Current state: 2026.
QMSR effective 2 February 2026 · EU AI Act Annex III applicable 2 August 2026 · ICH E6(R3) operative since January 2025 · ISO/IEC 42001 adoption accelerating · GMP Annex 22 in finalisation. The convergence of regulated-AI governance frameworks — what is mandatory in 2026.
Current state: 2026.
What's live · what just changed · what's in transition2026 is the densest single year of regulated-quality regulatory change since 1996. QMSR effective in February. EU AI Act Annex III applicable in August. ICH E6(R3) operative across regions. ISO/IEC 42001 adoption accelerating in tender criteria. Annex 22 in late finalisation. The 483 / non-conformance pattern projected for 2026-2027 reflects each of these dates.
QMSR effective Feb 2 2026.
Final rule Federal Register 2 February 2024. Effective 2 February 2026. Replaces 21 CFR 820 with a regulation that incorporates ISO 13485:2016 by reference plus FDA-specific overlays (UDI, eMDR, complaint files §820.198, labelling §820.45, objective evidence §820.10). 24-month implementation runway closed. No grandfather for existing PMA / 510(k) holders.
ICH E6(R3) operative.
Step 4 reached 6 January 2025. Operative across ICH regions through 2025. Principles-based GCP, sponsor-investigator oversight, decentralised-trial language, risk-based monitoring, electronic-systems alignment with §11 / Annex 11. Annex 1 (interventional) finalised; Annex 2 (non-traditional / decentralised) in development.
EU AI Act Annex III.
Regulation 2024/1689. Entered into force 1 August 2024. Annex III high-risk obligations applicable 2 August 2026; Annex I high-risk (safety components of regulated products including medical devices) applicable 2 August 2027. Risk-impact assessment, technical documentation, transparency, human oversight, robustness, cybersecurity.
ISO/IEC 42001 adoption curve.
Published December 2023. Through 2026, certification activity accelerating — especially among AI-enabled medical-device manufacturers, AI-augmented clinical-trial vendors, and SaMD developers preparing for EU AI Act Annex III. 42001 increasingly cited as tender / supplier-qualification baseline.
Annex 22 finalisation.
The AI-specific Annex 22 to EU GMP entered late-stage finalisation alongside the Annex 11 revision. Expected publication late 2026 / early 2027. Will set EU expectations for AI/ML lifecycle controls in regulated GMP operations — data governance, training-data integrity, monitoring, retraining, post-market surveillance.
ICH Q9(R1) dominant.
R1 (January 2023) is the most-cited ICH document in 2024-2026 inspections. Subjectivity management, knowledge-base risk, digitalisation expectations now read into change-control, deviation, validation-scoping decisions. The lens through which auditors read everything else.
ALCOA+ universal.
MHRA GxP DI (2018), FDA Data Integrity Q&A (2018), PIC/S PI 041-1 (2021) read together as the data-integrity baseline. Routine audit-trail-review SOP, periodic system-access review, electronic-paper hybrid handling all inspection-baseline expectations across regulators.
QMSR language retrofit.
Projected leading 483 category for 2026-2027: QMS still references retired 21 CFR 820 clauses. Pre-2026 procedures using §820.30 (design controls), §820.50 (purchasing controls), §820.100 (CAPA) without ISO 13485 §7.3, §7.4, §8.5 cross-reference. The clause-number find/replace project that sponsors underestimated.
CAPA effectiveness.
Persistent leader. The discipline gap is consistent — CAPAs closed without effectiveness verification, without measurable success criteria, without 6-12 month post-implementation metrics. ISO 13485 §8.5.2/3 unchanged in QMSR transition; the audit gap is implementation, not regulation.
AI governance gap.
Emerging finding: AI / ML systems deployed in regulated operations without integrated governance evidence. AI risk register sitting outside the Q9(R1) risk register; AI change-control parallel to the QMS change-control SOP; model retraining performed without documented release. The 42001 integration test.
Audit-trail review.
Persistent finding: audit trails exist but no evidence of routine review. The 2018 MHRA / FDA Data Integrity expectation was unambiguous; 2026 inspections still find SOPs requiring audit-trail review without operational evidence the review happens.
Combination products.
Sponsors who built §820-shaped device QMSs have to bridge them onto QMSR / ISO 13485 grammar while maintaining the §211 drug-product side. The DHF-to-PQS bridge documentation gap projected as a top-five finding category in 2026-2027.
FDA & EU distance work.
Post-COVID, FDA Mutual Reliance and EMA distance-assessment frameworks remain operational alongside on-site inspections. Hybrid posture stable through 2026 — inspectors expect the QMS to be remotely auditable as well as on-site auditable.
AI & medical-product governance.
2026 is the year regulated-AI governance and medical-product governance start converging on the same audit. EU AI Act Annex III obligations applicable 2 August 2026 overlap with EU MDR / IVDR, FDA QMSR for AI/ML SaMD, ICH E6(R3) for AI-augmented trials. The single inspection probing both axes.
EMA AI Reflection.
EMA Reflection Paper on AI in medicines lifecycle in advanced consultation through 2026. Expected to anchor EU sponsor expectations for AI in pharmaceutical development, manufacturing, pharmacovigilance — the pharma counterpart to the MDCG / EU AI Act guidance for devices.
FDA AI/ML Action Plan.
FDA's AI/ML-Based Software as a Medical Device Action Plan and the Predetermined Change Control Plan (PCCP) framework continue maturing through 2026 — the regulated path for adaptive ML systems in devices, parallel to the EU AI Act high-risk track.
Annex 11 revision.
Draft Annex 11 revision in consultation alongside Annex 22 finalisation. Expected to align with ICH Q9(R1), modernise CSV-vs-CSA distinctions (per FDA's Computer Software Assurance approach), and build the bridge to AI/ML lifecycle controls.