How do you keep up with regulatory changes in life sciences? | Affirm8

Regulations, guidance and standards change constantly. For a small quality team, keeping up can feel impossible. Many sites end up reacting only when an auditor or customer points out that a procedure is out of date. By then, the change has become a finding.

Why regulatory change catches sites out

Most teams don't miss changes because they don't care. They miss them because nobody owns horizon scanning, the sources are scattered and the day job always comes first. Changes arrive by email, sit unread, and are only discovered when they are already in force.

“You can't control when regulations change. You can control how quickly you respond.”

Craig Jacobs, Founder and Chief Momentum Officer, Affirm8

A five-step horizon-scanning routine

1. Choose your sources. List the regulators and bodies relevant to your products and markets, such as the MHRA, EMA, FDA and ISO, plus sector bodies and a trusted briefing. Subscribe to their update services.
2. Give it an owner. Assign one person to scan sources on a set day each week or month. Rotate the role if needed, but make someone responsible.
3. Log every change. Record each change in a simple register with the source, date, summary and whether it applies to you.
4. Assess the impact within a set window. For changes that apply, complete an impact assessment within an agreed time, such as fourteen days. Identify which procedures, training, documents or products are affected.
5. Track actions to closure. Treat resulting updates like any other action, with owners and due dates, and report progress in management review.

Recent changes that show why it matters

Two recent examples show how quickly the landscape can move. The FDA's Quality Management System Regulation took effect in February 2026, aligning US medical device quality system requirements with ISO 13485. And the ISO 9001:2026 revision brings changes that certified organisations will need to work through. Sites with a routine in place can plan these calmly. Sites without one end up rushing.

Update your QMS without a major project

Small, regular updates are far easier than a large rewrite every few years. Keep a rolling list of changes and build them into normal document reviews. Where a change is significant, plan it as a project with clear milestones. Either way, record your assessment so you can show an auditor how you responded.

Common mistakes to avoid

• Relying on memory. Without a register, changes get lost.
• Assessing without acting. An impact assessment is only useful if the actions get done.
• Ignoring customer requirements. Customers change their requirements too, and these can matter as much as regulation.

Where to start this week

1. List the regulators, standards and customer requirements that apply to your products and markets.
2. Set up a simple regulatory change register, even if it starts as a spreadsheet.
3. Name an owner and book a recurring slot in their diary for scanning and logging changes.

Then look back over the last twelve months and check whether any significant changes were missed. That review often reveals gaps worth closing straight away, and it gives your new routine a clear starting point. Share the register in management review so leaders can see the regulatory picture at a glance.

Frequently asked questions

What is regulatory horizon scanning?

It is a routine process of monitoring upcoming and new regulatory changes so an organisation can assess and plan its response before the changes take effect.

How often should we review regulatory updates?

Weekly or monthly scanning works for most sites, with a fixed deadline for completing impact assessments on relevant changes.

How Affirm8 can help

Affirm8's weekly newsletter, The Quality Management Signal, tracks regulatory changes for UK life sciences leaders. Our regulatory radar service goes further, with tailored monthly briefings and impact assessments within fourteen days, so your QMS stays current. Start with the free Always Audit-Ready Diagnostic at affirm8.co.uk.

Related reading

• How do you get beyond “human error” in root cause analysis?
• How do you build a quality culture that lasts?