Written by Diego Rodriguez, Regulatory Consultant & Joana Martins, Regulatory Affairs Specialist
ISO 20417:2021 is expected to be officially withdrawn. Six key changes are now in force. Notified Bodies may already be referencing the new edition in technical file reviews. Here is what your gap could look like today.
Standard Update · March 2026
Action required now
Notified Bodies conducting EU MDR technical file reviews are already referencing ISO 20417:2026. If your documentation still references the 2021 edition, you have a gap today, not at your next scheduled review.
ISO 20417 is the horizontal standard governing all information supplied by the manufacturer of a medical device, labels, Instructions for Use (IFU), packaging, and technical descriptions. It applies to every medical device and IVD placed on the market, regardless of class or technology.
The second edition, published in March 2026, cancels and replaces ISO 20417:2021. The changes are not cosmetic. Several requirements that were either optional, flexible, or informative under the 2021 version have become mandatory under the 2026 edition, and two changes directly invalidate practices that were explicitly permitted before.
One of the most common mistakes we see is treating labeling as an administrative task to complete at the end of the development process. ISO 20417 defines information supplied by the manufacturer as a safety control, one that should be driven by risk management, not handled as a marketing afterthought. The 2026 update reinforces this exactly.
What Changed: The 6 Key Updates
The table below gives a quick reference. The sections that follow explain each change in detail, with practical guidance on what it means for your technical documentation.
| Area | ISO 20417:2021 | ISO 20417:2026 | Audit Risk |
| Normative reference flexibility | Permitted: Could substitute referenced standards via risk assessment | Deleted: Must follow specific editions listed in Clause 2 | Critical |
| IFU readability (lay users) | Vague: “Readily understood” | Mandatory: Demonstrable lower secondary education level | Critical |
| Label durability | Informative annex: Guidance only | Normative: Mandatory testing requirement | High |
| Sterile barrier configuration | Not required | Required: Must be identified on label | High |
| eIFU restricted access | Not specified | New obligation: Evaluate access restriction per user group | Medium |
| “Applicable Policy” qualifiers | Not present | ~20 clauses: Market-specific documentation required | Critical |
CHANGE 1
Normative reference flexibility: deleted
You can no longer self-justify substituting referenced standards. Clause 2 editions are fixed unless your regulatory authority mandates otherwise.
CHANGE 2
IFU readability: now measurable
“Readily understood” is gone. Lay-user IFUs must be tested and documented to a defined education level.
CHANGE 3
Label durability: now normative
What was informative guidance is now a mandatory requirement, including peel resistance, abrasion, and post-sterilization legibility.
CHANGE 4
Sterile barrier configuration: new labeling requirement
Sterile device labels must explicitly identify the sterile barrier configuration.
CHANGE 5
eIFU: restricted access obligation
Manufacturers must evaluate whether access to electronic accompanying information should be restricted to defined user groups.
CHANGE 6
~20 “Applicable Policy” qualifiers
Requirements now formally defer to each market’s regulatory authority, creating a new market-mapping documentation obligation.
Change 1: Normative Reference Flexibility: Deleted
Under ISO 20417:2021, manufacturers had a degree of flexibility in Clause 2. If a newer edition of a referenced standard became available, you could (in principle) apply it based on your own risk-based justification, even if it was not the edition specifically listed. This gave QMS managers room to manoeuvre when standards were updated mid-project.
That permission no longer exists in ISO 20417:2026.
Manufacturers must now strictly adhere to the specific editions listed in Clause 2, unless the Authority Having Jurisdiction (AHJ), the regulatory authority with legal oversight in your market, mandates otherwise. Internal risk-based substitution is not an acceptable justification on its own.
“In simple terms, manufacturers can no longer assume they are free to apply newer referenced standards based on internal risk-based justification alone. If their QMS was designed around that flexibility, they may now need to update procedures, standards matrices, and supporting documentation to reflect the current reference approach.”
Diego Rodriguez, Regulatory Affairs Consultant, MDx CRO
What your gap looks like today
If your labeling procedure or standards matrix included a clause permitting substitution of harmonised standards based on internal assessment, that clause is now non-compliant. Review your QMS documentation, update your standards matrix to reflect the fixed Clause 2 editions, and ensure your technical file justifications no longer rely on this flexibility.
