FDA Updates Medical Device Cybersecurity Guidance
Published
Final guidance; underlying statute in effect. Law checked through October 18, 2026.
Troy did not fall to a siege engine; it fell to a gift it wheeled inside its own walls. A surgical robot or a hospital delivery robot that connects to a network is that sort of gift, and federal law now treats it accordingly.
On February 3, 2026, the FDA finalized "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions." It supersedes the version issued June 27, 2025. The new title tracks the agency's Quality Management System Regulation, which took effect February 2, 2026, and signals that cybersecurity is to be built into the manufacturer's quality system rather than appended to a submission.
The guidance recommends; the statute commands. Section 524B of the Food, Drug, and Cosmetic Act, codified at 21 U.S.C. § 360n-2, applies to a "cyber device," defined as a device that includes software validated, installed, or authorized by the sponsor, can connect to the internet, and has characteristics that could be vulnerable to cybersecurity threats. A sponsor of such a device must submit a plan to monitor and address postmarket vulnerabilities, maintain processes that provide reasonable assurance of cybersecurity, and provide a software bill of materials. Most networked surgical and hospital robots meet the definition.
For Texas hospitals and health systems, the practical change is in purchasing and incident response. Procurement files should hold the manufacturer's vulnerability-management commitments, and a robot's security event may be a medical-device report, a Texas breach-notification event, or both.
Limits
Guidance does not create new statutory duties. Whether a particular robot is a cyber device depends on its software and connectivity, not on the label "robotic."