When does cybersecurity work start for an AI/ML device?

At concept. The ML asset inventory and the extended threat model have to exist before the architecture freezes, because they generate security requirements that become design inputs. Teams that start after verification usually find an unsigned model-loading path or an unauthenticated inference endpoint they cannot change without reopening design controls.

Why are the steps anchored to AAMI CR515 topic areas?

CR515:2025 is the consensus report that catalogs the threats and assets specific to machine learning-enabled devices. Using its topic areas as the spine of the timeline keeps the premarket work and the postmarket work talking about the same assets, and it makes the eventual submission narrative easier for a reviewer to follow.

Does the FDA publish a timeline like this?

No. The February 3, 2026 final premarket cybersecurity guidance describes what the submission must contain, and the AI-enabled device software functions guidance describes PCCP expectations, but neither sequences the work. This tool sequences it the way our submissions actually run, so the dependencies are visible before they bite.

What changes if we file a PCCP?

A Predetermined Change Control Plan moves work earlier. The retraining gates, the security regression suite, and the rollback plan all have to be written and defensible before you file, because the PCCP is what authorizes future model updates without a new submission. Filing a PCCP with a static-model cybersecurity package is a reliable way to draw a deficiency.

Can we use this for a De Novo or PMA rather than a 510(k)?

Yes. The evidence set is the same across pathways for a cyber device; only the review mechanics and timing differ. De Novo adds special controls that the postmarket steps must satisfy, and PMA adds supplement decisions for security-relevant changes after approval.

Interactive tool

FDA AI/ML submission timeline

Fourteen steps from concept to postmarket retraining, each anchored to an AAMI CR515:2025 topic area. Every step names what it produces, which Section 524B obligation it feeds, and the failure mode that sends it back.

14 of 14 steps shown. Everything runs in your browser; nothing is sent anywhere.

1. Which phase are you in?

Leave everything unselected to see the whole timeline.

2. Walk the timeline

0 of 14 steps marked complete (0%)

Questions teams ask about this timeline

Go deeper

CR515 crosswalk maps the same topic areas onto GMLP, PCCP, AIBOM, and Section 524B.
AAMI CR515:2025 guide explains what the consensus report covers and how to cite it.
PCCP Builder drafts the modification protocol referenced in the submission phase.
AI/ML cybersecurity topic hub collects the guides and deep-dives behind each step.

FDA AI/ML submission timeline

1. Which phase are you in?

2. Walk the timeline

Step 1 · Premarket developmentStand up ML security governanceCR515: Program governanceConcept, before architecture freeze

Step 2 · Premarket developmentInventory the ML assetsCR515: ML asset identificationArchitecture definition

Step 3 · Premarket developmentExtend the threat model with ML threatsCR515: ML threat modelingDesign, before design freeze

Step 4 · Premarket developmentEstablish data provenance and integrityCR515: Data integrity and provenanceData curation, ongoing

Step 5 · Premarket developmentBuild the SBOM and AIBOM togetherCR515: Model supply chainIntegration, refreshed every build

Step 6 · Premarket developmentImplement and document ML security controlsCR515: Security controlsImplementation

Step 7 · Premarket developmentRun adversarial and integrity verificationCR515: Verification and testingVerification and validation, before submission

Step 8 · Submission assemblyDraft the PCCP with a cybersecurity envelopeCR515: Postmarket and changeSubmission assembly

Step 9 · Submission assemblyAssemble the eSTAR cybersecurity sectionsCR515: Program governanceTwo to four weeks before filing

Step 10 · FDA reviewTechnical screeningCR515: Program governanceFirst 15 days after filing

Step 11 · FDA reviewRespond to cybersecurity deficienciesCR515: ML threat modelingTypically 60 to 120 days after filing

Step 12 · Postmarket and changeRun postmarket monitoring for drift and attackCR515: Postmarket and changeFrom launch, continuously

Step 13 · Postmarket and changeExecute a retraining cycle under the PCCPCR515: Verification and testingEach authorized model update

Step 14 · Postmarket and changeShip security patches on a defined cadenceCR515: Security controlsRegular cycle, plus out-of-cycle for critical findings