FDA cybersecurity requirements for cyber devices

Section 524B of the FD&C Act applies to relevant premarket submissions from March 29, 2023. It addresses vulnerability management, processes supporting cybersecurity and updates, and a software bill of materials (SBOM). FDA's February 2026 final guidance, which replaced the June 2025 version, gives recommendations on device cybersecurity and submission documentation; those recommendations are separate from the statutory requirements. Next key date: none recorded. Last verified October 29, 2026.