Cybersecurity in FDA CDRH's proposed guidance list for fiscal year 2027

On October 1, the first day of fiscal year 2027, CDRH published its list of guidance documents it plans to issue this year. The A-list covers guidances FDA intends to publish during the year. The B-list covers those it will publish as resources allow. The Under Construction list is still being developed.

The FY2027 list is relatively short: 17 documents across all three lists, down from 20 in FY2026 and 29 in FY2025. Software, AI, and cybersecurity run through all three lists. For cybersecurity teams, one item stands out.

Finally on the list: postmarket cybersecurity

B-list (draft): Postmarket Management of Cybersecurity in Medical Devices

In our FY2025 post we pointed out that an update to FDA's 2016 postmarket cybersecurity guidance was missing from the list, and it was also absent from the 2026 list. It's now on the B-list as a draft.

It's overdue. Section 524B and the 2016 postmarket guidance were written for different purposes and in different eras, and a guidance update would be timely to reflect the legal changes introduced through the FD&C Act. The 2016 guidance predates Section 524B, which since 2023 has required cyber device makers to have a plan for monitoring and addressing postmarket vulnerabilities, coordinated vulnerability disclosure, regular and out-of-cycle patching, and an SBOM. Premarket expectations have moved on through a 2023 guidance update and its later revisions, including the 2026 alignment with the new QMSR. Postmarket guidance hasn't caught up. In fact, the current version is approaching its tenth anniversary by the end of the year.

A B-list spot means FDA will publish it "as resources permit." Given how few guidances CDRH is issuing (around 20 so far in 2026, against roughly 40 a year in 2022 to 2024, according to the FDA Law Blog), it may not appear in FY2027. However, we recommend that you don't wait for it to get your postmarket program in order.

What we hope the draft will address:

• Legal force. The 2016 document outlines nonbinding recommendations on how manufacturers should monitor, identify, and address cybersecurity vulnerabilities. Section 524B is a binding statute: not complying with it is a prohibited act under section 301(q). Things the guidance framed as good practice, such as a coordinated vulnerability disclosure (CVD) process and a patching capability, are now legal obligations for cyber devices. The guidance still reads as if they were optional.
• Scope. Alignment with the Section 524B definition of a "cyber device."
• A premarket trigger for postmarket duties. Per Section 524B, manufacturers must submit a plan to monitor, identify, and address vulnerabilities to give reasonable assurance of cybersecurity through updates and patches. However, nothing explains whether FDA will assess the plan against the 2016 guidance or 524B.
• Alignment of risk vocabularies. The 2016 guidance defines "controlled" and "uncontrolled" risks. Section 524B(b)(2) uses two different categories: "known unacceptable vulnerabilities," which are patched on a "reasonably justified regular cycle," and "critical vulnerabilities that could cause uncontrolled risks," which are patched "as soon as possible out of cycle."
• Security risk vs. safety risk alignment. The 2016 guidance centers on patient harm, using an exploitability-versus-severity assessment. The current 524B-aligned premarket guidance treats security risk management as separate from safety risk management.
• How 524B maps to day-to-day postmarket work. What a "reasonably justified regular cycle" for updates looks like in practice, and what FDA expects to see as evidence of it.
• Keeping the SBOM current after clearance. How often to update it, how to use it for vulnerability monitoring, and how to handle components that reach end of support, including customer communication (which is an expectation in the 2026 premarket guidance but is absent from the 2016 postmarket guidance).
• Vulnerability exploitability documentation (VEX) as an accepted way to show that a known vulnerability doesn't affect the device.
• Related systems. Section 524B extends the update and patch obligations to the device "and related systems," which FDA reads as including things like update servers and cloud components. The 2016 guidance is only focused on the device itself.
• Software changes and resubmission. The 2016 guidance treats most cybersecurity patches as routine updates that don't need a new submission. Under 524B, a modification that does require a submission would require alignment with 524B, including security documentation. The premarket guidance discusses this, but the postmarket guidance doesn't reconcile its "routine update" concept with that boundary.
• Fit with QMSR. How postmarket cybersecurity records fit the quality system now that QMSR is in effect.
• ISAO participation. In the 2016 guidance, active participation in an Information Sharing and Analysis Organization is one condition for enforcement discretion from Part 806 reporting. Section 524B doesn't mention ISAOs, so it's unclear whether ISAO participation still matters for cyber devices, or whether 524B changes the enforcement-discretion analysis.

In practice, we advise that manufacturers handle these gaps by treating their 524B(b)(1)-based postmarket plan as the controlling document. Map its patch-cadence categories explicitly onto the 2016 controlled/uncontrolled framework for Part 806 decisions, and apply the same processes to your legacy fleet.

Other items cybersecurity teams should track

A-list (final): Marketing Submission and Lifecycle Management Recommendations for Artificial Intelligence-Enabled Device Software Functions
AI lifecycle management moves from the B-list to the A-list as a final. AI-enabled devices bring their own cybersecurity risks, including model tampering and training-data integrity. Expect reviewers to look for them in your threat model.

A-list (final): Predetermined Change Control Plans for Medical Devices
PCCPs let you pre-authorize certain changes. If your plan covers software updates, it should also say how each change is assessed for cybersecurity. A PCCP doesn't cover new vulnerabilities.

A-list (final): Quality Management System Information for Certain Premarket Application Reviews
This is worth reading alongside the premarket cybersecurity guidance, which expects cybersecurity to sit inside the quality management system rather than next to it.

B-list (draft): Policy for Device Software Functions
It's been retitled, dropping "Mobile Medical Applications." Many manufacturers rely on this guidance to decide which software is a device and which is under enforcement discretion. Depending on how it changes, the scope of what needs cybersecurity documentation could change too.

Under Construction: Risk Assessment and Evidentiary Considerations for Generative Artificial Intelligence-Enabled Devices
It's early, but GenAI devices will need threat models that cover prompt injection, data leakage and output integrity. Further, GenAI systems require documentation and management of a structured inventory that includes every component, dataset, model weight, prompt, and software dependency used to build and operate an AI system: in other words, an AI Bill of Materials (AI BOM).

What to do now

1. Comment by November 30, 2026. FDA takes comments on the list itself, including which guidances to prioritize. If the postmarket update matters to your program, say so.
2. Don't wait for the postmarket draft. Section 524B already requires a postmarket plan, so make sure yours would stand up to review today.
3. Check your SBOM process for after clearance, not just for submission. That's where the new guidance is most likely to focus.

Turn the guidance into a device-ready plan

Medcrypt helps device makers meet FDA's cybersecurity expectations before and after clearance, from SBOM and vulnerability management to postmarket plans. Start with our free FDA cybersecurity readiness survey, or talk to an expert.

Source: FDA: CDRH Proposed Guidances for FY2027