Do FDA cybersecurity requirements apply to Class I devices?

Section 524B applies to any device that meets the statutory definition of a 'cyber device' regardless of class. Most Class I devices have no software and fall outside the definition, but a Class I device that contains validated software with network capability must produce the full premarket cybersecurity package.

Are the cybersecurity artifacts different for Class II and Class III devices?

The seven-section cybersecurity content set is the same for both classes. Class III PMA submissions require deeper architectural, manufacturing, and supply-chain evidence, and PMA annual reports must explicitly address cybersecurity changes.

Medical device classes & cybersecurity requirements

Class	Risk level	Examples	Pathway	§524B applies?	Cybersecurity artifacts required
Class I	Low risk; general controls only.	Bandages, manual stethoscopes, exam gloves.	Most are 510(k)-exempt; a small number require 510(k).	Only if the device meets the FD&C Act §524B definition of 'cyber device' (validated software + internet/network capability).	Most pure Class I devices have no software and fall outside Section 524B; if they do contain software the full 2026 cybersecurity package applies.
Class II	Moderate risk; general + special controls.	Infusion pumps, patient monitors, most SaMD, surgical robots.	510(k) or De Novo (eSTAR mandatory).	Yes for any device meeting the Section 524B 'cyber device' definition - the dominant case.	Full 2026 package: SPDF documentation, threat model, SBOM, security architecture views, cybersecurity risk assessment, penetration test, postmarket plan, labeling.
Class III	High risk; life-sustaining or life-supporting.	Implantable cardioverter-defibrillators, deep-brain stimulators, mechanical heart valves.	PMA (or HDE).	Yes - Section 524B applies; reviewers expect deeper architectural and manufacturing evidence.	Full 2026 package plus expanded architecture views, supply-chain controls, manufacturing-environment security evidence, and PMA annual reports addressing cyber changes.

Medical device classes & cybersecurity requirements

Related

Secure your device before it reaches patients.