2026/1744 amended the AI Act timetable: Article 6(1) high-risk systems tied to Annex I products, including qualifying MDR/IVDR devices requiring third-party assessment, apply from August 2, 2028, rather than the original August 2, 2027 date.

    View timeline milestone

    EU AI ActMDRIVDR

    The amended August 2, 2028 deadline has not been independently verified against the operative amendment to Article 113. EUR-Lex returned no readable text during this audit; the recorded source-check date is not verification.

    • Regulation (EU) 2026/1744: amended AI Act timetable

      European Union (EUR-Lex)

      https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744

    Recorded source check: 2026-11-01

Linked documents are evidence for review, not certification of every milestone claim.