FDA Recognition List 066: managing evidence boundaries, not just updating a standards register

Publication context. This article discusses FDA Recognition List 066, published in the Federal Register on 24 August 2026 and applicable on the same date. It is intended as professional regulatory commentary, not legal advice.

FDA's Recognition List 066 is easy to misread as a routine standards-maintenance event. It is more consequential than that. The update affects the evidentiary architecture behind US premarket submissions across biological safety, manufacturer-supplied information, cybersecurity, interoperability, and a broad range of device-specific technologies. It also reinforces a point that global regulatory teams sometimes overlook: an ISO or IEEE standard, the FDA's recognition of that standard, and the evidence needed for a particular submission are three related but distinct things.

FDA recognizes voluntary consensus standards under section 514 of the Federal Food, Drug, and Cosmetic Act to support portions of device premarket review. A Declaration of Conformity (DoC) can therefore be a highly efficient way to address defined requirements. It does not, however, replace the manufacturer's product-specific case for safety and effectiveness, nor does it remove the need to examine the FDA-recognized extent of a standard and any relevant supplementary information.

Recognition List 066: broad portfolio impact, focused governance response

Recognition List 066 adds, replaces, withdraws, corrects, or changes the extent of recognition for standards used in premarket submissions and other device requirements. The list includes updates across biocompatibility, cardiac valves and vascular devices, high-frequency surgery, MRI safety marking, dialysis fluids, orthopaedic implants, powered wheelchairs, radionuclide calibrators, point-of-care communication, and dental devices. It also newly recognizes IEEE Std 1752.1-2021 for representation of metadata, sleep, and physical-activity measures.

For regulatory-affairs and quality leaders, the right response is not a blanket migration exercise. It is a portfolio-level impact assessment that links every affected standard to active and planned US submissions, DoCs, testing strategies, templates, and controlled procedures. The highest-risk gaps arise where a global document cites a current international edition without recording the FDA-recognized version, limitations, or transition date.

Biological evaluation: ISO 10993-1:2025 is recognized, but not in full

The updated FDA record for ISO 10993-1:2025 (Recognition No. 2-313) is especially significant because biological evaluation sits at the core of so many device development programmes. FDA specifies partial recognition: the phrase "consumer products" in Clause 6.5.11.3 and Clause 6.9 on biological risk estimation are not recognized. FDA explains that these provisions conflict, respectively, with its existing guidance and with the FDA-recognized ISO 14971:2019 approach.

The supplementary information sheet goes further. FDA notes that the additional genotoxicity-evaluation requirements in Tables 2 to 4 and Clause 6.5.7 may not align with the Agency's ISO 10993-1 guidance for all prolonged-contact devices. It also encourages manufacturers to consult the appropriate review office before implementing provisions related to intermittent contact, bioaccumulation, reasonably foreseeable misuse, and life-cycle application.

This is not a semantic detail. A biological evaluation report prepared to the unqualified full text of ISO 10993-1:2025 may not map cleanly to the FDA-recognized scope. A robust US strategy should therefore make the boundaries visible in the Biological Evaluation Plan (BEP), Biological Evaluation Report (BER), test rationale, and standards matrix.

Operational principle: Do not state only that the device "conforms to ISO 10993-1:2025." State the FDA recognition number, the extent of recognition, the applicable transition decision, and the product-specific rationale for any approach affected by FDA's notes.

FDA will accept DoCs to the superseded ISO 10993-1:2018 record (No. 2-258) in support of premarket submissions until 1 July 2029. New projects should make an intentional, documented baseline decision rather than allow the cited edition to vary by supplier, laboratory, or protocol.

Manufacturer information and labeling: ISO 20417:2026 becomes a cross-functional change

FDA completely recognizes ISO 20417:2026 (Recognition No. 5-149), which replaces the recognized 2021 edition. The standard addresses information supplied by the manufacturer, including identification, labels, packaging, marking, and accompanying information. The FDA record explicitly links it to US requirements such as 21 CFR Parts 801, 809, and 820, as well as UDI and relevant IMDRF labeling principles.

That makes the impact broader than a label artwork review. The change should trigger an assessment of the quality-system processes controlling content creation, review, approval, translation, change control, and US submission consistency. It is also directly relevant to IVD manufacturers even though List 066 does not add a new entry in the IVD category itself. The prior recognized edition remains usable for DoCs until 1 July 2029.

Cybersecurity and software: a CVSS transition is not a cybersecurity case

List 066 extends the transition period for FIRST CVSS v3.1 (Recognition No. 13-142). FDA will accept DoCs to CVSS v3.1 until 2 July 2028, after which it will be superseded by CVSS v4.0 recognition. Yet the corresponding FDA supplementary information sheet is explicit: conformity to the standard may not satisfy all cybersecurity requirements in section 524B of the FD&C Act or the Agency's cybersecurity guidance.

This distinction should be embedded in submission planning. CVSS can support a consistent vulnerability-severity framework, but it does not itself demonstrate secure-product design, threat modeling, vulnerability-management processes, labeling, or the broader cybersecurity documentation FDA recommends for devices with cybersecurity risk. FDA's current cybersecurity guidance addresses precisely those design, labeling, and premarket-documentation expectations.

The list also replaces the prior recognition of IEEE 11073-10207 with the 2017 standard including Corrigendum 1:2025 for service-oriented point-of-care medical-device communication. In parallel, it newly recognizes IEEE Std 1752.1-2021, which defines representations for mobile-health minimum metadata and sleep and physical-activity data and is technology-agnostic with respect to the devices or apps that produce such data.

This is valuable for interoperability and data-format arguments. It is not, by itself, evidence that a digitally derived measure is clinically meaningful, analytically valid, or fit for its intended use. FDA's August 2026 paper on digitally derived measures states that a digital health technology used to generate a DDM should be verified and validated to be fit for purpose, supported by evidence appropriate to the DDM's selection, relevance, and validity.

A practical response: treat the list as a controlled standards-monitoring event

The strongest immediate action is to turn List 066 into a formal, traceable change record rather than an email alert. The assessment should be owned jointly by Regulatory Affairs, Quality Assurance, R&D, Clinical/Medical, Cybersecurity, and Labeling, with proportionate involvement from external test laboratories or toxicologists where needed.

The global lesson: alignment does not mean equivalence

FDA recognition is not the same as harmonization under the EU MDR or IVDR. Global teams can reuse sound underlying evidence where it is technically relevant, but they should not automatically carry FDA supplementary-information limitations into EU documents, nor assume that an EU harmonization status resolves US recognition questions. Each jurisdiction needs its own regulatory mapping, even when the same test report, risk analysis, or labeling evidence supports more than one market.

Recognition List 066 is therefore best understood as a governance test. Manufacturers that can distinguish standard edition, FDA-recognized scope, and product-specific evidence will be better positioned to protect submission timelines and avoid avoidable questions during review. The immediate goal is not to cite the newest standard everywhere. It is to make a deliberate, transparent, and defensible choice about what each standard proves, and what it does not.