Does Section 524B Apply to Devices Cleared Before March 29, 2023?

March 29, 2023 is a date sponsors researching Section 524B run into often, because it marks the point FDA's Refuse to Accept authority for cyber device submissions became operative. It is easy to misread that date as a cutoff separating "old devices that are exempt" from "new devices that are covered." That reading is wrong, and the correct answer matters for any manufacturer managing a long lived connected device portfolio.

What the Date Actually Marks

Section 524B was enacted as part of the Consolidated Appropriations Act of 2023. FDA's authority to refuse premarket submissions lacking required cybersecurity documentation took effect October 1, 2023, following a transition period after enactment. The installed base of devices already cleared or approved before that window is not retroactively pulled into 524B's documentation requirements simply because the statute now exists. There is no requirement to go back and build an SBOM or threat model for a device sitting quietly on the market with no planned submission.

What Actually Triggers 524B for a Legacy Device

The trigger is not the device's age; it is the act of filing a new premarket submission. Any of the following submissions, for a device meeting the cyber device definition, pulls the full 524B(b) documentation requirement into scope regardless of when the device was first cleared:

• A new 510(k) for a labeling change, even one unrelated to cybersecurity or connectivity.
• A PMA supplement for a hardware or software modification.
• A De Novo request for a related product built on the same platform.
• A Special 510(k) for a manufacturer initiated design change to the original cleared device.

A device cleared in 2018, with no cybersecurity documentation ever produced, becomes fully subject to 524B's premarket requirements the day its manufacturer files any one of these submission types. The original clearance date is irrelevant to that determination; what matters is whether the new submission is itself subject to the statute, which depends only on whether the device meets the cyber device definition today.

The Planning Problem This Creates

This creates a real planning exposure for manufacturers with aging, long lived device families. A legacy device with no SBOM, no threat model, and no formal cybersecurity documentation on file can suddenly need a full 524B package the moment an unrelated design change requires a new submission, and building that documentation from a blank page under submission deadline pressure is a materially harder problem than building it proactively. Sponsors with older connected device portfolios are generally better served assembling the SBOM and threat model ahead of any planned submission, rather than waiting for a submission to force the timeline.

Postmarket Obligations Are a Separate, Ongoing Question

Section 524B's premarket documentation trigger is distinct from FDA's broader, ongoing postmarket cybersecurity expectations. Vulnerability monitoring and patch management apply as a general quality system matter under 21 CFR Part 820 regardless of submission history; an already marketed connected device is expected to maintain reasonable postmarket vulnerability monitoring whether or not a new submission is on the horizon. A manufacturer should not read "no new submission planned" as "no cybersecurity obligations at all." The premarket documentation set and the postmarket monitoring expectation are two separate questions, and only the first one depends on the March 2023 date. A device with a documented vulnerability monitoring process already in place also has a shorter path to a complete 524B package once a submission does arrive, since the postmarket plan and the SBOM it depends on can largely be reused rather than built from scratch under deadline pressure.

ADB's regulatory team evaluates a legacy device portfolio's exposure by mapping planned submissions against each device's cyber device status, so the 524B documentation build happens on a sponsor's own timeline instead of under a deadline forced by an unrelated filing.

Frequently Asked Questions

Does an already marketed device need an SBOM today if it has no new submission planned?

Not under Section 524B's premarket documentation trigger. General postmarket cybersecurity expectations, vulnerability monitoring and patching, still apply as a quality system matter regardless of submission history.

What kinds of changes trigger 524B for a legacy device?

Any new premarket submission referencing that device, including a 510(k) for a labeling change, a PMA supplement, or a De Novo for a related product, triggers the full 524B documentation requirement if the device meets the cyber device definition.

Is the March 29, 2023 date still relevant for a device cleared years earlier?

The date marks when FDA's refuse to accept authority took effect; it does not create an ongoing exemption. A device cleared well before that date is fully in scope the moment it files a new qualifying submission, regardless of how old the original clearance is.