Medical device manufacturers are entering a period where “being compliant” is necessary but no longer sufficient to win. Across major markets, the compliance surface area is expanding (cybersecurity, AI lifecycle controls, digital traceability, tighter post‑market surveillance), while in parallel the operating environment is becoming more volatile (geopolitical fragmentation, tariffs, supplier concentration risks, constrained certification capacity, and persistent skills gaps). The result is a leadership challenge: the same pressures that raise operational risk can also be converted into measurable gains in quality, delivery, cost, and speed—if addressed as a coordinated performance programme rather than as disconnected compliance projects. 

This report analyses four forces reshaping medical device manufacturing globally:

Digital workforce and digitally fluent teams: Smart manufacturing maturity is increasingly limited by human capital, not by technology availability. Building a digitally fluent frontline and a “connected worker” operating model is now a quality and throughput strategy, not an HR initiative.

AI and connected systems integration while maintaining compliance: AI is moving from pilots to production in factories, while regulators are simultaneously clarifying expectations for AI‑enabled medical devices, change control, and cybersecurity. Manufacturers need to adopt governance that makes AI auditable, monitorable, and updatable without re‑creating paper-era friction. 

Supply chain resilience via regionalisation and traceability: Over the last three years, supply chain strategy has shifted from optimisation for cost to optimisation for resilience that can still sustain margin. Regionalisation and traceability are becoming mutually reinforcing: regionalisation reduces disruption exposure; traceability reduces the cost and time of response when disruption occurs. 

Regulatory evolution and market access: Regulatory regimes are converging in some areas (e.g., quality system baselines) while diverging in practical execution and digital infrastructure. Recent shifts—such as the Food and Drug Administration’s Quality Management System Regulation effective 2 February 2026 and EU moves to make key EUDAMED modules mandatory from 28 May 2026—change how manufacturers should invest in quality systems, data, and regulatory operations. 

Across all four forces, the most reliable “pressure-to-performance” pattern is the same: define a value thesis, build a small number of lighthouse use cases that prove impact, institutionalise governance that satisfies regulators by design, then scale through standardised platforms, training, and metrics. 

Why compliance is no longer enough

Over the last three years, regulatory and market expectations have changed in ways that directly touch manufacturing operations—not just regulatory affairs. Three developments illustrate the strategic shift.

First, quality system expectations are being modernised and aligned internationally. In the US, the FDA’s Quality Management System Regulation (QMSR) became effective on 2 February 2026 and incorporates ISO 13485:2016 by reference, signalling stronger alignment of US device CGMP requirements with international QMS practice. This matters operationally because it changes inspection expectations and increases the ROI of a globally consistent QMS operating model rather than a market-by-market patchwork. 

Second, cybersecurity has moved from “good practice” to explicit premarket expectations for connected devices, including requirements on vulnerability management planning and software bills of materials (SBOMs) under section 524B of the FD&C Act for “cyber devices.” For manufacturers, this expands the definition of “quality” into secure design and lifecycle patching, with direct implications for supplier management, configuration management, and post‑market processes. 

Third, the EU is accelerating digital traceability and transparency infrastructure. The European Commission announced that the first four EUDAMED modules will be mandatory to use from 28 May 2026, following Commission Decision (EU) 2025/2371 and the transitional mechanism enabled by Regulation (EU) 2024/1860. In parallel, the EU has repeatedly adjusted MDR/IVDR transitional timelines to prevent device shortages, reflecting persistent system capacity constraints and high compliance load on manufacturers.

What this means for senior leaders: compliance programmes that are treated as cost centres will increasingly collide with operational realities (skills, data fragmentation, supply volatility). The option space is narrowing to two choices: either design manufacturing systems so that compliance artefacts are by-products of good operations (digitally captured, traceable, reviewable), or accept rising friction (manual documentation, rework, slower release, higher audit findings, and brittle supply response). Evidence from a longitudinal case study in a large medical device manufacturer suggests that digitising validation (moving away from heavily paper-based validation) can streamline review/approval, improve data integrity management for large validation data volumes, and reduce opportunities for audit findings—while also revealing that training and change resistance become central constraints. 

