AI in medical devices · Expert · 13 min lesson

Premarket cybersecurity documentation, SBOM and postmarket vulnerability handling

FD&C Act section 524B, FDA premarket and postmarket cybersecurity guidance, MDR Annex I and Articles 83 to 89, MDCG 2019-16 rev.1

What you will learn

• List the documents a premarket cybersecurity package contains for a cyber device, and explain what section 524B(b) of the FD&C Act requires.
• Prepare and review a software bill of materials, including support status and known vulnerabilities, for an AI enabled device and its model components.
• Run postmarket vulnerability handling: monitor, triage as controlled or uncontrolled, remediate, disclose, and link the result to vigilance and the QMS.

Key takeaways

• A cyber device under section 524B has software, can connect to the internet and has technology that could be vulnerable; its submission needs a plan, processes and an SBOM.
• The FDA package centres on a security risk management report, threat model, architecture views, SBOM, testing evidence and labelling.
• An SBOM is only useful if it is machine readable, current and joined to a process that matches new vulnerabilities to components.
• Postmarket handling sorts vulnerabilities into controlled and uncontrolled risk by exploitability and patient harm, and sets timelines for each.
• In the EU, MDR Annex I sections 17.2 and 17.4 and Articles 83 to 89 carry the same ideas through technical documentation, surveillance and vigilance.

Free practice question

Ardent prepares a 510(k) for its glucose advisor, a Class II app with a cloud service. The regulatory lead proposes to leave out the software bill of materials because the app has no implant and no hardware.

What does section 524B require?

Key terms

• SBOM: Software bill of materials: a machine readable inventory of the commercial, open-source and off-the-shelf components in a product.
• cyber device: Under section 524B(c) of the FD&C Act, a device with software, the ability to connect to the internet, and technology that could be vulnerable to cybersecurity threats.
• controlled risk: A vulnerability whose residual risk of patient harm is acceptable, according to the FDA 2016 postmarket guidance.
• uncontrolled risk: A vulnerability whose residual risk of patient harm is unacceptable, calling for rapid remediation and possibly reporting.
• coordinated vulnerability disclosure: A process for receiving vulnerability reports, working with the reporter and releasing information and fixes in an agreed way.
• CVSS: Common Vulnerability Scoring System: a scoring method for the severity and exploitability of a vulnerability.
• ISAO: Information sharing and analysis organisation: a group, such as NH-ISAC, in which manufacturers share vulnerability information.

Official sources

• FD&C Act section 524B, 21 U.S.C. 360n-2, Ensuring cybersecurity of devices
• FDA, Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (guidance page)
• FDA, Postmarket Management of Cybersecurity in Medical Devices (December 2016)
• Federal Register notice, Cybersecurity in Medical Devices guidance, 27 June 2025
• MDCG 2019-16 rev.1, Guidance on cybersecurity for medical devices (July 2020)

Go further

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Illustrative example. Educational only, not legal advice.