Which Devices Are Subject to Section 524B?

Section 524B of the Federal Food, Drug, and Cosmetic Act gave FDA explicit authority, effective October 1, 2023, to refuse premarket submissions for cyber devices that lack required cybersecurity documentation. Before building that documentation, the first question every sponsor has to answer correctly is whether the statute even applies to their device. The definition is broader than most teams expect, and getting the scoping call wrong in either direction creates real cost: treating an in-scope device as out of scope invites a Refuse to Accept finding, while over-scoping an exempt device wastes engineering time on documentation FDA never asked for.

The Three-Part Statutory Test

Section 524B(c) defines a cyber device using three elements, and a device must satisfy every one of them to qualify.

• Includes software. The device includes software that the sponsor installed, built in, or otherwise authorized to run on the device. Firmware counts the same as application software.
• Can connect to the internet. The device has the ability to connect to the internet, whether directly through Wi-Fi or cellular, or indirectly through a companion app, gateway, or another networked product.
• Carries a cybersecurity vulnerability. The device contains a technological characteristic, put in place or authorized by the sponsor, that could be vulnerable to cybersecurity threats.

FDA and industry generally treat the third prong as satisfied by any networked software function, since almost any software running on a connected device carries some attack surface. In practice, qualification turns on the first two prongs: does the device run software, and can it connect to something outside itself.

How Broadly Does FDA Read "Ability to Connect"?

Very broadly. FDA's guidance and the plain text of the statute do not limit the connectivity prong to a direct internet connection. A device satisfies it through any of the following pathways, each sufficient on its own: Wi-Fi, cellular, Bluetooth, a wired USB or serial data connection, inductive or near-field communication, or a connection to a local area network, another medical device, or a companion smartphone app that itself reaches the cloud. A device with removable or optional connectivity modules qualifies if the sponsor authorizes that option at all, even if most shipped units have it disabled; the statutory test is "put in place or authorized," not "present and active in every unit sold."

This means a surprising number of devices that engineering teams think of as offline actually qualify. A device that only talks to a charging dock with its own network interface, or that exports data to a phone over Bluetooth with no internet access of its own, still meets the connectivity prong, because the statute treats connection to "another product" as equivalent to a direct internet connection.

Which Submission Types Does Section 524B Cover?

Section 524B applies across submission pathways; it is written around the device's own characteristics, not the regulatory pathway used to bring it to market. A 510(k), De Novo request, Premarket Approval application, or Humanitarian Device Exemption all carry the same cyber device documentation expectation when the underlying device qualifies. There is no submission type that is categorically exempt. A sponsor filing a De Novo for a novel connected diagnostic faces the identical 524B(b) documentation requirement as a sponsor filing a 510(k) for an established connected infusion pump.

Worked Examples: In Scope and Out of Scope

The statute's plain text resolves most cases cleanly once applied carefully. A few examples that illustrate the boundary:

• In scope: a continuous glucose monitor that transmits readings to a companion smartphone app over Bluetooth. It includes software, it connects to another product (the phone), and the connection is a potential attack surface.
• In scope: a standalone Software as a Medical Device (SaMD) product delivered through a cloud-hosted web application, with no physical hardware component at all. The connectivity prong is satisfied by the hosting architecture itself.
• In scope: an infusion pump with a USB port used only by field service technicians for firmware updates, with no wireless radio and no patient-facing connectivity. The "another product" connection through USB is independently sufficient.
• Out of scope: a purely mechanical device with no embedded software of any kind, such as a manual surgical instrument. It fails the first prong outright.
• Out of scope: a device that runs embedded software but has no physical or wireless interface of any kind to exchange data with anything external, and no field-service connectivity. This combination is rare among modern Class II and Class III devices, but it does occur in some single-use disposables with onboard microcontrollers that never communicate outside the device enclosure.

Where the Cyber Device Definition Came From

Section 524B was added to the FD&C Act by the Consolidated Appropriations Act of 2023, legislation that incorporated the text of the PATCH Act (Protecting and Transforming Cyber Health Care Act), which Congress had considered in earlier sessions without passage as a standalone bill. The PATCH Act's core requirements, a postmarket vulnerability management plan, a coordinated disclosure process, and an SBOM, carried over into the final statutory text largely unchanged. FDA gained the authority to refuse to accept noncompliant submissions starting October 1, 2023, with the September 2023 premarket cybersecurity guidance operationalizing the statute's requirements in practice.

ADB's regulatory team performs this scope determination as the first step of the Section 524B gap assessment, documenting the three-part analysis in writing rather than relying on an informal judgment call, since an undocumented scoping decision is itself a common source of reviewer questions during premarket review.

Frequently Asked Questions

Does a device qualify if it only connects over USB or Bluetooth, with no internet access?

Yes. The statute's connectivity prong is satisfied independently by a connection to the internet, a local network, a wireless network, or another product, so a device that exchanges data with a companion device only over USB or Bluetooth still meets the definition.

Does a legacy device cleared before 2023 ever become subject to Section 524B?

Not on its own. The obligation attaches the moment that device's manufacturer files any new premarket submission, even an unrelated labeling change, for a device that meets the cyber device definition.

What submission types does Section 524B apply to?

Section 524B applies to 510(k), De Novo, PMA, and Humanitarian Device Exemption submissions alike. The statute is written around the device's characteristics, not the submission pathway, so no pathway is exempt.