Digital workforce and digitally fluent teams

Current state and global trends (last three years)
Manufacturing digitisation is advancing faster than workforce readiness. In a 2025 survey of 600 manufacturing executives, Deloitte reports that human capital was the lowest maturity category among smart manufacturing domains, even though many organisations have adopted data and architecture standards. The same survey shows sizeable challenges in filling operations roles (e.g., production and operations management; planning and scheduling) and identifies “adapting workers to the Factory of the Future” as a top concern for a significant share of respondents. 

From a labour market lens, the World Economic Forum’s Future of Jobs analysis indicates employers expect ~39% of workers’ core skills to change by 2030, and reports an increase in the share of the workforce completing training as part of long-term learning strategies (50% in the report’s latest survey results). For device manufacturing leaders, the takeaway is that skills volatility is now a forecastable operating condition, not a one-off “upskilling year.” 

Within medtech specifically, a 2025 case-study-based study highlights structural barriers that will be familiar to global manufacturers: uneven awareness of Industry 4.0 beyond manufacturing leadership, a recurring need to standardise data and ERP systems as a prerequisite for scaling, and acute scarcity of AI/analytics skills—leading to reliance on external specialists who must be paired with internal process expertise to deliver value. 

Key risks and opportunities
The dominant risk is not “lack of training hours”; it is a failure to translate digital investment into stable daily work—resulting in shadow processes, poor data quality, and compliance drift. The paperless validation case study found that inadequate training, resistance to change, and upskilling gaps were central implementation challenges, even when the digital system delivered process and data integrity benefits. 
The opportunity is to treat workforce digital fluency as a direct driver of first-pass quality, faster changeovers, and faster release—because digitised work execution and digitised evidence reduce rework in both manufacturing and quality review. 

Practical roadmap and step-by-step implementation checklist
A pragmatic approach is a “Connected Workforce Cascade” that moves from critical processes to roles to tools—rather than starting with technology rollout.

1) Identify the few processes where human variance drives the most business pain (e.g., high-scrap assembly steps, manual inspections, line clearance, changeovers, complaint-driven rework loops). Use existing CAPA, NCR, and scrap Pareto—not a new study. 
2) Build a role-by-role skill map for those processes (operators, line leads, QA, maintenance, planners). Keep it measurable (task proficiency, error modes). 
3) Digitise work instructions and evidence capture for those processes first (version control, sign-off, attachments like images/measurements). This is where compliance and productivity converge: better guidance reduces errors; digital capture reduces review friction. 
4) Create a training-to-competence loop: train → demonstrate task performance → record competence → re-qualify on change. The aim is measurable time-to-proficiency and fewer deviations after changes. 
5) Scale through standards, not heroic coaching: adopt a unified data model, training/adoption standards, and an architecture standard (many manufacturers are already moving this direction). 
6) Industrialise change management with a formal communications rhythm (plant leadership, QA, supervisors) and quantified adoption targets; resistance is predictable and should be managed as a project risk. 

Implementation checklist (use in programme governance)
- Defined “critical processes” list with baseline defect modes and top human-error drivers. 
- Role/skill taxonomy approved by Operations + Quality. 
- Digital work execution design includes version control, approvals, and audit trail requirements aligned to electronic record expectations. 
- Training content is modular and linked to task versions (so retraining triggers on process/document changes). 
- Competence verified (observed performance or practical assessment), not self-attested. 
- Frontline “super-users” staffed and protected (time allocation), with clear escalation paths. 
- Adoption measured weekly; deviations investigated like quality events (root cause, corrective actions). 

KPIs and metrics to track
Track both adoption and manufacturing outcomes; otherwise you will “train a lot” and change little.
- Time-to-proficiency for critical tasks (days/weeks) 
- Digital work instruction usage rate for targeted processes (% steps executed digitally) 
- Deviation rate per 1,000 units (overall and human-error tagged) 
- First-pass yield / right-first-time (process-level) 
- CAPA cycle time for human-error-driven events 
- Training completion for role-critical modules (with demonstrated competence), not just attendance 
- Audit observations linked to documentation/data integrity (target: downtrend) 

Technology and vendor considerations

Avoid “tool sprawl” by treating connected worker capabilities as a stack: (1) content/versioning, (2) execution UI at point of work, (3) evidence capture, (4) analytics, (5) identity/access, (6) integration to QMS/MES/ERP. The 2025 medtech Industry 4.0 readiness study underscores that data standardisation and ERP consolidation are often prerequisites to scaling Industry 4.0—so vendor selection should prioritise interoperability and master data alignment over feature depth. 

