Does FDA 524B Apply to Auto-Injectors?

The lead center alone does not determine the cybersecurity evidence appropriate for a combination product. Assess the device constituent, direct and indirect internet connectivity, and marketing pathway. Do not equate a BLE, NFC, USB, or other interface alone with the complete statutory definition.

Why this matters

Connected auto-injectors can introduce risks across firmware, companion apps, and supporting services. Apply device-specific security risk management and confirm the regulatory pathway rather than assuming every combination-product application is a Section 524B submission.

Official sources: FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026); FDA Cybersecurity in Medical Devices FAQs (Section 524B); FDA Cybersecurity resources for medical devices.

When 524B Attaches to an Auto-Injector

Section 524B(c) requires all three elements: sponsor-validated, installed, or authorized software, ability to connect to the internet, and characteristics that could be vulnerable. Indirect internet access through a companion device matters; an interface alone is not sufficient.

The fastest applicability check:

• Does the injector have firmware or programmable logic? If no, 524B does not apply.
• Does the injector have any electronic interface (BLE, NFC, USB, serial, cellular, optical pairing)? If no, 524B does not apply.
• Assess actual internet-connectivity ability and vulnerability characteristics, then confirm whether the submission pathway is covered by Section 524B.

Purely mechanical spring-driven auto-injectors with no electronics are out of scope. For connected injectors, assess all three statutory elements and the submission pathway.

Why CDER-Led Doesn't Mean Cyber-Light

The Office of Combination Products assigns the lead center based on the product's primary mode of action. A monoclonal antibody delivered by an injector is drug-led, so CDER leads. That assignment governs the review pathway, fee schedule, and labeling. Section 524B applicability also depends on the statutory submission pathway, not only the device constituent.

CDER may consult CDRH on device-constituent issues. Plan cybersecurity evidence early; consultation timing and review outcomes vary.

What the Device-Side Package Looks Like

A standalone device cybersecurity package is a useful starting point, but confirm content and placement with the lead center for an NDA or BLA. The full mapping lives in our combination product cybersecurity guide and the FDA premarket cybersecurity deliverables and eSTAR v7.1 map. At a minimum:

• Security Risk Management Report aligned to AAMI TIR57 and ANSI/AAMI SW96, converged with the safety risk file per ISO 14971 vs AAMI TIR57.
• Machine-readable SBOM (SPDX or CycloneDX) for every component in the shipping firmware and companion app, with optional VEX statements for known vulnerabilities.
• Threat model (STRIDE or equivalent) tied to patient harm, covering BLE pairing, OTA update, app-to-device authentication, and telemetry endpoint exposure.
• Architecture views: global system, multi-patient harm, updateability, security use case.
• Cybersecurity testing: vulnerability scanning, software composition analysis, penetration testing of the device and the companion app, and fuzz testing of the BLE protocol stack and any other communication interface.
• Postmarket plan covering vulnerability monitoring, coordinated vulnerability disclosure intake, patch cadence, and end-of-life.
• The postmarket plan required by Section 524B(b)(1) for a covered cyber-device submission; confirm expectations for an NDA or BLA.

Where the Documentation Lives in a BLA or NDA

In a BLA or NDA, the cybersecurity content most commonly lives in Module 3.2.R (regional information) with cross-references from the device description in Module 3.2.P.7. Some sponsors build a dedicated cybersecurity sub-section that reviewers can work through without hunting. The structural choice matters less than completeness. Reviewers need to locate the SBOM, threat model, architecture views, testing report, and Cybersecurity Management Plan. A package scattered across modules with no cross-reference map draws information requests on layout alone.

For applicable 510(k) and De Novo submissions, use eSTAR cybersecurity prompts; PMA eSTAR use is voluntary.

Common Deficiency Patterns on Connected Injectors

See also: What Is a Cyber Device Under FDA Section 524B?, Ransomware and Medical Devices: What the FDA Expects, and SBOM for SaMD and Cloud Components: FDA Guide.

Four patterns recur:

• Companion app treated as out of scope. The sponsor assumes the third-party app vendor owns app-side cybersecurity. The submission holder owns it. The app's authentication, in-transit data integrity, secure pairing with the device, and the mobile platform's update mechanism are all in scope for the submission's threat model and testing.
• Stale SBOM. Ensure the SBOM matches the submitted build and vulnerability analysis is current. The FDA does not specify a universal 90-day SBOM age limit or require VEX.
• CDMO-supplied device with no contractual SBOM clause. The contract manufacturer does not deliver an SBOM or secure SDLC evidence, and the sponsor cannot produce one for review. "The CMO handles that" is not an acceptable response.
• Threat model missing OTA update path. Connected injectors usually support some form of firmware update through the companion app. The threat model omits the OTA path entirely, or covers it without addressing key management for the update signing keys.

How Blue Goat Approaches a Connected Auto-Injector Submission

We enter at device-constituent design freeze, not at BLA prep. Our team's prior work on connected drug-delivery systems means we know the typical attack surface on these products (BLE pairing flaws, OTA update key management, app-to-device authentication, telemetry endpoint exposure) and the deficiency patterns CDRH cyber consults raise on CDER-led submissions. We deliver the full premarket package, SBOM, threat model, security risk management report, architecture views, and testing, in a form that drops into either a CDER Module 3 or a CDRH eSTAR. Our engineers hold CISSP, OSCP, and prior military red-team credentials. If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed. Start with our FDA premarket cybersecurity services page, or read the combination product cybersecurity guide for the full deliverables walkthrough.

If you want one team to own the whole cybersecurity package, see our full-service FDA premarket cybersecurity submission support.

FAQ

Ready to scope cyber for your connected injector?

If you are pre-submission on a connected auto-injector and the cybersecurity work is being treated as a Module 3 attachment to be written at BLA prep, the timeline math will not work. We can scope the device-constituent cyber package while the design is still open and deliver it in the format your reviewers expect. If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed. Schedule a discovery call.

About the author. Christian Espinosa, Founder, Blue Goat Cyber. Christian leads a team focused exclusively on medical device cybersecurity for FDA premarket submissions and postmarket compliance, with deep experience on connected drug-delivery combination products under Section 524B. Read more about Christian.

Related on FDA Section 524B

• FDA Section 524B: complete cybersecurity requirements guide
• Does Section 524B apply to legacy devices?
• AI/ML cybersecurity threats under Section 524B
• Documenting update cadence for a 524B submission