If I recall in Part 11 compliance (which is how the FDA regulates software in the US) one is required to ensure that "Passwords are not remembered by [browsers] and applications."

From an ISO/IEC/IEEE 29148 perspective the language might be "shall not remember passwords" which would imply a legally binding requirement for compliance purposes.

This doesn't preclude applications from using autocomplete on form entry from password managers; just that the browser is not allowed to remember the entered password.

However in practice I've seen most systems deploy their applications on a target platform that runs the browser in "kiosk" mode, which if I recall from the time, was an IE-only thing. In more modern times we're starting to see consumer-level tablets and devices enter the mix and I'm not even sure if those can be locked down into a multi-user/kiosk type mode. Regardless... the web is a difficult platform for this kind of stuff.

Good thing that the NIST published updated recommendation on passwords, it supersedes all these previous regulations.

I love the NIST. That's good to hear.

If you want the browser to conform, you do control the browser. It isn't hard to set it up so it doesn't do autocomplete.