For regulated environments, insist on demonstrable audit trails, clear electronic record controls, and support for validation documentation practices consistent with expectations for trustworthy electronic records. 

Case example (real-world, published)
A 2024 longitudinal case study in a large medical device manufacturer documented a multi-year transition to a paperless validation system. Reported benefits included streamlined review/approval, improved handling of data integrity for large validation data volumes, and reduced opportunities for audit findings. The most prominent constraints were end-user training adequacy, resistance to change, upskilling requirements, and change communication management—a pattern worth assuming upfront in your own programme plan. 

Options comparison: digital upskilling approaches (use to choose a portfolio, not a single method) 

AI and connected systems integration while maintaining compliance

Current state and global trends (last three years)
AI adoption is increasing in both manufacturing operations and regulated products, but governance maturity lags. In Deloitte’s 2025 smart manufacturing survey, 29% of respondents reported using AI/ML at facility or network level and 24% reported deploying generative AI at the same scale, alongside significant piloting activity—evidence that AI is moving beyond experimentation for a meaningful minority of manufacturers.

On the product side, the FDA maintains a public list of AI‑enabled medical devices authorised for marketing in the United States, reflecting the scale and diversity of AI adoption in regulated devices. Peer‑reviewed analyses based on FDA authorisations show rapid growth in the number of AI/ML-enabled devices authorised, with radiology still dominant and year-on-year increases through 2023–2024. 

Regulators and standard-setters have also accelerated guidance. The FDA’s 2025 final guidance on Predetermined Change Control Plans (PCCPs) provides a mechanism to predefine, validate, and implement certain AI-enabled device modifications without needing a new marketing submission for each change—provided the PCCP is reviewed as part of the submission. 
At the international level, International Medical Device Regulators Forum published Good Machine Learning Practice guiding principles in January 2025. 
In the EU, the Regulation (EU) 2024/1689 establishes a risk-based framework for AI, with medical devices typically falling into high-risk categories and therefore facing stronger compliance expectations (risk management, QMS alignment, transparency obligations). 

Finally, connectedness raises the cybersecurity bar. FDA materials summarise statutory cybersecurity requirements for “cyber devices,” including vulnerability management plans, processes to assure cybersecure design and patching, and SBOM submission requirements. 

Key risks and opportunities
The central risk is non-auditable AI—models that improve local performance but introduce untracked changes, undocumented drift, or opaque decision logic that cannot be defended in an inspection or post-market investigation. The opportunity is to treat AI as a disciplined “quality accelerator”: AI can reduce false rejects, predict equipment drift, identify defect patterns earlier, and prioritise engineering actions—if its lifecycle is governed like any other high-impact process change. 

Practical roadmap and step-by-step implementation checklist
A board-relevant way to structure AI is to separate two portfolios with different compliance requirements:

• AI for manufacturing operations (e.g., vision inspection, predictive maintenance, anomaly detection). Primary compliance focus: validated use, data integrity, cybersecurity, change control, and documented impact on product quality. 
• AI as (part of) the medical device (SaMD/SiMD). Primary compliance focus: clinical performance, risk management, PCCP strategy for updates, cybersecurity, and post-market monitoring. 

A stepwise roadmap that works across both:

1) Define “compliance boundaries” for AI (what decisions AI can automate vs assist; what must remain human-reviewed; acceptable risk classes). Frame this in QMS language. 
2) Stand up a single AI governance model (risk assessment, documentation templates, validation approach, monitoring requirements, cybersecurity controls). Use a recognised framework such as National Institute of Standards and Technology AI RMF 1.0 as the backbone, then extend with IMDRF GMLP and device-specific regulatory needs. 
3) Ensure data readiness (known provenance, defined data quality checks, clear ownership). Deloitte’s survey notes manufacturers commonly adopt data standards (unified data model) and architecture standards—use these as prerequisites, not optional extras. 
4) Validate “model + process” together: test the AI in the real process context (operator workflow, lighting variance, batch variation, software updates). Document what changes trigger re-validation. 
5) Operationalise monitoring: drift detection, alert thresholds, and periodic review cadence; for connected devices, couple this with vulnerability monitoring and patching plans as expected under 524B for cyber devices. 
6) For AI-enabled devices, plan updates via PCCPs where appropriate: define the “planned modifications,” methods to develop/validate/implement them, and impact assessment—reviewed within the marketing submission. 

