Why this matters
On Feb 3, 2026 the FDA finalized its updated guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions. It directly supersedes the June 27, 2025 guidance and provides updated, nonbinding recommendations for premarket cybersecurity submissions.
Key takeaway: If your last submission was before Feb 2026, review your existing cybersecurity package against applicable requirements and updated recommendations. Plan a gap review before re-submitting.
What is a 'cyber device' under Section 524B?
Section 524B of the FD&C Act defines a cyber device as one that (a) includes software validated, installed, or authorized by the sponsor as a device or in a device, (b) has the ability to connect to the internet, and (c) contains technological characteristics that could be vulnerable to cybersecurity threats. Whether a device meets Section 524B's definition depends on all statutory criteria and device-specific facts; these connection types may be relevant to that assessment.