Change 2: IFU Readability Is Now Measurable
ISO 20417:2021 required that IFUs for lay users be “readily understood.” That phrase, while well-intentioned, was effectively unenforceable, manufacturers could declare compliance without demonstrating it.
ISO 20417:2026 replaces this with a defined standard: IFUs intended for lay users must be written at a “lower secondary education level.” Critically, you must be able to demonstrate this, stating that the IFU is clear is no longer sufficient.
“It means the manufacturer must be able to show that lay users understand the IFU, not just state that it is clear. In practice, this can be checked through plain-language review, a readability check, and also during usability testing with representative lay users, to confirm they can find, understand, and follow the key instructions and warnings correctly.”
Joana Martins, Regulatory Affairs Specialist, MDx CRO
How to test and document compliance
- Plain-language review: Have the IFU reviewed by someone without a medical background. Are the instructions actionable without explanation?
- Readability tools: Use a validated readability scoring method (e.g. Flesch-Kincaid, SMOG) to get a quantified readability grade. Aim for grade 7–8 equivalent as a starting benchmark.
- Usability testing: Include lay-user comprehension testing as part of your formative or summative usability studies. Participants should be able to find, understand, and correctly follow key instructions and warnings.
- Technical Documentation: Document the methodology used, the results, and any iterations made to the IFU as a result. A Notified Body reviewer will expect to see this process evidenced, not just asserted.
This requirement connects directly with IEC 62366-1 (usability engineering). If you already have a usability engineering process for lay-user devices, integrating IFU readability testing into your existing workflow is the most efficient path.
Change 3: Label Durability Annex Is Now Normative
In ISO 20417:2021, guidance on label durability appeared in an informative annex, meaning it was advisory, not mandatory. Manufacturers could follow it or not, and auditors could not cite non-compliance against it as a finding.
In ISO 20417:2026, label durability is normative, a mandatory requirement. This is particularly significant for manufacturers of sterile devices.
“This durability is expected for the lifetime of the device. For sterile device manufacturers, it means they should be able to show that the label remains attached, readable, and intact after the relevant conditions, sterilization, handling, abrasion, or fluid exposure.”
Joana Martins, Regulatory Affairs Specialist, MDx CRO
What a Notified Body reviewer will expect
In your technical file, expect a NB reviewer to look for:
- A label durability test plan covering the relevant conditions for your device (sterilization method, expected handling, cleaning agent exposure, etc.)
- Test results with defined acceptance criteria
- Evidence that the final label still meets all ISO 20417 labeling requirements after testing
- Confirmation that durability has been validated for the device’s intended lifetime
If your current technical documentation contains no label durability testing evidence, this is a gap to close now.
Change 4: Sterile Barrier Configuration: New Labeling Requirement
Manufacturers of sterile devices must now explicitly identify the sterile barrier configuration on the device or accessory label. Previously, it was sufficient to indicate that a device was sterile, the configuration of the sterile barrier system did not need to be specified on the label itself.
“A practical example would be adding the relevant single sterile barrier or double sterile barrier symbol on the packaging label, in line with ISO 15223-1 symbols already used in the industry. For manufacturers that do not currently include this, the effort is usually a label and documentation update rather than a full redesign, but it can still be significant if they have many sterile product families, different packaging formats, or multiple market versions.”
Diego Rodriguez, Regulatory Affairs Consultant, MDx CRO
What to do
- Identify all sterile device product families and their current label templates
- Confirm which ISO 15223-1 symbol applies (single or double sterile barrier)
- Update label templates and supporting design history documentation
- Ensure all market-specific versions are updated consistently
Change 5: eIFU Restricted Access Obligation
ISO 20417:2026 introduces a new obligation for manufacturers using electronic Instructions for Use: you must evaluate whether access to certain electronic accompanying information should be restricted to defined user groups.
This is a design and documentation obligation, not just a technical one. If you operate an eIFU portal or provide accompanying information electronically, you must be able to demonstrate that you have assessed access control requirements and implemented appropriate restrictions where needed.
“Under the updated requirements, eIFU must be accessible, clearly referenced on the physical label, and the most current version must be available. For medical devices commercialised in the EU, this aligns with Regulation (EU) 2021/2226 and Amending Regulation (EU) 2025/1234 on eIFU.”
Joana Martins, Regulatory Affairs Specialist, MDx CRO
This change has implications for the design of eIFU systems and for the documentation that supports them. Manufacturers with existing portals should review their access control architecture against the new obligation.