Implementation checklist (minimum viable governance for auditable AI)
- AI use case classified (manufacturing AI vs device AI) and risk-ranked. 
- Model documentation complete (intended use, training data boundaries, performance metrics, limitations). 
- Validation protocol approved and executed; evidence stored with audit trail controls. 
- Change control defined: what requires re-validation; what can be handled within a PCCP (for device AI). 
- Monitoring dashboard live (drift + performance + incident response). 
- Cybersecurity artefacts ready for connected systems (SBOM, vulnerability management plan, patching approach). 

KPIs and metrics to track
- % AI use cases that have completed governance and validation gates (portfolio health) 
- Model performance in production vs validation (drift gap) 
- False reject rate / false accept rate (for inspection AI), measured weekly 
- Mean time to detect process drift (hours/days) 
- Cybersecurity vulnerability response time (identify → triage → patch release) 
- % connected products with complete SBOMs and coordinated vulnerability disclosure process 
- For AI-enabled devices: update cadence delivered within approved change control boundaries (e.g., PCCP compliance rate) 

Technology and vendor considerations
For manufacturing AI, prioritise: (1) audit trails for data/model/parameter changes,

(2) integration into MES/QMS workflows,

(3) edge reliability (offline tolerance), and

(4) cybersecurity posture aligned to connected environments.

For device AI, prioritise:

(1) lifecycle documentation support,

(2) post-market monitoring hooks, and

(3) change control tooling that can map directly to PCCP constructs. 

Avoid vendor lock-in by requiring model portability and documented interfaces—especially where the enterprise is consolidating data models and architecture standards. 

Case example (plausible, anonymised)
A global Class II manufacturer deploys computer-vision inspection for a manual assembly step driving recurring scrap. The initial pilot improves detection but creates line friction due to false rejects. The company re-frames the system as “AI + process”: it validates lighting control, operator UI prompts, and exception workflows; sets weekly drift reviews; and formalises re-validation triggers when camera firmware or model weights change. The programme becomes a measurable quality lever (lower scrap and faster root cause), while creating inspection-ready evidence through controlled electronic records. 

Options comparison: AI governance frameworks and how to use them together 

Supply chain resilience via regionalisation and traceability

Current state and global trends (last three years)
Medical supply chains remain vulnerable, with persistent volatility even after acute pandemic disruptions. A 2024 Organisation for Economic Co-operation and Development report notes that the pandemic strained already stretched medical product supply chains due to demand spikes and bottlenecks, and argues that urgent action is needed to curb shortages routinely and during crises. 

Industry surveys and thought leadership over 2023–2026 show a continued pivot towards resilience strategies (digitisation, regionalised footprints, buffers) amid changing risk drivers such as tariffs and trade restrictions. entity["company","McKinsey & Company","management consultancy"] highlights ongoing supply chain turbulence and the need for digitisation and proactive risk management, including board-level engagement. 
Boston Consulting Group frames the challenge as balancing cost competitiveness with agility through a “cost of resilience” mindset, pointing to structurally different supply chain operating models rather than incremental tweaks. 

Traceability is becoming a reinforcing pillar, not an administrative burden. In the US, device labels and packages must bear a UDI under 21 CFR Part 801 Subpart B, enabling identification through distribution and use. 

In the EU, the digital infrastructure for traceability is advancing rapidly: the European Commission confirmed that four EUDAMED modules (including Actor registration and UDI/device registration) become mandatory from 28 May 2026. 

Key risks and opportunities

The major risk is brittle single points of failure: sole-source suppliers, region-specific disruptions, and lack of timely visibility into where affected lots and components are located—turning a manageable disruption into a prolonged shortage or a costly recall. EU law changes explicitly recognise the relevance of supply interruption/discontinuation obligations alongside EUDAMED rollout, signalling growing policy interest in continuity of supply for critical devices. 
The opportunity is to treat resilience as a performance capability: fewer expedites, higher service levels, less costly compliance response during disruptions, and faster containment when issues occur—especially when traceability is integrated into the manufacturing “digital thread” rather than maintained as a separate regulatory spreadsheet. 

