Upcoming deadlines
MyHealth@EU: one week until the entry into force of the authentication rules
EU · digital health and conformity assessment · adopted regulation - reminder T–7
Implementing Regulation (EU) 2026/2099 on identification and authentication for cross-border exchanges of health data via MyHealth@EU enters into force on 12 October. Its main application starts on 26 March 2027, with individual provisions having later dates. For certain means of electronic identification, the regulation allows for the confirmation of the assurance level by a conformity assessment body, along with the route through a notified scheme. This concerns healthcare providers, national contact points and identification solution providers. They should differentiate the dates, establish the applicable route and plan the evidence. The entry into force does not mean that all technical obligations or a new universal certification start on 12 October.
New data in radioactive waste return documents
EU · nuclear safety and regulatory traceability · adopted act - first coverage of upcoming deadline
Decision (EU) 2026/2209, published on 2 October, amends the standard document for the supervision and control of shipments of radioactive waste and spent fuel. The registration number of the initial shipment authorisation is added to return applications in order to link the documents and facilitate verification by the competent authorities. Parts A-1 and B-1 of the form of Decision 2008/312/Euratom are replaced. The amendment enters into force on 9 October, seven days after publication. Holders, consignors and relevant control units should check the templates used, the availability of initial authorisations and the traceability of data when preparing return applications.
EMA: plan for changes to authorisations before the end of the year
EU · medicinal products · procedural guidance - submission planning
EMA published on 1 October guidance for the submission of type I variations to marketing authorisations by the end of 2026. For holders who want an outcome on type IA variations this year, the agency recommends submission by 20 November. For type IB variations, including related group applications, the recommended date is 30 November if the procedure is to start in 2026. These are planning guidelines and not new legal deadlines or a guarantee of completion. Later submissions will be processed, but the outcome or start may be pushed back to January 2027. Regulatory teams should check the variation calendar, completeness of dossiers and dependencies on manufacturing changes.
FDA: One month until electronic opinions for herbal medicines
USA · pharmacy, testing and quality standards · consultation — reminder T–30
FDA is accepting submissions on the development of herbal medicinal products under a consultation published on September 4. The electronic deadline is November 3, 2026, 11:59 p.m. Eastern Time — November 4, 6:59 a.m. in Sofia. Today marks the T–30 threshold on the Sofia calendar date. This is a request for information, not a new authorization or change to mandatory standards. Topics include quality, batch-to-batch consistency, evidence, and standards development. Manufacturers and laboratories interested in the U.S. drug market may prepare specific examples of testing and reproducibility. Paper submissions are subject to a separate November 3 deadline.
Strategic Watch
Bulgaria expands audit functions for European funds
Bulgaria · European funding, audit and verification · active baseline — first coverage
Decree No. 165 of 29 September 2026, published in the State Gazette, issue 91, expands the scope of the Executive Agency for the Audit of European Union Funds with the Social Climate Fund and the SAFE instrument. The changes are effective from 2 October. The checks for legality of expenditure and reliability of reports have been specified, and audit and methodological responsibilities, including for risk-based verification, are distributed between three directorates. This is important for managing structures, beneficiaries and implementers of the affected programs. They should verify the responsible units, applicable instructions and traceability of expenditure evidence. The act changes the institutional audit framework; it does not introduce a universal requirement for a new certificate for enterprises.
France proposes stricter proof for photovoltaics with reduced VAT
France / suppliers from the EU and other markets · photovoltaics, testing and certification · notified project - first coverage
France notified on 1 October a draft on the conditions under which residential photovoltaic installations up to 9 kWp receive a VAT of 5.5%. The draft foresees resistance to hail of 5 cm at -20°C, proof of the carbon assessment and requirements for the qualification of installers. Class RG 5 gives a presumption of compliance with the hail resistance criterion. Assessment by an accredited certification body, traceability of production sites and a certificate with a maximum validity of 12 months are foreseen. The proposed start is 1 December 2026, but the text has not yet been adopted. Manufacturers, exporters, laboratories and certification bodies should assess their testing capabilities and technical files. This is a condition for tax relief, not a general ban on access to the French market.
EU KIDS Act: consultation on certified age verification solutions
EU · digital services, AI and age verification · consultation - legislative proposal
The European Commission is accepting opinions on the EU KIDS Act proposal until 26 November. The proposal COM(2026)681 was presented on 17 September and the feedback page was updated on 2 October. It is not yet a regulation in force. The envisaged solutions and electronic certificates for age verification, certified by public authorities and included in European lists, are key to assessing compliance. Future acts should specify the technical, organisational and security requirements. Providers of digital services and identification solutions should review Articles 29-31 and prepare opinions on reliability, data protection and evidence. The draft does not create an immediate obligation for a new certificate.
The British Software Initiative is not evidence of assessed compliance
United Kingdom · cybersecurity and vendor assessment · active baseline — official clarification
On 1 October, the UK government added an explicit clarification to the Software Security Ambassadors Scheme: the initiative is not an assessment scheme and membership should not be used as a criterion for award or tendering. The self-assessment tool is recommended for assessing compliance with the voluntary Software Security Code of Practice. The clarification affects software vendors, purchasing organisations and consultants who use public commitments as evidence of security. Procurement and audit teams should review the questionnaires, criteria and marketing claims. Participation in the initiative should not be equated with independently verified compliance or accredited certification.
ISO adopts Paris Declaration on Standards and Risk Resilience
International · standardization and risk management · international strategic signal
On 1 October 2026, ISO members adopted the Paris Declaration, which places voluntary standards among the tools for anticipating, measuring and managing risks. The document links future standardization work to climate adaptation, ecosystem resilience and sustainable development. It is an institutional strategic statement, not a new standard, law or additional certification requirement. The signal is important for technical committees, conformity assessment bodies and enterprises developing risk management systems. The practical next step is to follow up on the specific work programmes and draft standards. The possible future impact on evidence and audits remains a prospect for monitoring, not an active obligation.
Published by MG Global in partnership with ERPI.
English 
Български