Perspectives on regulatory challenges, decision-making, and maintaining a defensible scope over time

AI can produce a regulatory answer in seconds. It can summarise a regulation, suggest a classification, create a market-entry pathway or draft a checklist. But a useful answer is not necessarily a defensible one. Can you explain which product, market, regulatory assumptions and source material the answer was based on? Can a colleague review it? Can the organisation reassess it when the regulation, product or intended market changes? For Regulatory Affairs, those questions mat

Regulatory work is rarely a single task. A product may already be established in one market while the team is assessing entry into another. Existing applicability decisions may be spread across spreadsheets, documents and individual expertise. New developments may affect decisions that were made months or years ago. Compliance Studio brings these activities together around one central construct: the Regulatory Position. A Regulatory Position is the documented regulatory cont

There is a comforting assumption behind regulatory monitoring: if something important changes, we will find it. For a long time, that was a reasonable assumption. Regulatory Affairs knew its authorities, its legislation and the sources worth following. A medical device team watched medical device regulation. Pharma watched the medicines authorities. Global teams followed the major jurisdictions and local teams kept an eye on what happened closer to home. The challenge was ke

Regulatory work rarely happens in isolation. Positions need to be reviewed, questions need input from colleagues, and decisions often involve people across different roles and functions. With the new collaboration features in Compliance Studio, you can now bring those people directly into your project. Invite your whole team — for free Compliance Studio now lets you invite an unlimited number of team members to your project as Editors or Viewers. Editors can actively contribu

Continuous regulatory awareness built around your Regulatory Positions Every regulatory team monitors regulations. Newsletters arrive every week. Regulatory authorities publish updates. Consultants share summaries. Regulatory intelligence platforms generate alerts. Yet many organisations still struggle with the same problem. The real challenge is rarely finding regulatory information. It is understanding whether a regulatory development is actually relevant to your products,

If you work in Regulatory Affairs today, you have probably already been asked: "Where should we use AI?" or perhaps even, "Why aren't we using it yet?" Over the past year, AI has shifted from a future vision to a present reality for many regulatory teams. Some organisations have already integrated the technology into parts of their work. Others are still evaluating where it best fits. Some remain sceptical, while others see AI as the biggest opportunity the profession has exp

Imagine this: Your next MDR technical documentation is reviewed by an internal AI system before anyone on your team opens the file. It identifies three inconsistencies against EN ISO 14971, highlights two recent regulatory updates that could affect your intended claims, and points to a previous design decision that may no longer be defensible. Your regulatory team reviews the findings, agrees with most of them, rejects a few and documents the rationale behind every decision b

A few years ago, a Regulatory Affairs Director told me a story that has stayed with me ever since. His team had spent several weeks re-examining a regulatory position that nobody had questioned in almost seven years. The exercise had not been triggered by a finding, a warning letter or a challenge from a notified body. There was no crisis. No corrective action. No obvious reason to revisit the decision at all. The position had survived multiple audits, multiple product update

“How do you know the list is complete?” It is a question that should appear at the centre of regulatory governance. Strangely, it almost never does. Regulatory teams ask many other questions. Has the technical documentation been updated? Has the latest guidance been reviewed? Has the notified body comment been addressed? Has the regulatory update been assessed? Has the market requirement been implemented? All of these questions matter. None of them are trivial. But they share

There is a particular kind of audit conversation that rarely begins dramatically. No one has found a missing certificate. No procedure has collapsed. No one has discovered that the company ignored a regulation it should have known about. The discussion begins with something much smaller, and usually more polite. The auditor reads a conclusion, looks up from the file and asks why the organisation reached it. The answer is given. The regulatory team explains the decision, refer

If a notified body challenged your current list of applicable regulatory requirements and standards tomorrow, how confident are you that your organisation could explain every decision behind it? Not just why MDR applies. Not just why GDPR appears on the list. But why one regulation was included while another was excluded. Why a requirement was considered relevant. Why a local implementation was deemed equivalent to the European version. Why a regulatory update was assessed as

Most regulatory teams have a way of working that feels structured. There is an applicable list. Updates are tracked. Decisions are documented. The process fits the organisation, and over time it becomes accepted as “how we do regulatory.” From the inside, it looks like control. But when that same structure is tested outside the organisation — in an audit, an inspection, or a due diligence process — something changes. Questions that should have straightforward answers suddenly

Regulatory compliance is rarely where organisations fail. The real failure point is reconstructability. Most life science organisations already make regulatory decisions every day. The problem is not whether decisions exist, but whether those decisions can be reconstructed consistently, on demand and over time. This is where regulatory governance often starts to break down. In many organisations, regulatory reasoning is spread across emails, spreadsheets, documents, risk file

The development of Compliance Studio originated from a recurring observation in regulatory practice. Across more than 200 interviews with Regulatory Affairs and Quality Assurance professionals in medical devices, IVD, pharmaceuticals, and biotechnology, a consistent pattern emerged. The central challenge was not access to regulatory information, nor a lack of tools. Instead, it concerned the ability to determine and maintain a correct regulatory scope for a given product acro

Determining regulatory scope has always been a foundational task in Regulatory Affairs. It concerns which regulations apply to a given product, across which markets, and how that evolves over time. In practice, this has rarely been established as a stable construct. Instead, it is built and maintained through a combination of regulatory interpretation, internal documentation, and accumulated experience. This approach can function operationally. However, it introduces recurrin

Most discussions about the MDR and IVDR transition focus on deadlines, delays, and notified body bottlenecks. But for many manufacturers, the real, lasting effect has emerged elsewhere. The transition has not just changed when things need to be done—it has changed how regulatory scope must be defined, structured, and defended. For the first time in years, the question is no longer just whether requirements have been identified, but whether the very structure for managing th

Most regulatory teams believe they have control over their Applicable List. It exists. It gets updated now and then. It has worked so far. But audit exposure rarely arises from obvious omissions—a forgotten regulation, an overlooked standard. It emerges more subtly. It begins when confidence in the list's reliability gradually erodes, without anyone really noticing. As regulatory scope expands—across markets, product variations, and new domains such as cybersecurity and AI—ma

Regulatory failures rarely start with a warning letter, a rejected submission, or a failed audit. They usually start much earlier, with small assumptions, unclear ownership, or requirements that nobody realised they were responsible for. The following cases are based on real patterns observed in audits, MDR reviews, and industry practice. The companies are anonymous and composite, but the situations are entirely realistic. Case 1: The Requirement Nobody Owned The situation A

Most Applicable Lists are built around a single primary framework. For medical device manufacturers, that framework is often MDR or IVDR. The structure reflects the regulation: articles, annexes, essential requirements. Applicability decisions are made within that defined scope, documented, and maintained accordingly. This model works as long as regulatory obligations are treated as largely self-contained. Increasingly, they are not. When scope no longer fits inside one regul

Traceability problems in applicability rationales Most organisations can point to an Applicable List and say, “This is where our applicability decisions live.” On paper, that suggests control. In practice, many teams find that while decisions are documented, the reasoning behind them is far less robust. The decision is there, but the path that led to it is harder to follow. Over time, rationales fade, fragment, or become tied to specific individuals. What remains is an applic