Practical roadmap and step-by-step implementation checklist
A workable approach is “Regionalise what matters; trace everything that matters”:

1) Segment your portfolio by patient criticality and substitution risk (not only by revenue). This aligns to the OECD focus on preventing shortages that affect care. 
2) Map critical BOM nodes (single-source parts, long lead tooling, sterilisation capacity, key electronics) and quantify time-to-recover. 
3) Choose a regionalisation model per category (see comparison table below). Don’t “nearshore everything”; nearshore fragility. 
4) Embed traceability at design and process level: UDI alignment, serial/lot capture at key steps, and clean master data so downstream reporting isn’t manual. 
5) Connect supplier quality to traceability: quality agreements must include data standards, change notification, and (for connected products) cybersecurity supply chain artefacts such as SBOM components where relevant. 
6) Operationalise disruption playbooks: pre-approved alternate materials, validated alternate suppliers, and clear decision rights for allocation during shortages. 

Implementation checklist (regionalisation + traceability)

- Critical device list and “no-interruption” threshold defined. 
- Supplier concentration ratio for critical parts (top 10) documented. 
- Alternate supplier qualification pathway defined and time-boxed. 
- UDI data governance in place (ownership, change control, data quality checks). 
- EUDAMED readiness plan (actor registration, UDI/device module processes) on track for May 2026. 
- Lot/serial trace capture validated at internal handoffs (receiving → WIP → finished goods → distribution). 

KPIs and metrics to track

- Critical-part single-source exposure (% of critical BOM spend with single supplier) 
- Lead time variability for critical components (std dev / mean) 
- Supply disruption “time to recover” (days) for top risk scenarios 
- Supplier quality ppm and audit status for critical suppliers 
- Traceability completeness (% lots/serials with complete upstream/downstream links) 
- Recall/field action execution speed (time to identify affected units and customers) 
- Expedite cost as % of COGS (should fall as resilience improves) 

Technology and vendor considerations

Resilience and traceability typically require: master data management, supplier collaboration portals, track-and-trace/event capture, and analytics (“control tower” visibility). But technology alone will not fix fragmented data; the medtech Industry 4.0 readiness study emphasises standardising databases and ERP as prerequisites for scaled digital programmes. 
For EU market readiness, ensure systems can support EUDAMED-related data flows and governance processes as the mandatory use date approaches. 

Case example (plausible, anonymised)

A manufacturer of sterile disposable devices experiences repeated late deliveries due to sole-source packaging material from a single region. It pilots a dual-region sourcing model: regional supplier qualification (with validated alternate material), and a traceability upgrade capturing lot genealogy and packaging component IDs at pack-out. When a supplier disruption occurs, the company switches supply without pausing shipment, and traceability enables rapid containment when a packaging defect is detected—reducing both shortage risk and the cost of response. 

Options comparison: regionalisation models 

Regulatory evolution and market access

Current state and global trends (last three years)
Regulatory evolution is reshaping manufacturing in three ways: (1) QMS and inspection expectations, (2) digital regulatory infrastructure, and (3) capacity constraints and transition management.

In the US, the FDA’s QMSR became effective on 2 February 2026, explicitly incorporating ISO 13485:2016. Operationally, this increases the value of harmonised, globally consistent QMS design and reduces the logic for separate “US-only” quality subsystems—particularly for manufacturers already operating under ISO-based regimes elsewhere. 

In the EU, the MDR/IVDR transition remains a major strategic variable. Regulation (EU) 2023/607 amended transitional provisions due to capacity and preparedness constraints, explicitly referencing the risk of shortages if devices cannot be certified in time. The European Commission’s December 2025 report notes that 51 notified bodies were designated under the MDR and 19 under the IVDR at that point, reflecting progress but also the scale of the system.

Digital regulatory infrastructure is moving from “future” to “mandatory now.” Regulation (EU) 2024/1860 enables a gradual roll-out of EUDAMED modules once verified as functional. Following Commission Decision (EU) 2025/2371, the European Commission states the first four modules become mandatory from 28 May 2026. This shifts regulatory operations from document-centric compliance to data-centric compliance, and in practice forces manufacturers to integrate regulatory data flows into day-to-day operations. 

