Source-to-decision register

Regulatory Updates

Primary-source facts are separated from professional interpretation, so teams can see what changed, what did not, and what action is proportionate.

Binding or operative text Agency guidance Draft or horizon scan

U.S. Food and Drug Administration · United States

Computer Software Assurance for Production and Quality Management System Software

Final guidance

Source classification: Agency guidance
Publication / effective date: 2026-02 · On issuance
Applicability: Production and quality management system software used in medical-device manufacturing.
What changed: FDA issued revised final guidance and superseded the September 24, 2025 version.
What did not change: The document remains nonbinding guidance; firms retain responsibility for compliance and appropriate evidence.
Operational impact Professional interpretation: Review procedures for risk-based assurance terminology, unscripted testing evidence, and supplier evidence leverage.
Recommended action Professional interpretation: Perform a controlled gap assessment; do not automatically rewrite or rerun existing validation solely because the guidance was revised.

European Commission · European Union

Draft consultation closed

Source classification: Draft agency guidance
Publication / effective date: 2025-07-07 · Not effective
Applicability: Stakeholder consultation material for computerized systems and AI used in GMP contexts.
What changed: Draft texts proposed updated computerized-system expectations and a dedicated AI annex.
What did not change: The consultation drafts are not final binding requirements; the existing Annex 11 remains the published operative annex until replaced.
Operational impact Professional interpretation: Use the drafts for horizon scanning, not as if already effective law.
Recommended action Professional interpretation: Map potentially affected controls and monitor official adoption; keep current compliance decisions anchored to effective requirements.

U.S. Electronic Code of Federal Regulations · United States

Current regulation

Source classification: Binding regulation
Publication / effective date: Current eCFR · In force
Applicability: Electronic records and electronic signatures within the scope defined by Part 11.
What changed: Register entry added for direct access to the current official text; this is not a claim of a new amendment.
What did not change: Applicability must still be determined from the predicate rule, record use, and the Part 11 scope provisions.
Operational impact Professional interpretation: Maintain traceable decisions for record integrity, access, audit trails, signatures, retention, and operational controls.
Recommended action Professional interpretation: Use the current official text and applicable FDA guidance; avoid treating a generic checklist as an applicability assessment.

European Commission · European Union

Current published annex

Source classification: Binding GMP guidance
Publication / effective date: 2011-01 · 2011-06-30
Applicability: Computerised systems used as part of EU GMP regulated activities.
What changed: Register entry distinguishes the operative Annex 11 from later consultation drafts.
What did not change: The January 2011 revision remains listed in EudraLex Volume 4 while the proposed revision proceeds separately.
Operational impact Professional interpretation: Continue applying lifecycle risk management, supplier controls, data integrity, security, incident, continuity, and periodic evaluation expectations.
Recommended action Professional interpretation: Assess against the operative annex and monitor the Commission page for a final replacement.

U.S. Food and Drug Administration · United States

Current regulation

Source classification: Binding regulation
Publication / effective date: 2024-02-02 · 2026-02-02
Applicability: Finished medical-device manufacturers and other organizations within the scope of 21 CFR Part 820.
What changed: The revised Part 820 is now titled QMSR and incorporates ISO 13485:2016 by reference, with FDA’s updated inspection program in use from February 2, 2026.
What did not change: Manufacturers remain responsible for applicable FD&C Act and FDA requirements; incorporation by reference does not make every external practice automatically sufficient for a specific computerized-system decision.
Operational impact Professional interpretation: Revisit QMS documentation, supplier and software assurance interfaces, terminology, and inspection-readiness narratives against the operative QMSR text.
Recommended action Professional interpretation: Use the current rule and FDA implementation material to verify process-level impact; connect computerized-system evidence to the QMS processes the software supports.

International Society for Pharmaceutical Engineering · International industry practice

Current second edition

Source classification: Consensus industry guidance
Publication / effective date: 2022-07 · Not a regulation
Applicability: Practitioner guidance for effective, fit-for-use, compliant GxP computerized systems.
What changed: The second edition updates the established framework for service providers, modern development, software tools, automation, data integrity, and CSA.
What did not change: GAMP remains industry guidance rather than binding law; applicable regulation and the regulated company’s justified decisions control.
Operational impact Professional interpretation: Use the framework to structure lifecycle and supplier practice while preserving risk-based, context-specific judgment.
Recommended action Professional interpretation: Map local procedures to the relevant principles; avoid turning GAMP categories or deliverables into an automatic documentation checklist.