FDA's final guidance on cybersecurity in medical devices, with quality management system considerations and premarket submission content, was issued in February 2026. It covers design, labeling and documentation FDA recommends for devices with cybersecurity risk, and addresses section 524B of the FD&C Act for cyber devices.
What the FDA page says
The FDA page marks the guidance as final and issued in February 2026, with the page last updated on 3 February 2026. It supersedes the earlier guidance titled Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions, issued 27 June 2025. The docket number is FDA-2021-D-1158.
The page says the guidance gives recommendations on cybersecurity design, labeling and the documentation FDA recommends in premarket submissions for devices with cybersecurity risk. It aims to promote consistency, support efficient premarket review and help ensure marketed devices are resilient to cybersecurity threats. It also addresses section 524B of the FD&C Act for cyber devices.
What we could not confirm
The page text does not detail the SBOM, secure product development framework or postmarket plan recommendations. Those sit in the full guidance document, which you can download from the page. We have not summarized them here, so read the document before you write them into a plan.
How to use this if you build devices or device software
- Download the final document and track it against the version your team used before. The title and issue date changed.
- Map your current submission package to the sections on design, labeling and documentation.
- Check section 524B applicability for each product with your regulatory team.
- Keep your software inventory current. Whatever the exact SBOM wording, a complete and current list of components is the base for any such recommendation. See our buyer's guide to SBOM tools for medical devices.
- Confirm with counsel or a regulatory specialist before relying on a summary, including this one.
If you buy devices rather than build them
Hospitals can use the same logic when they ask vendors questions. Ask whether the vendor can provide a component list, how it handles vulnerabilities after sale, and how it distributes updates. HICP practice 9 on network connected medical devices, covered in our HICP post, sets the buyer side.
A reading plan for the full document
Because the page summary is short, set aside time for the guidance itself. Read the scope first, to confirm which devices it covers. Then read the sections on design and labeling, the documentation section, and anything that mentions section 524B. Note every place that refers to a component list, an update plan or a vulnerability process, and ask who in your organization owns each. Finish by comparing the document with the version your team used before, since the title changed.
Quick check
Is the 2026 guidance law?
FDA guidance documents describe the agency's current thinking and recommendations. Section 524B is part of the statute. Confirm the legal effect with a regulatory specialist.
Which guidance did it replace?
The FDA page says it supersedes the guidance issued on 27 June 2025 under the earlier title.
Safeguard can generate SBOMs and scan dependencies for device software, and automate parts of compliance evidence. It does not provide regulatory advice.
Sources
Last reviewed: 19 October 2026.