In the UK, regulatory reform is progressing on both post-market and future pre-market rules. The Medicines and Healthcare products Regulatory Agency has published a revised roadmap (December 2024) and guidance on new post-market surveillance requirements that came into force on 16 June 2025, with stated intentions to strengthen PMS and improve traceability of incidents and trends. 

Globally, market access is also shaped by audit models and reliance mechanisms. The Medical Device Single Audit Program is positioned by regulators as a single audit approach that can satisfy multiple participating jurisdictions, and authorities have supported remote/hybrid audit pilots to maintain audit continuity. For manufacturers, this changes the cost curve of market expansion: investing in a mature, standardised QMS can pay back through reduced audit duplication and faster market readiness. 

Key risks and opportunities
The risk is transition whiplash: overlapping systems, shifting timelines, and capacity bottlenecks (notified bodies, auditors, internal RA/QA bandwidth) causing product delays or forced portfolio rationalisation. EU law changes and Commission reporting explicitly frame the risk of supply shortages as a policy concern, which can translate into higher expectations on manufacturers to manage transitions and supply continuity proactively. 
The opportunity is to transform “regulatory work” into a higher-throughput capability: faster submissions, fewer audit findings, better inspection readiness, and improved quality economics (less rework, faster release) by digitising evidence and standardising systems globally. 

Practical roadmap and step-by-step implementation checklist

A market access roadmap that ties directly to manufacturing performance:

1) Build a living, global regulatory requirements map for your portfolio (US QMSR, EU MDR/IVDR transition conditions, EUDAMED data obligations, UK PMS). Keep it connected to product families and sites. 
2) Unify QMS design around ISO 13485-aligned processes and confirm readiness for QMSR inspections. Target “one way of working” with market-specific appendices, not parallel systems. 
3) Digitise regulatory data flows: treat EUDAMED and UDI as master-data-backed processes with ownership, validation, and release controls. 
4) Industrialise post-market surveillance operations: integrate complaint handling, trending, and field action execution into the same operational data backbone; the UK explicitly frames PMS strengthening as a major reform step. 
5) Use audit leverage where possible (e.g., MDSAP participation strategies) and plan for audit modality changes (remote/hybrid). 

Implementation checklist (market access “control points”)
- QMSR impact assessment completed; inspection approach updated. 
- EU transition portfolio plan with notified body engagement and internal resourcing. 
- EUDAMED readiness: actor registration, device/UDI processes, certificate process integration, market surveillance interface plan (by May 2026). 
- UK PMS requirements operational and embedded from June 2025 onward (procedures + metrics + training). 
- Single-audit strategy assessed (where MDSAP is commercially relevant) and remote audit capabilities validated. 

KPIs and metrics to track

- Time from design freeze to regulatory submission (days) 
- Submission “right-first-time” rate (avoid deficiency cycles) 
- Audit findings per audit and repeat findings rate 
- EU certification throughput (certificates/month) and pipeline ageing 
- EUDAMED data quality (error rate, rework hours) 
- PMS responsiveness (time to close investigations; trend detection lead time) 

Technology and vendor considerations

Regulatory evolution is pushing organisations towards interoperable platforms for eQMS, regulatory information management, master data, and document control—because obligations are increasingly data-centric (UDI/EUDAMED) and lifecycle-centric (cybersecurity, AI updates, PMS). Selection criteria should emphasise auditability, integration, and validated change control—not simply “feature count.” 

Case example (plausible, anonymised)

A mid-size manufacturer selling into the US, EU, and UK rationalises its QA operating model: it re-baselines SOPs to align with ISO 13485 expectations supporting US QMSR, implements a single master product data model feeding both UDI registries and internal traceability, and digitises validation artefacts. The result is fewer audit observations, faster product change implementation (because evidence is captured electronically), and reduced regulatory operations rework as EUDAMED moves towards mandatory use. 

The winners in this next cycle will not be the firms that run the biggest compliance projects. They will be the ones that redesign operations so compliance evidence is produced naturally by excellent execution: work done once, captured digitally, traceable end to end, and inspection ready by default. Start with a clear value thesis, prove it through a handful of lighthouse use cases, embed governance that satisfies regulators by design, then scale through standard platforms, training, and metrics. In short, treat compliance as the baseline and performance as the strategy.