Change 6: ~20 “Applicable Policy” Qualifiers
Across approximately 20 clauses in ISO 20417:2026, requirements now formally defer to the “applicable policy” meaning the specific requirements of the regulatory authority in each target market. This is a structural change that affects how globally-active manufacturers document and manage compliance.
The practical implication: you cannot satisfy this with a single, market-neutral labeling procedure. You need a documented mapping of how each applicable policy clause is met in each of your target markets.
“I would handle these requirements by creating a market-specific comparison table. Each clause that refers to ‘applicable policy’ can then be matched to the specific regulatory requirements in every target market, so it is clear why certain label or IFU elements may need to change from one country or region to another. In general, the EU tends to be the most complex market, especially under MDR and IVDR, because of the detailed requirements and the added challenge of consistency across different countries and languages.”
Diego Rodriguez, Regulatory Affairs Consultant, MDx CRO
A single consolidated document, rather than separate market-specific policies, is generally easier to maintain. A matrix format mapping each applicable policy clause to the specific requirements of EU MDR, FDA 21 CFR 801, TGA, and any other relevant markets is the recommended approach.
ISO 20417:2026 Gap Analysis Checklist
A structured checklist covering all 6 key changes, with a market-by-market applicable policy matrix for EU MDR, IVDR, and FDA.
- All 6 change areas with specific checklist items
- Applicable policy clause matrix (EU, FDA, TGA)
- Label durability test plan template
- IFU readability documentation guide
SaMD and AI Developers: This Standard Applies to You Too
A common misconception among software medical device manufacturers is that labeling requirements do not apply because there is no physical device. This is incorrect. ISO 20417:2026 applies to all medical devices, including SaMD and AI-based tools, and the user interface is the regulated label.
“It is common for SaMD manufacturers to incorrectly believe that labelling requirements are not applicable since they don’t have a physical device. Labelling requirements still apply, but will be provided to the user in the device’s UI, typically through an IFU, Help, or About section.”
Joana Martins, Regulatory Affairs Specialist, MDx CRO
For SaMD and AI developers, the practical implications are:
- UDI and build version must be immediately accessible within the clinical workflow, not buried in an external document
- Algorithmic limitations, confidence boundaries, and dataset constraints must be traceable from the UI back to the risk management file
- IFU content must be accessible in-app and kept current, this is part of your post-market obligations
- Your UI design process should be informed by ISO 20417 requirements from the outset, not applied retrospectively
MDR, IVDR, and Harmonisation Status
As of April 2026, ISO 20417:2026 is not yet formally harmonised under EU MDR (2017/745) or IVDR (2017/746). This requires a specific publication in the Official Journal of the EU, a process that takes time after a standard is published.
Notably, ISO 20417:2021 was never harmonised before it was withdrawn. This means the question of harmonisation is, in practice, less significant than it might appear: the standard has always been applied as State of the Art rather than through formal harmonised presumption of conformity.
“ISO 20417:2026 is now considered the State of the Art and should be followed because of that. Non-harmonised standards can still be used to show compliance with applicable requirements and this will be summarised when preparing the General Safety and Performance Requirements Checklist.”
Joana Martins, Regulatory Affairs Specialist, MDx CRO
ISO 20417:2026 in the context of your MDR/IVDR GSPR checklist
ISO 20417:2026 addresses the requirements of Annex I, Chapter III of both MDR and IVDR, the requirements regarding information supplied with the device, including labelling and instructions for use. It is, however, not a standalone solution. Compliance with the labelling GSPRs also requires:
- EN ISO 15223-1:2021 for symbols to be used on labels
- EN ISO 17664-1/2 for information to be supplied for device reprocessing (where applicable)
- EN ISO 18113 series for IVD reagents and instruments (professional or self-testing)
- IEC 60601 symbols for medical electrical equipment (where applicable)
Apply ISO 20417:2026 as the central framework, cross-referenced to the above standards as applicable to your device type.
NB Audit Risk: What to Expect in 2026–2027
Top 3 Notified Body Finding Risks: ISO 20417:2026
1
Applicable Policy Qualifiers: documentation gap
The ~20 new applicable policy clauses require market-specific mapping. Most manufacturers have not yet created this documentation. NBs will look for it.
