Feb 3, 2026·FDA · Final GuidanceActiveHigh impact
FDA finalizes 2026 premarket cybersecurity guidance
The FDA's February 3, 2026 final guidance distinguishes nonbinding cybersecurity evidence recommendations from Section 524B statutory duties. Covered cyber-device submissions require an SBOM; VEX is optional, and an SPDF is encouraged rather than mandated.
What changed
- SBOM is required at submission with named components, versions, and suppliers (no vague 'TBD' rows).
- The guidance recommends device-specific vulnerability assessments. VEX is an optional way to communicate status, not a required submission artifact.
- Threat modeling must be traceable to design controls and to the security risk file (AAMI SW96 / TIR57).
- Postmarket plans must define monitoring sources, triage SLAs, and a published CVD URL.
Action for manufacturers
Distinguish Section 524B obligations from recommended evidence. Include the required SBOM and device-specific vulnerability assessments; use VEX if helpful. Clearly identify and cross-reference architecture views and testing categories, in one report or several, without assuming separate files are mandated.