February 2026 Compliance Calendar

The FDA's Quality Management System Regulation (QMSR) replaces the existing Quality System Regulation (QSR) under 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. All medical device manufacturers marketing devices in the US must comply. Risk-based thinking must be embedded in all operations.

FDA published updated guidance on cybersecurity in medical devices. Under Section 524B, cyber device manufacturers must submit cybersecurity plans for postmarket vulnerability monitoring, demonstrate secure design practices, and provide Software Bill of Materials (SBOM) with all premarket submissions (510(k), PMA, De Novo, HDE).

Key reforms from the UK Data (Use and Access) Act 2025 took effect on February 5, 2026. Changes include: automated decision-making is now permitted subject to safeguards; new recognised legitimate interests lawful basis for processing; e-privacy penalty alignment with UK GDPR; and new complaint handling requirements for controllers.

Annual NIS2 entity registration window closes February 28, 2026. Essential and important entities must register with national authorities. The registration must include entity details, sector classification, and contact information for cybersecurity coordination.