2
Normative Reference Flexibility: deleted but still in QMS
QMS documents that still reference the now-deleted flexibility from Clause 2 of the 2021 version are a direct non-conformity. Update your standards matrix and procedures.
3
IFU Readability: assertion without evidence
Manufacturers can find it difficult to measure and demonstrate the lower secondary education level requirement. NBs will expect documented evidence, not a declaration.
Why this matters: real-world consequences
Poor compliance with manufacturer information requirements has led to real product corrections. Two FDA cases are worth noting:
FDA Correction Cases, IFU-Related
- Olympus Ligating Device: Correction issued by Olympus due to unclear or incorrect IFU for a ligating device. Users were unable to safely follow the instructions as written. FDA alert
- Becton Dickinson BD Alaris Pump: BD issued a correction to update instructions for the Alaris infusion pump due to information deficiencies that created a risk of use error. FDA alert
Both cases illustrate the core principle of ISO 20417: information is a safety control, not an administrative output.
Your 30-Day Action Plan
If your organisation has not yet reviewed ISO 20417:2026, this is where to start. Notified Bodies are already applying the 2026 edition in technical file reviews.
- Run a gap analysis against the six key changes listed above. Use the checklist below as your starting point.
- Update your standards matrix to reference ISO 20417:2026 and remove any reliance on the deleted normative reference flexibility.
- Identify all products with lay-user IFUs and assess your current readability documentation. If there is no evidence of readability testing, create a plan to generate it.
- Review sterile device label templates for sterile barrier configuration identification.
- Audit your label durability test documentation confirm it covers the full device lifetime and all relevant conditions.
- Create an applicable policy clause matrix for each of your target markets.
Frequently Asked Questions about ISO 20417:2021
No. ISO 20417:2021 was officially withdrawn when ISO 20417:2026 was published in March 2026. The 2026 edition is now the current version and must be used for all new and updated technical documentation.
As of April 2026, ISO 20417:2026 is not yet formally harmonised under MDR (2017/745) or IVDR (2017/746). However, ISO 20417:2021 was never harmonised before it was withdrawn either. The 2026 edition is now considered the State of the Art and should be applied. It can be used in your GSPR checklist to demonstrate compliance with Annex I, Chapter III of both regulations.
Based on our experience, the top three audit risks are: (1) the applicable policy qualifiers, most manufacturers have not yet created the required market-specific documentation; (2) the deletion of normative reference flexibility, QMS documents that still reference the old clause are a direct non-conformity; and (3) the IFU readability mandate, NBs will expect documented evidence of testing, not a declaration.
Yes. ISO 20417:2026 applies to all medical devices, including SaMD and AI-based tools. The user interface is the regulated label. Labeling requirements are delivered through the device’s UI, typically via an IFU, Help, or About section. UDI and build version must be immediately accessible within the clinical workflow, and algorithmic limitations must be traceable from the UI back to the risk management file.
Readability for lay users can be demonstrated through three steps: (1) plain-language review by a non-technical reader; (2) formal readability scoring using a validated tool such as Flesch-Kincaid or SMOG; and (3) usability testing with representative lay users who confirm they can find, understand, and follow key instructions and warnings. All three steps and their results must be documented in the Technical Documentation.
You can have one overarching procedure, but it must include a market-specific table mapping requirements for each target market. ISO 20417:2026 and 21 CFR 801 have both similarities and important differences, particularly around language requirements, which may require separate label sets for different markets. The key is consistency: any change to a device name, warning, or labeling element must be applied across all market versions as applicable.
The sterile barrier configuration refers to whether the device uses a single or double sterile barrier system. ISO 20417:2026 now requires this to be explicitly identified on the label, not just that the device is sterile. In practice, this typically means adding the appropriate ISO 15223-1 symbol (single or double sterile barrier) to your packaging label. For manufacturers with multiple sterile product families or market-specific packaging, this may require updating several label templates and their associated documentation.
No. ISO 20417:2026 addresses the central framework for manufacturer information requirements, but full MDR/IVDR labeling compliance also requires EN ISO 15223-1:2021 (symbols), EN ISO 17664-1/2 (reprocessing information, where applicable), and the EN ISO 18113 series for IVDs. Additional standards such as IEC 60601 symbols may apply depending on your device type.
Need a structured gap analysis?
Our regulatory team can conduct a rapid ISO 20417:2026 gap assessment of your technical documentation and labeling, and give you a prioritised remediation plan.
